atris 3.82.5 → 3.82.8

package/lib/sentinel-guard-install.js

@@ -2,8 +2,9 @@
 
 // Installs the sentinel guard (lib/sentinel-guard.js) as a Claude Code
 // PreToolUse hook, the same way `atris spend guard install` installs its
-// hook (lib/claude-spend-guard.js): the hook is a copy of the guard file,
-// so it keeps working if the CLI moves, and the settings file is rewritten
+// hook (lib/claude-spend-guard.js): the hook is a copy of the guard file.
+// Its rules file (lib/sentinel-rules.json) sits beside it. It keeps
+// working if the CLI moves. The settings file is rewritten
 // atomically and never clobbered when it does not parse.
 //
 //   project   <project>/.claude/hooks/sentinel-guard.js, wired in
@@ -19,6 +20,9 @@ const guard = require('./sentinel-guard');
 
 const SCRIPT_NAME = `${guard.GUARD_MARK}.js`;
 const GUARD_SOURCE = path.join(__dirname, 'sentinel-guard.js');
+// The guard reads its tunable rules from this file beside it.
+const RULES_SOURCE = path.join(__dirname, 'sentinel-rules.json');
+const RULES_NAME = 'sentinel-rules.json';
 
 function homeDir(env = process.env) {
   return env.HOME || os.homedir();
@@ -26,7 +30,7 @@ function homeDir(env = process.env) {
 
 function locations({ global = false, root = process.cwd(), env = process.env } = {}) {
   const base = global ? path.join(homeDir(env), '.claude') : path.join(path.resolve(root), '.claude');
-  return { scope: global ? 'global' : 'project', settings: path.join(base, 'settings.json'), script: path.join(base, 'hooks', SCRIPT_NAME) };
+  return { scope: global ? 'global' : 'project', settings: path.join(base, 'settings.json'), script: path.join(base, 'hooks', SCRIPT_NAME), rules: path.join(base, 'hooks', RULES_NAME) };
 }
 
 function nodeBinary() {
@@ -93,7 +97,7 @@ function status({ global = false, root, env = process.env } = {}) {
   const groups = (settings.hooks && settings.hooks.PreToolUse) || [];
   const wired = readable && Array.isArray(groups) && groups.some(isGuardGroup);
   const present = fs.existsSync(loc.script);
-  const current = present && fileHash(loc.script) === fileHash(GUARD_SOURCE);
+  const current = present && fileHash(loc.script) === fileHash(GUARD_SOURCE) && fileHash(loc.rules) === fileHash(RULES_SOURCE);
   const hooksOff = settings.disableAllHooks === true;
   return { ...loc, installed: wired && present, wired, present, current, readable, hooks_off: hooksOff };
 }
@@ -116,6 +120,7 @@ function install({ global = false, root, env = process.env, atrisBin } = {}) {
   const loc = locations({ global, root, env });
   const settings = readSettings(loc.settings);
   fs.mkdirSync(path.dirname(loc.script), { recursive: true });
+  fs.copyFileSync(RULES_SOURCE, loc.rules);
   fs.copyFileSync(GUARD_SOURCE, loc.script);
   fs.chmodSync(loc.script, 0o755);
   settings.hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
@@ -142,6 +147,7 @@ function uninstall({ global = false, root, env = process.env } = {}) {
     writeSettings(loc.settings, settings);
   }
   try { fs.unlinkSync(loc.script); } catch {}
+  try { fs.unlinkSync(loc.rules); } catch {}
   return status({ global, root, env });
 }
 

package/lib/sentinel-guard.js

@@ -55,17 +55,100 @@ const crypto = require('crypto');
 const GUARD_MARK = 'sentinel-guard';
 const MATCHER = 'Bash|Edit|Write|MultiEdit|NotebookEdit';
 
-// Destinations a secret may go to without a block: local servers, and the
-// services those keys belong to. More hosts can be added in
+// The tunable rules live in sentinel-rules.json beside this file. They are
+// literal data, never code: trusted hosts, network programs, secret name
+// parts, the safe option lists, read-only programs, database clients and
+// literal command blocks. `atris sentinel improve` may change only that
+// file. The guard matches every entry with a plain string operation. A
+// proposed entry can never be a regular expression or stall on long input.
+// The hand-written regular expressions below stay in code, out of the
+// proposer's reach. More hosts can be added in
 // ~/.atris/sentinel/guard.json { "allow_hosts": ["api.example.com"] }.
-const DEFAULT_ALLOW_HOSTS = [
-  'localhost', '127.0.0.1', '0.0.0.0', '::1',
-  'api.github.com', 'github.com', 'uploads.github.com',
-  'api.openai.com', 'api.anthropic.com',
-  'registry.npmjs.org', 'pypi.org', 'upload.pypi.org',
-  'api.atris.ai', 'atris.ai',
-  'api.stripe.com', 'slack.com', 'api.vercel.com', 'api.render.com',
+const RULES_FILE = path.join(__dirname, 'sentinel-rules.json');
+const RULE_CATEGORIES = ['exfil', 'destroy', 'disarm'];
+
+// Fixed shapes, not proposer data: the review scanner's known-token rules
+// and the secrets files. These are the only regular expressions the guard
+// uses. None of them come from the rules file.
+const KEY_SHAPES = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{36,}\b/,
+  /\bgithub_pat_[A-Za-z0-9_]{40,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  /\bsk-ant-[A-Za-z0-9_-]{20,}\b/,
+  /\bsk-proj-[A-Za-z0-9_-]{32,}\b/,
+  /\bsk-[A-Za-z0-9]{32,}\b/,
+  /\bAIza[0-9A-Za-z_-]{35}\b/,
+  /\b[rs]k_live_[A-Za-z0-9]{20,}\b/,
+  /\bnpm_[A-Za-z0-9]{36}\b/,
+  /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/,
 ];
+const DROP_TEXT = /\bdrop\s+(?:database|schema)\b|\.dropDatabase\s*\(|\bflushall\b|\bflushdb\b/i;
+// SECRET_FILES needs HOME_REF, defined further down; it is built lazily.
+let SECRET_FILES = null;
+function secretFiles() {
+  if (SECRET_FILES) return SECRET_FILES;
+  SECRET_FILES = [
+    new RegExp(`${HOME_REF}/\\.ssh(?:/(?![^\\s'"]*\\.pub(?=$|[\\s'"|;&)]))[^\\s'"|;&)]*|(?=$|[\\s'"|;&)]))`),
+    /(?:^|[\s'"=@<:/])id_(?:rsa|dsa|ecdsa|ed25519)(?!\.pub)(?=$|[\s'"|;&)])/,
+    /\.aws\/(?:credentials|config)\b/,
+    /(?:^|[\s'"=@<:/])\.env(?:\.(?!example\b|sample\b|template\b|dist\b|defaults?\b)[\w-]+)?(?=$|[\s'"|;&)<>])/,
+    /\.netrc\b/, /\.git-credentials\b/, /\.npmrc\b/, /\.pypirc\b/,
+    /\.docker\/config\.json\b/, /\.kube\/config\b/, /\/etc\/shadow\b/,
+    /\.config\/gh\/hosts\.yml\b/, /\.atris\/credentials/, /\.gnupg\//,
+  ];
+  return SECRET_FILES;
+}
+
+// Turns the literal rules data into sets and lists. Throws on a bad file:
+// the hook then fails open and logs it, like any other guard error.
+function compileRules(raw) {
+  const g = (raw && raw.guard) || {};
+  const list = (v, name) => { if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) throw new Error(`rules: guard.${name} must be a list of strings`); return v; };
+  const safeNet = {};
+  for (const [prog, spec] of Object.entries(g.safe_net || {})) {
+    safeNet[prog] = {
+      flags: new Set(list(spec.flags, `safe_net.${prog}.flags`)),
+      values: new Set(list(spec.values, `safe_net.${prog}.values`)),
+      localValue: new Set(list(spec.local_values, `safe_net.${prog}.local_values`)),
+      shortFlags: String(spec.short_flags || ''),
+      shortValues: String(spec.short_values || ''),
+      items: spec.items === true,
+    };
+  }
+  for (const [alias, target] of Object.entries(g.safe_net_aliases || {})) if (safeNet[target]) safeNet[alias] = safeNet[target];
+  return {
+    allowHosts: list(g.allow_hosts, 'allow_hosts').map((h) => h.toLowerCase()),
+    netTools: new Set(list(g.net_tools, 'net_tools')),
+    secretParts: new Set(list(g.secret_parts, 'secret_parts')),
+    keyShapes: KEY_SHAPES,
+    secretFiles: secretFiles(),
+    safeNet,
+    readOnly: new Set(list(g.read_only, 'read_only')),
+    readOnlyGit: new Set(list(g.read_only_git, 'read_only_git')),
+    dbClients: new Set(list(g.db_clients, 'db_clients')),
+    dropText: DROP_TEXT,
+    // Literal command blocks. Each blocks when the command runs one of its
+    // programs (if any) and contains every one of its literal substrings.
+    // No regular expression, no proposer pattern.
+    commandBlocks: (Array.isArray(g.command_blocks) ? g.command_blocks : []).map((b, i) => {
+      if (!b || !RULE_CATEGORIES.includes(b.category)) throw new Error(`rules: guard.command_blocks[${i}].category must be exfil, destroy or disarm`);
+      const all = list(b.all, `command_blocks[${i}].all`);
+      if (!all.length) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
+      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all };
+    }),
+  };
+}
+
+let DEFAULT_RULES = null;
+let ACTIVE_RULES = null;
+// The rules in force: the ones passed to decide(), else the file beside this one.
+function R() {
+  if (ACTIVE_RULES) return ACTIVE_RULES;
+  if (!DEFAULT_RULES) DEFAULT_RULES = compileRules(JSON.parse(fs.readFileSync(RULES_FILE, 'utf8')));
+  return DEFAULT_RULES;
+}
 
 function homeDir(env = process.env) {
   return env.HOME || os.homedir();
@@ -279,16 +362,14 @@ function gitSub(args) {
 
 // ---------------------------------------------------------------- rules
 
-const NET_TOOLS = new Set(['curl', 'wget', 'nc', 'ncat', 'netcat', 'socat', 'telnet', 'scp', 'sftp', 'ftp', 'rsync', 'http', 'https', 'xh', 'httpie', 'aria2c', 'lftp', 'ssh']);
 const DEV_TCP = /\/dev\/(?:tcp|udp)\//;
 
-const SECRET_PARTS = new Set(['KEY', 'KEYS', 'TOKEN', 'TOKENS', 'SECRET', 'SECRETS', 'PASSWORD', 'PASSWD', 'PASS', 'PWD', 'CREDENTIAL', 'CREDENTIALS', 'CREDS', 'AUTH', 'PRIVATE', 'SESSION', 'COOKIE', 'APIKEY', 'PAT', 'DSN']);
 // A variable whose name says it holds a secret: one of its underscore parts
 // is a secret word (GITHUB_TOKEN, DB_PASSWORD), or it ends in KEY or TOKEN.
 function secretVarName(name) {
   const up = String(name || '').toUpperCase();
   if (!up || up === 'PWD' || up === 'OLDPWD') return false;
-  if (up.split('_').some((p) => SECRET_PARTS.has(p))) return true;
+  if (up.split('_').some((p) => R().secretParts.has(p))) return true;
   return /(?:KEY|TOKEN|SECRET)$/.test(up);
 }
 function hasSecretVar(text) {
@@ -298,71 +379,21 @@ function hasSecretVar(text) {
   return false;
 }
 
-// Key shapes, a copy of the review scanner's known-token rules.
-const KEY_SHAPES = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
-  /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
-  /\bgh[pousr]_[A-Za-z0-9]{36,}\b/,
-  /\bgithub_pat_[A-Za-z0-9_]{40,}\b/,
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
-  /\bsk-ant-[A-Za-z0-9_-]{20,}\b/,
-  /\bsk-proj-[A-Za-z0-9_-]{32,}\b/,
-  /\bsk-[A-Za-z0-9]{32,}\b/,
-  /\bAIza[0-9A-Za-z_-]{35}\b/,
-  /\b[rs]k_live_[A-Za-z0-9]{20,}\b/,
-  /\bnpm_[A-Za-z0-9]{36}\b/,
-  /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/,
-];
 
 const HOME_REF = '(?:~|\\$HOME|\\$\\{HOME\\}|\\/Users\\/[^\\/\\s]+|\\/home\\/[^\\/\\s]+|\\/root)';
-const SECRET_FILES = [
-  new RegExp(`${HOME_REF}/\\.ssh(?:/(?![^\\s'"]*\\.pub(?=$|[\\s'"|;&)]))[^\\s'"|;&)]*|(?=$|[\\s'"|;&)]))`),
-  /(?:^|[\s'"=@<:/])id_(?:rsa|dsa|ecdsa|ed25519)(?!\.pub)(?=$|[\s'"|;&)])/,
-  /\.aws\/(?:credentials|config)\b/,
-  /(?:^|[\s'"=@<:/])\.env(?:\.(?!example\b|sample\b|template\b|dist\b|defaults?\b)[\w-]+)?(?=$|[\s'"|;&)<>])/,
-  /\.netrc\b/, /\.git-credentials\b/, /\.npmrc\b/, /\.pypirc\b/,
-  /\.docker\/config\.json\b/, /\.kube\/config\b/, /\/etc\/shadow\b/,
-  /\.config\/gh\/hosts\.yml\b/, /\.atris\/credentials/, /\.gnupg\//,
-];
 
 // Secret-carrying network calls are judged by allow-list, not by pattern.
-// Each program has a short list of options known to be safe; any other
-// option, attached or separate (a proxy, a resolve override, a config file),
-// blocks. Programs not listed here (nc, socat, scp, ssh, rsync, telnet and
-// the rest) are never allowed with a secret.
-const SAFE_NET = {
-  curl: {
-    flags: new Set(['-s', '--silent', '-S', '--show-error', '-f', '--fail', '--fail-with-body', '--fail-early', '-L', '--location', '-O', '--remote-name', '-i', '--include', '-v', '--verbose', '--compressed', '-G', '--get']),
-    values: new Set(['-H', '--header', '-d', '--data', '--data-raw', '--data-binary', '--data-urlencode', '--data-ascii', '--json', '-X', '--request', '-o', '--output', '-w', '--write-out', '-m', '--max-time']),
-    localValue: new Set(['-o', '--output']),
-    shortFlags: 'sSfLOivG',
-    shortValues: 'HdXowm',
-  },
-  wget: {
-    flags: new Set(['-q', '--quiet', '-S', '--server-response', '-nv', '--no-verbose']),
-    values: new Set(['-O', '--output-document', '--header', '--post-data', '--method', '--body-data', '-T', '--timeout', '-t', '--tries']),
-    localValue: new Set(['-O', '--output-document']),
-    shortFlags: 'qS',
-    shortValues: 'OTt',
-  },
-  http: {
-    flags: new Set(['-j', '--json', '-f', '--form', '-h', '--headers', '-b', '--body', '-v', '--verbose', '--check-status', '--ignore-stdin']),
-    values: new Set(['-p', '--print', '--timeout', '-o', '--output']),
-    localValue: new Set(['-o', '--output']),
-    shortFlags: 'jfhbv',
-    shortValues: 'po',
-    items: true,
-  },
-};
-SAFE_NET.https = SAFE_NET.http;
-SAFE_NET.xh = SAFE_NET.http;
-SAFE_NET.httpie = SAFE_NET.http;
+// Each program has a short list of options known to be safe (safe_net in
+// the rules file); any other option, attached or separate (a proxy, a
+// resolve override, a config file), blocks. Programs not listed there (nc,
+// socat, scp, ssh, rsync, telnet and the rest) are never allowed with a
+// secret.
 
 const HTTP_METHODS = /^(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/;
 
 // The destinations of one call on the safe list, or ok: false.
 function safeNetCall(c) {
-  const spec = SAFE_NET[c.name];
+  const spec = R().safeNet[c.name];
   if (!spec) return { ok: false };
   const dests = [];
   const localOk = (v) => typeof v === 'string' && v !== '' && !/^[a-z][a-z0-9+.-]*:/i.test(v) && !v.startsWith('-');
@@ -455,14 +486,14 @@ function isEnvDump(c) {
 }
 
 function checkExfil(command, cmds, { allowHosts }) {
-  const netCmds = cmds.filter((c) => NET_TOOLS.has(c.name));
+  const netCmds = cmds.filter((c) => R().netTools.has(c.name));
   const devTcp = DEV_TCP.test(command);
   if (!netCmds.length && !devTcp) return null;
-  if (SECRET_FILES.some((re) => re.test(command))) return block('exfil-secret-file', 'critical', 'blocked: this command reads a private key or secrets file and makes a network call. it could send your secrets out.', 'An agent tried to read a secrets file and make a network call in the same command. Nothing was sent.');
+  if (R().secretFiles.some((re) => re.test(command))) return block('exfil-secret-file', 'critical', 'blocked: this command reads a private key or secrets file and makes a network call. it could send your secrets out.', 'An agent tried to read a secrets file and make a network call in the same command. Nothing was sent.');
   if (/\/proc\/(?:self|\d+)\/environ/.test(command) || /\$\(\s*(?:env|printenv)\s*\)|`\s*(?:env|printenv)\s*`/.test(command) || cmds.some((c) => isEnvDump(c) && c.pipe.length > 1)) {
     return block('exfil-env-dump', 'critical', 'blocked: this command sends your whole environment over the network. it holds your keys.', 'An agent tried to send all environment variables over the network. Nothing was sent.');
   }
-  if (KEY_SHAPES.some((re) => re.test(command))) return block('exfil-key-literal', 'critical', 'blocked: this command puts a secret key into a network call.', 'An agent tried to send a string that looks like a secret key over the network. Nothing was sent.');
+  if (R().keyShapes.some((re) => re.test(command))) return block('exfil-key-literal', 'critical', 'blocked: this command puts a secret key into a network call.', 'An agent tried to send a string that looks like a secret key over the network. Nothing was sent.');
   if (carriesSecret(command, netCmds)) {
     let trusted = !devTcp && netCmds.length > 0;
     for (const c of netCmds) {
@@ -477,8 +508,6 @@ function checkExfil(command, cmds, { allowHosts }) {
 }
 
 const RM_TARGET_DANGER = new RegExp(`^(?:/|/\\*|${HOME_REF}/?|${HOME_REF}/\\*|/(?:Users|home|etc|usr|var|bin|sbin|lib|opt|System|Library|Applications|private)/?|\\.\\./?\\.\\./?.*)$`);
-const DB_CLIENTS = new Set(['psql', 'pg_restore', 'mysql', 'mariadb', 'sqlite3', 'sqlite', 'sqlcmd', 'mongosh', 'mongo', 'redis-cli', 'clickhouse-client', 'clickhouse', 'cockroach', 'duckdb', 'supabase', 'prisma', 'turso', 'wrangler', 'neonctl', 'cqlsh']);
-const DROP_TEXT = /\bdrop\s+(?:database|schema)\b|\.dropDatabase\s*\(|\bflushall\b|\bflushdb\b/i;
 
 function checkDestroy(command, cmds, { cwd, homeDirPath, gitBranch }) {
   for (const c of cmds) {
@@ -523,8 +552,8 @@ function checkDestroy(command, cmds, { cwd, homeDirPath, gitBranch }) {
   // Database deletion text counts only when a database client is in the
   // command to run it. Searching for it (rg, grep, cat) is fine.
   // A client run inside a container or over ssh counts too.
-  const viaRunner = (c) => ['docker', 'podman', 'kubectl', 'ssh', 'heroku', 'fly', 'flyctl', 'railway'].includes(c.name) && c.args.some((a) => DB_CLIENTS.has(path.basename(a)));
-  if (cmds.some((c) => DB_CLIENTS.has(c.name) || viaRunner(c)) && DROP_TEXT.test(command)) return block('destroy-database', 'critical', 'blocked: this deletes a whole database.', 'An agent tried to drop a database. Nothing was deleted.');
+  const viaRunner = (c) => ['docker', 'podman', 'kubectl', 'ssh', 'heroku', 'fly', 'flyctl', 'railway'].includes(c.name) && c.args.some((a) => R().dbClients.has(path.basename(a)));
+  if (cmds.some((c) => R().dbClients.has(c.name) || viaRunner(c)) && R().dropText.test(command)) return block('destroy-database', 'critical', 'blocked: this deletes a whole database.', 'An agent tried to drop a database. Nothing was deleted.');
   return null;
 }
 
@@ -547,7 +576,7 @@ function protectedTarget(word, ctx = {}) {
   const home = homeDir(ctx.env || process.env);
   const sentinel = path.join(home, '.atris', 'sentinel');
   if (/\/\.claude\/settings(?:\.local)?\.json$/.test(abs)) return 'settings';
-  if (/\/\.claude\/hooks\/sentinel-guard\.js$/.test(abs)) return 'guard';
+  if (/\/\.claude\/hooks\/sentinel-(?:guard\.js|rules\.json)$/.test(abs)) return 'guard';
   if (abs.startsWith(`${sentinel}/`) && /^(?:guard\.json|guard\.log|guard-errors\.log|queue\.jsonl.*|flush\.stamp)$/.test(path.basename(abs))) return 'guard';
   if (abs === sentinel || abs === path.join(home, '.atris') || abs === path.join(home, '.claude') || /\/\.claude(?:\/hooks)?$/.test(abs)) return 'folder';
   return null;
@@ -555,14 +584,12 @@ function protectedTarget(word, ctx = {}) {
 
 // Names that are protected wherever they sit, for commands that change
 // folder first (cd .claude && echo {} > settings.json).
-const PROTECTED_NAMES = /^(?:settings\.json|settings\.local\.json|sentinel-guard\.js|queue\.jsonl.*|guard\.json|guard\.log)$/;
+const PROTECTED_NAMES = /^(?:settings\.json|settings\.local\.json|sentinel-guard\.js|sentinel-rules\.json|queue\.jsonl.*|guard\.json|guard\.log)$/;
 
 // Programs that only read. A command that names a protected path anywhere
 // in its arguments (key=value forms like of= and attached options like
 // -ofile included) runs only when it is one of these. Everything else
 // blocks: dd, tee, cp, mv, sed, truncate, ln, install, rsync, interpreters.
-const READ_ONLY = new Set(['cat', 'less', 'more', 'head', 'tail', 'grep', 'egrep', 'fgrep', 'rg', 'jq', 'ls', 'stat', 'wc', 'file', 'diff', 'echo', 'test', '[', 'realpath', 'readlink']);
-const READ_ONLY_GIT = new Set(['diff', 'log', 'show', 'status']);
 
 function pathCandidates(arg) {
   const a = String(arg);
@@ -576,8 +603,8 @@ function pathCandidates(arg) {
 }
 
 function readOnlyCommand(c) {
-  if (READ_ONLY.has(c.name)) return true;
-  if (c.name === 'git') return READ_ONLY_GIT.has(gitSub(c.args).sub);
+  if (R().readOnly.has(c.name)) return true;
+  if (c.name === 'git') return R().readOnlyGit.has(gitSub(c.args).sub);
   return false;
 }
 
@@ -671,12 +698,38 @@ function currentBranch(cwd) {
 
 // The decision for one tool call. Pure apart from reading guard.json, the
 // settings file an edit targets, and the git branch for a bare force push.
-function decide(event, { env = process.env, gitBranch = currentBranch } = {}) {
+const BLOCK_REASON = {
+  exfil: ['blocked: this command matches a known way to send secrets out.', 'An agent ran a command that matches a known way to send secrets out. Nothing was sent.'],
+  destroy: ['blocked: this command matches a known destructive pattern.', 'An agent ran a command that matches a known destructive pattern. Nothing was run.'],
+  disarm: ['blocked: this command matches a known way to turn off a protection.', 'An agent ran a command that matches a known way to turn off a protection. Nothing changed.'],
+};
+
+// Literal command blocks from the rules file. Each block reads the whole
+// command with plain substring checks, limited to commands that run one of
+// its programs when it lists any. Linear time, no regular expression.
+function checkBlocks(command, cmds) {
+  for (const b of R().commandBlocks) {
+    if (b.programs && !cmds.some((c) => b.programs.has(c.name))) continue;
+    if (!b.all.every((sub) => command.includes(sub))) continue;
+    const [reason, detail] = BLOCK_REASON[b.category];
+    return block(`${b.category}-block`, b.category === 'disarm' ? 'high' : 'critical', reason, detail);
+  }
+  return null;
+}
+
+function decide(event, { env = process.env, gitBranch = currentBranch, rules = null } = {}) {
+  if (!rules) return decideWith(event, { env, gitBranch });
+  const prev = ACTIVE_RULES;
+  ACTIVE_RULES = compileRules(rules);
+  try { return decideWith(event, { env, gitBranch }); } finally { ACTIVE_RULES = prev; }
+}
+
+function decideWith(event, { env, gitBranch }) {
   const tool = String((event && event.tool_name) || '');
   const input = (event && event.tool_input && typeof event.tool_input === 'object') ? event.tool_input : {};
   const cwd = (event && event.cwd) || process.cwd();
   const cfg = loadConfig(env);
-  const allowHosts = [...DEFAULT_ALLOW_HOSTS, ...(Array.isArray(cfg.allow_hosts) ? cfg.allow_hosts.map((h) => String(h).toLowerCase()) : [])];
+  const allowHosts = [...R().allowHosts, ...(Array.isArray(cfg.allow_hosts) ? cfg.allow_hosts.map((h) => String(h).toLowerCase()) : [])];
   if (tool === 'Bash') {
     const command = String(input.command || '');
     if (!command.trim()) return { allow: true };
@@ -684,6 +737,7 @@ function decide(event, { env = process.env, gitBranch = currentBranch } = {}) {
     return checkExfil(command, cmds, { allowHosts })
       || checkDestroy(command, cmds, { cwd, homeDirPath: homeDir(env), gitBranch })
       || checkDisarm(command, cmds, { env, cwd })
+      || checkBlocks(command, cmds)
       || { allow: true };
   }
   if (tool === 'Edit' || tool === 'Write' || tool === 'MultiEdit' || tool === 'NotebookEdit') return checkEdit(tool, input, { env, cwd }) || { allow: true };
@@ -762,6 +816,9 @@ function recordBlock(event, decision, { env = process.env, now = new Date() } =
     'disarm-os': 'Sentinel stopped an agent from turning off a security protection.',
     'disarm-guard': 'Sentinel stopped an agent from turning off the guard.',
     'disarm-hooks': 'Sentinel stopped an agent from turning off hooks.',
+    'exfil-block': 'Sentinel stopped an agent from sending secrets out.',
+    'destroy-block': 'Sentinel stopped an agent from running a destructive command.',
+    'disarm-block': 'Sentinel stopped an agent from turning off a protection.',
   };
   appendLine(path.join(dir, 'queue.jsonl'), {
     kind: 'blocked', repo, severity: decision.severity || 'high',
@@ -861,6 +918,8 @@ function runSamples({ env = process.env, samples = SAMPLES } = {}) {
 
 module.exports = {
   GUARD_MARK,
+  RULES_FILE,
+  compileRules,
   MATCHER,
   decide,
   hookMain,