@raishin/vanguard-frontier-agentic 3.14.0 → 3.16.0

package/mods/blast-radius-guard/codex/UNSUPPORTED.md

@@ -0,0 +1,7 @@
+# Blast Radius Guard on Codex
+
+<!-- Generated by scripts/generate-mods.mjs from mod.toml. Do not edit. -->
+
+## Degraded
+
+- `PreToolUse`: Codex rejects ask; confirm mode denies with a reason.

package/mods/blast-radius-guard/codex/hooks.json

@@ -0,0 +1,14 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .codex/vanguard-mods/blast-radius-guard/bin/hook.mjs --harness codex --event PreToolUse"
+          }
+        ]
+      }
+    ]
+  }
+}

package/mods/blast-radius-guard/hooks/hooks.json

@@ -0,0 +1,5 @@
+{
+  "modules": [
+    "./register.ts"
+  ]
+}

package/mods/blast-radius-guard/hooks/register.test.ts

@@ -0,0 +1,97 @@
+import { test, expect, mock } from 'claude-code/testing'
+
+const ENV_MODE = 'VANGUARD_BLAST_RADIUS_GUARD_MODE'
+const ENV_PATTERNS = 'VANGUARD_BLAST_RADIUS_GUARD_PATTERNS'
+const allow = () => ({ decision: 'allow' as const })
+const bash = (command: string) => ({ tool: 'Bash', input: { command } })
+const ext = (over: object = {}) =>
+  JSON.stringify([{ id: 'danger-cmd', name: 'danger cmd', regex: 'danger-cmd', flags: '', context: ['bash'], ...over }])
+
+test('rm -rf / asks by default', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('rm -rf /'))).decision).toBe('ask')
+})
+
+test('block mode denies', async ($, on) => {
+  mock.env(on, { [ENV_MODE]: 'block' })
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('rm -rf /'))).decision).toBe('deny')
+})
+
+test('unknown mode denies', async ($, on) => {
+  mock.env(on, { [ENV_MODE]: 'bogus' })
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('rm -rf /'))).decision).toBe('deny')
+})
+
+test('clean command passes the engine verdict', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  expect((await $.tool.check(bash('ls'))).decision).toBe('allow')
+})
+
+test('engine deny stays deny', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', () => ({ decision: 'deny' as const, reason: 'engine' }))
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('Write to a traversal path to /etc asks', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check({ tool: 'Write', input: { file_path: '/tmp/../etc/passwd', content: 'x' } })
+  expect(v.decision).toBe('ask')
+})
+
+test('Read of /etc/passwd is allowed', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check({ tool: 'Read', input: { file_path: '/etc/passwd' } })
+  expect(v.decision).toBe('allow')
+})
+
+test('argv array is read as a command line', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check({ tool: 'Exec', input: { argv: ['rm', '-rf', '/'] } })
+  expect(v.decision).toBe('ask')
+})
+
+test('extension pattern asks', async ($, on) => {
+  mock.env(on, { [ENV_PATTERNS]: '/ext.json' })
+  on('tool.check', allow)
+  on('fs.read', () => ({ value: ext() }))
+  expect((await $.tool.check(bash('run danger-cmd now'))).decision).toBe('ask')
+})
+
+test('unreadable extension file denies', async ($, on) => {
+  mock.env(on, { [ENV_PATTERNS]: '/ext.json' })
+  on('tool.check', allow)
+  on('fs.read', () => {
+    throw new Error('nope')
+  })
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('extension that is not JSON denies', async ($, on) => {
+  mock.env(on, { [ENV_PATTERNS]: '/ext.json' })
+  on('tool.check', allow)
+  on('fs.read', () => ({ value: 'not json' }))
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('extension reusing a built-in id denies', async ($, on) => {
+  mock.env(on, { [ENV_PATTERNS]: '/ext.json' })
+  on('tool.check', allow)
+  on('fs.read', () => ({ value: ext({ id: 'rm-rf-root-or-home' }) }))
+  expect((await $.tool.check(bash('ls'))).decision).toBe('deny')
+})
+
+test('oversized command asks as too large', async ($, on) => {
+  mock.env(on, {})
+  on('tool.check', allow)
+  const v = await $.tool.check(bash('a'.repeat(70000)))
+  expect(v.decision).toBe('ask')
+  expect(v.reason).toContain('input too large to evaluate')
+})

package/mods/blast-radius-guard/hooks/register.ts

@@ -0,0 +1,13 @@
+import type { Register } from 'claude-code'
+import { checkToolUse, compileGuardPatterns, modeOf } from '../lib/core.mjs'
+
+export const register: Register = (on) => {
+  on('tool.check', async ($, e, next) => {
+    const v = await next(e)
+    if (v.decision === 'deny') return v
+    const mode = modeOf(await $.env.get('VANGUARD_BLAST_RADIUS_GUARD_MODE'))
+    const file = await $.env.get('VANGUARD_BLAST_RADIUS_GUARD_PATTERNS')
+    const patterns = compileGuardPatterns(file ? await $.fs.read(file) : undefined)
+    return checkToolUse({ tool: e.tool, input: e.input }, patterns, mode) ?? v
+  }).catch(() => ({ decision: 'deny', reason: 'blast-radius-guard: check failed; denied' }))
+}

package/mods/blast-radius-guard/kiro/UNSUPPORTED.md

@@ -0,0 +1,7 @@
+# Blast Radius Guard on Kiro
+
+<!-- Generated by scripts/generate-mods.mjs from mod.toml. Do not edit. -->
+
+## Degraded
+
+- `PreToolUse`: Kiro documents no confirmation protocol or stdin field names; the whole payload is scanned, the system-path rule applies to the path keys whatever the tool, and confirm mode denies.

package/mods/blast-radius-guard/kiro/blast-radius-guard-pre-tool-use-hook.json

@@ -0,0 +1,14 @@
+{
+  "version": "v1",
+  "hooks": [
+    {
+      "name": "blast-radius-guard:PreToolUse",
+      "description": "Asks before, or blocks, destructive shell commands and writes to system paths.",
+      "trigger": "PreToolUse",
+      "action": {
+        "type": "command",
+        "command": "node .kiro/vanguard-mods/blast-radius-guard/bin/hook.mjs --harness kiro --event PreToolUse"
+      }
+    }
+  ]
+}

package/mods/blast-radius-guard/lib/common.mjs

@@ -0,0 +1,213 @@
+// Shared helpers for the mods under mods/. scripts/generate-mods.mjs copies this file
+// byte-for-byte to mods/<id>/lib/common.mjs, so edit it here and run `npm run mods:write`.
+//
+// Pure on purpose: no imports, no environment, no I/O. Claude Code's native mod runtime
+// imports it and has no Node, and every harness must reach the same verdict on the same
+// input. Regexes compile without the `u` flag so Node and Python `re.ASCII`
+// (tests/validate-mods.py) read them the same way.
+
+export const LIMITS = Object.freeze({
+  // A redaction that still changes after this many passes is withheld as a whole.
+  maxPasses: 8,
+  // A guard candidate longer than this is not evaluated and counts as a hit.
+  maxCandidateChars: 65536,
+  // Guard candidates are not evaluated past this combined length; the call counts as a hit.
+  maxTotalChars: 262144,
+  // Only the tail of a leaf's context (key or previous sibling) is prefixed to it.
+  maxContextChars: 256,
+})
+
+const MARKER_PREFIX = '[REDACTED:'
+export const OVERFLOW_MARKER = '[REDACTED:overflow]'
+const OVERFLOW_HIT = Object.freeze({ id: 'overflow', name: 'redaction did not converge' })
+export const TOO_LARGE_HIT = Object.freeze({ id: 'too-large', name: 'input too large to evaluate' })
+
+const ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/
+const PATTERN_KEYS = new Set(['id', 'name', 'description', 'regex', 'flags', 'context', 'severity', 'agents'])
+const isStringArray = (v) => Array.isArray(v) && v.every((s) => typeof s === 'string' && s !== '')
+
+// Parser diagnostics can quote credential-bearing data; never expose it in hook logs.
+export function parseJson(text, source) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    throw new Error(`${source}: invalid JSON`)
+  }
+}
+
+// Validates a patterns.json-shaped list and compiles it. Throws on anything malformed so a
+// bad extension file fails closed in the caller instead of silently matching nothing.
+export function compilePatterns(list, source = 'patterns') {
+  if (!Array.isArray(list)) throw new Error(`${source}: expected an array of patterns`)
+  const seen = new Set()
+  return list.map((p, i) => {
+    const where = `${source}[${i}]`
+    if (p === null || typeof p !== 'object' || Array.isArray(p)) throw new Error(`${where}: expected an object`)
+    for (const k of Object.keys(p)) if (!PATTERN_KEYS.has(k)) throw new Error(`${where}: unknown key ${k}`)
+    if (typeof p.id !== 'string' || !ID_RE.test(p.id)) throw new Error(`${where}: id must be kebab-case`)
+    if (seen.has(p.id)) throw new Error(`${where}: duplicate id ${p.id}`)
+    seen.add(p.id)
+    if (typeof p.name !== 'string' || p.name === '') throw new Error(`${where}: name must be a non-empty string`)
+    if (typeof p.regex !== 'string' || p.regex === '') throw new Error(`${where}: regex must be a non-empty string`)
+    if (p.flags !== '' && p.flags !== 'i') throw new Error(`${where}: flags must be "" or "i"`)
+    if (!isStringArray(p.context) || p.context.length === 0) throw new Error(`${where}: context must be a non-empty string array`)
+    for (const k of ['description', 'severity']) {
+      if (p[k] !== undefined && typeof p[k] !== 'string') throw new Error(`${where}: ${k} must be a string`)
+    }
+    if (p.agents !== undefined && !isStringArray(p.agents)) throw new Error(`${where}: agents must be a string array`)
+    let rx, rxg
+    try {
+      rx = new RegExp(p.regex, p.flags)
+      rxg = new RegExp(p.regex, 'g' + p.flags)
+    } catch {
+      throw new Error(`${where}: regex does not compile`)
+    }
+    return Object.freeze({
+      id: p.id,
+      name: p.name,
+      severity: p.severity,
+      context: Object.freeze([...p.context]),
+      agents: p.agents ? Object.freeze([...p.agents]) : undefined,
+      rx,
+      rxg,
+      marker: `${MARKER_PREFIX}${p.id}]`,
+    })
+  })
+}
+
+// Every string value (not key) in depth-first order. The order follows the input, so the
+// same payload always yields the same list.
+export function stringLeaves(value, out = []) {
+  if (typeof value === 'string') out.push(value)
+  else if (Array.isArray(value)) for (const v of value) stringLeaves(v, out)
+  else if (value !== null && typeof value === 'object') for (const v of Object.values(value)) stringLeaves(v, out)
+  return out
+}
+
+// Guard candidates: every string leaf, plus every all-string array joined with spaces so
+// an argv-style command (["rm", "-rf", "/"]) reads like the shell line it runs.
+export function candidates(value) {
+  const out = stringLeaves(value)
+  const joinArrays = (v) => {
+    if (Array.isArray(v)) {
+      if (v.length > 1 && v.every((s) => typeof s === 'string')) out.push(v.join(' '))
+      v.forEach(joinArrays)
+    } else if (v !== null && typeof v === 'object') {
+      Object.values(v).forEach(joinArrays)
+    }
+  }
+  joinArrays(value)
+  return out
+}
+
+// The patterns tagged with `context` that match any text, in catalog order. Oversized input
+// is not evaluated (regex cost is unbounded there) and reports TOO_LARGE_HIT instead.
+export function matchPatterns(patterns, texts, context) {
+  let total = 0
+  for (const t of texts) {
+    total += t.length
+    if (t.length > LIMITS.maxCandidateChars || total > LIMITS.maxTotalChars) return [TOO_LARGE_HIT]
+  }
+  return patterns.filter((p) => p.context.includes(context) && texts.some((t) => p.rx.test(t)))
+}
+
+// One pattern pass after another until the text stops changing. Each pass can expose a new
+// match (password-in-url can swallow an earlier marker), so a single pass is not enough.
+function fixedPoint(text, patterns, hits) {
+  let x = text
+  for (let pass = 0; pass <= LIMITS.maxPasses; pass++) {
+    let y = x
+    for (const p of patterns) {
+      y = y.replace(p.rxg, (m) => {
+        if (m === '') return m
+        hits.add(p)
+        return p.marker
+      })
+    }
+    if (y === x) return x
+    x = y
+  }
+  hits.add(OVERFLOW_HIT)
+  return OVERFLOW_MARKER
+}
+
+// Redacts `s` with `ctx` in front so a secret split across a key and its value, or across
+// argv elements ("Bearer", "<token>"), still matches; then strips the context back off.
+function redactLeaf(s, ctx, patterns, hits) {
+  if (ctx === '') return fixedPoint(s, patterns, hits)
+  const pre = ctx.slice(-LIMITS.maxContextChars) + ' '
+  const y = fixedPoint(pre + s, patterns, hits)
+  if (y === OVERFLOW_MARKER) return y
+  const r = fixedPoint(pre, patterns, new Set())
+  if (y.startsWith(r)) return fixedPoint(y.slice(r.length), patterns, hits)
+  // A match spans the boundary: keep from the marker that covers it. Slicing changes
+  // anchors and boundaries, so also check the standalone leaf after contextual matching.
+  let d = 0
+  while (d < r.length && y[d] === r[d]) d++
+  const i = y.lastIndexOf(MARKER_PREFIX, d)
+  return fixedPoint(i >= 0 ? y.slice(i) : y, patterns, hits)
+}
+
+function walk(v, ctx, patterns, hits) {
+  if (typeof v === 'string') {
+    const local = new Set()
+    const out = redactLeaf(v, ctx, patterns, local)
+    if (out !== v) for (const h of local) hits.add(h)
+    return out
+  }
+  if (Array.isArray(v)) {
+    let prev = null
+    return v.map((el) => {
+      const out = walk(el, typeof prev === 'string' ? prev : ctx, patterns, hits)
+      prev = el
+      return out
+    })
+  }
+  if (v !== null && typeof v === 'object') {
+    const named = typeof v.name === 'string' ? v.name : typeof v.key === 'string' ? v.key : null
+    // fromEntries, not assignment: `out[k] = v` would drop an own "__proto__" key.
+    return Object.fromEntries(
+      Object.entries(v).map(([k, x]) => [
+        walk(k, '', patterns, hits),
+        walk(x, k === 'value' && named !== null ? named : k, patterns, hits),
+      ]),
+    )
+  }
+  return v
+}
+
+// Returns a copy of `value` with every match replaced by `[REDACTED:<id>]`, plus the
+// patterns that fired (catalog order, unique). Keys are redacted too; two keys that redact
+// to the same marker collapse into one, which loses data but never leaks it.
+export function redactValue(value, patterns) {
+  const hits = new Set()
+  const out = walk(value, '', patterns, hits)
+  const order = [...patterns, OVERFLOW_HIT]
+  return { value: out, hits: order.filter((p) => hits.has(p)) }
+}
+
+// Same shape as `value`, every string replaced by `text`. The fallback when redaction
+// itself failed: withhold everything rather than pass anything through.
+export function maskValue(value, text) {
+  if (typeof value === 'string') return text
+  if (Array.isArray(value)) return value.map((v) => maskValue(v, text))
+  if (value !== null && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, maskValue(v, text)]))
+  }
+  return value
+}
+
+// JSON with object keys sorted at every level, so equal values hash equally.
+export function canonicalJson(value) {
+  if (Array.isArray(value)) return '[' + value.map((v) => (v === undefined ? 'null' : canonicalJson(v))).join(',') + ']'
+  if (value !== null && typeof value === 'object') {
+    const keys = Object.keys(value).filter((k) => value[k] !== undefined).sort()
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(value[k])).join(',') + '}'
+  }
+  return JSON.stringify(value) ?? 'null'
+}
+
+export async function sha256Hex(text) {
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('')
+}

package/mods/blast-radius-guard/lib/core.mjs

@@ -0,0 +1,66 @@
+// Blast Radius Guard logic, shared by the native module and the Node hook so every
+// harness reaches the same verdict. Pure: no I/O, no environment.
+import { candidates, compilePatterns, matchPatterns, parseJson } from './common.mjs'
+import builtin from './patterns.mjs'
+
+const PATH_KEYS = new Set(['file_path', 'path', 'notebook_path', 'filePath'])
+const WRITE_TOOL = /write|edit|create|patch|delete|move|rename/i
+
+// Built-in patterns, plus the operator's extension appended (never replacing). Throws on
+// bad JSON or shape, or an id reused from the built-ins; callers fail closed.
+export function compileGuardPatterns(extraText, source = 'extension patterns') {
+  if (extraText === undefined) return compilePatterns(builtin, 'built-in patterns')
+  return compilePatterns([...builtin, ...parseJson(extraText, source)], source)
+}
+
+// Only an unset value or exactly `confirm` asks; any other value (typos included) blocks.
+export function modeOf(value) {
+  return value === undefined || value === 'confirm' ? 'confirm' : 'block'
+}
+
+// Lexical POSIX normalization: no cwd, `..` never climbs above an absolute root.
+export function normalizePosix(p) {
+  const abs = p.startsWith('/')
+  const out = []
+  for (const seg of p.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg !== '..') out.push(seg)
+    else if (out.length > 0 && out[out.length - 1] !== '..') out.pop()
+    else if (!abs) out.push('..')
+  }
+  const body = out.join('/')
+  return abs ? '/' + body : body || '.'
+}
+
+// String values of path-like keys at any depth.
+function pathValues(value, out = []) {
+  if (Array.isArray(value)) value.forEach((v) => pathValues(v, out))
+  else if (value !== null && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) {
+      if (PATH_KEYS.has(k) && typeof v === 'string') out.push(v)
+      else pathValues(v, out)
+    }
+  }
+  return out
+}
+
+// undefined when nothing matched, else the ask/deny verdict naming every pattern hit.
+export function checkToolUse({ tool, input }, patterns, mode) {
+  const hits = new Set(matchPatterns(patterns, candidates(input), 'bash'))
+  if (typeof tool !== 'string' || WRITE_TOOL.test(tool)) {
+    for (const h of matchPatterns(patterns, pathValues(input).map(normalizePosix), 'file-write')) hits.add(h)
+  }
+  if (hits.size === 0) return undefined
+  const names = [...hits].map((h) => h.name)
+  return {
+    decision: mode === 'confirm' ? 'ask' : 'deny',
+    reason: `blast-radius-guard: ${[...new Set(names)].join('; ')}`,
+  }
+}
+
+// Node harnesses: without a tool_input object (Kiro) the whole payload is scanned.
+export function toolUseFromPayload(payload) {
+  const ti = payload.tool_input
+  const plain = ti !== null && typeof ti === 'object' && !Array.isArray(ti)
+  return { tool: typeof payload.tool_name === 'string' ? payload.tool_name : undefined, input: plain ? ti : payload }
+}

package/mods/blast-radius-guard/lib/patterns.mjs

@@ -0,0 +1,102 @@
+// Generated by scripts/generate-mods.mjs from patterns.json. Do not edit.
+export default [
+  {
+    "id": "rm-rf-root-or-home",
+    "name": "rm -r on /, /*, ~, ~/, $HOME or a top-level system dir",
+    "description": "rm with a recursive flag (any of -r -R -rf -fr -Rf -rfv, split -r -f, --recursive) AND a whole-token target of / /* ~ ~/ ~/* $HOME ${HOME} (optionally quoted) or a top-level system dir (/etc /usr /var ...). Flag/target order-independent (lookahead AND). Force flag deliberately not required: rm -r / is as destructive. Known FP: the text inside echo/grep/commit messages.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])rm(?=[ \\t])(?=[^;&|\\n]*[ \\t](?:-[A-Za-z]*[rR][A-Za-z]*|--recursive)(?![^ \\t\\r\\n;&|)]))(?=[^;&|\\n]*[ \\t][\"']?(?:/(?:(?:bin|boot|dev|etc|home|lib|lib32|lib64|opt|proc|root|sbin|srv|sys|usr|var)/?)?\\*?|~/?\\*?|\\$HOME/?\\*?|\\$\\{HOME\\}/?\\*?)[\"']?(?![^ \\t\\r\\n;&|)]))",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "sql-drop-object",
+    "name": "SQL DROP TABLE/DATABASE/SCHEMA",
+    "description": "DROP followed by whitespace/newline and TABLE|DATABASE|SCHEMA, case-insensitive, left/right word-bounded. Matches the SQL text inside psql -c / mysql -e / sqlcmd -Q strings. Does not see SQL inside files (psql -f x.sql) nor the dropdb CLI.",
+    "regex": "(?:^|[^A-Za-z0-9_])drop[ \\t\\r\\n]+(?:table|database|schema)(?![A-Za-z0-9_])",
+    "flags": "i",
+    "severity": "critical",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "git-force-push-protected",
+    "name": "git push --force / -f / --force-with-lease / +refspec to protected branch",
+    "description": "git [global opts] push with (a force flag AND a protected-branch token) OR a +refspec of a protected branch. Protected = main, master, release/*, prod, production, prod-*, prod_*, prod/*. Branch token may be bare, src:dst, or refs/heads/*. --force-with-lease IS included: the lease only guards against clobbering unseen commits, it still rewrites protected history. 'prod*' from the spec narrowed so product-page does not match. Bare 'git push -f' (current branch unknown) is NOT matched.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])git(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+push(?![A-Za-z0-9_-])(?:(?=[^;&|\\n]*[ \\t](?:--force(?:-with-lease|-if-includes)?(?:=[^ \\t\\r\\n;&|]*)?|-[A-Za-z]*f[A-Za-z]*)(?![^ \\t\\r\\n;&|)]))(?=[^;&|\\n]*[ \\t][\"']?\\+?(?:[^ \\t\\r\\n;&|:]*:)?(?:refs/heads/)?(?:main|master|release/[^ \\t\\r\\n;&|\"']+|prod(?:uction)?|prod[-_/][^ \\t\\r\\n;&|\"']*)[\"']?(?![^ \\t\\r\\n;&|)]))|(?=[^;&|\\n]*[ \\t][\"']?\\+(?:[^ \\t\\r\\n;&|:]*:)?(?:refs/heads/)?(?:main|master|release/[^ \\t\\r\\n;&|\"']+|prod(?:uction)?|prod[-_/][^ \\t\\r\\n;&|\"']*)[\"']?(?![^ \\t\\r\\n;&|)])))",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "pipe-remote-to-shell",
+    "name": "curl|wget piped to a shell",
+    "description": "curl or wget whose output is piped (possibly through intermediate filters) into sh/bash/zsh/dash/ksh/csh, optionally via sudo/env and an absolute path. '||' is not treated as a pipe. Interpreters other than shells (python, node, perl) are not covered.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:curl|wget)(?![A-Za-z0-9_-])[^;&\\n|]*(?:\\|(?!\\|)[^;&\\n|]*)*\\|(?!\\|)[ \\t]*(?:sudo(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,4}[ \\t]+|env[ \\t]+)?(?:/[A-Za-z0-9_./-]*/)?(?:ba|z|da|k|c)?sh(?![A-Za-z0-9_.-])",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "remote-script-substitution",
+    "name": "shell/source/eval of curl|wget command substitution",
+    "description": "bash <(curl ...), sh -c \"$(curl ...)\", eval \"$(wget ...)\", source <(curl ...), . <(curl ...). Same threat as pipe-to-shell via process/command substitution.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:(?:ba|z|da|k)?sh(?:[ \\t]+-[A-Za-z]+)*|source|eval|\\.)[ \\t]+[\"']?(?:<\\(|\\$\\()[ \\t]*(?:curl|wget)(?![A-Za-z0-9_-])",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "terraform-destroy-auto-approve",
+    "name": "terraform/tofu/terragrunt destroy with -auto-approve",
+    "description": "terraform|tofu|terragrunt with a destroy token (destroy or -destroy, so 'apply -destroy' is included) AND -auto-approve/--auto-approve, in either order. Plain 'terraform destroy' (interactive confirm; no TTY in agent shells) and plain 'terraform apply -auto-approve' are deliberately NOT matched: apply is covered by live-guard-gate, and matching all auto-approved applies would double-prompt and flag routine CI-style usage.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:terraform|tofu|terragrunt)(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]-?destroy(?![^ \\t\\r\\n;&|)]))(?=[^;&|\\n]*[ \\t]--?auto-approve(?:=[^ \\t\\r\\n;&|]*)?(?![^ \\t\\r\\n;&|)]))",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "kubectl-delete-namespace",
+    "name": "kubectl/oc delete namespace",
+    "description": "kubectl|oc ... delete [flags] namespace|namespaces|ns (also ns/<name>). Flags between delete and the resource kind are allowed (--force --grace-period=0).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+delete(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:namespaces?|ns)(?:/|,|(?![^ \\t\\r\\n;&|)]))",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "kubectl-delete-all",
+    "name": "kubectl/oc delete ... --all",
+    "description": "kubectl|oc with a delete token AND --all (or --all=true). --all-namespaces is excluded by the terminator check.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+delete(?![^ \\t\\r\\n;&|)])(?=[^;&|\\n]*[ \\t]--all(?:=[^ \\t\\r\\n;&|]*)?(?![^ \\t\\r\\n;&|)]))",
+    "flags": "",
+    "severity": "high",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "file-write-system-path",
+    "name": "File write into a system directory",
+    "description": "Anchored at path start: /etc/ /usr/ /bin/ /sbin/ /boot/ /sys/ /proc/ (leading // tolerated). Anchoring avoids matching myproject/etc/x or /home/u/usr/x, which the spec's unanchored /(etc|usr|...)/ would. The caller MUST resolve the path (path.resolve / realpath -m) first; ../../etc/passwd or symlinks are not caught by the pattern.",
+    "regex": "^/+(?:etc|usr|bin|sbin|boot|sys|proc)/",
+    "flags": "",
+    "severity": "critical",
+    "context": [
+      "file-write"
+    ]
+  }
+];