pi-opa-net 0.1.0 → 0.3.0

package/src/config/Config.ts

@@ -23,6 +23,12 @@ export interface EngineConfig {
   readonly hostname?: string;
   /** Calling session ID for metadata (pi/claude session). Empty if none. */
   readonly sessionId?: string;
+  /** Unlock keys from PIOPANET_UNLOCK_KEYS / --unlock (comma-separated env). */
+  readonly unlockKeys?: readonly string[];
+  /** Path to the deploy-local salt file (or PIOPANET_UNLOCK_SALT override). */
+  readonly unlockSaltPath?: string;
+  /** Agent ID for unlock audit metadata (PIOPANET_AGENT_ID). */
+  readonly unlockAgentId?: string;
 }
 
 const ENV = process.env;
@@ -63,9 +69,25 @@ function readdirSafe(path: string): string[] {
 export function configFromEnv(policyPath: string): EngineConfig {
   const failMode: FailMode = (ENV.PI_OPA_FAIL_MODE as FailMode) === 'closed' ? 'closed' : 'open';
   const timeoutMs = ENV.PI_OPA_TIMEOUT_MS ? Number.parseInt(ENV.PI_OPA_TIMEOUT_MS, 10) : 250;
-  const cacheTtlMs = ENV.PI_OPA_CACHE_TTL_MS
+  const baseCacheTtlMs = ENV.PI_OPA_CACHE_TTL_MS
     ? Number.parseInt(ENV.PI_OPA_CACHE_TTL_MS, 10)
     : DEFAULT_CACHE_TTL_MS;
+
+  // Unlock keys: PIOPANET_UNLOCK_KEYS (comma-separated, trimmed).
+  const unlockKeys = (ENV.PIOPANET_UNLOCK_KEYS ?? '')
+    .split(',')
+    .map((k) => k.trim())
+    .filter((k) => k.length > 0);
+
+  // LD-G3: force cacheTtlMs=0 when unlock keys are present (cache poisoning guard).
+  const cacheTtlMs = unlockKeys.length > 0 ? 0 : baseCacheTtlMs;
+
+  // Salt path: PIOPANET_UNLOCK_SALT or PIOPANET_UNLOCK_SALT_FILE → default ~/.pi-opa-net/salt.
+  const unlockSaltPath =
+    ENV.PIOPANET_UNLOCK_SALT ?? ENV.PIOPANET_UNLOCK_SALT_FILE ?? defaultSaltPath();
+
+  const unlockAgentId = ENV.PIOPANET_AGENT_ID;
+
   return {
     opaBinary: resolveOpaBinary(),
     policyPath,
@@ -74,5 +96,14 @@ export function configFromEnv(policyPath: string): EngineConfig {
     cacheTtlMs,
     hostname: ENV.PI_OPA_HOSTNAME,
     sessionId: ENV.PI_OPA_SESSION_ID,
+    unlockKeys,
+    unlockSaltPath,
+    unlockAgentId,
   };
 }
+
+/** Default salt file path: ~/.pi-opa-net/salt. */
+function defaultSaltPath(): string {
+  const home = ENV.HOME ?? process.env.HOME ?? '';
+  return `${home}/.pi-opa-net/salt`;
+}

package/src/output/DecisionBuilder.ts

@@ -4,13 +4,21 @@ import type { EngineConfig } from '../config/Config.ts';
 import type { EngineDecision, RawDeny } from '../engine/types.ts';
 import type { ParsedCommand } from '../parser/types.ts';
 import { type RuleMeta, type RuleRegistry, inferFamilyFromProgram } from '../rules/index.ts';
+import type { UnlockResult } from '../unlock/types.ts';
 
 /** The schema-compliant decision output (decision-output.v1). */
 export interface DecisionOutput {
   readonly schema_version: '1.0';
   readonly decision: 'allow' | 'deny';
   readonly action: 'allow' | 'block' | 'prompt_user' | 'log_only';
-  readonly source: 'opa' | 'fail-open' | 'fail-closed' | 'cached';
+  readonly source:
+    | 'opa'
+    | 'fail-open'
+    | 'fail-closed'
+    | 'cached'
+    | 'opa-unlocked'
+    | 'fail-open-keyless'
+    | 'unlock-filter-error';
   readonly reasons: readonly Reason[];
   readonly input: EvaluatedInput;
   readonly summary: string;
@@ -26,6 +34,11 @@ export interface Reason {
   readonly message: string;
   readonly family: string;
   readonly severity: 'block' | 'warn' | 'info';
+  readonly bypassed?: boolean;
+  readonly unlock_key_id?: string;
+  readonly unlock_key_type?: 'll' | 'ttl';
+  readonly unlock_expires_at?: string;
+  readonly unlock_status?: 'valid' | 'expired';
 }
 
 export interface EvaluatedInput {
@@ -43,6 +56,9 @@ export interface DecisionMetadata {
   readonly policy_path: string;
   readonly hostname: string;
   readonly session_id: string;
+  readonly unlock_count?: number;
+  readonly unlock_blocked_count?: number;
+  readonly unlock_agent?: string;
 }
 
 export interface DecisionBuilderDeps {
@@ -70,15 +86,49 @@ export class DecisionBuilder {
     this.deps = deps;
   }
 
-  build(parsed: ParsedCommand, engine: EngineDecision): DecisionOutput {
-    const reasons = engine.decision === 'deny' ? this.buildReasons(engine.reasons, parsed) : [];
+  build(
+    parsed: ParsedCommand,
+    engine: EngineDecision,
+    opts?: { unlockResult?: UnlockResult },
+  ): DecisionOutput {
+    const unlockResult = opts?.unlockResult;
+    const reasons =
+      engine.decision === 'deny' ? this.buildReasons(engine.reasons, parsed, unlockResult) : [];
     const suggestions = this.collectSuggestions(reasons);
-    const action = engine.decision === 'allow' ? 'allow' : 'block';
+
+    // Determine source and decision based on unlock result.
+    let source: DecisionOutput['source'] = engine.source;
+    let decision = engine.decision;
+    if (unlockResult && unlockResult.bypassedCount > 0 && unlockResult.blockedCount === 0) {
+      source = 'opa-unlocked';
+      decision = 'allow';
+    }
+
+    const action = decision === 'allow' ? 'allow' : 'block';
+
+    // Build metadata with optional unlock fields.
+    const metadata: DecisionMetadata = {
+      engine: 'opa',
+      opa_version: engine.opaVersion,
+      rulebook_digest: this.deps.digest,
+      policy_path: this.deps.config.policyPath,
+      hostname: this.deps.config.hostname ?? osHostname(),
+      session_id: this.deps.config.sessionId ?? '',
+    };
+    if (unlockResult) {
+      const meta = metadata as unknown as Record<string, unknown>;
+      meta.unlock_count = unlockResult.bypassedCount;
+      meta.unlock_blocked_count = unlockResult.blockedCount;
+      if (this.deps.config.unlockAgentId) {
+        meta.unlock_agent = this.deps.config.unlockAgentId;
+      }
+    }
+
     return {
       schema_version: '1.0',
-      decision: engine.decision,
+      decision,
       action,
-      source: engine.source,
+      source,
       reasons,
       input: {
         raw: parsed.raw,
@@ -89,29 +139,50 @@ export class DecisionBuilder {
       },
       summary: this.summary(engine, parsed, reasons),
       suggestions,
-      metadata: {
-        engine: 'opa',
-        opa_version: engine.opaVersion,
-        rulebook_digest: this.deps.digest,
-        policy_path: this.deps.config.policyPath,
-        hostname: this.deps.config.hostname ?? osHostname(),
-        session_id: this.deps.config.sessionId ?? '',
-      },
+      metadata,
       evaluated_at: (this.deps.now ?? (() => new Date()))().toISOString(),
       decision_id: (this.deps.uuid ?? randomUUID)(),
       duration_ms: engine.durationMs,
     };
   }
 
-  private buildReasons(raw: readonly RawDeny[], parsed: ParsedCommand): Reason[] {
-    return raw.map((d) => {
-      const meta = this.deps.registry.lookup(d);
-      return {
+  private buildReasons(
+    raw: readonly RawDeny[],
+    parsed: ParsedCommand,
+    unlockResult?: UnlockResult,
+  ): Reason[] {
+    return raw.map((d, i) => {
+      const familyHint = inferFamilyFromProgram(parsed.program);
+      const meta = this.deps.registry.lookup(d, familyHint, parsed.args);
+      const reason: Record<string, unknown> = {
         rule_id: meta.ruleId,
         message: meta.message,
         family: this.resolveFamily(meta, parsed),
-        severity: 'block' as const,
+        severity: 'block',
       };
+
+      // Merge unlock info if available.
+      if (unlockResult && i < unlockResult.reasons.length) {
+        const info = unlockResult.reasons[i];
+        if (info.bypassed) {
+          reason.bypassed = true;
+          reason.severity = 'info'; // Demote bypassed reason severity.
+        }
+        const keyId = info.unlockKeyId ?? info.unlock_key_id;
+        if (keyId) reason.unlock_key_id = keyId;
+        const keyType = info.keyType ?? info.unlock_key_type;
+        if (keyType) reason.unlock_key_type = keyType;
+        const exp = info.expiresAt ?? info.unlock_expires_at;
+        if (typeof exp === 'number') {
+          reason.unlock_expires_at = new Date(exp * 1000).toISOString();
+        } else if (typeof exp === 'string') {
+          reason.unlock_expires_at = exp;
+        }
+        const status = info.unlockStatus ?? info.unlock_status;
+        if (status) reason.unlock_status = status;
+      }
+
+      return reason as unknown as Reason;
     });
   }
 

package/src/pi/audit.ts

@@ -0,0 +1,81 @@
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { resolve } from 'node:path';
+import type { DecisionOutput } from '../output/DecisionBuilder.ts';
+
+/**
+ * Redact common secret patterns from a command string before audit.
+ * - Bearer tokens / Authorization headers
+ * - API keys (sk-... long hex/alnum)
+ */
+export function redactSecrets(text: string): string {
+  let out = text;
+  // Authorization: Bearer <token>
+  out = out.replace(/(Bearer\s+)([A-Za-z0-9._\-]+)/gi, '$1[REDACTED]');
+  // Generic sk-<token> (Stripe/Anthropic/etc API keys)
+  out = out.replace(/\bsk-[A-Za-z0-9_\-]{6,}/g, 'sk-[REDACTED]');
+  return out;
+}
+
+/**
+ * Audit sink bridge — writes one JSONL line per decision.
+ *
+ * Test/unit injectable: tests pass an `auditSink` with a captured `write`.
+ * Production wires this to a real filesystem sink (JSONL append).
+ */
+export interface AuditSink {
+  write: (entry: unknown) => Promise<void>;
+}
+
+export interface WriteAuditEntryInput {
+  sessionId: string | undefined;
+  decision: Pick<
+    DecisionOutput,
+    'decision' | 'source' | 'reasons' | 'input' | 'evaluated_at' | 'decision_id'
+  >;
+  auditSink: AuditSink;
+}
+
+interface AuditEntry {
+  decision_id: string;
+  decision: string;
+  source: string;
+  command: string;
+  rule_ids: string[];
+  evaluated_at: string;
+}
+
+export async function writeAuditEntry(input: WriteAuditEntryInput): Promise<void> {
+  if (!input.sessionId) return;
+
+  const entry: AuditEntry = {
+    decision_id: input.decision.decision_id,
+    decision: input.decision.decision,
+    source: input.decision.source,
+    command: redactSecrets(input.decision.input.raw),
+    rule_ids: input.decision.reasons.map((r) => r.rule_id),
+    evaluated_at: input.decision.evaluated_at,
+  };
+
+  await input.auditSink.write(entry);
+}
+
+/**
+ * Default filesystem audit sink — appends JSONL to `${cwd}/.pi-opa-net/audit/${decision_id}.jsonl`.
+ * Production wires this when ctx.auditSink is not injected.
+ */
+export function createFilesystemAuditSink(cwd: string): AuditSink {
+  const auditDir = resolve(cwd, '.pi-opa-net', 'audit');
+  return {
+    write: async (entry: unknown) => {
+      try {
+        mkdirSync(auditDir, { recursive: true });
+        const decisionId = (entry as { decision_id?: string }).decision_id ?? 'unknown';
+        const logPath = resolve(auditDir, `${decisionId}.jsonl`);
+        appendFileSync(logPath, `${JSON.stringify(entry)}\n`);
+      } catch {
+        // Audit write failure is non-fatal — log to stderr and continue.
+        console.error('[pi-opa-net] audit write failed, continuing without audit');
+      }
+    },
+  };
+}

package/src/pi/index.ts

@@ -0,0 +1,33 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { registerToolCallEvent } from './tool-call.ts';
+
+type PiExtensionApi = Parameters<typeof registerToolCallEvent>[0];
+
+/**
+ * Auto-discover the rule/policy config shipped alongside the pi agent.
+ *
+ * Mirrors pi-safety-net/src/pi/index.ts: derives agent dir from PI_CODING_AGENT_DIR
+ * or PI_SESSION_FILE (sessions/ parent), checks for a `<agentDir>/pi-opa-net/rules/`
+ * candidate, and sets PIOPANET_HOME so the engine picks it up zero-config.
+ */
+function autoDiscoverOpaNetHome(): void {
+  if (process.env.PIOPANET_HOME) return;
+  const agentDir =
+    process.env.PI_CODING_AGENT_DIR ||
+    (process.env.PI_SESSION_FILE && dirname(dirname(process.env.PI_SESSION_FILE)));
+  if (!agentDir) return;
+  const candidate = join(agentDir, 'pi-opa-net');
+  if (existsSync(join(candidate, 'rules'))) {
+    process.env.PIOPANET_HOME = candidate;
+  }
+}
+
+export default function piOpaNetExtension(pi: PiExtensionApi): void {
+  autoDiscoverOpaNetHome();
+  registerToolCallEvent(pi);
+}
+
+// Re-export for direct unit-test access.
+export { handlePiToolCall, registerToolCallEvent } from './tool-call.ts';
+export type { PiToolCallContext, PiToolCallResult } from './tool-call.ts';

package/src/pi/tool-call.ts

@@ -0,0 +1,193 @@
+import { spawn } from 'node:child_process';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import type { DecisionOutput } from '../output/DecisionBuilder.ts';
+import { type AuditSink, createFilesystemAuditSink, writeAuditEntry } from './audit.ts';
+
+/** Fail-closed block reason — mirrors pi-safety-net's REASON_SAFETY_NET_FAILED_CLOSED. */
+export const REASON_OPA_NET_FAILED_CLOSED =
+  'OPA-Net fail-closed: command evaluation failed unexpectedly.';
+
+/** Reason prefix for malformed shell tool input. */
+const REASON_MALFORMED_SHELL_INPUT =
+  'OPA-Net fail-closed: shell tool call input missing required command field.';
+
+type PiApi = {
+  on: (
+    event: 'tool_call',
+    handler: (event: unknown, ctx: PiToolCallContext) => Promise<PiToolCallResult>,
+  ) => void;
+};
+
+export type EvalOpts = { cwd?: string; env?: NodeJS.ProcessEnv };
+
+export type PiToolCallContext = {
+  cwd: string;
+  sessionManager: {
+    getSessionFile: () => string | undefined;
+  };
+  /**
+   * Inject-able eval function. Unit tests pass a stub. Production wires this
+   * to the real `bin/pi-opa-net.js eval` subprocess.
+   */
+  opaNetEvalCommand?: (command: string, opts?: EvalOpts) => Promise<DecisionOutput>;
+  /** Optional audit sink for test capture. Production wires filesystem sink. */
+  auditSink?: AuditSink;
+  /** Reserved for future config passthrough. */
+  opaNetConfigOptions?: Record<string, unknown>;
+};
+
+export type PiToolCallResult = { block: true; reason: string } | undefined;
+
+type PiToolCallEvent = {
+  type?: string;
+  toolName?: string;
+  input?: Record<string, unknown>;
+};
+
+type PiShellToolAdapter = {
+  commandField: string;
+  cwdField?: string;
+};
+
+const PI_SHELL_TOOL_ADAPTERS: Partial<Record<string, PiShellToolAdapter>> = {
+  bash: { commandField: 'command' },
+  Shell: { commandField: 'command', cwdField: 'working_directory' },
+};
+
+type PiShellToolCall = { command: string; cwd: string } | { malformed: true };
+
+export function registerToolCallEvent(pi: PiApi): void {
+  pi.on('tool_call', handlePiToolCall);
+}
+
+function isStrictMode(): boolean {
+  return process.env.PIOPANET_STRICT === '1';
+}
+
+/**
+ * Default subprocess eval — spawns `bin/pi-opa-net.js eval "<cmd>" --json`
+ * and parses stdout as DecisionOutput. This is the production bridge:
+ * without this, the handler has no way to evaluate commands.
+ *
+ * Mirrors pi-safety-net's `?? analyzeCommand` default.
+ */
+async function defaultEvalCommand(command: string, opts?: EvalOpts): Promise<DecisionOutput> {
+  const binPath = resolve(fileURLToPath(import.meta.url), '../../../bin/pi-opa-net.js');
+  const cwd = opts?.cwd ?? process.cwd();
+
+  return new Promise((accept, reject) => {
+    const child = spawn('bun', [binPath, 'eval', command, '--json'], {
+      cwd,
+      env: opts?.env ?? process.env,
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (d: Buffer) => {
+      stdout += d.toString();
+    });
+    child.stderr.on('data', (d: Buffer) => {
+      stderr += d.toString();
+    });
+    child.on('error', reject);
+    child.on('close', (code: number | null) => {
+      if (code !== 0 && code !== 2) {
+        // Exit code 0 = allow, 2 = deny. Anything else = subprocess error.
+        reject(new Error(`pi-opa-net eval exited ${code}: ${stderr}`));
+        return;
+      }
+      try {
+        const decision = JSON.parse(stdout.trim()) as DecisionOutput;
+        accept(decision);
+      } catch (err) {
+        reject(
+          new Error(`pi-opa-net eval non-JSON stdout: ${stdout.slice(0, 200)}\nstderr: ${stderr}`),
+        );
+      }
+    });
+  });
+}
+
+/** @internal — exported for test coverage */
+export async function handlePiToolCall(
+  event: unknown,
+  ctx: PiToolCallContext,
+): Promise<PiToolCallResult> {
+  const shellToolCall = getPiShellToolCall(event, ctx);
+  if (!shellToolCall) return undefined;
+
+  if ('malformed' in shellToolCall) {
+    return blockPiToolCall(REASON_MALFORMED_SHELL_INPUT);
+  }
+
+  const { command, cwd } = shellToolCall;
+
+  // Use injected eval OR default subprocess eval.
+  const evalCommand = ctx.opaNetEvalCommand ?? defaultEvalCommand;
+
+  let decision: DecisionOutput;
+  try {
+    decision = await evalCommand(command, { cwd });
+  } catch {
+    // Fork fail-open default: do not brick the agent on eval errors.
+    if (isStrictMode()) {
+      return blockPiToolCall(REASON_OPA_NET_FAILED_CLOSED, command);
+    }
+    return undefined;
+  }
+
+  // Allow + log_only: proceed (with audit).
+  // opa-unlocked: engine already filtered — plugin trusts it.
+  // fail-open / cached: degraded paths — proceed silently.
+  if (
+    decision.decision === 'allow' ||
+    decision.action === 'allow' ||
+    decision.action === 'log_only'
+  ) {
+    return undefined;
+  }
+
+  // Deny + block: translate + audit + block.
+  if (decision.decision === 'deny' && decision.action === 'block') {
+    const sessionId = ctx.sessionManager.getSessionFile();
+    if (sessionId) {
+      const auditSink = ctx.auditSink ?? createFilesystemAuditSink(cwd);
+      await writeAuditEntry({
+        sessionId,
+        decision,
+        auditSink,
+      });
+    }
+    return blockPiToolCall(formatBlockReason(decision), command);
+  }
+
+  // prompt_user (reserved v2) — treat as allow for now.
+  return undefined;
+}
+
+function getPiShellToolCall(event: unknown, ctx: PiToolCallContext): PiShellToolCall | undefined {
+  if (!event || typeof event !== 'object') return undefined;
+  const toolCall = event as PiToolCallEvent;
+  if (typeof toolCall.toolName !== 'string') return undefined;
+
+  const adapter = PI_SHELL_TOOL_ADAPTERS[toolCall.toolName];
+  if (!adapter) return undefined;
+  if (!toolCall.input || typeof toolCall.input !== 'object') return { malformed: true };
+
+  const command = toolCall.input[adapter.commandField];
+  if (typeof command !== 'string') return { malformed: true };
+
+  const cwdInput = adapter.cwdField ? toolCall.input[adapter.cwdField] : undefined;
+  const cwd = typeof cwdInput === 'string' ? resolve(ctx.cwd, cwdInput) : ctx.cwd;
+  return { command, cwd };
+}
+
+function formatBlockReason(decision: DecisionOutput): string {
+  const reasons = decision.reasons.map((r) => `${r.rule_id}: ${r.message}`).join('; ');
+  const header = decision.summary || 'BLOCKED by OPA-Net';
+  return `${header}\nReason: ${reasons}\nRule family: ${decision.reasons[0]?.family ?? 'unknown'}`;
+}
+
+function blockPiToolCall(reason: string, _command?: string): PiToolCallResult {
+  return { block: true, reason };
+}

package/src/rules/RuleRegistry.ts

@@ -10,7 +10,10 @@ export type RuleFamily =
   | 'glab'
   | 'bd'
   | 'builtin'
-  | 'custom';
+  | 'custom'
+  | 'tmux'
+  | 'pkill'
+  | 'killall';
 
 export interface RuleMeta {
   readonly ruleId: string;
@@ -18,6 +21,15 @@ export interface RuleMeta {
   readonly message: string;
   /** Safe alternatives for the "did you mean?" UX. Optional. */
   readonly suggestions?: readonly string[];
+  /**
+   * Disambiguation tokens used ONLY when multiple registered rules share an
+   * identical message AND family (collision). If any of these tokens appears
+   * in the parsed command's args, this candidate wins. Only needed for rules
+   * whose reason text is byte-identical to a sibling rule's (e.g.
+   * block-tmux-kill-server vs block-tmux-kill-session, which share the same
+   * verbatim reason and family 'tmux').
+   */
+  readonly matchArgs?: readonly string[];
 }
 
 /**
@@ -28,20 +40,51 @@ export interface RuleMeta {
  * so audits trace decision → rule → source line. Messages not in the registry
  * fall back to a synthesized `custom:<hash>` id with family=custom.
  *
+ * Multiple rules MAY share an identical message (e.g. the four
+ * tmux/pkill/killall session-kill rules all carry the same verbatim reason
+ * text). Such collisions are stored as a list and resolved by family hint
+ * (inferred from the parsed program) when one is supplied to lookup().
+ *
  * Keeping this in TS (not rego) is intentional: rego is the policy, this is the
  * provenance metadata layer. DRY — one canonical list, consumed by the builder.
  */
 export class RuleRegistry {
-  private readonly byMessage: Map<string, RuleMeta>;
+  private readonly byMessage: Map<string, RuleMeta[]>;
 
   constructor(rules: readonly RuleMeta[]) {
-    this.byMessage = new Map(rules.map((r) => [r.message, r]));
+    this.byMessage = new Map<string, RuleMeta[]>();
+    for (const r of rules) {
+      const arr = this.byMessage.get(r.message) ?? [];
+      arr.push(r);
+      this.byMessage.set(r.message, arr);
+    }
   }
 
-  /** Look up metadata for a deny message; synthesizes a custom entry if unknown. */
-  lookup(deny: RawDeny): RuleMeta {
-    const found = this.byMessage.get(deny.message);
-    if (found) return found;
+  /**
+   * Look up metadata for a deny message; synthesizes a custom entry if unknown.
+   *
+   * Collision resolution order when several registered rules share the same
+   * message:
+   *   1. `familyHint` (inferred from the parsed program) narrows to that family.
+   *   2. `parsedArgs` narrows further to a candidate whose `matchArgs` intersects
+   *      the parsed args (for rules that share message AND family, e.g. the two
+   *      tmux kill-* rules).
+   *   3. Otherwise the first remaining candidate is returned.
+   */
+  lookup(deny: RawDeny, familyHint?: string, parsedArgs?: readonly string[]): RuleMeta {
+    const candidates = this.byMessage.get(deny.message);
+    if (candidates && candidates.length > 0) {
+      let pool = candidates;
+      if (familyHint) {
+        const byFamily = pool.filter((c) => c.family === familyHint);
+        if (byFamily.length > 0) pool = byFamily;
+      }
+      if (parsedArgs && pool.length > 1) {
+        const byArgs = pool.filter((c) => c.matchArgs?.some((t) => parsedArgs.includes(t)));
+        if (byArgs.length > 0) pool = byArgs;
+      }
+      return pool[0];
+    }
     return {
       ruleId: `custom:${hashMessage(deny.message)}`,
       family: 'custom',

package/src/rules/catalog.ts

@@ -1,4 +1,4 @@
-import type { RuleMeta } from './RuleRegistry.ts';
+import type { RuleFamily, RuleMeta } from './RuleRegistry.ts';
 
 /**
  * Canonical rule catalog — mirrors policy/safety.rego message-for-message.
@@ -206,15 +206,51 @@ export const RULES: readonly RuleMeta[] = [
     family: 'glab',
     message: 'Public GitLab repository creation is blocked by default.',
   },
+  // ── GROUP G: tmux / pkill / killall session protection (cc-safety-net parity) ──
+  {
+    ruleId: 'block-tmux-kill-server',
+    family: 'tmux',
+    message:
+      'Killing the tmux/wezterm server destroys ALL sessions, panes, and in-flight work across every client. Do NOT run this automatically \u2014 hand the exact command back to the user and let them run it themselves.',
+    matchArgs: ['kill-server'],
+  },
+  {
+    ruleId: 'block-tmux-kill-session',
+    family: 'tmux',
+    message:
+      'Killing the tmux/wezterm server destroys ALL sessions, panes, and in-flight work across every client. Do NOT run this automatically \u2014 hand the exact command back to the user and let them run it themselves.',
+    matchArgs: ['kill-session'],
+  },
+  {
+    ruleId: 'block-pkill-tmux-wezterm',
+    family: 'pkill',
+    message:
+      'Killing the tmux/wezterm server destroys ALL sessions, panes, and in-flight work across every client. Do NOT run this automatically \u2014 hand the exact command back to the user and let them run it themselves.',
+  },
+  {
+    ruleId: 'block-killall-tmux-wezterm',
+    family: 'killall',
+    message:
+      'Killing the tmux/wezterm server destroys ALL sessions, panes, and in-flight work across every client. Do NOT run this automatically \u2014 hand the exact command back to the user and let them run it themselves.',
+  },
 ];
 
-/** gcloud/bq produce sprintf messages — family inferred from program. */
-export function inferFamilyFromProgram(program: string): 'gcloud' | 'bq' | 'custom' {
+/** gcloud/bq produce sprintf messages — family inferred from program.
+ *  tmux/pkill/killall rules share identical reason text (the four session-kill
+ *  rules), so their family is also inferred from the program to disambiguate
+ *  the message-keyed registry. */
+export function inferFamilyFromProgram(program: string): RuleFamily {
   switch (program) {
     case 'gcloud':
       return 'gcloud';
     case 'bq':
       return 'bq';
+    case 'tmux':
+      return 'tmux';
+    case 'pkill':
+      return 'pkill';
+    case 'killall':
+      return 'killall';
     default:
       return 'custom';
   }