@reddb-io/red-skills 4.4.1 → 4.5.0

package/runtime/plugins/dev/hooks/command-guard.sh

@@ -0,0 +1,893 @@
+#!/usr/bin/env bash
+# Dev PreToolUse shell-command guard.
+#
+# Reads a Claude/Codex/OpenCode-style PreToolUse payload on stdin, extracts the
+# shell command, and blocks it when it matches a deny rule from .red/config.yaml:
+#
+#   command_guard:
+#     global:
+#       - "sudo *"
+#       - "rm -rf *"
+#     main:
+#       - "git rebase"
+#     worktree:
+#       - "git clean"
+#
+#   plugins:
+#     dev:
+#       enabled: true
+#
+# The hook is dormant unless plugins.dev.enabled is true. Once enabled, the dev
+# invariant is built in: agent-created git worktrees must live under .red/tmp/,
+# and branch-moving commands are blocked in the primary checkout. Missing/empty
+# deny rules still allow every other command. `global` rules apply in every
+# scope, `main` rules apply outside RedSkills runtime worktrees, and `worktree`
+# rules apply inside `/afk` and `/go` worktrees. Deny rules accept explicit
+# modes: `regex:<pattern>`, `prefix:<literal>`, `suffix:<literal>`,
+# `exact:<literal>`, and `glob:<pattern>`. Bare rules with glob metacharacters
+# are treated as globs; every other bare rule matches the exact command, a
+# command prefix, or a command suffix at a shell-command boundary.
+
+set -uo pipefail
+
+INPUT="$(timeout "${RED_SKILLS_HOOK_STDIN_TIMEOUT_S:-5s}" cat 2>/dev/null || true)"
+
+allow() {
+  printf '{}'
+  exit 0
+}
+
+deny() {
+  local reason="$1"
+  printf '%s\n' "$reason" >&2
+  jq -nc --arg reason "$reason" '{
+    decision: "block",
+    reason: $reason,
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: $reason
+    }
+  }'
+  exit 0
+}
+
+command -v jq >/dev/null 2>&1 || allow
+
+COMMAND="$(
+  jq -r '
+    def command_value:
+      .tool_input.command? //
+      .tool_input.cmd? //
+      .tool_input.args.command? //
+      .input.command? //
+      .input.cmd? //
+      .arguments.command? //
+      .arguments.cmd? //
+      .command? //
+      .cmd? //
+      empty;
+    command_value
+    | if type == "array" then map(tostring) | join(" ")
+      elif type == "string" then .
+      else ""
+      end
+  ' <<<"$INPUT" 2>/dev/null
+)"
+[[ -n "$COMMAND" && "$COMMAND" != "null" ]] || allow
+
+ROOT="$(jq -r '.cwd // .workspace.current_dir // empty' <<<"$INPUT" 2>/dev/null)"
+[[ -z "$ROOT" || "$ROOT" == "null" ]] && ROOT="${CLAUDE_PROJECT_DIR:-${CODEX_PROJECT_DIR:-}}"
+[[ -z "$ROOT" || "$ROOT" == "null" ]] && ROOT="$(pwd)"
+
+if [[ -n "$ROOT" && ! -d "$ROOT/.git" ]]; then
+  ROOT="$(git -C "$ROOT" rev-parse --show-toplevel 2>/dev/null || printf '%s' "$ROOT")"
+fi
+[[ -n "$ROOT" ]] || allow
+
+find_config() {
+  local dir="$1"
+  local i
+  for ((i = 0; i < 64; i++)); do
+    if [[ -f "$dir/.red/config.yaml" ]]; then
+      printf '%s\n' "$dir/.red/config.yaml"
+      return 0
+    fi
+    [[ "$dir" == "/" ]] && break
+    dir="$(dirname "$dir")"
+  done
+  return 1
+}
+
+CONFIG="$(find_config "$ROOT" || true)"
+[[ -n "$CONFIG" ]] || allow
+REPO_ROOT="${CONFIG%/.red/config.yaml}"
+
+trim() {
+  local s="$1"
+  s="${s#"${s%%[![:space:]]*}"}"
+  s="${s%"${s##*[![:space:]]}"}"
+  printf '%s' "$s"
+}
+
+strip_comment() {
+  local s="$1"
+  if [[ "$s" != *\"* && "$s" != *\'* ]]; then
+    s="${s%%#*}"
+  fi
+  trim "$s"
+}
+
+strip_line_comment() {
+  local s="$1"
+  if [[ "$s" != *\"* && "$s" != *\'* ]]; then
+    s="${s%%#*}"
+  fi
+  s="${s%"${s##*[![:space:]]}"}"
+  printf '%s' "$s"
+}
+
+unquote_scalar() {
+  local s
+  s="$(strip_comment "$1")"
+  local q="${s:0:1}"
+  if [[ "$q" == '"' || "$q" == "'" ]]; then
+    local rest="${s:1}"
+    local before="${rest%%"$q"*}"
+    if [[ "$rest" == *"$q"* ]]; then
+      local close_len=$((1 + ${#before} + 1))
+      local tail="${s:$close_len}"
+      if [[ "$tail" =~ ^[[:space:]]*(#.*)?$ ]]; then
+        s="${s:1:${#before}}"
+      fi
+    fi
+  fi
+  trim "$s"
+}
+
+join_stack() {
+  local joined="" item
+  for item in "${STACK[@]}"; do
+    [[ -n "$joined" ]] && joined+="."
+    joined+="$item"
+  done
+  printf '%s' "$joined"
+}
+
+read_config_scalar() {
+  local wanted="$1"
+  local -a STACK=()
+  local -a INDENTS=()
+  local raw line indent_str indent rest key value full
+
+  while IFS= read -r raw || [[ -n "$raw" ]]; do
+    raw="${raw%$'\r'}"
+    line="$(strip_line_comment "$raw")"
+    [[ -z "${line//[[:space:]]/}" ]] && continue
+    indent_str="${raw%%[![:space:]]*}"
+    indent=${#indent_str}
+    ((indent % 2 == 0)) || return 1
+    rest="${line:$indent}"
+
+    [[ "$rest" =~ ^[A-Za-z_][A-Za-z0-9_-]*: ]] || continue
+    key="${rest%%:*}"
+    value="${rest#*:}"
+    value="$(trim "$value")"
+
+    while ((${#INDENTS[@]} > 0 && INDENTS[${#INDENTS[@]} - 1] >= indent)); do
+      unset "STACK[$((${#STACK[@]} - 1))]"
+      unset "INDENTS[$((${#INDENTS[@]} - 1))]"
+    done
+
+    full="$(join_stack)"
+    [[ -n "$full" ]] && full+="."
+    full+="$key"
+
+    if [[ -z "$value" ]]; then
+      STACK+=("$key")
+      INDENTS+=("$indent")
+      continue
+    fi
+
+    if [[ "$full" == "$wanted" ]]; then
+      unquote_scalar "$value"
+      return 0
+    fi
+  done <"$CONFIG"
+
+  return 1
+}
+
+enabled="$(read_config_scalar "plugins.dev.enabled" || true)"
+[[ "$enabled" == "true" ]] || allow
+
+scope_is_command_guard_worktree() {
+  local root="$1"
+  case "$root" in
+    */.red/tmp/work-* | */.red/tmp/work-*/*) return 0 ;;
+    */.red/tmp/workers/*/worktree | */.red/tmp/workers/*/worktree/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+COMMAND_GUARD_SCOPE="main"
+scope_is_command_guard_worktree "$ROOT" && COMMAND_GUARD_SCOPE="worktree"
+
+canonical_path() {
+  local base="$1"
+  local path="$2"
+  if [[ "$path" == /* ]]; then
+    realpath -m -- "$path" 2>/dev/null || printf '%s\n' "$path"
+  else
+    realpath -m -- "$base/$path" 2>/dev/null || printf '%s/%s\n' "$base" "$path"
+  fi
+}
+
+git_subcommand_index() {
+  local -n tokens_ref="$1"
+  local git_index="$2"
+  local -n cwd_ref="$3"
+  local k=$((git_index + 1))
+  local len=${#tokens_ref[@]}
+  while ((k < len)); do
+    local tok="${tokens_ref[k]}"
+    case "$tok" in
+      -C)
+        if ((k + 1 < len)); then
+          cwd_ref="$(canonical_path "$cwd_ref" "${tokens_ref[k + 1]}")"
+        fi
+        k=$((k + 2))
+        continue
+        ;;
+      -c|--git-dir|--work-tree|--namespace|--exec-path|--super-prefix)
+        k=$((k + 2))
+        continue
+        ;;
+      --*=*|-*)
+        k=$((k + 1))
+        continue
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+  printf '%s\n' "$k"
+}
+
+skip_git_worktree_add_option() {
+  local -n tokens_ref="$1"
+  local -n index_ref="$2"
+  local len=${#tokens_ref[@]}
+  local tok="${tokens_ref[index_ref]}"
+  case "$tok" in
+    -b|-B|--orphan|--reason)
+      index_ref=$((index_ref + 2))
+      return 0
+      ;;
+    --reason=*|--orphan=*)
+      index_ref=$((index_ref + 1))
+      return 0
+      ;;
+    --detach|--checkout|--no-checkout|--guess-remote|--no-guess-remote|--force|-f|--lock)
+      index_ref=$((index_ref + 1))
+      return 0
+      ;;
+    --)
+      index_ref=$((index_ref + 1))
+      return 1
+      ;;
+    --*)
+      index_ref=$((index_ref + 1))
+      return 0
+      ;;
+    -*)
+      # Unknown short option. Treat it as a flag so the destination is still the
+      # first non-option token; if the option actually consumed an argument, the
+      # guard fails closed on a non-.red/tmp "destination".
+      index_ref=$((index_ref + 1))
+      return 0
+      ;;
+    *)
+      ((index_ref < len))
+      return 1
+      ;;
+  esac
+}
+
+worktree_add_destination() {
+  local tokens_name="$1"
+  local -n tokens_ref="$tokens_name"
+  local git_index="$2"
+  local cwd="$ROOT"
+  local s
+  s="$(git_subcommand_index "$tokens_name" "$git_index" cwd)"
+  [[ "${tokens_ref[s]:-}" == "worktree" && "${tokens_ref[s + 1]:-}" == "add" ]] || return 1
+
+  local j=$((s + 2))
+  local len=${#tokens_ref[@]}
+  while ((j < len)); do
+    if skip_git_worktree_add_option "$tokens_name" j; then
+      continue
+    fi
+    [[ -n "${tokens_ref[j]:-}" ]] || return 1
+    printf '%s\t%s\n' "$cwd" "${tokens_ref[j]}"
+    return 0
+  done
+  return 1
+}
+
+primary_branch_movement_reason() {
+  local tokens_name="$1"
+  local -n tokens_ref="$tokens_name"
+  local n=${#tokens_ref[@]}
+  local i j s sub
+
+  for ((i = 0; i < n; i++)); do
+    if [[ "${tokens_ref[i]}" == "gh" && "${tokens_ref[i + 1]:-}" == "pr" && "${tokens_ref[i + 2]:-}" == "checkout" ]]; then
+      printf 'gh pr checkout changes the primary checkout; create or reuse a .red/tmp worktree for the PR branch instead'
+      return 0
+    fi
+
+    [[ "${tokens_ref[i]}" == "git" ]] || continue
+    local cwd="$ROOT"
+    s="$(git_subcommand_index "$tokens_name" "$i" cwd)"
+    sub="${tokens_ref[s]:-}"
+    case "$sub" in
+      checkout|switch)
+        local target="" saw_doubledash=0
+        for ((j = s + 1; j < n; j++)); do
+          local t="${tokens_ref[j]}"
+          case "$t" in
+            --)
+              saw_doubledash=1
+              continue
+              ;;
+            -b|-B|-c|-C|--create|--force-create|--orphan|--track)
+              printf 'git %s creates or checks out a branch in the primary checkout; use git worktree add .red/tmp/work-<slug> -b <branch> ... instead' "$sub"
+              return 0
+              ;;
+            --create=*|--force-create=*|--orphan=*)
+              printf 'git %s creates a branch in the primary checkout; use git worktree add .red/tmp/work-<slug> -b <branch> ... instead' "$sub"
+              return 0
+              ;;
+            -*)
+              continue
+              ;;
+            *)
+              target="$t"
+              break
+              ;;
+          esac
+        done
+        ((saw_doubledash)) && continue
+        [[ -z "$target" || "$target" == "." ]] && continue
+        printf 'git %s changes the primary checkout branch; create or enter a .red/tmp worktree instead' "$sub"
+        return 0
+        ;;
+    esac
+  done
+
+  return 1
+}
+
+enforce_dev_worktree_policy() {
+  local -a tokens
+  read -ra tokens <<<"$COMMAND"
+  local n=${#tokens[@]}
+  ((n > 0)) || return 0
+
+  local i
+  for ((i = 0; i < n; i++)); do
+    [[ "${tokens[i]}" == "git" ]] || continue
+    local pair cwd dest abs allowed_root
+    pair="$(worktree_add_destination tokens "$i" || true)"
+    [[ -n "$pair" ]] || continue
+    cwd="${pair%%$'\t'*}"
+    dest="${pair#*$'\t'}"
+    abs="$(canonical_path "$cwd" "$dest")"
+    allowed_root="$(canonical_path "$REPO_ROOT" ".red/tmp")"
+    case "$abs" in
+      "$allowed_root"/*)
+        ;;
+      *)
+        deny "$(cat <<EOF
+BLOCKED by RedSkills dev worktree guard.
+plugins.dev.enabled is true, so agent-created git worktrees must live under .red/tmp/.
+
+Requested worktree path: $dest
+Resolved worktree path:  $abs
+Allowed root:            $allowed_root/
+
+Use: git worktree add .red/tmp/work-<slug> -b <branch> origin/main
+EOF
+        )"
+        ;;
+    esac
+  done
+
+  if [[ "$COMMAND_GUARD_SCOPE" == "main" ]]; then
+    local reason
+    reason="$(primary_branch_movement_reason tokens || true)"
+    if [[ -n "$reason" ]]; then
+      deny "$(cat <<EOF
+BLOCKED by RedSkills dev primary-checkout guard.
+plugins.dev.enabled is true, so agents must not create or switch branches in the primary checkout.
+
+$reason.
+EOF
+      )"
+    fi
+  fi
+}
+
+enforce_dev_worktree_policy
+
+is_gh_write_command() {
+  local upper
+  upper="$(printf '%s' "$COMMAND" | tr '[:lower:]' '[:upper:]')"
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])GH[[:space:]]+ISSUE[[:space:]]+(COMMENT|CREATE|EDIT)([[:space:]]|$) ]] && return 0
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])GH[[:space:]]+PR[[:space:]]+(COMMENT|CREATE|EDIT|REVIEW)([[:space:]]|$) ]] && return 0
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])GH[[:space:]]+RELEASE[[:space:]]+(CREATE|EDIT)([[:space:]]|$) ]] && return 0
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])GH[[:space:]]+GIST[[:space:]]+CREATE([[:space:]]|$) ]] && return 0
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])RSP[[:space:]]+GH[[:space:]]+ISSUE[[:space:]]+(COMMENT|CREATE|EDIT)([[:space:]]|$) ]] && return 0
+  [[ "$upper" =~ (^|[[:space:]\;\&\|])RSP[[:space:]]+GH[[:space:]]+PR[[:space:]]+(COMMENT|CREATE|EDIT|REVIEW)([[:space:]]|$) ]] && return 0
+  return 1
+}
+
+has_gh_body_home_path() {
+  [[ "$COMMAND" =~ (^|[[:space:]])(--body|-b)(=|[[:space:]]+).*(/home/[^[:space:]\'\"]+|/Users/[^[:space:]\'\"]+) ]]
+}
+
+has_sensitive_assignment() {
+  local upper
+  upper="$(printf '%s' "$COMMAND" | tr '[:lower:]' '[:upper:]')"
+  [[ "$upper" =~ [A-Z0-9_]*(TOKEN|SECRET|PASSWORD|APIKEY|API_KEY|API-KEY)[A-Z0-9_-]*=[^[:space:]\'\"]+ ]]
+}
+
+enforce_no_leak_gh_write_policy() {
+  is_gh_write_command || return 0
+  local reason=""
+  if [[ "$COMMAND" == *"claude.ai/code/session_"* ]]; then
+    reason="Claude session link"
+  elif has_gh_body_home_path; then
+    reason="absolute home path in gh body text"
+  elif has_sensitive_assignment; then
+    reason="sensitive KEY=value assignment"
+  fi
+
+  [[ -n "$reason" ]] || return 0
+  deny "$(cat <<EOF
+BLOCKED by RedSkills no-leak command guard.
+The gh write command contains a public-output leak pattern: $reason.
+
+Redact and retry. Use placeholders such as [REDACTED_HOME], [REDACTED_SECRET], or [REDACTED_CLAUDE_SESSION] when the reference is unavoidable.
+EOF
+  )"
+}
+
+enforce_no_leak_gh_write_policy
+
+# Returns the filename component if path targets the .red/tmp/ root directly
+# (no named-lane subdirectory after the root).  Returns nothing otherwise.
+tmp_root_blocked_path() {
+  local raw="$1"
+  local s="$raw"
+  [[ "$s" == \'* ]] && s="${s:1}" && s="${s%\'}"
+  [[ "$s" == \"* ]] && s="${s:1}" && s="${s%\"}"
+  local rel
+  case "$s" in
+    "$REPO_ROOT/.red/tmp/"*)
+      rel="${s#$REPO_ROOT/.red/tmp/}"
+      ;;
+    ".red/tmp/"*)
+      rel="${s#.red/tmp/}"
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+  [[ -n "$rel" && "$rel" != */* ]] || return 1
+  printf '%s' "$rel"
+}
+
+deny_tmp_root_write() {
+  local path="$1"
+  deny "$(cat <<EOF
+BLOCKED by RedSkills tmp-root write guard.
+plugins.dev.enabled is true, so files must not be created directly at .red/tmp/.
+
+Requested path: $path
+Correct lanes:  .red/tmp/logs/<YYYY-MM-DD>/ for session logs
+                .red/tmp/scratch/ for ad-hoc scratch files
+
+Write to the appropriate named lane instead.
+EOF
+  )"
+}
+
+enforce_tmp_root_write_policy() {
+  local -a tokens
+  read -ra tokens <<<"$COMMAND"
+  local n=${#tokens[@]}
+  ((n > 0)) || return 0
+
+  local i j leaf
+
+  for ((i = 0; i < n; i++)); do
+    local tok="${tokens[i]}"
+    local redir_target=""
+
+    # Standalone or concatenated redirection operators
+    case "$tok" in
+      '>'|'>>'|[0-9]'>'|[0-9]'>>'|'&>'|'&>>')
+        redir_target="${tokens[i+1]:-}"
+        ;;
+      '>'?*|'>>'?*)
+        if [[ "$tok" == '>>'* ]]; then
+          redir_target="${tok#>>}"
+        else
+          redir_target="${tok#>}"
+        fi
+        ;;
+      [0-9]'>'?*|[0-9]'>>'?*)
+        local re_fd_append='^[0-9]+>>(.+)'
+        local re_fd_write='^[0-9]+>(.+)'
+        if [[ "$tok" =~ $re_fd_append ]]; then
+          redir_target="${BASH_REMATCH[1]}"
+        elif [[ "$tok" =~ $re_fd_write ]]; then
+          redir_target="${BASH_REMATCH[1]}"
+        fi
+        ;;
+      '&>'?*|'&>>'?*)
+        if [[ "$tok" == '&>>'* ]]; then
+          redir_target="${tok#&>>}"
+        else
+          redir_target="${tok#&>}"
+        fi
+        ;;
+    esac
+
+    if [[ -n "$redir_target" ]]; then
+      leaf="$(tmp_root_blocked_path "$redir_target" || true)"
+      [[ -n "$leaf" ]] && deny_tmp_root_write "$redir_target"
+    fi
+
+    # File-creating commands: touch, tee, cp, mv
+    case "$tok" in
+      touch|tee)
+        for ((j = i + 1; j < n; j++)); do
+          local arg="${tokens[j]}"
+          case "$arg" in '>'|'>>'|'|'|'&&'|'||'|';') break ;; esac
+          [[ "${arg:0:1}" == "-" ]] && continue
+          leaf="$(tmp_root_blocked_path "$arg" || true)"
+          [[ -n "$leaf" ]] && deny_tmp_root_write "$arg"
+        done
+        ;;
+      cp|mv)
+        local -a positional=()
+        for ((j = i + 1; j < n; j++)); do
+          local arg="${tokens[j]}"
+          case "$arg" in '>'|'>>'|'|'|'&&'|'||'|';') break ;; esac
+          [[ "${arg:0:1}" == "-" ]] && continue
+          positional+=("$arg")
+        done
+        if [[ ${#positional[@]} -ge 2 ]]; then
+          local dest="${positional[${#positional[@]}-1]}"
+          leaf="$(tmp_root_blocked_path "$dest" || true)"
+          [[ -n "$leaf" ]] && deny_tmp_root_write "$dest"
+        fi
+        ;;
+    esac
+  done
+}
+
+enforce_tmp_root_write_policy
+
+strip_path_token() {
+  local s="$1"
+  [[ "$s" == \'* ]] && s="${s:1}" && s="${s%\'}"
+  [[ "$s" == \"* ]] && s="${s:1}" && s="${s%\"}"
+  printf '%s' "$s"
+}
+
+pid_file_live() {
+  local pid_file="$1" raw
+  [[ -f "$pid_file" ]] || return 1
+  raw="$(tr -d '[:space:]' <"$pid_file" 2>/dev/null || true)"
+  [[ "$raw" =~ ^[1-9][0-9]*$ ]] || return 1
+  kill -0 "$raw" 2>/dev/null
+}
+
+supervisor_delete_reason() {
+  local abs="$1" dir
+  for dir in \
+    "$(canonical_path "$REPO_ROOT" ".red/state/afk")" \
+    "$(canonical_path "$REPO_ROOT" ".red/tmp")"
+  do
+    case "$abs" in
+      "$dir"/afk-supervisor.*|"$dir")
+        if pid_file_live "$dir/afk-supervisor.pid"; then
+          printf 'refusing to delete live supervisor artifacts under %s' "$dir"
+          return 0
+        fi
+        ;;
+    esac
+  done
+  return 1
+}
+
+worker_delete_reason() {
+  local abs="$1" tmp_root ns prefix rel worker worker_dir
+  tmp_root="$(canonical_path "$REPO_ROOT" ".red/tmp")"
+  for ns in workers go-workers scout-workers; do
+    prefix="$tmp_root/$ns/"
+    case "$abs" in
+      "$prefix"*)
+        rel="${abs#$prefix}"
+        worker="${rel%%/*}"
+        [[ -n "$worker" ]] || continue
+        worker_dir="$prefix$worker"
+        if pid_file_live "$worker_dir/worker.pid"; then
+          printf 'refusing to delete live worker artifacts under %s' "$worker_dir"
+          return 0
+        fi
+        ;;
+    esac
+  done
+  return 1
+}
+
+delete_target_reason() {
+  local raw="$1" s abs tmp_root rel reason
+  s="$(strip_path_token "$raw")"
+  [[ -n "$s" ]] || return 1
+  abs="$(canonical_path "$ROOT" "$s")"
+  tmp_root="$(canonical_path "$REPO_ROOT" ".red/tmp")"
+
+  if [[ "$abs" == "$tmp_root" ]]; then
+    printf 'refusing to delete the .red/tmp root'
+    return 0
+  fi
+
+  case "$abs" in
+    "$tmp_root"/*)
+      rel="${abs#$tmp_root/}"
+      if [[ "$rel" == "*" ]]; then
+        printf 'refusing to delete every entry under .red/tmp'
+        return 0
+      fi
+      ;;
+  esac
+
+  reason="$(supervisor_delete_reason "$abs" || true)"
+  if [[ -n "$reason" ]]; then
+    printf '%s' "$reason"
+    return 0
+  fi
+
+  reason="$(worker_delete_reason "$abs" || true)"
+  if [[ -n "$reason" ]]; then
+    printf '%s' "$reason"
+    return 0
+  fi
+
+  return 1
+}
+
+deny_tmp_delete() {
+  local path="$1" reason="$2"
+  deny "$(cat <<EOF
+BLOCKED by RedSkills tmp deletion guard.
+plugins.dev.enabled is true, so cleanup commands must delete a named lane under .red/tmp/, not the tmp root or live liveness anchors.
+
+Requested path: $path
+Reason: $reason
+
+Target a specific owned lane or stop the live supervisor/worker before removing its anchors.
+EOF
+  )"
+}
+
+enforce_tmp_delete_policy() {
+  local -a tokens
+  read -ra tokens <<<"$COMMAND"
+  local n=${#tokens[@]}
+  ((n > 0)) || return 0
+
+  local i j arg reason
+  for ((i = 0; i < n; i++)); do
+    case "${tokens[i]}" in
+      rm|/bin/rm|/usr/bin/rm)
+        for ((j = i + 1; j < n; j++)); do
+          arg="${tokens[j]}"
+          case "$arg" in '>'|'>>'|'|'|'&&'|'||'|';') break ;; esac
+          [[ "$arg" == -- ]] && continue
+          [[ "${arg:0:1}" == "-" ]] && continue
+          reason="$(delete_target_reason "$arg" || true)"
+          [[ -n "$reason" ]] && deny_tmp_delete "$arg" "$reason"
+        done
+        ;;
+    esac
+  done
+}
+
+enforce_tmp_delete_policy
+
+guard_scope_for_path() {
+  local path="$1"
+  case "$path" in
+    command_guard.global | \
+      command_guard.deny | \
+      plugins.dev.command_guard.global | \
+      plugins.dev.command_guard.deny | \
+      dev.command_guard.global | \
+      dev.command_guard.deny)
+      printf 'global'
+      ;;
+    command_guard.main | plugins.dev.command_guard.main | dev.command_guard.main)
+      printf 'main'
+      ;;
+    command_guard.worktree | plugins.dev.command_guard.worktree | dev.command_guard.worktree)
+      printf 'worktree'
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+emit_deny_pattern() {
+  local path="$1"
+  local raw_value="$2"
+  local scope item
+  scope="$(guard_scope_for_path "$path" || true)"
+  [[ -n "$scope" ]] || return 0
+  [[ "$scope" == "global" || "$scope" == "$COMMAND_GUARD_SCOPE" ]] || return 0
+  item="$(unquote_scalar "$raw_value")"
+  [[ -n "$item" ]] && printf '%s\t%s\n' "$scope" "$item"
+}
+
+read_deny_patterns() {
+  local -a STACK=()
+  local -a INDENTS=()
+  local raw line indent_str indent rest parent key value full
+
+  while IFS= read -r raw || [[ -n "$raw" ]]; do
+    raw="${raw%$'\r'}"
+    line="$(strip_line_comment "$raw")"
+    [[ -z "${line//[[:space:]]/}" ]] && continue
+    indent_str="${raw%%[![:space:]]*}"
+    indent=${#indent_str}
+    ((indent % 2 == 0)) || return 0
+    rest="${line:$indent}"
+
+    while ((${#INDENTS[@]} > 0 && INDENTS[${#INDENTS[@]} - 1] >= indent)); do
+      unset "STACK[$((${#STACK[@]} - 1))]"
+      unset "INDENTS[$((${#INDENTS[@]} - 1))]"
+    done
+
+    if [[ "$rest" =~ ^-([[:space:]]|$) ]]; then
+      parent="$(join_stack)"
+      emit_deny_pattern "$parent" "${rest#-}"
+      continue
+    fi
+
+    [[ "$rest" =~ ^[A-Za-z_][A-Za-z0-9_-]*: ]] || continue
+    key="${rest%%:*}"
+    value="${rest#*:}"
+    value="$(trim "$value")"
+    full="$(join_stack)"
+    [[ -n "$full" ]] && full+="."
+    full+="$key"
+
+    if [[ -z "$value" ]]; then
+      STACK+=("$key")
+      INDENTS+=("$indent")
+      continue
+    fi
+
+    emit_deny_pattern "$full" "$value"
+  done <"$CONFIG"
+}
+
+has_leading_command_boundary() {
+  local value="$1"
+  local first="${value:0:1}"
+  [[ -z "$value" ||
+    "$first" == ";" ||
+    "$first" == "&" ||
+    "$first" == "|" ||
+    "$first" =~ [[:space:]] ]]
+}
+
+has_trailing_command_boundary() {
+  local value="$1"
+  local last="${value: -1}"
+  [[ -z "$value" ||
+    "$last" == ";" ||
+    "$last" == "&" ||
+    "$last" == "|" ||
+    "$last" =~ [[:space:]] ]]
+}
+
+matches_rule() {
+  local command="$1"
+  local rule="$2"
+  local mode="" pattern="$rule"
+  case "$rule" in
+    regex:*|re:*)
+      pattern="${rule#*:}"
+      [[ -n "$pattern" && "$command" =~ $pattern ]]
+      return
+      ;;
+    prefix:*)
+      mode="prefix"
+      pattern="${rule#prefix:}"
+      ;;
+    suffix:*)
+      mode="suffix"
+      pattern="${rule#suffix:}"
+      ;;
+    exact:*)
+      mode="exact"
+      pattern="${rule#exact:}"
+      ;;
+    glob:*)
+      mode="glob"
+      pattern="${rule#glob:}"
+      ;;
+  esac
+
+  local left right
+  case "$mode" in
+    prefix)
+      right="${command#"$pattern"}"
+      [[ "$right" != "$command" ]] && has_leading_command_boundary "$right"
+      return
+      ;;
+    suffix)
+      left="${command%"$pattern"}"
+      [[ "$left" != "$command" ]] && has_trailing_command_boundary "$left"
+      return
+      ;;
+    exact)
+      [[ "$command" == "$pattern" ]]
+      return
+      ;;
+    glob)
+      [[ "$command" == $pattern ]]
+      return
+      ;;
+  esac
+
+  case "$rule" in
+    *[\*\?\[]*)
+      [[ "$command" == $rule ]]
+      ;;
+    *)
+      if [[ "$command" == "$rule" ]]; then
+        return 0
+      fi
+      right="${command#"$rule"}"
+      left="${command%"$rule"}"
+      ([[ "$right" != "$command" ]] && has_leading_command_boundary "$right") ||
+        ([[ "$left" != "$command" ]] && has_trailing_command_boundary "$left")
+      ;;
+  esac
+}
+
+while IFS=$'\t' read -r rule_scope rule; do
+  [[ -n "$rule" ]] || continue
+  if matches_rule "$COMMAND" "$rule"; then
+    deny "$(cat <<EOF
+BLOCKED by RedSkills command guard.
+The command '$COMMAND' matched command_guard.$rule_scope rule '$rule' from .red/config.yaml.
+
+Remove or narrow command_guard.$rule_scope if this command is intentional.
+EOF
+    )"
+  fi
+done < <(read_deny_patterns)
+
+allow