@khoavu882/doflow 2.0.0-beta.5 → 2.0.1

package/core/harnesses/shared/hooks/policies/blocked-patterns.conf

@@ -1,91 +0,0 @@
-# blocked-patterns.conf — Dangerous command patterns for pre-bash-guard.sh
-#
-# Format (TAB-separated):
-#   regex<TAB>reason shown to the harness<TAB>exclude_regex (optional)
-#
-# Rules:
-#   - Lines beginning with # are comments (skipped)
-#   - Empty lines are skipped
-#   - Regex is POSIX Extended Regular Expression (ERE, as used by `grep -E`),
-#     matched case-insensitively against the full command string (RM and GIT run
-#     on a case-insensitive filesystem such as the macOS default), which
-#     includes any expanded heredocs or -m "..." arguments. Git and rm
-#     patterns use a command-context anchor:
-#       (^|[[:space:]]*(&&|\|\||;)[[:space:]]*)
-#     so they only fire when the dangerous text is an actual invocation,
-#     not when it appears as text inside a commit message or other argument.
-#   - Anchored patterns (those beginning with "(^|") are matched against the
-#     command with quoted text blanked out (pre-bash-guard.sh scrub_quotes),
-#     so echo "x && rm -rf /" or git commit -m "git reset --hard" is not a
-#     command. The argument of sh -c, bash -c, zsh -c and eval is NOT blanked
-#     (it executes). Every other pattern is matched against the full text.
-#   - The rm lines use a wider command position than the others: start of a
-#     line or after ; & | ( or a backtick, then optional sudo/command/time/
-#     nohup/exec/env (with options, VAR=x and, per wrapper, the options that take
-#     a separate argument: sudo -u/-g/-C/-h/-p/-r/-t/-U/-D/-R and --user/--group
-#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else, then rm,
-#     \rm, /bin/rm or /usr/bin/rm. "git rm" and "echo rm -rf /" are therefore
-#     not matched. pre-bash-guard.sh's hardcoded floor uses the same rule.
-#     Matching is case-insensitive, so an uppercase flag-only option that shares a
-#     letter with a value-taking one (sudo -H beside -h, xargs -p beside -P) is
-#     treated as value-taking: a false deny, the fail-safe direction.
-#   - The git patterns accept git's global options before the subcommand
-#     (git -C dir push, git -c k=v push). The force-push rules block -f (also
-#     inside a flag cluster such as -uf), --force and a +refspec; the
-#     --force-with-lease form stays allowed, as the reason text advises, but a
-#     +refspec still blocks next to a lease (git push --force-with-lease origin +main).
-#   - The find rule blocks -delete, and -exec rm, off the root, a home directory
-#     or a system directory (among other start paths, find or \find or
-#     /usr/bin/find) when only -type, -maxdepth/-mindepth N, -mount, -xdev,
-#     -depth, -noleaf, -follow or -ignore_readdir_race follow the path: none of
-#     those narrows what is deleted. Any other predicate (-name, -path, -newer,
-#     -mtime, -size, -user, -empty ...) counts as scoping, so
-#     find ~ -name '*.pyc' -delete is allowed.
-#   - SQL patterns are intentionally NOT anchored — DROP/DELETE/TRUNCATE
-#     inside heredoc-to-psql pipelines are real execution and must be caught.
-#   - The optional third column is an exclude_regex: when present and the
-#     command ALSO matches it, the pattern line is skipped (not blocked).
-#     This is how negative-lookahead behavior (unsupported in POSIX ERE) is
-#     approximated — e.g. "git push --force" blocks force pushes, but the
-#     exclude_regex "--force-with-lease" lets that safer variant through.
-#   - First matching pattern wins — order matters
-#   - A malformed regex on any line is skipped (guard continues safely)
-#
-# Add project-specific patterns at the bottom of this file.
-
-# ── Dangerous git operations ──────────────────────────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+clean -fd	Irreversible clean blocked — use --dry-run to preview what would be deleted
-
-# ── Filesystem catastrophes ───────────────────────────────────────────────────
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
-
-# ── SQL destructive statements (no anchor — must catch inside psql heredocs) ──
-DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)[[:space:]]	Destructive DDL blocked — confirm with user before dropping
-DELETE[[:space:]]+FROM[[:space:]]+[[:alnum:]_]+[[:space:]]*;	Unscoped DELETE blocked — this would affect all rows, add a WHERE clause
-TRUNCATE[[:space:]]+TABLE	Irreversible truncate blocked — confirm with user before truncating
-
-# ── Code execution from untrusted network sources ─────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)(curl|wget)[[:space:]]+[^[:space:]]+.*\|[[:space:]]*(ba)?sh	Pipe-to-shell blocked — download and review the script before executing
-
-# ── Broad permission grants ───────────────────────────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)chmod[[:space:]]+-R[[:space:]]+777	chmod -R 777 blocked — grants world-write access recursively; use targeted permissions (e.g. chmod 755) instead
-
-# ── Disk device operations ────────────────────────────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)dd[[:space:]]+if=/dev/	dd from block device blocked — can wipe or clone disks; confirm with user before any raw device operation
-
-# ── Known limitation (not a pattern — comment only) ──────────────────────────
-# eval-based indirection (e.g. CMD="git push --force"; eval "$CMD") bypasses all
-# static pattern matching above. This is an inherent limitation of text-based
-# guards. For high-security environments, supplement with branch protection
-# rules and code review rather than relying solely on this guard.
-#
-# Variables other than HOME ($B, "$DIR") are not blocked: an empty or unset
-# variable cannot be known statically, so rm -rf "$B"/ is allowed. Only the
-# literal targets in the rm rule above are judged (root, home, and the system
-# directories listed; subpaths such as /tmp/x or /Users/kai/x are allowed).

package/core/harnesses/shared/hooks/policies/pre-bash-guard.sh

@@ -1,378 +0,0 @@
-#!/usr/bin/env bash
-case $0 in */*) _DOFLOW_POLDIR=${0%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
-# pre-bash-guard.sh — Canonical Policy Library: PreToolUse(shell-command) hook
-#
-# Intercepts every shell-command tool call and blocks dangerous commands by
-# matching against POSIX ERE patterns in blocked-patterns.conf (grep -E).
-#
-# Multi-session safe: stateless — reads only the conf file, no shared state.
-# Must complete in <50ms.
-#
-# Canonical Policy Script Contract (design.md §4):
-#   env    DOFLOW_PROJECT_DIR, DOFLOW_AGENT (both optional; not required to
-#          evaluate this policy)
-#   stdin  a native payload with envelope v1 under doflow_event; only the
-#          envelope's operation, tool and command fields are used.
-#   exit   exit 2 + doflow_decide deny = deny; other faults per IC-011.
-#
-# Reconciliation note (022-normalize-hooks, Phase A / D1): this also absorbs
-# stream-hook-runner.js's inline DESTRUCTIVE_COMMAND_PATTERN
-# (`\brm\s+-rf\s+[/~]`, since narrowed to the recursive-rm-of-catastrophic-target
-# rule below), which was the only pre-bash-guard protection Gemini
-# and Antigravity sessions routed through that runner actually had — it
-# duplicated, rather than delegated to, this policy's fuller
-# blocked-patterns.conf coverage (git force-push, git reset --hard, git clean
-# -fd, SQL DROP/DELETE/TRUNCATE, curl|wget-pipe-to-shell, chmod -R 777, dd
-# from a block device). That pattern is kept here as a hardcoded floor for
-# the case blocked-patterns.conf itself is missing, so a harness that had
-# only the hardcoded regex before this change does not lose even that
-# minimum floor of protection; once blocked-patterns.conf is present (the
-# normal case), the full config-driven pattern list applies as it already
-# does for claude/gemini/codex today, which is a real, intended widening of
-# coverage for Gemini/Antigravity once B.5 wires this policy for them (see
-# design.md R2/R3), not a silent side effect.
-
-set -uo pipefail
-
-INPUT=$(cat)
-if [ -f "$_DOFLOW_POLDIR/contract.sh" ]; then
-  . "$_DOFLOW_POLDIR/contract.sh"
-else
-  doflow_decision_init() { :; }
-  doflow_decide() { :; }
-  doflow_read_envelope() { DF_ENV_CLASS=missing; DF_ENV_CODE=contract-missing; }
-  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-bash-guard contract-missing ) >/dev/null 2>&1 || true
-  if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then
-    printf '[pre-bash-guard] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2
-  else
-    printf '[pre-bash-guard] DoFlow hooks out of step; run: doflow update\n' >&2
-  fi
-  doflow_decide deny contract-missing
-  exit 2
-fi
-doflow_decision_init pre-bash-guard 1
-command -v jq >/dev/null 2>&1 || {
-  doflow_decide error dependency-missing:jq
-  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-bash-guard dependency-missing:jq ) >/dev/null 2>&1 || true
-  exit 0
-}
-DF_ENV_CLASS=missing DF_ENV_CODE=envelope-missing
-doflow_read_envelope || true
-
-TOOL_NAME=""
-COMMAND=""
-if [ "$DF_ENV_CLASS" = v1 ]; then
-  [ "$DF_ENV_OP" = command ] || exit 0
-  TOOL_NAME=$DF_ENV_TOOL
-  COMMAND=$DF_ENV_COMMAND
-elif [ "$DF_ENV_CLASS" = unsupported ]; then
-  doflow_decide unsupported envelope-version
-  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-bash-guard unsupported:envelope-version ) >/dev/null 2>&1 || true
-  exit 0
-else
-  if [ "${DF_ENV_CODE:-envelope-missing}" != contract-missing ]; then
-    ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-bash-guard envelope-missing ) >/dev/null 2>&1 || true
-  fi
-  if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then printf '[pre-bash-guard] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2; else printf '[pre-bash-guard] DoFlow hooks out of step; run: doflow update\n' >&2; fi
-  doflow_decide deny "${DF_ENV_CODE:-envelope-missing}"
-  exit 2
-fi
-
-# Nothing to check if command is empty
-[ -z "$COMMAND" ] && exit 0
-
-PATTERNS_FILE="$_DOFLOW_POLDIR/blocked-patterns.conf"
-
-# ASCII-only patterns: the C locale keeps bash's substring/pattern operations
-# byte-wise (much faster than multibyte-aware in a UTF-8 locale).
-export LC_ALL=C
-
-# ── Quoted text, comments and heredoc bodies are not commands ────────────────
-# scrub_quotes <text> -> sets SCRUBBED. Anchored shell-command patterns must
-# not fire on text that is merely data (a commit message, an echo, a comment,
-# a heredoc body). One linear pass, line by line, pure bash, no forks:
-#   - quoted text containing whitespace or ; & | is blanked to "" (it could
-#     otherwise fake a command position, e.g.  echo "done && rm -rf /x");
-#     a quoted word with none of those ("/", "$HOME", $'/') is kept, unquoted,
-#     so  rm -rf "/"  is still seen as a target
-#   - the argument of sh|bash|zsh -c, eval and a here-string fed to a shell IS executed: it is kept and put
-#     in command position (wrapped in ";"), scrubbed again inside
-#   - inside double quotes, $( ... ) and `...` bodies also run: kept the same way
-#   - a # that starts a word comments out the rest of the line
-#   - a heredoc body (<<WORD, <<-WORD, quoted or not) is data and is dropped,
-#     except when the heredoc feeds a shell (bash <<EOF), whose body runs
-#   - a backslash-newline joins the two lines (outside a heredoc body)
-#   - a backslash-escaped character is literal; an unterminated quote keeps the
-#     rest of the text as is (errs toward blocking)
-# Nesting depth is capped; beyond the cap the raw text is used (errs toward
-# blocking). Text with no quote, # or << (or no command word at all) is
-# returned unchanged without scanning.
-_EXEC_CTX='(^|[[:space:];&|(])((([^[:space:]]*/)?(ba|z|da|k)?sh[[:space:]]+(-[[:alnum:]]+[[:space:]]+)*-[[:alnum:]]*c|eval)[[:space:]]+|([^[:space:]]*/)?(ba|z|da|k)?sh([[:space:]]+-[-[:alnum:]]*)*[[:space:]]*[0-9]*<<<[[:space:]]*)$'
-_SH_HERE='(^|[[:space:];&|(])([^[:space:]]*/)?(ba|z|da|k)?sh([[:space:]]+-[[:alnum:]]+)*[[:space:]]*$'
-_HD_WORD="^(-?)[[:space:]]*[\"']?\\\\?([A-Za-z_][A-Za-z0-9_.-]*)"
-SCRUB_DEPTH=0
-
-# Closes the quote scrub_quotes just read (uses its locals: out qc qin qexec).
-_scrub_close_quote() {
-  local rest pre body acc depth ch
-  if [ "$qexec" = 1 ]; then
-    [ "$qc" = '"' ] && qin=${qin//\\\"/\"}      # \" inside "..." is a quote of the inner command
-    scrub_quotes "$qin"; cur+="; $SCRUBBED ; "
-    return
-  fi
-  case $qin in
-    *[[:space:]\;\&\|]*) ;;
-    *) cur+=$qin; return ;;
-  esac
-  cur+=$qc$qc
-  [ "$qc" = '"' ] || return
-  case $qin in *'$('*|*\`*) ;; *) return ;; esac
-  rest=$qin
-  while :; do
-    pre=${rest%%[\`\$\\]*}
-    [ "$pre" = "$rest" ] && break
-    rest=${rest#"$pre"}
-    case ${rest:0:1} in
-      '\') rest=${rest:2} ;;
-      '`')
-        body=${rest:1}
-        case $body in *\`*) acc=${body%%\`*}; rest=${body#*\`} ;; *) acc=$body; rest="" ;; esac
-        scrub_quotes "$acc"; cur+="; $SCRUBBED ; " ;;
-      *)
-        if [ "${rest:1:1}" = "(" ]; then
-          body=${rest:2}; acc=""; depth=1
-          while [ -n "$body" ]; do
-            pre=${body%%[()]*}
-            if [ "$pre" = "$body" ]; then acc+=$body; body=""; break; fi
-            acc+=$pre; ch=${body:${#pre}:1}; body=${body:$((${#pre} + 1))}
-            if [ "$ch" = "(" ]; then depth=$((depth + 1)); acc+=$ch
-            else depth=$((depth - 1)); [ "$depth" -eq 0 ] && break; acc+=$ch; fi
-          done
-          rest=$body
-          scrub_quotes "$acc"; cur+="; $SCRUBBED ; "
-        else
-          rest=${rest:1}
-        fi ;;
-    esac
-  done
-}
-
-scrub_quotes() {
-  local text=$1
-  case $text in
-    *[\'\"#]*|*'<<'*|*'\'$'\n'*) ;;
-    *) SCRUBBED=$text; return ;;
-  esac
-  case $text in
-    *rm[[:space:]]*|*git[[:space:]]*|*curl[[:space:]]*|*wget[[:space:]]*|*chmod[[:space:]]*|*dd[[:space:]]*|*find[[:space:]]*|*eval*|*sh[[:space:]]*) ;;
-    *) SCRUBBED=$text; return ;;
-  esac
-  if [ "$SCRUB_DEPTH" -ge 8 ]; then SCRUBBED=$text; return; fi
-  SCRUB_DEPTH=$((SCRUB_DEPTH + 1))
-
-  local out="" cur="" line L first=1 qc="" qin="" qexec=0 qansi=0 hd_word="" hd_dash=0
-  local pre c tail w d
-  while IFS= read -r line; do
-    if [ -z "$hd_word" ]; then                # backslash-newline joins lines
-      while [[ $line == *[!\\]'\' || $line == '\' ]] && IFS= read -r w; do line="${line%?} $w"; done
-    fi
-    L=$line
-    if [ -n "$qc" ]; then
-      qin+=$'\n'
-    else
-      [ "$first" = 1 ] || cur+=$'\n'
-      if [ -n "$hd_word" ]; then              # inside a heredoc body: skip the line
-        if [ "$hd_dash" = 1 ]; then while [ "${L:0:1}" = $'\t' ]; do L=${L:1}; done; fi
-        [ "$L" = "$hd_word" ] && hd_word=""
-        first=0; continue
-      fi
-    fi
-    first=0
-    # A very long line is scanned in ~1 KB segments (quote state carries over),
-    # so the per-token slicing below never copies a huge remainder: stays linear.
-    while [ -n "$line" ]; do
-    if [ ${#line} -gt 2048 ]; then
-      L=${line:0:1024}; line=${line:1024}
-      while [[ $L == *'\' || $L == *'<' ]] && [ -n "$line" ]; do L+=${line:0:1}; line=${line:1}; done
-    else
-      L=$line; line=""
-    fi
-    while [ -n "$L" ]; do
-      if [ ${#cur} -gt 512 ]; then             # keep the tail buffer small
-        out+=${cur:0:$((${#cur} - 128))}; cur=${cur: -128}
-      fi
-      if [ -n "$qc" ]; then                    # inside a quote: look for the close
-        if [ "$qc" = "'" ] && [ "$qansi" = 0 ]; then
-          case $L in
-            *\'*) qin+=${L%%\'*}; L=${L#*\'}; _scrub_close_quote; qc="" ;;
-            *) qin+=$L; L="" ;;
-          esac
-        else
-          if [ "$qc" = '"' ]; then pre=${L%%[\"\\]*}; else pre=${L%%[\'\\]*}; fi
-          if [ "$pre" = "$L" ]; then
-            qin+=$L; L=""
-          else
-            qin+=$pre; L=${L#"$pre"}
-            if [ "${L:0:1}" = '\' ]; then
-              qin+=${L:0:2}; L=${L:2}
-            else
-              L=${L:1}; _scrub_close_quote; qc=""
-            fi
-          fi
-        fi
-        continue
-      fi
-      pre=${L%%[\'\"\\#<]*}
-      if [ "$pre" = "$L" ]; then cur+=$L; L=""; break; fi
-      cur+=$pre; L=${L#"$pre"}
-      c=${L:0:1}
-      case $c in
-        '\') cur+=${L:0:2}; L=${L:2} ;;
-        '#')
-          case ${cur: -1} in
-            ""|[[:space:]\;\&\|\(]) L="" ;;
-            *) cur+=$c; L=${L:1} ;;
-          esac ;;
-        '<')
-          if [ "${L:0:3}" = '<<<' ]; then
-            cur+='<<<'; L=${L:3}
-          elif [ "${L:0:2}" = '<<' ]; then
-            cur+='<<'; L=${L:2}
-            case $out$cur in
-              *'(('*) ;;
-              *)
-                if [[ $L =~ $_HD_WORD ]]; then
-                  d=${BASH_REMATCH[1]}; w=${BASH_REMATCH[2]}
-                  if [ ${#cur} -gt 122 ]; then tail=${cur: -122}; else tail=$cur; fi
-                  tail=${tail%??}
-                  [[ $tail =~ $_SH_HERE ]] || { hd_word=$w; [ -n "$d" ] && hd_dash=1 || hd_dash=0; }
-                fi ;;
-            esac
-          else
-            cur+='<'; L=${L:1}
-          fi ;;
-        *)                                     # opening quote
-          qc=$c; qin=""; qexec=0; qansi=0; L=${L:1}
-          if [ "$c" = "'" ] && [ "${cur: -1}" = '$' ]; then
-            cur=${cur%?}; qansi=1
-          fi
-          if [ ${#cur} -gt 100 ]; then tail=${cur: -100}; else tail=$cur; fi
-          [[ $tail =~ $_EXEC_CTX ]] && qexec=1 ;;
-      esac
-    done
-    done
-  done <<< "$text"
-  [ -n "$qc" ] && cur+=$qc$qin                  # unterminated quote: keep as is
-  SCRUB_DEPTH=$((SCRUB_DEPTH - 1))
-  SCRUBBED=$out$cur
-}
-scrub_quotes "$COMMAND"
-SHELL_TEXT=$SCRUBBED
-
-# Hardcoded floor, used only when blocked-patterns.conf is missing: recursive
-# rm (any flag spelling, flag before or after the target) of a catastrophic
-# target — the same rule as the rm lines in blocked-patterns.conf. Subpaths
-# such as /tmp/x are not blocked.
-_CMDPOS='(^|[;&|(`])[[:space:]]*'
-_WRAP='((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*'
-_PATHRM='(\\|/(usr/)?bin/)?rm'
-_RM_FLAG='(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)'
-_RM_ARGS='([[:space:]]+[^[:space:];&|]+)*'
-_END='([[:space:];&|)`]|$)'
-_RM_PREFIX="${_CMDPOS}${_WRAP}${_PATHRM}${_RM_ARGS}[[:space:]]+"
-# _floor_rm_hits <target-regex> : does the scrubbed command recursively rm it?
-_floor_rm_hits() {
-  grep -qiE -- "${_RM_PREFIX}(${_RM_FLAG}${_RM_ARGS}[[:space:]]+($1)${_END}|($1)${_RM_ARGS}[[:space:]]+${_RM_FLAG}${_END})" <<<"$SHELL_TEXT" 2>/dev/null
-}
-
-if [ ! -f "$PATTERNS_FILE" ]; then
-  # The pattern file ships with DoFlow, so a missing one means a broken install: record it on this
-  # machine (feature 046, IC-018) and go on exactly as before. Subshell, output discarded: nothing
-  # the helper does can reach this policy's options, variables, output or exit status.
-  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-bash-guard patterns-missing ) >/dev/null 2>&1 || true
-  doflow_decide error patterns-missing
-  if _floor_rm_hits '/+\*{0,2}'; then
-    echo "[pre-bash-guard] Catastrophic delete blocked — recursive rm of the root directory (/)" >&2
-    doflow_decide deny catastrophic-rm-root
-    exit 2
-  fi
-  if _floor_rm_hits '(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?'; then
-    echo "[pre-bash-guard] Catastrophic delete blocked — recursive rm of the home directory" >&2
-    doflow_decide deny catastrophic-rm-home
-    exit 2
-  fi
-  if _floor_rm_hits '/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?'; then
-    echo "[pre-bash-guard] Catastrophic delete blocked — recursive rm of a system directory" >&2
-    doflow_decide deny catastrophic-rm-system
-    exit 2
-  fi
-  # No patterns file beyond the hardcoded floor — allow everything else
-  # (fail open — don't block the agent).
-  exit 0
-fi
-
-# One combined ERE cheaply rules out commands that match no live pattern. A
-# grep match or regex error falls through to the original per-line loop, which
-# still owns the reason and optional exclude semantics.
-_anchored_patterns="" _full_patterns="" _has_backreference=false
-while IFS=$'\t' read -r pattern _reason _exclude || [ -n "$pattern" ]; do
-  [ -z "$pattern" ] && continue
-  case "$pattern" in \#*) continue ;; esac
-  if [[ "$pattern" =~ \\[1-9] ]]; then _has_backreference=true; fi
-  case "$pattern" in
-    '(^|'*) _anchored_patterns="${_anchored_patterns:+$_anchored_patterns|}($pattern)" ;;
-    *) _full_patterns="${_full_patterns:+$_full_patterns|}($pattern)" ;;
-  esac
-done < "$PATTERNS_FILE"
-_anchored_status=1 _full_status=1
-if [ -n "$_anchored_patterns" ]; then
-  grep -qiE -- "$_anchored_patterns" <<<"$SHELL_TEXT" 2>/dev/null
-  _anchored_status=$?
-fi
-if [ -n "$_full_patterns" ]; then
-  grep -qiE -- "$_full_patterns" <<<"$COMMAND" 2>/dev/null
-  _full_status=$?
-fi
-if [ "$_anchored_status" -eq 1 ] && [ "$_full_status" -eq 1 ] && [ "$_has_backreference" != true ]; then exit 0; fi
-
-# ── Pattern matching ──────────────────────────────────────────────────────────
-
-while IFS=$'\t' read -r pattern reason exclude || [ -n "$pattern" ]; do
-  # Skip comments and empty lines
-  [ -z "$pattern" ] && continue
-  case "$pattern" in \#*) continue ;; esac
-
-  # Match pattern against command (case-insensitive, POSIX extended regex: the default macOS
-  # filesystem is case-insensitive, so RM and GIT run there).
-  # A bad regex makes grep exit 2, which "if" reads as no match (fail open).
-  # "--" stops grep from treating a pattern beginning with '-' (e.g. an
-  # exclude pattern like "--force-with-lease") as an option flag.
-  # Anchored shell-command patterns (they begin with the "(^|" command-position
-  # anchor) match the scrubbed text; every other pattern (the SQL ones)
-  # matches the full text, so statements inside quoted psql -c / heredocs are
-  # still caught.
-  case "$pattern" in '(^|'*) target=$SHELL_TEXT ;; *) target=$COMMAND ;; esac
-  matched=false
-  if grep -qiE -- "$pattern" <<<"$target" 2>/dev/null; then
-    matched=true
-  fi
-
-  # Optional third column: if the command also matches the exclude pattern,
-  # this pattern line is skipped entirely (approximates negative lookahead,
-  # which POSIX ERE cannot express — e.g. "--force-with-lease" excludes the
-  # "git push --force" block).
-  if [ "$matched" = "true" ] && [ -n "$exclude" ]; then
-    if grep -qiE -- "$exclude" <<<"$target" 2>/dev/null; then
-      matched=false
-    fi
-  fi
-
-  if [ "$matched" = "true" ]; then
-    echo "[pre-bash-guard] ${reason:-Command blocked by pre-bash-guard}" >&2
-    doflow_decide deny blocked-pattern
-    exit 2
-  fi
-done < "$PATTERNS_FILE"
-
-# No match — allow
-exit 0

package/core/shared/guidance/FLAGS.md

@@ -1,25 +0,0 @@
-# Runtime Behavior and Flags
-
-Loaded into **every** session on every harness. What a flag used to request is now mostly
-unconditional, so this states the behavior once rather than listing knobs.
-
-## Always on
-
-**Readiness gating** — a stage that edits source is graded against its class contract first;
-the verdict is one of four states, never a number.
-**Recovery bounds** — a failed verification is classified and retried under a bound the runtime
-sets. You do not pick a cycle count.
-**Run tracing** — every runtime call is recorded as it happens and read back; where a run
-stopped is read from that record, never reconstructed.
-**Capability routing** — an information need resolves to a provider healthy on this machine, not to
-a habitual tool.
-
-## Flags
-
-What the user typed beats auto-detection. Every flag belongs to one skill and is declared in that
-skill's `argument-hint`, except this one, which crosses them:
-
-**--focus [quality|security|performance|architecture]** — narrows analysis to one domain. Consumed
-by `do-diagnose`.
-
-MCP short flags are generated per install into `MCP_INDEX.md`; this file names no server.

package/core/shared/guidance/rules/RULE_01_SAFETY.md

@@ -1,25 +0,0 @@
-# Safety Rules (CRITICAL)
-
-## Priority System
-**CRITICAL** — Security, data safety, production — never compromise
-**IMPORTANT** — Quality, maintainability, professionalism — strong preference
-**RECOMMENDED** — Optimization, style, best practices — apply when practical
-
-Conflict order: Safety > Scope > Quality > Speed. Prototype != Production requirements.
-
-<important if="debugging, fixing a bug, or investigating a failure">
-## Failure Investigation
-- Root cause always — understand WHY, not just THAT; fix the cause, not the symptom
-- Never skip/disable/comment-out tests or validation to pass builds
-</important>
-
-<important if="performing git operations or starting work on a codebase">
-## Git Workflow
-- `git status && git branch` first; feature branches for ALL work; never force-push main
-- Commit incrementally with descriptive messages; `git diff` before staging; restore-point commit
-  before anything risky
-</important>
-
-## Temporal Awareness
-- Read the date from `<env>` before any temporal claim; never infer it from your knowledge cutoff,
-  and state its source

package/core/shared/guidance/rules/RULE_02_WORKFLOW.md

@@ -1,23 +0,0 @@
-# Workflow Rules
-
-## Planning
-- **Parallel by default** — sequential only for hard dependencies; a task list once past 3 tasks, when the session offers one
-- Validate before execution, verify after; run lint/typecheck before marking complete
-- Check deps (package.json) and existing patterns before any changes
-- Feature delivery follows the doflow chain — see `references/DOFLOW_CHAIN.md` for the phase-gated
-  flow, artifact contracts, and the enforced gate
-
-<important if="planning or starting a multi-step task">
-## Planning Efficiency
-- Identify concurrent vs sequential operations
-- Map dependencies; batch tool calls; estimate parallelization gains
-</important>
-
-## Implementation Completeness
-- Start it = Finish it. No partial features, TODO stubs, mocks, or "not implemented" throws
-- All generated code must work as specified; no scaffolding placeholders
-
-## Scope Discipline
-- Build ONLY what's asked — no bonus features, no enterprise bloat (auth/monitoring/deployment
-  unless requested)
-- MVP first; YAGNI; single responsibility per component

package/core/shared/guidance/rules/RULE_03_QUALITY.md

@@ -1,14 +0,0 @@
-# Quality Rules
-
-## Organization & Hygiene
-**Naming**: Follow language standards (camelCase JS, snake_case Python); no mixed conventions
-**Files**: Organize by feature/domain; tests → `tests/`; scripts → `scripts/`; reports → `agent-docs/`
-**Workspace**: Remove temp files, debug scripts, build artifacts after use; never leave clutter in VCS
-
-## Professional Honesty
-- No marketing language ("blazingly fast", "100% secure", "magnificent")
-- No invented sources, figures, citations or quotes; leave out what you cannot trace; state "untested/MVP/needs validation" honestly
-- If you are not sure, say so plainly and name what is unknown; do not present a guess as established
-- Warn when a claim may be outdated: information from memory or an old source can have changed since it was written
-- Never attribute a statement or view to a real person unless you have verified it; otherwise omit the name
-- Push back on bad approaches; evidence-based claims only

package/core/shared/guidance/rules/RULE_04_QUESTIONS.md

@@ -1,46 +0,0 @@
-# Question & Clarification Rules
-
-## When to Ask
-- Ask ONLY for genuine user-owned decisions unresolved by the request, the code, or sensible defaults
-- Enough to act → act; don't ask to confirm the obvious (see RULE_02 Scope Discipline)
-- One question that unblocks beats three that re-litigate settled choices
-
-<important if="asking the user a clarifying question or choosing between approaches">
-## How to Ask (MANDATORY format)
-Structured multiple-choice — never a free-form question buried in prose.
-- **A native question tool exists in this session** (Claude Code's `AskUserQuestion`, or any
-  harness tool that presents options and returns the user's choice): use it. Which harness this
-  is is not the test — what THIS session offers is; Codex and Gemini sessions increasingly
-  carry one.
-- **No native question tool** (truly non-interactive runs): write a `{stage}-questions.md` file
-  with `[Answer]:` tags — the fallback, never the preference.
-
-Each question:
-- 2–4 **meaningful, mutually-exclusive** options covering the real scenarios
-- NEVER invent filler; an "Other"/free-text escape is always the last choice
-- One topic per question; specific and unambiguous; lead with your recommended default
-</important>
-
-<important if="writing a question file because this session has no native question tool">
-## Question-File Format
-```markdown
-## Question 1 — [the question]
-A) [option]  B) [option]  X) Other (free text after the tag)
-
-[Answer]:
-```
-Naming: `{stage}-questions.md` (e.g. `spec-questions.md`) in the directory the stage writes
-its output to — not a fixed path outside the repo's layout.
-
-Lifecycle: write the file → tell the user and wait for "done" → read answers →
-**Validate Before Proceeding** (below) → act. A missing `[Answer]:`, or one that is not a listed
-letter, means ask again — never guess, and never reinterpret free text as a letter choice.
-</important>
-
-<important if="reading the user's answers before you act on them">
-## Validate Before Proceeding
-- Scan answers for contradictions (scope vs risk, quick fix vs multi-subsystem) and ambiguity
-- Conflict found → name it and ask one targeted follow-up in `{stage}-clarification-questions.md`,
-  same format, citing the conflicting answer; never proceed on an unresolved contradiction, and
-  never assume an answer to an ambiguous response
-</important>