@yagni-app/code-staging 0.3.0-staging.1079.1 → 0.3.0-staging.1081.1

package/dist/extension/execPolicy.js

@@ -1,6 +1,6 @@
 /**
  * Exec policy engine — classifies bash commands via prefix rules + lightweight
- * shell tokenization (YAG-504).
+ * shell tokenization (YAG-504, restructured in YAG-510).
  *
  * Pure: no I/O, no network, no model. Loads at startup and classifies
  * synchronously. The curated default set auto-allows read-only commands
@@ -10,24 +10,45 @@
  *
  * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
  *
+ * Classification composes three signals and takes the STRICTEST:
+ *   1. prefix-rule matching on every segment (newlines, ;, &&, ||, | split);
+ *   2. a construct floor — commands using redirects, substitution, or
+ *      background & can never be auto-allowed (floor: prompt);
+ *   3. dangerScan — a best-effort sweep of command-substitution inner text
+ *      ($(...) and backticks, including inside double quotes) against the
+ *      FORBIDDEN rules only. Danger anywhere upgrades to forbidden; the scan
+ *      can never make anything more permissive.
+ * This is the codex two-parser lesson: fail closed to prove safety, scan
+ * best-effort to prove danger. A forbidden match must win even when the
+ * command also carries constructs (`rm -rf / &` is forbidden, not prompt).
+ *
+ * Command words are matched through a leading-token strip (env assignments,
+ * sudo/env/command wrappers, shell reserved words, a leading backslash) and
+ * basename normalization (/bin/rm → rm) — both applied ASYMMETRICALLY: they
+ * can make a command land on forbidden/prompt rules, but a stripped or
+ * path-prefixed command is never auto-allowed (`sudo ls` and `./ls` stay in
+ * the prompt band; an attacker-named local `./rm` binary must not ride the
+ * allow list, and `/bin/ls` pays the same price by design).
+ *
  * Tokenization is a lightweight inline parser — not shell-quote — because the
  * extension is bundled into @yagni-app/code's dist (a file copy, not a real
  * bundler), and external dependencies aren't resolvable from the bundled path.
- * We only need: split on whitespace (respecting single/double quotes), detect
- * control operators (|, &&, ||, ;), and flag shell constructs ($(...),
- * backticks, redirects) that we can't statically analyze.
  */
 /**
  * Parse a shell command string into tokens and control operators.
  *
  * Handles:
  * - Single and double quoted strings (preserves spaces inside)
- * - Control operators: |, &&, ||, ;
- * - Shell constructs we flag as unanalyzable: $(), backticks, >, <
+ * - Control operators: |, &&, ||, ;, and newlines (a newline separates
+ *   commands exactly like `;` — treating it as whitespace let multiline
+ *   commands smuggle anything behind an allow-listed first line)
+ * - `#` comments (start-of-word to end-of-line, outside quotes)
+ * - Shell constructs we flag as unanalyzable: $(), backticks (INCLUDING
+ *   inside double quotes — bash executes those), >, <, background &
  *
- * Does NOT handle: variable expansion, glob patterns, heredocs, nested
- * subshells beyond the first level. Commands using those are classified
- * as "prompt" (let the Guardian review).
+ * Does NOT handle: variable expansion, glob patterns, heredocs beyond the
+ * redirect flag, nested subshells beyond depth tracking. Commands using
+ * those are classified as "prompt" at minimum (construct floor).
  */
 export function shellParse(command) {
     const tokens = [];
@@ -57,10 +78,24 @@ export function shellParse(command) {
         if (inDouble) {
             if (ch === '"') {
                 inDouble = false;
+                i++;
+                continue;
             }
-            else {
-                current += ch;
+            // Backslash escapes that bash honors inside double quotes: \$ \` \" \\.
+            // Without this, `echo "\$(safe)"` would false-flag as a substitution.
+            if (ch === "\\" && (command[i + 1] === "$" || command[i + 1] === "`" || command[i + 1] === '"' || command[i + 1] === "\\")) {
+                current += command[i + 1];
+                i += 2;
+                continue;
+            }
+            // Bash EXECUTES $(...) and backticks inside double quotes; the old
+            // tokenizer treated them as literal text, which made
+            // `echo "$(rm -rf x)"` classify as a plain echo → allow. Flag as a
+            // construct; dangerScan sweeps the inner text separately.
+            if ((ch === "$" && command[i + 1] === "(") || ch === "`") {
+                hasConstruct = true;
             }
+            current += ch;
             i++;
             continue;
         }
@@ -73,10 +108,26 @@ export function shellParse(command) {
                 inDouble = true;
                 i++;
                 continue;
+            case "#":
+                // Comment: only at a word boundary (bash rule). `echo a#b` keeps the #.
+                if (current.length === 0) {
+                    while (i < command.length && command[i] !== "\n")
+                        i++;
+                    continue;
+                }
+                current += ch;
+                i++;
+                continue;
             case " ":
             case "\t":
+                pushCurrent();
+                i++;
+                continue;
             case "\n":
+            case "\r":
+                // Newlines separate commands like `;` — NOT whitespace.
                 pushCurrent();
+                tokens.push({ op: "semi" });
                 i++;
                 continue;
             case "|":
@@ -98,9 +149,12 @@ export function shellParse(command) {
                     i += 2;
                 }
                 else {
-                    // Single & — background operator, treat as construct
+                    // Single & — background operator. A construct (floor: prompt), but
+                    // the command before it must still be rule-matched: `rm -rf / &`
+                    // has to stay forbidden, so emit a separator rather than gluing.
+                    pushCurrent();
+                    tokens.push({ op: "semi" });
                     hasConstruct = true;
-                    current += ch;
                     i++;
                 }
                 continue;
@@ -159,17 +213,79 @@ export function shellParse(command) {
     }
     pushCurrent();
     // If we detected constructs but didn't emit them as operator tokens
-    // (e.g. background &), surface that via a substitution token.
-    if (hasConstruct && !tokens.some((t) => typeof t === "object")) {
+    // (e.g. background & or double-quoted substitution), surface that via a
+    // trailing substitution token so hasUnhandledConstructs sees it.
+    if (hasConstruct && !tokens.some((t) => typeof t === "object" && (t.op === "redirect" || t.op === "substitution"))) {
         tokens.push({ op: "substitution" });
     }
     return tokens;
 }
+/**
+ * Extract the inner text of every command substitution — $(...) and
+ * backticks — respecting single-quote literalness and backslash escapes.
+ * Includes substitutions inside double quotes (bash executes those).
+ * Best-effort, used ONLY by dangerScan to prove danger, never safety.
+ */
+export function extractSubstitutions(command) {
+    const found = [];
+    let i = 0;
+    let inSingle = false;
+    while (i < command.length) {
+        const ch = command[i];
+        if (inSingle) {
+            if (ch === "'")
+                inSingle = false;
+            i++;
+            continue;
+        }
+        if (ch === "'") {
+            inSingle = true;
+            i++;
+            continue;
+        }
+        if (ch === "\\") {
+            i += 2;
+            continue;
+        }
+        if (ch === "$" && command[i + 1] === "(") {
+            const start = i + 2;
+            let depth = 1;
+            let j = start;
+            while (j < command.length && depth > 0) {
+                if (command[j] === "(")
+                    depth++;
+                if (command[j] === ")")
+                    depth--;
+                j++;
+            }
+            found.push(command.slice(start, depth === 0 ? j - 1 : j));
+            i = j;
+            continue;
+        }
+        if (ch === "`") {
+            const start = i + 1;
+            let j = start;
+            while (j < command.length && command[j] !== "`")
+                j++;
+            found.push(command.slice(start, j));
+            i = j < command.length ? j + 1 : j;
+            continue;
+        }
+        i++;
+    }
+    return found;
+}
 /** Interpreters that, when piped into, indicate code execution — always forbidden. */
 const PIPE_TO_SHELL = new Set([
     "sh", "bash", "zsh", "fish", "nc", "ncat", "socat",
     "python", "python3", "perl", "ruby", "node",
 ]);
+/** Wrapper words that forward to another command (`sudo rm …` runs rm). */
+const WRAPPER_WORDS = new Set(["sudo", "env", "command", "builtin", "exec", "nohup", "time", "nice"]);
+/** Shell reserved words that can precede a command inside control flow. */
+const RESERVED_WORDS = new Set(["do", "then", "else", "elif", "if", "while", "until", "done", "fi", "esac", "!"]);
+/** Bash env-assignment prefix: FOO=bar cmd … */
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 /**
  * Parse a command string into tokens using our lightweight tokenizer. Returns
  * string tokens only (control operators and constructs are filtered out —
@@ -181,51 +297,149 @@ export function tokenize(command) {
 /** Operator tokens we can safely split on (compound command segments). */
 const SPLIT_OPS = new Set(["pipe", "and", "or", "semi"]);
 /**
- * Detect whether the command uses shell constructs we can't statically classify
- * (command substitution, redirects, etc.) — anything that is NOT a splittable
- * operator (pipe, and, or, semi).
+ * Detect whether the command uses shell constructs we can't statically
+ * classify (command substitution, redirects, background &) — anything that
+ * is NOT a splittable operator. These impose a floor of `prompt`: a command
+ * carrying them is never auto-allowed, but forbidden matches still win.
  */
 function hasUnhandledConstructs(command) {
     return shellParse(command).some((t) => typeof t === "object" && "op" in t && !SPLIT_OPS.has(t.op));
 }
 /**
- * Split a command into segments at control operators (|, &&, ||, ;).
- * Returns the raw string of each segment.
+ * Split a command into token-array segments at control operators (|, &&, ||,
+ * ;, newline). Redirect targets (the token after > or <) are dropped from the
+ * segment — they are filenames, not arguments to rule-match. Token arrays are
+ * carried through (never re-joined into strings) so quoting survives.
  */
-function splitSegments(command) {
-    const tokens = shellParse(command);
+function splitSegmentsTokens(command) {
+    const parsed = shellParse(command);
     const segments = [];
     let current = [];
-    for (const t of tokens) {
+    let skipNext = false;
+    for (const t of parsed) {
         if (typeof t === "object") {
             if (SPLIT_OPS.has(t.op)) {
                 if (current.length > 0)
-                    segments.push(current.join(" "));
+                    segments.push(current);
                 current = [];
+                skipNext = false;
             }
-            // Non-splittable operators (redirect, substitution) are already
-            // handled by hasUnhandledConstructs above — we won't reach splitSegments.
+            else if (t.op === "redirect") {
+                skipNext = true;
+            }
+            // substitution ops are construct markers; the inner text is handled
+            // by dangerScan via extractSubstitutions.
         }
         else {
+            if (skipNext) {
+                skipNext = false;
+                continue;
+            }
             current.push(t);
         }
     }
     if (current.length > 0)
-        segments.push(current.join(" "));
+        segments.push(current);
     return segments;
 }
-/** Check if any segment pipes into a known shell/network interpreter. */
-function isPipeToShell(command) {
-    const tokens = shellParse(command);
-    for (let i = 0; i < tokens.length - 1; i++) {
+/** basename("/usr/bin/git") → "git"; leaves plain words untouched. */
+function basenameToken(token) {
+    const idx = token.lastIndexOf("/");
+    return idx >= 0 ? token.slice(idx + 1) : token;
+}
+/**
+ * Unified leading-token strip: remove env assignments, wrapper words (plus
+ * their immediate dash-flags), shell reserved words, leading `(`/`{` (even
+ * glued: `(rm`), and a leading backslash on the command word. Used to FIND
+ * the command word for forbidden/prompt matching — callers must treat a
+ * stripped result as never-allow (see classifySegmentTokens).
+ */
+function stripLeadingTokens(tokens) {
+    const out = [...tokens];
+    let stripped = false;
+    let guard = 0;
+    while (out.length > 0 && guard++ < 32) {
+        let t = out[0];
+        // Leading ( or { — possibly glued to the command word.
+        if (t.startsWith("(") || t.startsWith("{")) {
+            const trimmed = t.replace(/^[({]+/, "");
+            stripped = true;
+            if (trimmed.length === 0) {
+                out.shift();
+            }
+            else {
+                out[0] = trimmed;
+            }
+            continue;
+        }
+        // Trailing ) } on a lone closer token — drop (e.g. segment "rm -rf /)" ).
+        if (/^[)}]+$/.test(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (RESERVED_WORDS.has(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (ENV_ASSIGNMENT_RE.test(t)) {
+            out.shift();
+            stripped = true;
+            continue;
+        }
+        if (WRAPPER_WORDS.has(basenameToken(t))) {
+            out.shift();
+            stripped = true;
+            // Wrapper flags (env -i, sudo -n, …). Imperfect for flags that take a
+            // separate value (sudo -u alice); worst case the "command word" is the
+            // value and we land in the prompt band — never allow.
+            while (out.length > 0 && out[0].startsWith("-"))
+                out.shift();
+            continue;
+        }
+        if (t.startsWith("\\") && t.length > 1) {
+            out[0] = t.slice(1);
+            stripped = true;
+            continue;
+        }
+        break;
+    }
+    return { tokens: out, stripped };
+}
+/**
+ * git accepts global options between `git` and the subcommand (`git -C /x
+ * push --force`). Skip them so subcommand rules and flagsAnywhere see the
+ * real shape. Matching-only — never mutates what actually runs.
+ */
+function normalizeGitTokens(tokens) {
+    if (tokens[0] !== "git")
+        return tokens;
+    const out = ["git"];
+    let i = 1;
+    while (i < tokens.length) {
         const t = tokens[i];
-        if (typeof t === "object" && t.op === "pipe") {
-            const next = tokens[i + 1];
-            if (typeof next === "string" && PIPE_TO_SHELL.has(next))
-                return true;
+        if (t === "-C" || t === "-c") {
+            i += 2; // option + its value
+            continue;
+        }
+        if (t.startsWith("--git-dir") ||
+            t.startsWith("--work-tree") ||
+            t.startsWith("--exec-path") ||
+            t === "-p" ||
+            t === "--paginate" ||
+            t === "--no-pager") {
+            i += 1;
+            continue;
         }
+        break;
     }
-    return false;
+    out.push(...tokens.slice(i));
+    return out;
+}
+/** Glob-aware token match shared by unlessTokens and flagsAnywhere. */
+function tokenMatchesEntry(token, entry) {
+    return entry.endsWith("*") ? token.startsWith(entry.slice(0, -1)) : token === entry;
 }
 /** Match a token array against a prefix rule's pattern. */
 function matchRule(tokens, rule) {
@@ -243,43 +457,142 @@ function matchRule(tokens, rule) {
                 return false;
         }
     }
+    if (rule.flagsAnywhere) {
+        const rest = tokens.slice(rule.pattern.length);
+        const hit = rest.some((tok) => rule.flagsAnywhere.some((f) => tokenMatchesEntry(tok, f)));
+        if (!hit)
+            return false;
+    }
     if (rule.unlessTokens) {
         for (const tok of tokens.slice(rule.pattern.length)) {
             for (const unless of rule.unlessTokens) {
-                const matches = unless.endsWith("*")
-                    ? tok.startsWith(unless.slice(0, -1))
-                    : tok === unless;
-                if (matches)
+                if (tokenMatchesEntry(tok, unless))
                     return false;
             }
         }
     }
     return true;
 }
-/** Classify a single command segment (no shell constructs). */
-function classifySegment(segment, rules) {
-    const tokens = tokenize(segment);
-    if (tokens.length === 0) {
+/** Decision severity: forbidden > prompt > allow. */
+const SEVERITY = { allow: 0, prompt: 1, forbidden: 2 };
+function stricter(a, b) {
+    return SEVERITY[b.decision] > SEVERITY[a.decision] ? b : a;
+}
+/** Depth cap for substitution/xargs recursion (matches codex's wrapper cap). */
+const MAX_SCAN_DEPTH = 8;
+/** Classify one segment's tokens against the rules. */
+function classifySegmentTokens(rawTokens, policy, opts) {
+    if (rawTokens.length === 0) {
         return { decision: "prompt", justification: "empty command segment" };
     }
+    const { tokens: strippedTokens, stripped } = stripLeadingTokens(rawTokens);
+    if (strippedTokens.length === 0) {
+        return opts.forbiddenOnly
+            ? { decision: "allow", justification: "no forbidden match" }
+            : { decision: "prompt", justification: "empty command segment" };
+    }
+    // Asymmetric basename normalization: /bin/rm → rm for matching, but a
+    // path-prefixed command word disqualifies allow (see below).
+    const cmdWord = strippedTokens[0];
+    const normalizedWord = basenameToken(cmdWord);
+    const pathPrefixed = normalizedWord !== cmdWord;
+    let tokens = pathPrefixed ? [normalizedWord, ...strippedTokens.slice(1)] : strippedTokens;
+    tokens = normalizeGitTokens(tokens);
+    const neverAllow = stripped || pathPrefixed;
+    // xargs forwards to its argv tail: classify the tail as its own segment so
+    // `xargs rm -rf` inherits rm's forbidden. xargs itself is never allow.
+    if (tokens[0] === "xargs" && opts.depth < MAX_SCAN_DEPTH) {
+        let j = 1;
+        while (j < tokens.length && tokens[j].startsWith("-"))
+            j++;
+        const tail = tokens.slice(j);
+        if (tail.length > 0) {
+            const tailResult = classifySegmentTokens(tail, policy, { ...opts, depth: opts.depth + 1 });
+            if (tailResult.decision === "forbidden")
+                return tailResult;
+        }
+        if (opts.forbiddenOnly)
+            return { decision: "allow", justification: "no forbidden match" };
+        return { decision: "prompt", justification: "xargs executes its argument command — review the target" };
+    }
     // First match wins (rules are ordered; more specific rules come first).
-    for (const rule of rules) {
+    for (const rule of policy.rules) {
+        if (opts.forbiddenOnly && rule.decision !== "forbidden")
+            continue;
         if (matchRule(tokens, rule)) {
+            if (rule.decision === "allow" && neverAllow) {
+                return {
+                    decision: "prompt",
+                    justification: "wrapper- or path-prefixed command cannot be auto-allowed",
+                };
+            }
             return { decision: rule.decision, justification: rule.justification, matchedRule: rule };
         }
     }
+    if (opts.forbiddenOnly) {
+        return { decision: "allow", justification: "no forbidden match" };
+    }
     // No rule matched → prompt (fail toward review, not toward allow)
     return { decision: "prompt", justification: `no policy rule matched for "${tokens[0]}"` };
 }
-/** Decision severity: forbidden > prompt > allow. */
-const SEVERITY = { allow: 0, prompt: 1, forbidden: 2 };
+/** Check if any segment pipes into a known shell/network interpreter. */
+function isPipeToShell(command) {
+    const parsed = shellParse(command);
+    for (let i = 0; i < parsed.length - 1; i++) {
+        const t = parsed[i];
+        if (typeof t === "object" && t.op === "pipe") {
+            const next = parsed[i + 1];
+            if (typeof next !== "string")
+                continue;
+            const word = basenameToken(next.startsWith("\\") ? next.slice(1) : next);
+            if (PIPE_TO_SHELL.has(word))
+                return true;
+            // `… | env sh` / `… | /usr/bin/env sh`
+            if (word === "env") {
+                const after = parsed[i + 2];
+                if (typeof after === "string" && PIPE_TO_SHELL.has(basenameToken(after)))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Best-effort danger sweep of command-substitution inner text ($(...) and
+ * backticks, including inside double quotes). Matches FORBIDDEN rules only —
+ * can upgrade the classification, never relax it.
+ */
+function dangerScanSubstitutions(command, policy, depth) {
+    if (depth > MAX_SCAN_DEPTH)
+        return null;
+    for (const inner of extractSubstitutions(command)) {
+        if (inner.trim().length === 0)
+            continue;
+        if (isPipeToShell(inner)) {
+            return {
+                decision: "forbidden",
+                justification: "piping into a shell or network interpreter is forbidden",
+            };
+        }
+        for (const seg of splitSegmentsTokens(inner)) {
+            const r = classifySegmentTokens(seg, policy, { forbiddenOnly: true, depth: depth + 1 });
+            if (r.decision === "forbidden")
+                return r;
+        }
+        const nested = dangerScanSubstitutions(inner, policy, depth + 1);
+        if (nested)
+            return nested;
+    }
+    return null;
+}
 /**
  * Classify a full bash command string against the exec policy.
  *
- * Compound commands (pipes, &&, ||, ;) are split into segments and each is
- * classified independently. The strictest decision wins (forbidden > prompt >
- * allow). Commands with shell constructs we can't parse (command substitution,
- * redirects beyond pipe) are classified as prompt. Pipe-to-shell is always
+ * Compound commands (pipes, &&, ||, ;, newlines) are split into segments and
+ * each is classified independently; the strictest decision wins (forbidden >
+ * prompt > allow). Commands with shell constructs (substitution, redirects,
+ * background &) have a floor of `prompt`, and their substitution inner text
+ * is danger-scanned against the forbidden rules. Pipe-to-shell is always
  * forbidden.
  */
 export function classifyCommand(command, policy) {
@@ -290,54 +603,91 @@ export function classifyCommand(command, policy) {
             justification: "piping into a shell or network interpreter is forbidden",
         };
     }
-    // Command substitution, redirects, and other constructs we can't statically
-    // analyze → prompt (let the Guardian review). Only checked for constructs
-    // that are NOT splittable (|, &&, ||, ;) — those are handled below.
-    if (hasUnhandledConstructs(command)) {
-        return {
-            decision: "prompt",
-            justification: "command uses shell constructs (substitution/redirect) that cannot be statically analyzed",
-        };
+    const constructFloor = hasUnhandledConstructs(command);
+    const segments = splitSegmentsTokens(command);
+    let result = null;
+    for (const seg of segments) {
+        const segResult = classifySegmentTokens(seg, policy, { depth: 0 });
+        result = result === null ? segResult : stricter(result, segResult);
+        if (result.decision === "forbidden")
+            break;
     }
-    const segments = splitSegments(command);
-    if (segments.length <= 1) {
-        return classifySegment(command, policy.rules);
+    if (result === null) {
+        result = { decision: "prompt", justification: "empty command segment" };
     }
-    // Compound command: classify each segment, take the strictest.
-    let result = { decision: "allow", justification: "all segments allowed" };
-    for (const seg of segments) {
-        const segResult = classifySegment(seg, policy.rules);
-        if (SEVERITY[segResult.decision] > SEVERITY[result.decision]) {
-            result = segResult;
-        }
+    // Danger sweep of substitution inner text — upgrade-only.
+    if (result.decision !== "forbidden") {
+        const danger = dangerScanSubstitutions(command, policy, 0);
+        if (danger)
+            result = danger;
+    }
+    // Construct floor: redirects/substitutions/background can never auto-allow.
+    if (constructFloor && result.decision === "allow") {
+        result = {
+            decision: "prompt",
+            justification: "command uses shell constructs (substitution/redirect/background) that cannot be statically analyzed",
+        };
     }
     return result;
 }
 /** Curated default rules — the shipped safety floor. */
 export const DEFAULT_EXEC_POLICY = {
     rules: [
-        // --- forbidden: destructive commands (highest priority) ---
+        // --- forbidden: position-independent dangerous-flag rules (checked first;
+        //     GNU getopt permutes flags, so `rm x -rf` and `git push origin
+        //     --force` carry the flag after positional args) ---
+        {
+            pattern: ["rm"],
+            flagsAnywhere: ["-r*", "-f*", "--recursive*", "--force*"],
+            decision: "forbidden",
+            justification: "recursive/forced deletion is destructive and irreversible",
+        },
+        {
+            // Exact --force/-f only: --force-with-lease is the guarded variant and
+            // deliberately stays in the prompt band (Guardian reviews it) — but the
+            // grants layer fences ALL --force* so a prefix approval never covers it
+            // (approvedPrefixes.ts).
+            pattern: ["git", "push"],
+            flagsAnywhere: ["--force", "-f", "--mirror", "--delete", "-d", "--receive-pack*", "--exec*"],
+            decision: "forbidden",
+            justification: "force/delete/mirror push rewrites or removes shared history",
+        },
+        {
+            pattern: ["git", "clean"],
+            flagsAnywhere: ["-f*", "-d*", "-x*", "--force*"],
+            decision: "forbidden",
+            justification: "git clean removes untracked files irreversibly",
+        },
+        {
+            pattern: ["chmod"],
+            flagsAnywhere: ["777", "0777", "a+rwx"],
+            decision: "forbidden",
+            justification: "world-writable permission change weakens security",
+        },
+        {
+            pattern: ["chown"],
+            flagsAnywhere: ["-R*", "--recursive*"],
+            decision: "forbidden",
+            justification: "recursive ownership change",
+        },
+        {
+            pattern: ["kill"],
+            flagsAnywhere: ["-9", "-KILL", "-SIGKILL"],
+            decision: "forbidden",
+            justification: "force kill is destructive",
+        },
+        // --- forbidden: destructive commands (positional) ---
         {
             pattern: ["rm", ["-rf", "-fr", "-r", "-f", "--recursive", "--force"]],
             decision: "forbidden",
             justification: "recursive/forced deletion is destructive and irreversible",
         },
-        { pattern: ["rm", "-r"], decision: "forbidden", justification: "recursive deletion is destructive" },
-        { pattern: ["rm", "-f"], decision: "forbidden", justification: "forced deletion bypasses prompts" },
-        { pattern: ["rm", "--recursive"], decision: "forbidden", justification: "recursive deletion is destructive" },
-        { pattern: ["rm", "--force"], decision: "forbidden", justification: "forced deletion bypasses prompts" },
         { pattern: ["git", "reset", "--hard"], decision: "forbidden", justification: "hard reset discards uncommitted changes irreversibly" },
-        { pattern: ["git", "push", ["--force", "-f"]], decision: "forbidden", justification: "force-push rewrites shared history" },
-        { pattern: ["git", "clean", ["-fd", "-df", "-f", "-d"]], decision: "forbidden", justification: "git clean removes untracked files irreversibly" },
         { pattern: ["git", "checkout", "--"], decision: "forbidden", justification: "discards working tree changes" },
-        { pattern: ["chmod", "-R", "777"], decision: "forbidden", justification: "recursive world-writable permission change weakens security" },
-        { pattern: ["chown", "-R"], decision: "forbidden", justification: "recursive ownership change" },
         { pattern: ["dd"], decision: "forbidden", justification: "low-level disk operations are destructive" },
         { pattern: ["mkfs"], decision: "forbidden", justification: "filesystem formatting is destructive" },
         { pattern: ["shutdown"], decision: "forbidden", justification: "system shutdown" },
         { pattern: ["reboot"], decision: "forbidden", justification: "system reboot" },
-        { pattern: ["kill", "-9"], decision: "forbidden", justification: "force kill is destructive" },
-        { pattern: ["kill", "-KILL"], decision: "forbidden", justification: "force kill is destructive" },
         { pattern: ["truncate"], decision: "forbidden", justification: "truncates files destructively" },
         // --- allow: read-only commands ---
         { pattern: ["ls"], decision: "allow", justification: "list directory contents" },
@@ -448,6 +798,8 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["unzip"], decision: "prompt", justification: "archive operation" },
         { pattern: ["ps"], decision: "prompt", justification: "lists processes" },
         { pattern: ["kill"], decision: "prompt", justification: "sends a signal to a process" },
+        { pattern: ["chmod"], decision: "prompt", justification: "permission change — review the mode" },
+        { pattern: ["chown"], decision: "prompt", justification: "ownership change" },
     ],
 };
 //# sourceMappingURL=execPolicy.js.map