failproofai 1.0.7-beta.0 → 1.0.7-beta.2

package/dist/worker.mjs

@@ -708,7 +708,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
       description: "Prevent catastrophic deletions",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["destructive-deletion"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -739,7 +740,8 @@ var init_policy_catalog = __esm(() => {
       impact: "kubectl can change live cluster state — gated unless allow-listed.",
       description: "Block kubectl commands (Kubernetes cluster mutations)",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -756,7 +758,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
       description: "Block terraform and tofu (OpenTofu) commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -773,7 +776,8 @@ var init_policy_catalog = __esm(() => {
       impact: "AWS CLI can spend money or break prod — gated.",
       description: "Block aws CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -790,7 +794,8 @@ var init_policy_catalog = __esm(() => {
       impact: "gcloud can spend money or break prod — gated.",
       description: "Block gcloud (Google Cloud) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -807,7 +812,8 @@ var init_policy_catalog = __esm(() => {
       impact: "az can spend money or break prod — gated.",
       description: "Block az (Azure) CLI commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -824,7 +830,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Helm releases mutate cluster state — gated.",
       description: "Block helm commands",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["production-infra-change"],
       defaultEnabled: false,
       category: "Infra Commands",
       params: {
@@ -858,7 +865,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
       description: "Block writing secret key files",
       match: { events: ["PreToolUse"], toolNames: ["Write"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["secret-exposure"],
       defaultEnabled: false,
       category: "Dangerous Commands",
       params: {
@@ -892,7 +900,8 @@ var init_policy_catalog = __esm(() => {
       impact: "Force-pushes rewrite history and can clobber teammates' work.",
       description: "Prevent force-pushing to any branch",
       match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-      authority: "hard",
+      authority: "reviewable",
+      reviewedBy: ["git-history-rewrite"],
       defaultEnabled: false,
       category: "Git"
     },
@@ -934,6 +943,23 @@ var init_policy_catalog = __esm(() => {
       defaultEnabled: false,
       category: "Git"
     },
+    {
+      name: "warn-git-clean",
+      displayTitle: "Tried to delete untracked or ignored files with git clean",
+      impact: "`git clean -fdx` takes `.env`, local config and unstaged work — git never had a copy of any of it.",
+      description: "Warns before git clean deletes untracked directories (-d) or ignored files (-x / -X)",
+      match: { events: ["PreToolUse"], toolNames: ["Bash"] },
+      authority: "hard",
+      defaultEnabled: false,
+      category: "Git",
+      params: {
+        destructiveFlags: {
+          type: "string[]",
+          description: "git clean flag letters that make it worth warning about, checked alongside --force. Narrow to ['x','X'] to allow `git clean -fd`, or widen with 'f' to warn on a bare `git clean -f`.",
+          default: ["d", "x", "X"]
+        }
+      }
+    },
     {
       name: "warn-all-files-staged",
       displayTitle: "Staged all files with git add -A / .",
@@ -1136,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.7-beta.0";
+var version = "1.0.7-beta.2";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -2055,7 +2081,7 @@ function stripShellQuoting(command) {
   const ansiDecoded = joined.replace(/\$'((?:[^'\\]|\\.)*)'/g, (_, body) => decodeAnsiC(body));
   return ansiDecoded.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
 }
-function gitSubcommand(args) {
+function gitSubcommandIndex(args) {
   for (let i = 0;i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -2064,9 +2090,13 @@ function gitSubcommand(args) {
     }
     if (arg.startsWith("-"))
       continue;
-    return arg;
+    return i;
   }
-  return;
+  return -1;
+}
+function gitSubcommand(args) {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 function globCouldNameState(raw) {
   const stripped = raw.replace(/^[()]+|[()]+$/g, "");
@@ -3182,6 +3212,77 @@ function warnGitStashDrop(ctx) {
   }
   return allow();
 }
+function readGitCleanFlags(args) {
+  const letters = new Set;
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions)
+      continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--"))
+      continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token))
+      continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f")
+        force = true;
+      if (letter === "n")
+        dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force)
+    letters.add("f");
+  return { force, dryRun, letters };
+}
+function gitCleanForceWaived(globalOptions) {
+  for (let i = 0;i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value = token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value))
+      return true;
+  }
+  return false;
+}
+function warnGitClean(ctx) {
+  if (ctx.toolName !== "Bash")
+    return allow();
+  const destructiveFlags = ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS;
+  if (destructiveFlags.length === 0)
+    return allow();
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0)
+      continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean")
+      continue;
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    if (flags.dryRun)
+      continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx)))
+      continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f)))
+      continue;
+    return instruct("STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " + "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " + "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " + "Re-run it with --dry-run and confirm the exact paths with the user before executing.");
+  }
+  return allow();
+}
 function warnAllFilesStaged(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
@@ -3567,7 +3668,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SECRET_PATTERNS, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, SELF_ENTRY_PATH_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_STATE_PATH_RE, STATE_READ_COMMANDS, SHELL_KEYWORD_PREFIXES, LOOP_HEADER_RE, COPY_COMMANDS, OPERAND_WRITE_COMMANDS, SECOND_OPERAND_WRITERS, OUTPUT_FLAG_COMMANDS, FIND_WRITE_ACTIONS, SAFE_EXEC_COMMANDS, GIT_DESTRUCTIVE_SUBCOMMANDS, GIT_FLAGS_WITH_OPERANDS, STATE_MENTION_COMMANDS, FIND_EXEC_ACTIONS, PIPELINE_SEPARATORS, VAR_REFERENCE_RE, STATE_GLOB_CANDIDATES, GLOB_DECOYS, BRACE_EXPANSION_LIMIT = 4096, BRACE_EXPANSION_ROUNDS = 24, GLOB_METACHAR_RE, REDIRECT_TARGET_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_CMD_RE, SHORT_FLAG_CLUSTER_RE, GIT_CLEAN_FORCE_WAIVED_RE, GIT_CLEAN_DESTRUCTIVE_FLAGS, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, POLICY_IMPLEMENTATIONS, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_policy_catalog();
   init_policy_registry();
@@ -3836,6 +3937,10 @@ var init_builtin_policies = __esm(() => {
   FAILPROOFAI_UNINSTALL_RE = /(?:npm\s+(?:uninstall|remove|un|r)\s.*failproofai|bun\s+remove\s.*failproofai|yarn\s+global\s+remove\s+failproofai|pnpm\s+(?:remove|uninstall|un)\s.*failproofai)/;
   GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
   GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
+  GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+  SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+  GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+  GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
   GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
   NPM_GLOBAL_RE = /\bnpm\s+(?:install|i)\b(?=.*(?:\s-g\b|--global\b))/;
   YARN_GLOBAL_RE = /\byarn\s+global\s+add\b/;
@@ -3904,6 +4009,7 @@ var init_builtin_policies = __esm(() => {
     "block-work-on-main": blockWorkOnMain,
     "warn-git-amend": warnGitAmend,
     "warn-git-stash-drop": warnGitStashDrop,
+    "warn-git-clean": warnGitClean,
     "warn-all-files-staged": warnAllFilesStaged,
     "warn-destructive-sql": warnDestructiveSql,
     "warn-schema-alteration": warnSchemaAlteration,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "failproofai",
-  "version": "1.0.7-beta.0",
-  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+  "version": "1.0.7-beta.2",
+  "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
     "failproofaid": "./bin/failproofaid-shim.mjs"
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.0",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.0",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.0",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.0"
+    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
   },
   "failproofaidBinaries": {
-    "linux-x64": "3ac234868fe9149179c32981da9ae1209371e98df7ffb09c6a4947664a3d6857",
-    "linux-arm64": "3603faac5741c321a63ba5a963e0cb4bb38c84663a63b53f764faae020116f90",
-    "darwin-x64": "c8a5b32a1e97b5a7f76ce4e42c78f0d566d108be65fdca3c6cd59c405f39b946",
-    "darwin-arm64": "255ac741c3ee3069591b1eb8bbf397baa0722ef240b83a8540b73f3f1b35722c"
+    "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
+    "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
+    "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
+    "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
   }
 }

package/scripts/build-policy-pack.mjs

@@ -114,6 +114,20 @@ for (const policy of BUILTIN_POLICIES) {
     defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
+    // The parameter schema. It has to be registered here as well as written
+    // into the manifest this script builds, because there are TWO manifest
+    // producers for this pack and they have to agree: this script builds one
+    // from POLICY_CATALOG, and the publish command rebuilds one by importing
+    // the entry and reading back what it registered. A field the entry does
+    // not register is a field the second producer cannot know about.
+    //
+    // params is the one that fails silently STRICTER. Registration reads a
+    // pack policy's schema from the manifest, so an absent schema means the
+    // policy sees empty params: block-sudo's allowPatterns, and block-rm-rf's
+    // and block-read-outside-cwd's allowPaths, stop applying -- taking the
+    // user's own configured values with them. No backticks in this comment:
+    // see the note above entrySource.
+    ...(policy.params !== undefined ? { params: policy.params } : {}),
     // Whether Jev may clear it; see the note on authority at the top.
     ...(policy.authority !== undefined ? { authority: policy.authority } : {}),
     ...(policy.reviewedBy !== undefined ? { reviewedBy: policy.reviewedBy } : {}),

package/src/audit/features.ts

@@ -69,13 +69,13 @@ export const ARCHITECT_CAUTION_SIGNALS = new Set(["reread-after-edit", "redundan
 
 /**
  * Mapping from policy/detector short-name → which archetype its hits feed,
- * and how heavily (intensity within the cluster). Every one of the 39 builtin
+ * and how heavily (intensity within the cluster). Every one of the 40 builtin
  * policies and 8 audit-only detectors maps exactly once — no overlaps, full
  * coverage. Weights express *severity within* a persona; cross-persona
  * fairness is handled later by lift normalisation, not by these numbers.
  */
 export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: number }> = {
-  // ── cowboy ── destructive / forceful / bypasses guardrails (20) ───────────
+  // ── cowboy ── destructive / forceful / bypasses guardrails (21) ───────────
   "block-rm-rf":               { archetype: "cowboy", weight: 2.0 },
   "block-failproofai-commands":{ archetype: "cowboy", weight: 2.0 },
   "block-sudo":                { archetype: "cowboy", weight: 1.5 },
@@ -88,6 +88,7 @@ export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: numbe
   "git-commit-no-verify":      { archetype: "cowboy", weight: 1.5 },
   "warn-git-amend":            { archetype: "cowboy", weight: 0.8 },
   "warn-git-stash-drop":       { archetype: "cowboy", weight: 1.0 },
+  "warn-git-clean":            { archetype: "cowboy", weight: 1.0 },
   "warn-all-files-staged":     { archetype: "cowboy", weight: 0.6 },
   "block-kubectl":             { archetype: "cowboy", weight: 1.5 },
   "block-terraform":           { archetype: "cowboy", weight: 1.5 },

package/src/hooks/builtin-policies.ts

@@ -623,8 +623,15 @@ const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
  */
 const GIT_FLAGS_WITH_OPERANDS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"]);
 
-/** The `git` subcommand, with git's own global options walked off first. */
-function gitSubcommand(args: string[]): string | undefined {
+/**
+ * Where the `git` subcommand sits in `args`, with git's own global options
+ * walked off first, or `-1` when there is no subcommand at all.
+ *
+ * The index rather than the value, because a caller that wants to read the
+ * SUBCOMMAND's flags (`warnGitClean`) needs to know where they start, and
+ * `args.indexOf("clean")` would land on a `-C clean` operand instead.
+ */
+function gitSubcommandIndex(args: string[]): number {
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -632,9 +639,15 @@ function gitSubcommand(args: string[]): string | undefined {
       continue;
     }
     if (arg.startsWith("-")) continue;
-    return arg;
+    return i;
   }
-  return undefined;
+  return -1;
+}
+
+/** The `git` subcommand, with git's own global options walked off first. */
+function gitSubcommand(args: string[]): string | undefined {
+  const i = gitSubcommandIndex(args);
+  return i < 0 ? undefined : args[i];
 }
 
 /**
@@ -1379,6 +1392,48 @@ const GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
 // warnGitStashDrop
 const GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
 
+// warnGitClean
+/**
+ * `git`, however the command line spells it. Same shape as {@link RM_CMD_RE}:
+ * an absolute path to the binary does not change what it does.
+ */
+const GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
+
+/** A short-flag cluster: `-f`, `-fdx`, `-xdf`. */
+const SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
+
+/**
+ * `clean.requireForce=false`, the config that makes `git clean` delete with no
+ * `-f` at all — and settable per invocation as `git -c
+ * clean.requireForce=false clean -xd`. Reading the subcommand's flags alone
+ * would call that "no force, no warning" on the one spelling that needs none.
+ */
+const GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
+
+/**
+ * The default `destructiveFlags`, and why the condition is these three letters
+ * rather than "any `git clean`".
+ *
+ * `git clean` deletes nothing without `-f` / `--force` (or the config above),
+ * and `-n` / `--dry-run` only prints — so force is the precondition and
+ * dry-run is the exemption. What force ALONE removes is untracked files in the
+ * current directory: the narrowest spelling, and the one people mean when they
+ * tidy up. These are the letters that widen the blast radius past that:
+ *
+ * - `-x` also removes IGNORED files — `.env`, local config, editor state,
+ *   scratch work. That is the data that genuinely cannot be rebuilt by running
+ *   a command, and it is what makes `git clean -fdx` the severe spelling.
+ * - `-X` removes ONLY ignored files: the same loss, tracked tree untouched.
+ * - `-d` also removes untracked DIRECTORIES — whole new subtrees git has never
+ *   had a copy of.
+ *
+ * A bare `git clean -f` is deliberately absent. It has the smallest radius and
+ * by far the most traffic, and a guard that fires on the ordinary spelling is
+ * one people switch off — which would cost them the `-fdx` warning too. Add
+ * `"f"` to `destructiveFlags` to opt into it.
+ */
+const GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
+
 // warnAllFilesStaged
 const GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
 
@@ -2528,6 +2583,101 @@ function warnGitStashDrop(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/** What one `git clean` argument list asks for. */
+interface GitCleanFlags {
+  force: boolean;
+  dryRun: boolean;
+  /** Short-flag letters, with `--force` counted as `f` so widening works either way. */
+  letters: Set<string>;
+}
+
+/**
+ * Read `git clean`'s own options: clusters (`-fdx`) and the two long forms
+ * that matter (`--force`, `--dry-run`).
+ *
+ * Everything after `--` is a pathspec, not a flag — `git clean -n -- -fdx`
+ * asks about a file literally called `-fdx` and deletes nothing.
+ */
+function readGitCleanFlags(args: string[]): GitCleanFlags {
+  const letters = new Set<string>();
+  let force = false;
+  let dryRun = false;
+  let sawEndOfOptions = false;
+  for (const token of args) {
+    if (token === "--") {
+      sawEndOfOptions = true;
+      continue;
+    }
+    if (sawEndOfOptions) continue;
+    if (token === "--force") {
+      force = true;
+      continue;
+    }
+    if (token === "--dry-run") {
+      dryRun = true;
+      continue;
+    }
+    if (token.startsWith("--")) continue;
+    if (!SHORT_FLAG_CLUSTER_RE.test(token)) continue;
+    for (const letter of token.slice(1)) {
+      if (letter === "f") force = true;
+      if (letter === "n") dryRun = true;
+      letters.add(letter);
+    }
+  }
+  if (force) letters.add("f");
+  return { force, dryRun, letters };
+}
+
+/** True when git's own `-c key=value` options waive `clean.requireForce`. */
+function gitCleanForceWaived(globalOptions: string[]): boolean {
+  for (let i = 0; i < globalOptions.length; i++) {
+    const token = globalOptions[i];
+    const value =
+      token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
+    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value)) return true;
+  }
+  return false;
+}
+
+/**
+ * The gap this closes: `git clean -fdx` was caught by NEITHER tier — no regex
+ * builtin matched the string at all, and the semantic check that covers
+ * unrecoverable deletion cannot fire on it. See the note on the catalog entry
+ * for the measurement and for why this policy is `hard`.
+ */
+function warnGitClean(ctx: PolicyContext): PolicyResult {
+  if (ctx.toolName !== "Bash") return allow();
+  const destructiveFlags = ((ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS) as string[]);
+  if (destructiveFlags.length === 0) return allow();
+
+  for (const segment of shellSegments(getCommand(ctx))) {
+    const tokens = parseArgvTokens(segment);
+    // `findIndex`, not `tokens[0]`, so an env prefix (`GIT_DIR=x git clean …`)
+    // and an absolute binary path both still resolve to the git invocation.
+    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
+    if (gitIdx < 0) continue;
+    const args = tokens.slice(gitIdx + 1);
+    const subIdx = gitSubcommandIndex(args);
+    if (subIdx < 0 || args[subIdx] !== "clean") continue;
+
+    const flags = readGitCleanFlags(args.slice(subIdx + 1));
+    // `-n` / `--dry-run` prints what would go and removes nothing, whatever
+    // else is on the line — the safe inspection form, never a warning.
+    if (flags.dryRun) continue;
+    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx))) continue;
+    if (!destructiveFlags.some((f) => flags.letters.has(f))) continue;
+
+    return instruct(
+      "STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " +
+        "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " +
+        "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " +
+        "Re-run it with --dry-run and confirm the exact paths with the user before executing.",
+    );
+  }
+  return allow();
+}
+
 function warnAllFilesStaged(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
@@ -3090,7 +3240,7 @@ function requireCiGreenBeforeStop(ctx: PolicyContext): PolicyResult {
  * Each value is the identical hoisted function object, never a wrapper. Two
  * things depend on that and neither fails loudly: `audit/cache.ts` hashes
  * `fn.toString()` into the audit cache's `engineVersion`, so wrapping every
- * entry would collapse 39 distinct hashes into one and freeze the key — stale
+ * entry would collapse 40 distinct hashes into one and freeze the key — stale
  * audit results would then be served for the full 30-day TTL with no symptom;
  * and `gitBranchCache` is module-scoped, so a per-call factory would silently
  * reset it on every hook event.
@@ -3121,6 +3271,7 @@ const POLICY_IMPLEMENTATIONS: Record<string, PolicyFunction> = {
   "block-work-on-main": blockWorkOnMain,
   "warn-git-amend": warnGitAmend,
   "warn-git-stash-drop": warnGitStashDrop,
+  "warn-git-clean": warnGitClean,
   "warn-all-files-staged": warnAllFilesStaged,
   "warn-destructive-sql": warnDestructiveSql,
   "warn-schema-alteration": warnSchemaAlteration,

package/src/hooks/jev-cli.ts

@@ -345,6 +345,29 @@ function providerForUrl(url: string): JevProviderKind {
   }
 }
 
+/**
+ * The account id a Cloudflare URL already carries, or null.
+ *
+ * Cloudflare's run endpoint IS per-account — `…/client/v4/accounts/<id>/ai/run`
+ * — so the id is in the canonical URL, and asking for it again as a flag asks
+ * for something the person has already typed. The first real attempt to
+ * configure Cloudflare pasted exactly that URL and was refused with "pass the
+ * account id as well", with the id visible in the string being rejected.
+ *
+ * Read from the path only, never from a query or fragment, and only on a host
+ * this build already recognises as Cloudflare's, so nothing else can inject one.
+ */
+export function accountIdFromUrl(url: string): string | null {
+  try {
+    const parsed = new URL(url);
+    if (PROVIDER_BY_HOST[parsed.hostname.toLowerCase()] !== "cloudflare") return null;
+    const m = /\/accounts\/([0-9a-f]{32})(?:\/|$)/i.exec(parsed.pathname);
+    return m ? m[1].toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Whether a validated URL is exactly where this provider's requests already go. */
 function isProviderDefaultUrl(kind: JevProviderKind, url: string): boolean {
   const base = JEV_PROVIDER_DEFAULTS[kind].baseUrl;
@@ -468,6 +491,34 @@ async function setup(argv: string[], deps: JevCliDeps, opts: RenderOpts): Promis
     }
     const kind = explicit ?? urlProvider.kind;
     if (explicit === null) values.set("--provider", kind);
+    // Cloudflare's endpoint IS per-account, so the run URL copied out of the
+    // dashboard already names the account. Read it from there rather than
+    // demanding a value that is sitting in the string being read — the first
+    // person to configure Cloudflare pasted exactly that URL and was told to
+    // "pass the account id as well", with the id visible in the refusal.
+    //
+    // Set into `values` here, while the URL is still in scope, because the
+    // block below deletes `--url` once it has moved the address to
+    // `--base-url`. Everything downstream then treats it as a flag that was
+    // given, including the 32-hex validation.
+    if (kind === "cloudflare") {
+      const fromUrl = accountIdFromUrl(normalized);
+      const given = values.get("--account-id");
+      if (fromUrl !== null && given === undefined) {
+        values.set("--account-id", fromUrl);
+      } else if (fromUrl !== null && given !== undefined && given.toLowerCase() !== fromUrl) {
+        // Preferring either one silently would send every request to an account
+        // the person did not name on the line they are looking at.
+        return fail([
+          "Not saved: --account-id and the account id in --url are different.",
+          `  --url names ${fromUrl}`,
+          `  --account-id names ${given.toLowerCase()}`,
+          "Drop one of them.",
+          "",
+          "Nothing was written.",
+        ]);
+      }
+    }
     // The provider's own API is where its key belongs anyway, so a URL naming
     // it clears the override instead of writing the same address into the file
     // (`custom` has no API of its own — its URL is the whole address).
@@ -546,9 +597,14 @@ async function setup(argv: string[], deps: JevCliDeps, opts: RenderOpts): Promis
   // host with another provider asked for is settled above, and nothing here
   // demands an id the file would not keep.
   if (kind === "cloudflare" && urlProvider?.kind === "cloudflare" && typeof next.accountId !== "string") {
+    // Reached only when the URL did not carry one either — a bare
+    // `/client/v4`, say. The URL form is named as well as the flag, because it
+    // is the address the dashboard hands out.
     return fail([
       `Not saved: ${urlProvider.host} is Cloudflare Workers AI, whose endpoint is per-account.`,
-      "Pass the account id as well: --account-id <32 hex characters>.",
+      "Pass the account id as well: --account-id <32 hex characters>,",
+      "or give the full run URL, which already contains it:",
+      "  https://api.cloudflare.com/client/v4/accounts/<id>/ai/run",
       "",
       "Nothing was written.",
     ]);

package/src/hooks/manager.ts

@@ -1108,7 +1108,7 @@ export async function listHooks(cwd?: string): Promise<void> {
   // `packCount` counts ENABLED policies, so a pack installed with everything
   // switched off reaches zero the same way an empty machine does — and the
   // advice for the two could not be more different. Telling somebody who has
-  // just unticked all 38 to `policies add FailproofAI/policies` sends them to
+  // just unticked all 39 to `policies add FailproofAI/policies` sends them to
   // install what they already have, and doing it would change nothing: the
   // selection is what is empty, not the shelf.
   const packsInstalled = (() => {