@sriinnu/omit 0.3.0

package/bin/omit.mjs

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+// omit CLI: provider-neutral enforcement. Claude Code hooks, git pre-commit,
+// CI, and any other agent's hook system all call the same commands.
+//
+//   omit init [agents|claude|cursor|cline|windsurf|all]   copy rule files into this repo
+//   omit audit [--base <ref>] [--json|--markdown]         net diff, new deps, hazards, score
+//   omit check <file...>                                  hazard-scan specific files
+//   omit gate                                             audit the staged diff; fail on hazards/uncited deps
+//   omit hook install                                     add the gate to .git/hooks/pre-commit
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs'
+import { execSync } from 'node:child_process'
+import { basename, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { isManifest, addedDeps } from '../lib/deps.mjs'
+import { findHazards } from '../lib/hazards.mjs'
+import { lintFiles } from '../lib/lint.mjs'
+import { assessCommand } from '../lib/danger.mjs'
+
+const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
+const git = (args) => execSync(`git ${args}`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+
+// ---------- init ----------
+const targets = {
+  agents: [['AGENTS.md', 'AGENTS.md']],
+  claude: [[join('skills', 'omit', 'SKILL.md'), join('.claude', 'skills', 'omit', 'SKILL.md')]],
+  cursor: [[join('.cursor', 'rules', 'omit.mdc'), join('.cursor', 'rules', 'omit.mdc')]],
+  cline: [[join('.clinerules', 'omit.md'), join('.clinerules', 'omit.md')]],
+  windsurf: [[join('.windsurf', 'rules', 'omit.md'), join('.windsurf', 'rules', 'omit.md')]],
+  copilot: [[join('.github', 'copilot-instructions.md'), join('.github', 'copilot-instructions.md')]],
+}
+targets.codex = targets.agents // Codex reads AGENTS.md
+targets.takumi = targets.agents // Takumi reads AGENTS.md
+targets.all = [...new Set(Object.values(targets).flat())]
+
+function init(pick = 'agents') {
+  if (!targets[pick]) {
+    console.error(`usage: omit init [${Object.keys(targets).join('|')}]   (default: agents)`)
+    process.exit(1)
+  }
+  for (const [src, dest] of targets[pick]) {
+    if (existsSync(dest)) {
+      console.log(`skip  ${dest} (already exists: will not overwrite)`)
+      continue
+    }
+    mkdirSync(dirname(dest), { recursive: true })
+    copyFileSync(join(pkgRoot, src), dest)
+    console.log(`wrote ${dest}`)
+  }
+  console.log('\nDraft less. Cite everything. Cut last.')
+}
+
+// ---------- audit / gate ----------
+function collect(diffRange) {
+  const numstat = git(`diff --numstat ${diffRange}`).split('\n').filter(Boolean)
+  const files = []
+  let added = 0
+  let deleted = 0
+  for (const row of numstat) {
+    const [a, d, path] = row.split('\t')
+    if (a === '-') continue // binary
+    files.push({ path, added: +a, deleted: +d })
+    added += +a
+    deleted += +d
+  }
+
+  const newDeps = []
+  for (const f of files.filter((f) => isManifest(f.path))) {
+    const diff = git(`diff ${diffRange} -- "${f.path}"`)
+    newDeps.push(...addedDeps(basename(f.path), diff).map((dep) => ({ dep, manifest: f.path })))
+  }
+
+  const fullDiff = git(`diff ${diffRange}`)
+  const addedLines = fullDiff.split('\n').filter((l) => l.startsWith('+') && !l.startsWith('+++')).map((l) => l.slice(1))
+  const hazards = findHazards(addedLines)
+  const footnotes = addedLines.filter((l) => /omitted:/.test(l)).length
+  const loadBearing = addedLines.filter((l) => /load-bearing:/.test(l)).length
+
+  let receipts = ''
+  if (existsSync('.omit/receipts.jsonl')) receipts = readFileSync('.omit/receipts.jsonl', 'utf8')
+  const uncitedDeps = newDeps.filter((d) => !receipts.includes(d.dep))
+
+  const lint = lintFiles(process.cwd(), files.map((f) => f.path).filter((p) => existsSync(p)))
+
+  return { files, added, deleted, net: added - deleted, newDeps, uncitedDeps, hazards, footnotes, loadBearing, lint }
+}
+
+function scoreOf(r) {
+  let s = 100
+  if (r.net > 0) s -= Math.min(30, Math.round(r.net / 25))
+  s -= 15 * r.newDeps.length
+  s -= Math.min(40, 25 * r.hazards.filter((h) => h.type === 'secret').length + 10 * r.hazards.filter((h) => h.type === 'injection').length)
+  s += Math.min(10, 2 * r.footnotes)
+  s -= Math.min(20, 10 * r.files.filter((f) => f.added > 300).length)
+  s -= Math.min(20, 10 * (r.lint ?? []).filter((l) => !l.ok).length)
+  return Math.max(0, Math.min(100, s))
+}
+
+function render(r, fmt) {
+  const score = scoreOf(r)
+  const light = score >= 85 ? '🟢' : score >= 60 ? '🟡' : '🔴'
+  if (fmt === 'json') return JSON.stringify({ ...r, score }, null, 2)
+  const rows = [
+    `net: +${r.added} −${r.deleted} lines across ${r.files.length} file${r.files.length === 1 ? '' : 's'}`,
+    `new deps: ${r.newDeps.length}${r.newDeps.length ? ': ' + r.newDeps.map((d) => d.dep).join(', ') : ' ✅'}${r.uncitedDeps.length ? ` (${r.uncitedDeps.length} without receipts ⚠)` : ''}`,
+    `hazards: ${r.hazards.length === 0 ? '0 ✅' : r.hazards.map((h) => `${h.type}:${h.rule}`).join(', ') + ' ⛔'}`,
+    `footnotes: ${r.footnotes} recorded · load-bearing: ${r.loadBearing} marked`,
+    `lint: ${!r.lint || r.lint.length === 0 ? 'no linter configured' : r.lint.every((l) => l.ok) ? r.lint.map((l) => l.linter).join(', ') + ' ✅' : r.lint.filter((l) => !l.ok).map((l) => l.linter).join(', ') + ' failing ⛔'}`,
+    `omit score: ${score}/100 ${light}`,
+  ]
+  if (fmt === 'markdown') return `### omit verdict\n\n${rows.map((x) => `- ${x}`).join('\n')}\n`
+  return `omit verdict\n────────────\n${rows.join('\n')}`
+}
+
+function audit(args) {
+  const baseIdx = args.indexOf('--base')
+  const base = baseIdx !== -1 ? args[baseIdx + 1] : 'HEAD'
+  const fmt = args.includes('--json') ? 'json' : args.includes('--markdown') ? 'markdown' : 'text'
+  console.log(render(collect(base), fmt))
+}
+
+function gate() {
+  const r = collect('--cached')
+  console.log(render(r, 'text'))
+  const secrets = r.hazards.filter((h) => h.type === 'secret')
+  if (secrets.length) {
+    console.error(`\n⛔ omit gate: ${secrets.length} secret(s) staged. Move to env/secrets manager, rotate if real, restage.`)
+    process.exit(1)
+  }
+  if (r.uncitedDeps.length) {
+    console.error(`\n⛔ omit gate: new dep(s) without receipts: ${r.uncitedDeps.map((d) => d.dep).join(', ')}. Append citations to .omit/receipts.jsonl or drop them.`)
+    process.exit(1)
+  }
+  if (r.hazards.length) {
+    console.error(`\n⚠ omit gate: injection-prone lines staged. Parameterize, use safe APIs, or mark reviewed lines with omit-allow: <reason>.`)
+    process.exit(1)
+  }
+  const lintFails = (r.lint ?? []).filter((l) => !l.ok)
+  if (lintFails.length) {
+    console.error(`\n⛔ omit gate: the repo's own linter is failing on staged files.\n${lintFails.map((l) => `[${l.linter}]\n${l.output}`).join('\n')}`)
+    process.exit(1)
+  }
+}
+
+function check(files) {
+  if (!files.length) {
+    console.error('usage: omit check <file...>')
+    process.exit(1)
+  }
+  let bad = false
+  for (const f of files) {
+    const findings = findHazards(readFileSync(f, 'utf8').split('\n'))
+    for (const h of findings) {
+      console.log(`${f}:${h.line}  ${h.type}  [${h.rule}]  ${h.text}`)
+      bad = true
+    }
+  }
+  process.exit(bad ? 1 : 0)
+}
+
+function lint(files) {
+  if (!files.length) {
+    files = git('diff --name-only HEAD').split('\n').filter(Boolean)
+    try {
+      files.push(...git('ls-files --others --exclude-standard').split('\n').filter(Boolean))
+    } catch {}
+    files = files.filter((f) => existsSync(f))
+  }
+  const results = lintFiles(process.cwd(), files)
+  if (results.length === 0) {
+    console.log('omit lint: no configured linter applies to these files')
+    return
+  }
+  for (const r of results) console.log(`[${r.linter}] ${r.ok ? 'pass ✅' : `fail ⛔\n${r.output}`}`)
+  process.exit(results.some((r) => !r.ok) ? 1 : 0)
+}
+
+function guard(args) {
+  const command = args.join(' ')
+  if (!command) {
+    console.error('usage: omit guard "<shell command>"')
+    process.exit(1)
+  }
+  const findings = assessCommand(command)
+  if (findings.length === 0) {
+    console.log('ok')
+    return
+  }
+  for (const f of findings) console.error(`[${f.rule}] ${f.reason}`)
+  process.exit(1)
+}
+
+function hookInstall() {
+  const hookPath = join('.git', 'hooks', 'pre-commit')
+  if (!existsSync('.git')) {
+    console.error('omit: not a git repository')
+    process.exit(1)
+  }
+  if (existsSync(hookPath) && readFileSync(hookPath, 'utf8').includes('omit gate')) {
+    console.log('skip  pre-commit gate already installed')
+    return
+  }
+  const line = '\nnpx -y @sriinnu/omit gate || exit 1\n'
+  if (existsSync(hookPath)) {
+    writeFileSync(hookPath, readFileSync(hookPath, 'utf8') + line)
+  } else {
+    writeFileSync(hookPath, '#!/bin/sh' + line)
+  }
+  chmodSync(hookPath, 0o755)
+  console.log('wrote .git/hooks/pre-commit: every commit now passes the omit gate, whatever agent wrote it')
+}
+
+// ---------- dispatch ----------
+const [cmd, ...rest] = process.argv.slice(2)
+if (cmd === 'audit') audit(rest)
+else if (cmd === 'gate') gate()
+else if (cmd === 'check') check(rest)
+else if (cmd === 'lint') lint(rest)
+else if (cmd === 'guard') guard(rest)
+else if (cmd === 'hook' && rest[0] === 'install') hookInstall()
+else if (cmd === 'init') init(rest[0])
+else if (targets[cmd]) init(cmd) // back-compat: `omit cursor`
+else {
+  console.error('usage: omit <init|audit|check|gate|lint|guard|hook install>')
+  process.exit(cmd ? 1 : 0)
+}

package/hooks/command-sentinel.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+// PreToolUse hook: assesses shell commands BEFORE they execute and blocks the
+// classic agent disasters (recursive deletes of home/system paths, deletes
+// through unset variables, disk overwrites). The user's machine is load-bearing.
+import { readFileSync } from 'node:fs'
+import { assessCommand } from '../lib/danger.mjs'
+
+if (process.env.OMIT_OFF === '1') process.exit(0)
+
+let data
+try {
+  data = JSON.parse(readFileSync(0, 'utf8'))
+} catch {
+  process.exit(0)
+}
+
+const command = data.tool_input?.command
+if (!command) process.exit(0)
+
+const findings = assessCommand(command)
+if (findings.length === 0) process.exit(0)
+
+console.error(
+  'omit blocks this command: the machine is load-bearing.\n' +
+    findings.map((f) => `  [${f.rule}] ${f.reason}`).join('\n') +
+    '\nUse a narrower target inside the workspace, guard variables with ${VAR:?}, ' +
+    'or, only after genuine review with the user, append: # omit-allow: <reason>'
+)
+process.exit(2)

package/hooks/dep-sentinel.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// PostToolUse hook: raises a blocking objection when a new dependency lands
+// in a manifest without a receipt in .omit/receipts.jsonl.
+import { readFileSync, existsSync } from 'node:fs'
+import { execSync } from 'node:child_process'
+import { basename, join } from 'node:path'
+import { isManifest, addedDeps } from '../lib/deps.mjs'
+
+if (process.env.OMIT_OFF === '1') process.exit(0)
+
+let data
+try {
+  data = JSON.parse(readFileSync(0, 'utf8'))
+} catch {
+  process.exit(0)
+}
+
+const file = data.tool_input?.file_path
+if (!file || !isManifest(file)) process.exit(0)
+
+const cwd = data.cwd ?? process.cwd()
+let diff = ''
+try {
+  diff = execSync(`git diff HEAD -- "${file}"`, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+} catch {
+  process.exit(0) // not a git repo: nothing to compare against
+}
+
+const deps = addedDeps(basename(file), diff)
+if (deps.length === 0) process.exit(0)
+
+let receipts = ''
+const ledger = join(cwd, '.omit', 'receipts.jsonl')
+if (existsSync(ledger)) receipts = readFileSync(ledger, 'utf8')
+
+const uncited = deps.filter((d) => !receipts.includes(d))
+if (uncited.length === 0) process.exit(0)
+
+console.error(
+  `omit objects: new dependenc${uncited.length > 1 ? 'ies' : 'y'} with no receipt: ${uncited.join(', ')}.\n` +
+    `Omissions 2-5 come first: show the codebase, stdlib, platform, and installed deps cannot cover this.\n` +
+    `If they truly cannot, append the citation to .omit/receipts.jsonl ` +
+    `({"claim":"new dep ${uncited[0]} required","receipt":"<what you verified>","rung":7}) and re-apply. Otherwise revert the manifest change.`
+)
+process.exit(2)

package/hooks/final-draft-gate.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// Stop hook: the turn may not end with an edited working tree and no Final Draft.
+// The deletion pass is a gate, not a suggestion.
+import { readFileSync, statSync, existsSync } from 'node:fs'
+import { execSync } from 'node:child_process'
+import { join } from 'node:path'
+
+if (process.env.OMIT_OFF === '1') process.exit(0)
+
+let data = {}
+try {
+  data = JSON.parse(readFileSync(0, 'utf8'))
+} catch {}
+if (data.stop_hook_active) process.exit(0) // never loop the gate
+
+const cwd = data.cwd ?? process.cwd()
+let changed = []
+try {
+  changed = execSync('git status --porcelain', { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+    .split('\n')
+    .filter(Boolean)
+    .map((l) => l.slice(3).replace(/^.*-> /, ''))
+    .filter((p) => !p.startsWith('.omit/'))
+} catch {
+  process.exit(0)
+}
+// omitted: distinguishing this session's edits from pre-existing dirt: git has no
+// session concept; set OMIT_OFF=1 in dirty-tree workflows until a marker file lands.
+if (changed.length === 0) process.exit(0)
+
+const draft = join(cwd, '.omit', 'final-draft.md')
+if (existsSync(draft)) {
+  const draftTime = statSync(draft).mtimeMs
+  const newestEdit = Math.max(
+    ...changed.map((p) => {
+      try {
+        return statSync(join(cwd, p)).mtimeMs
+      } catch {
+        return 0 // deleted file: cannot be newer than the draft
+      }
+    })
+  )
+  if (draftTime >= newestEdit) process.exit(0)
+}
+
+console.error(
+  'omit: the working tree changed but there is no current Final Draft.\n' +
+    'Working code is a first draft. Edit your own diff once (dead branches, unused params/imports, ' +
+    'speculative options, restating comments, single-caller indirection), then write the net report to ' +
+    '.omit/final-draft.md: files touched, lines +/-, new dependencies, footnotes recorded. Then finish.'
+)
+process.exit(2)

package/hooks/hazard-sentinel.mjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+// PostToolUse hook: blocks hardcoded secrets and injection-prone patterns
+// the moment they land in an edited file. Load-bearing lines are never cut -
+// and hazards are never shipped.
+import { readFileSync, existsSync } from 'node:fs'
+import { execSync } from 'node:child_process'
+import { basename, join } from 'node:path'
+import { findHazards } from '../lib/hazards.mjs'
+
+if (process.env.OMIT_OFF === '1') process.exit(0)
+
+let data
+try {
+  data = JSON.parse(readFileSync(0, 'utf8'))
+} catch {
+  process.exit(0)
+}
+
+const file = data.tool_input?.file_path
+if (!file) process.exit(0)
+const name = basename(file)
+if (name.endsWith('.lock') || name === 'package-lock.json' || file.includes(`${'.omit'}/`)) process.exit(0)
+
+const cwd = data.cwd ?? process.cwd()
+
+// Scan only what this edit added: the diff for tracked files, the whole file if untracked.
+let addedLines = []
+try {
+  const diff = execSync(`git diff HEAD -- "${file}"`, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+  if (diff) {
+    addedLines = diff.split('\n').filter((l) => l.startsWith('+') && !l.startsWith('+++')).map((l) => l.slice(1))
+  }
+} catch {}
+if (addedLines.length === 0 && existsSync(join(cwd, file).length > 0 ? file : file)) {
+  try {
+    addedLines = readFileSync(file, 'utf8').split('\n')
+  } catch {
+    process.exit(0)
+  }
+}
+
+const findings = findHazards(addedLines)
+if (findings.length === 0) process.exit(0)
+
+const secrets = findings.filter((f) => f.type === 'secret')
+const injections = findings.filter((f) => f.type === 'injection')
+
+let msg = 'omit objects: hazards in this edit:\n'
+for (const f of secrets) msg += `  SECRET  [${f.rule}] ${f.text}\n`
+for (const f of injections) msg += `  INJECT  [${f.rule}] ${f.text}\n`
+msg += secrets.length
+  ? 'Secrets never ship: move them to environment variables or a secrets manager and rotate any real key that was just written.\n'
+  : ''
+msg += injections.length
+  ? 'Injection-prone patterns need parameterized queries, safe APIs, or an explicit reviewed `omit-allow: <reason>` on the line.\n'
+  : ''
+console.error(msg.trimEnd())
+process.exit(2)

package/hooks/hooks.json

@@ -0,0 +1,45 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/command-sentinel.mjs\""
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/dep-sentinel.mjs\""
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hazard-sentinel.mjs\""
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/lint-sentinel.mjs\""
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/final-draft-gate.mjs\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/lint-sentinel.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// PostToolUse hook: runs the repo's OWN linter on the file just edited and
+// objects immediately on errors. omit brings no lint rules of its own.
+import { readFileSync } from 'node:fs'
+import { lintFiles } from '../lib/lint.mjs'
+
+if (process.env.OMIT_OFF === '1') process.exit(0)
+
+let data
+try {
+  data = JSON.parse(readFileSync(0, 'utf8'))
+} catch {
+  process.exit(0)
+}
+
+const file = data.tool_input?.file_path
+if (!file) process.exit(0)
+
+const cwd = data.cwd ?? process.cwd()
+const failing = lintFiles(cwd, [file]).filter((r) => !r.ok)
+if (failing.length === 0) process.exit(0)
+
+console.error(
+  `omit: the linter this repo already configured objects (omission 2: use what exists).\n` +
+    failing.map((r) => `[${r.linter}]\n${r.output}`).join('\n') +
+    `\nFix these now; do not restate or suppress them.`
+)
+process.exit(2)

package/lib/danger.mjs

@@ -0,0 +1,80 @@
+// Destructive-command detection: the user's machine is load-bearing.
+// Blocks the classic agent disasters before they execute: recursive deletes of
+// home/system/drive roots, deletes through unset variables, disk overwrites.
+// Suppress a reviewed command by appending: # omit-allow: <reason>
+
+const PROTECTED_TARGETS = [
+  /^\/+$/, // filesystem root
+  /^~[\\/]?$/,
+  /^\$HOME[\\/]?$/,
+  /^\$\{HOME\}[\\/]?$/,
+  /^%USERPROFILE%[\\/]?$/i,
+  /^\$env:USERPROFILE[\\/]?$/i,
+  /^[a-z]:[\\/]*$/i, // drive root
+  /^[\\/](home|root|etc|usr|bin|sbin|boot|var|opt|users)[\\/]?$/i,
+  /^[\\/](home|users)[\\/][^\\/]+[\\/]?$/i, // a user's home dir
+  /^[a-z]:[\\/](users|windows|program files( \(x86\))?)[\\/]?$/i,
+  /^[a-z]:[\\/]users[\\/][^\\/]+[\\/]?$/i, // a Windows profile
+]
+
+const CWD_WIPE = /^(\*|\.|\.\/|\.\\)$/
+
+const isProtected = (t) => PROTECTED_TARGETS.some((re) => re.test(stripQuotes(t)))
+const stripQuotes = (t) => t.replace(/^['"]|['"]$/g, '')
+
+// unresolved variable at the head of a delete target: `rm -rf $OUT/*` nukes / when $OUT is empty
+const VARIABLE_HEAD = /^['"]?(\$\{?\w+\}?|%\w+%|\$env:\w+)['"]?([\\/].*)?$/
+
+function deleteTargets(segment) {
+  const words = segment.trim().split(/\s+/)
+  if (words[0] === 'sudo') words.shift()
+  const cmd = (words[0] ?? '').toLowerCase().replace(/\.exe$/, '')
+  let recursive = false
+  let targets = []
+
+  if (['rm'].includes(cmd)) {
+    const flags = words.filter((w) => w.startsWith('-'))
+    recursive = flags.some((f) => /^-[a-z]*r/i.test(f) || f === '--recursive')
+    if (flags.includes('--no-preserve-root')) return { recursive: true, targets: ['/'], noPreserveRoot: true }
+    targets = words.slice(1).filter((w) => !w.startsWith('-'))
+  } else if (['rmdir', 'rd', 'del'].includes(cmd)) {
+    recursive = words.some((w) => /^\/s$/i.test(w))
+    targets = words.slice(1).filter((w) => !w.startsWith('/') || w.length > 2)
+  } else if (['remove-item', 'ri'].includes(cmd)) {
+    recursive = words.some((w) => /^-recurse/i.test(w))
+    targets = words.slice(1).filter((w) => !w.startsWith('-'))
+  }
+  return { recursive, targets }
+}
+
+export function assessCommand(command) {
+  if (/omit-allow:/.test(command)) return []
+  const findings = []
+  const push = (rule, reason) => findings.push({ rule, reason })
+
+  if (/dd\s+[^|;&]*of=\/dev\/(sd|hd|nvme|disk|mmcblk)/.test(command)) push('disk-overwrite', 'dd writing directly to a block device')
+  if (/\bmkfs(\.\w+)?\b/.test(command)) push('disk-format', 'mkfs formats a filesystem')
+  if (/\b(format)\s+[a-z]:/i.test(command)) push('disk-format', 'formatting a drive')
+  if (/\bdiskpart\b/i.test(command)) push('disk-format', 'diskpart can repartition disks')
+  if (/:\(\)\s*\{\s*:\|:&\s*\}\s*;\s*:/.test(command)) push('fork-bomb', 'fork bomb')
+  if (/\bfind\s+(\/|~|\$HOME)[^|;&]*(-delete|-exec\s+rm)/.test(command)) push('find-delete-root', 'find -delete sweeping a protected root')
+  if (/\b(chmod|chown)\s+(-[a-z]*R[a-z]*\s+)[^|;&]*\s(\/|~|\$HOME)\s*$/im.test(command)) push('recursive-perms-root', 'recursive permission change on a protected root')
+
+  for (const segment of command.split(/&&|\|\||;|\|/)) {
+    const { recursive, targets, noPreserveRoot } = deleteTargets(segment)
+    if (noPreserveRoot) {
+      push('no-preserve-root', '`--no-preserve-root` exists only to delete the root filesystem')
+      continue
+    }
+    if (!recursive || !targets) continue
+    for (const t of targets) {
+      const bare = stripQuotes(t)
+      if (isProtected(bare)) push('protected-root-delete', `recursive delete of protected path: ${bare}`)
+      else if (CWD_WIPE.test(bare)) push('cwd-wipe', `recursive delete of the entire working directory (${bare}); delete specific paths instead`)
+      else if (VARIABLE_HEAD.test(bare) && !/^\$\{\w+:?[-?]/.test(bare)) {
+        push('unset-variable-delete', `recursive delete through a variable (${bare}); if it is empty or unset this can hit / or the home directory. Use \${VAR:?} or check it first`)
+      }
+    }
+  }
+  return findings
+}

package/lib/deps.mjs

@@ -0,0 +1,56 @@
+// Shared manifest/dependency detection for hooks and `omit audit`.
+import { basename } from 'node:path'
+
+const MANIFESTS = new Set([
+  'package.json', 'requirements.txt', 'pyproject.toml', 'go.mod',
+  'Cargo.toml', 'Gemfile', 'composer.json',
+])
+
+export const isManifest = (path) => MANIFESTS.has(basename(path))
+
+// Extracts dependency names that are genuinely NEW in a unified diff of one
+// manifest: present in added lines and absent from removed lines (a dep whose
+// line was merely reformatted: trailing comma, version bump: is not new).
+// omitted: full manifest parsing: heuristics per format are enough to raise an
+// objection; false negatives are acceptable, the agent's own rules still apply.
+export function addedDeps(manifestName, diff) {
+  const side = (prefix) =>
+    depsIn(
+      manifestName,
+      diff
+        .split('\n')
+        .filter((l) => l.startsWith(prefix) && !l.startsWith(prefix.repeat(3)))
+        .map((l) => l.slice(1).trim())
+    )
+  const removed = new Set(side('-'))
+  return side('+').filter((d) => !removed.has(d))
+}
+
+function depsIn(manifestName, lines) {
+  const out = []
+  for (const line of lines) {
+    let m = null
+    switch (manifestName) {
+      case 'package.json':
+      case 'composer.json':
+        // dep values start with a version range (^1.2, ~3, >=2, 1.0): script lines don't
+        m = line.match(/^"(@?[a-z0-9._/-]+)"\s*:\s*"[~^><=]?\d/i)
+        break
+      case 'requirements.txt':
+        m = line.match(/^([A-Za-z0-9._-]+)\s*(?:[><=~[]|$)/)
+        break
+      case 'go.mod':
+        m = line.match(/^(?:require\s+)?([\w.-]+\.[\w./-]+)\s+v\d/)
+        break
+      case 'Cargo.toml':
+      case 'pyproject.toml':
+        m = line.match(/^([A-Za-z0-9_-]+)\s*=\s*["{]/)
+        break
+      case 'Gemfile':
+        m = line.match(/^gem\s+['"]([\w-]+)['"]/)
+        break
+    }
+    if (m) out.push(m[1])
+  }
+  return [...new Set(out)]
+}

package/lib/hazards.mjs

@@ -0,0 +1,45 @@
+// Hazard scanning: hardcoded secrets and injection-prone patterns in added lines.
+// Heuristics raise objections, not verdicts: suppress a reviewed line with `omit-allow: <reason>`.
+
+const SECRET_RULES = [
+  ['aws-access-key', /AKIA[0-9A-Z]{16}/],
+  ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/],
+  ['github-token', /gh[pousr]_[A-Za-z0-9]{36,}/],
+  ['slack-token', /xox[baprs]-[A-Za-z0-9-]{10,}/],
+  ['anthropic-key', /sk-ant-[A-Za-z0-9_-]{20,}/],
+  ['stripe-live-key', /sk_live_[A-Za-z0-9]{20,}/],
+  ['openai-style-key', /\bsk-[A-Za-z0-9_-]{32,}/],
+  ['google-api-key', /AIza[0-9A-Za-z_-]{35}/],
+  ['hardcoded-credential', /(?:api[_-]?key|secret|token|password|passwd)["']?\s*[:=]\s*["'][A-Za-z0-9+/_-]{16,}["']/i],
+]
+
+const INJECTION_RULES = [
+  ['eval', /\beval\s*\(/],
+  ['new-function', /new\s+Function\s*\(/],
+  ['shell-concat', /\bexec(?:Sync)?\s*\(\s*(?:`[^`]*\$\{|[^)"'`]*\+)/],
+  ['subprocess-shell-true', /subprocess\.(?:run|call|Popen)\s*\(.*shell\s*=\s*True/],
+  ['os-system-dynamic', /os\.system\s*\(\s*(?:f["']|[^)"']*\+)/],
+  ['inner-html', /\.innerHTML\s*=|dangerouslySetInnerHTML/],
+  ['pickle-load', /pickle\.loads?\s*\(/],
+  ['yaml-unsafe-load', /yaml\.load\s*\((?![^)]*SafeLoader)/],
+]
+
+const sqlInjection = (line) =>
+  /\b(?:execute|query|raw)\s*\(/i.test(line) &&
+  /\b(?:SELECT|INSERT|UPDATE|DELETE)\b/i.test(line) &&
+  (/\$\{/.test(line) || /["'`]\s*\+/.test(line) || /f["']/.test(line) || /%\s*\(/.test(line))
+
+export function findHazards(lines) {
+  const findings = []
+  lines.forEach((text, i) => {
+    if (text.includes('omit-allow:')) return
+    for (const [rule, re] of SECRET_RULES) {
+      if (re.test(text)) findings.push({ type: 'secret', rule, line: i + 1, text: text.trim().slice(0, 120) })
+    }
+    for (const [rule, re] of INJECTION_RULES) {
+      if (re.test(text)) findings.push({ type: 'injection', rule, line: i + 1, text: text.trim().slice(0, 120) })
+    }
+    if (sqlInjection(text)) findings.push({ type: 'injection', rule: 'sql-string-built', line: i + 1, text: text.trim().slice(0, 120) })
+  })
+  return findings
+}