unbound-cli 1.16.22 → 1.16.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbound-cli",
-  "version": "1.16.22",
+  "version": "1.16.23",
   "description": "CLI tool for Unbound - AI Gateway management",
   "main": "src/index.js",
   "bin": {

package/src/lib/policy-ai-assist.js

@@ -12,13 +12,61 @@ const MAX_PROMPT_LEN = 1800;
 const TOOL_ACTIONS = ['AUDIT', 'BLOCK', 'WARN', 'REQUIRE_SLACK_APPROVAL'];
 
 const OUT_OF_SCOPE_KEYWORDS = Object.freeze([
-  'staging', 'production', 'prod', 'dev', 'qa', 'testing',
   'archived', 'archive',
   'business hour', 'after hour', 'outside hour', 'weekend',
-  'except', 'unless', 'but not',
+  'except', 'unless', 'but not', 'non-prod', 'non prod',
   'private repo', 'public repo', 'private project', 'public project',
 ]);
 
+// Terminal policies can scope by environment (cloud_*, database_* and
+// build_operation carry an `environment` field); MCP tool policies cannot.
+const MCP_OUT_OF_SCOPE_KEYWORDS = Object.freeze([
+  'staging', 'production', 'prod', 'dev', 'qa', 'testing',
+  ...OUT_OF_SCOPE_KEYWORDS,
+]);
+
+// Environment words checked against the prompt after the assist reply, whole
+// words only ("product-catalog" is not "prod"). Words that are also everyday
+// English ("npm test", "git stage", "live reload") count only before an
+// environment noun or after in/to/on/against/into ("in the test environment",
+// "deploy to live").
+// `pre-?prod` precedes bare `prod` so "pre-prod" reads as pre-production, not
+// as production; the regex alternates left to right.
+const ENVIRONMENT_WORDS = 'production|pre[-_ ]?prod(?:uction)?|preprod|prod|prd|staging|stg|uat|dev|development|sandbox|sbx|qa|mainnet';
+const CONTEXT_ENVIRONMENT_WORDS = 'test|testing|tst|live|stage|local|localhost';
+const ENVIRONMENT_NOUNS = 'environment|env|cluster|namespace|servers?|database|db|account|project|stack|deployment|instances?';
+// `\b` treats `_` as a word char and cannot see `prod_db`; the separator class
+// can. A negated word is dropped: "non-prod" asks for the opposite of `prod`.
+const ENVIRONMENT_WORD_RE = new RegExp(
+  `(?<!non[-_ ]?)(?<![a-z0-9])(${ENVIRONMENT_WORDS})(?![a-z0-9])`
+  + `|\\b(?:in|to|on|against|into)\\s+(?:the\\s+)?(${CONTEXT_ENVIRONMENT_WORDS})\\b`
+  + `|\\b(${CONTEXT_ENVIRONMENT_WORDS})\\s+(?:${ENVIRONMENT_NOUNS})\\b`,
+  'gi'
+);
+
+// Environment token -> label. Source of truth: the gateway's deterministic
+// classifier, src/services/classifier/deterministic/environmentTokens.ts.
+const ENVIRONMENT_LABELS = Object.freeze({
+  prod: 'production', production: 'production', prd: 'production', live: 'production', mainnet: 'production',
+  stg: 'staging', staging: 'staging', stage: 'staging', uat: 'staging', preprod: 'staging', preproduction: 'staging',
+  dev: 'dev', development: 'dev', sandbox: 'dev', sbx: 'dev',
+  test: 'test', testing: 'test', tst: 'test',
+  local: 'local', localhost: 'local', '127.0.0.1': 'local',
+});
+
+// Aliases holding a separator, which tokenising would break apart.
+const DOTTED_OR_HYPHENATED_ALIASES = Object.keys(ENVIRONMENT_LABELS).filter((k) => /[^a-z0-9]/.test(k));
+
+// Pre-production spelled with a separator. The label table holds only the
+// collapsed `preprod`, so these spellings are matched before tokenising.
+const SEPARATED_PREPROD_RE = /(?<![a-z0-9])pre[^a-z0-9]+prod(?:uction)?(?![a-z0-9])/g;
+
+// The label for a detected word, after collapsing separators so the spellings
+// the prompt regex accepts ("pre-prod", "pre prod") reach the same entry.
+function normaliseEnvironmentWord(word) {
+  return ENVIRONMENT_LABELS[word] ?? ENVIRONMENT_LABELS[String(word).replace(/[^a-z0-9]+/g, '')];
+}
+
 // Single source of truth for --action override validation. Used both early
 // (in runTerminalPromptCreate, to fail before the assist POST) and late
 // (in mergeAiAndFlags, when applying the override). Returns the normalized
@@ -44,13 +92,15 @@ async function loadPrivileges() {
   return _privilegesCache;
 }
 
-function validatePromptPreflight(opts) {
+function validatePromptPreflight(opts, keywords) {
   if (!opts || typeof opts.prompt !== 'string') {
     throw new Error('--prompt is required.');
   }
   const collapsed = opts.prompt
     .replace(/\n{2,}/g, '\n')
-    .replace(/[^\x20-\x7e\n\t]/g, '');
+    // A stripped run becomes a space: a non-breaking space (routine in pasted
+    // text) would otherwise glue the words it separated into one.
+    .replace(/[^\x20-\x7e\n\t]+/g, ' ');
   const sanitizedPrompt = collapsed.trim();
   if (sanitizedPrompt.length > MAX_PROMPT_LEN) {
     const e = new Error(`Input is too long (max ${MAX_PROMPT_LEN} characters).`);
@@ -59,12 +109,28 @@ function validatePromptPreflight(opts) {
   }
   const warnings = [];
   const lower = sanitizedPrompt.toLowerCase();
-  for (const token of OUT_OF_SCOPE_KEYWORDS) {
+  for (const token of keywords) {
     if (lower.includes(token)) warnings.push(token);
   }
   return { sanitizedPrompt, warnings };
 }
 
+function outOfScopeWarning(word, scopes) {
+  return `Your prompt mentions \`${word}\`. Tool policies cannot scope by ${scopes} clauses. The endpoint will ignore those parts.`;
+}
+
+// `conditions` is the full AND list; selected_field / field_value only mirror
+// conditions[0] for single-condition consumers.
+function configFromAssist(f) {
+  const conditions = Array.isArray(f.conditions) ? f.conditions.filter((c) => c && c.field) : [];
+  if (!conditions.length) {
+    return f.selected_field ? { [f.selected_field]: String(f.field_value || '').trim() } : {};
+  }
+  const config = {};
+  for (const c of conditions) config[c.field] = String(c.value ?? '').trim();
+  return config;
+}
+
 function mergeAiAndFlags(formUpdates, opts) {
   const f = formUpdates || {};
   const body = {
@@ -74,9 +140,7 @@ function mergeAiAndFlags(formUpdates, opts) {
   if (f.description) body.description = f.description;
   if (f.command_family) body.command_family = f.command_family;
 
-  const field = f.selected_field || '';
-  const value = f.field_value || '';
-  body.config = field ? { [field]: value } : {};
+  body.config = configFromAssist(f);
 
   body.action = (f.action ? String(f.action).toUpperCase() : 'AUDIT');
 
@@ -103,6 +167,63 @@ function mergeAiAndFlags(formUpdates, opts) {
   return body;
 }
 
+// True when a condition value already targets the environment `word`: one of
+// its tokens is the word (branch 'production', 'make release-prod') or an alias
+// of the same label (namespace '*prod*' or 'prod-*' for "production").
+// Whole tokens only, so 'product-catalog' does not target "prod".
+function targetsEnvironment(value, word) {
+  const label = normaliseEnvironmentWord(word);
+  const v = String(value).toLowerCase();
+  // An all-wildcard pattern matches every environment, so it targets this one.
+  if (/^\*+$/.test(v.trim())) return true;
+  // Tokens split on non-alphanumerics, so an alias holding one (`127.0.0.1`)
+  // never survives as a token and is matched on the whole value.
+  if (DOTTED_OR_HYPHENATED_ALIASES.some((a) => v.includes(a) && ENVIRONMENT_LABELS[a] === label)) {
+    return true;
+  }
+  // `pre-prod` is pre-production however it is spelled, so it is consumed before
+  // tokenising: the `prod` left behind would otherwise read as production.
+  let preprod = false;
+  const tokens = v.replace(SEPARATED_PREPROD_RE, () => { preprod = true; return ' '; }).split(/[^a-z0-9]+/);
+  if (preprod && label === ENVIRONMENT_LABELS.preprod) return true;
+  return tokens.some(
+    (token) => token === word || (label !== undefined && ENVIRONMENT_LABELS[token] === label)
+  );
+}
+
+// Only some families (cloud_*, database_*, build_operation) have an
+// `environment` field, so the resolved policy can silently drop or narrow an
+// environment the prompt named. A word some condition already targets was
+// applied, so it does not warn. Returns true when it warned.
+function warnEnvironmentScope(prompt, body) {
+  const environment = String(body.config.environment ?? '').trim();
+  // An `environment` condition decides scope on its own. Another field holding
+  // the word (`service: prod-api`) does not widen it, so it cannot vouch here.
+  // Present-but-blank still decides: a blank condition scopes to nothing.
+  const values = Object.prototype.hasOwnProperty.call(body.config, 'environment')
+    ? [environment]
+    : Object.values(body.config);
+  const words = new Set([...prompt.matchAll(ENVIRONMENT_WORD_RE)].map((m) => (m[1] || m[2] || m[3]).toLowerCase()));
+  let warned = environment ? warnUnrecognisedEnvironment(environment) : false;
+  for (const word of words) {
+    if (values.some((v) => targetsEnvironment(v, word))) continue;
+    const scope = environment
+      ? `this policy's environment condition is \`${environment}\`, so it does not apply in ${word}`
+      : `this ${body.command_family || 'terminal'} policy has no environment condition, so it applies in all environments`;
+    output.warn(`Your prompt mentions \`${word}\`, but ${scope}.`);
+    warned = true;
+  }
+  return warned;
+}
+
+function warnUnrecognisedEnvironment(environment) {
+  if (String(environment).replace(/\*/g, '').trim().toLowerCase() !== 'qa') return false;
+  const labels = [...new Set(Object.values(ENVIRONMENT_LABELS))];
+  const aliases = Object.keys(ENVIRONMENT_LABELS).filter((token) => ENVIRONMENT_LABELS[token] !== token);
+  output.warn(`\`qa\` is not a recognised environment label (recognised: ${labels.join(', ')}, and their aliases ${aliases.join(', ')}), so this policy may not match.`);
+  return true;
+}
+
 function colorAction(action) {
   const colors = output.colors;
   if (!action) return '(unspecified)';
@@ -117,10 +238,8 @@ function renderTerminalPreview(body, explanation) {
     ? `groups: ${body.scope_user_group_ids.join(', ')}`
     : '(org-wide)';
   const family = body.command_family || '(unspecified)';
-  const cfg = body.config || {};
-  const cfgKeys = Object.keys(cfg);
-  const fieldKey = cfgKeys[0] || '(unspecified)';
-  const pattern = cfgKeys.length ? String(cfg[cfgKeys[0]]) : '(unspecified)';
+  const cfgEntries = Object.entries(body.config || {});
+  const matches = cfgEntries.length ? cfgEntries : [['(unspecified)', '(unspecified)']];
 
   // Header goes to stdout (NOT output.info, which writes to stderr) so the
   // whole preview — header, keyValue rows, explanation — is captured by a
@@ -134,8 +253,11 @@ function renderTerminalPreview(body, explanation) {
   if (body.description) rows.push(['Description', body.description]);
   rows.push(['Type', body.policy_type]);
   rows.push(['Command family', family]);
-  rows.push(['Field', fieldKey]);
-  rows.push(['Pattern', pattern]);
+  if (matches.length > 1) rows.push(['Conditions', output.colors.dim('all must match (AND)')]);
+  for (const [key, value] of matches) {
+    rows.push(['Field', key]);
+    rows.push(['Pattern', String(value)]);
+  }
   rows.push(['Action', colorAction(body.action)]);
   if (body.custom_message) rows.push(['Custom message', body.custom_message]);
   rows.push(['Scope (groups)', scope]);
@@ -204,6 +326,10 @@ function confirmCreate() {
   return promptYesNo('Create policy? [Y/n] ', true);
 }
 
+function confirmCreateAnyway() {
+  return promptYesNo('Create policy anyway? [y/N] ', false);
+}
+
 function confirmContinue() {
   return promptYesNo('Continue anyway? The endpoint will ignore those parts. [y/N] ', false);
 }
@@ -237,9 +363,9 @@ async function runTerminalPromptCreate(opts) {
   // care about the throw side-effect; mergeAiAndFlags re-validates and applies.
   validateActionOverride(opts.action);
 
-  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts);
+  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts, OUT_OF_SCOPE_KEYWORDS);
   for (const w of warnings) {
-    output.warn(`Your prompt mentions \`${w}\`. Tool policies cannot scope by environment / project / time / exception clauses. The endpoint will ignore those parts.`);
+    output.warn(outOfScopeWarning(w, 'project / time / exception'));
   }
   if (warnings.length && !opts.yes && !opts.json) {
     const cont = await confirmContinue();
@@ -314,10 +440,11 @@ async function runTerminalPromptCreate(opts) {
   }
 
   if (!opts.json) renderTerminalPreview(body, response.explanation);
+  const warned = warnEnvironmentScope(sanitizedPrompt, body);
 
   let confirmed = true;
   if (!opts.yes && !opts.json) {
-    confirmed = await confirmCreate();
+    confirmed = await (warned ? confirmCreateAnyway() : confirmCreate());
   }
   return { body, confirmed, explanation: response.explanation };
 }
@@ -402,9 +529,9 @@ async function runMcpPromptCreate(opts) {
 
   validateActionOverride(opts.action);
 
-  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts);
+  const { sanitizedPrompt, warnings } = validatePromptPreflight(opts, MCP_OUT_OF_SCOPE_KEYWORDS);
   for (const w of warnings) {
-    output.warn(`Your prompt mentions \`${w}\`. Tool policies cannot scope by environment / project / time / exception clauses. The endpoint will ignore those parts.`);
+    output.warn(outOfScopeWarning(w, 'environment / project / time / exception'));
   }
   if (warnings.length && !opts.yes && !opts.json) {
     const cont = await confirmContinue();
@@ -494,6 +621,7 @@ async function runMcpPromptCreate(opts) {
 module.exports = {
   MAX_PROMPT_LEN,
   OUT_OF_SCOPE_KEYWORDS,
+  MCP_OUT_OF_SCOPE_KEYWORDS,
   validatePromptPreflight,
   mergeAiAndFlags,
   renderTerminalPreview,

package/test/policy-ai-assist-preflight.test.js

@@ -4,6 +4,7 @@ const assert = require('node:assert/strict');
 const {
   validatePromptPreflight,
   OUT_OF_SCOPE_KEYWORDS,
+  MCP_OUT_OF_SCOPE_KEYWORDS,
   MAX_PROMPT_LEN,
 } = require('../src/lib/policy-ai-assist');
 
@@ -11,52 +12,85 @@ const {
 // with backend-equivalent wording.
 
 test('preflight: prompt of 1799 chars passes', () => {
-  const r = validatePromptPreflight({ prompt: 'a'.repeat(1799) });
+  const r = validatePromptPreflight({ prompt: 'a'.repeat(1799) }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.warnings.length, 0);
 });
 
 test('preflight: prompt of 1800 chars passes (boundary)', () => {
-  const r = validatePromptPreflight({ prompt: 'a'.repeat(MAX_PROMPT_LEN) });
+  const r = validatePromptPreflight({ prompt: 'a'.repeat(MAX_PROMPT_LEN) }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.warnings.length, 0);
 });
 
 test('preflight: prompt of 1801 chars rejects with verbatim wording', () => {
   assert.throws(
-    () => validatePromptPreflight({ prompt: 'a'.repeat(1801) }),
+    () => validatePromptPreflight({ prompt: 'a'.repeat(1801) }, OUT_OF_SCOPE_KEYWORDS),
     new RegExp(`^Error: Input is too long \\(max ${MAX_PROMPT_LEN} characters\\)\\.$`)
   );
 });
 
-// §6.2 step 4: parametrized over the keyword list — every token surfaces a warning.
+// §6.2 step 4: parametrized over the keyword lists — every token surfaces a warning.
 for (const token of OUT_OF_SCOPE_KEYWORDS) {
   test(`preflight: out-of-scope keyword "${token}" produces a warning`, () => {
-    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` });
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, OUT_OF_SCOPE_KEYWORDS);
     assert.ok(r.warnings.includes(token), `expected warning for ${token}, got ${JSON.stringify(r.warnings)}`);
   });
 }
 
+for (const token of MCP_OUT_OF_SCOPE_KEYWORDS) {
+  test(`preflight: MCP out-of-scope keyword "${token}" produces a warning`, () => {
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, MCP_OUT_OF_SCOPE_KEYWORDS);
+    assert.ok(r.warnings.includes(token), `expected warning for ${token}, got ${JSON.stringify(r.warnings)}`);
+  });
+}
+
+// Terminal policies can scope by environment, so these only warn for MCP.
+for (const token of ['staging', 'production', 'prod', 'dev', 'qa', 'testing']) {
+  test(`preflight: environment keyword "${token}" does not warn with the terminal list`, () => {
+    const r = validatePromptPreflight({ prompt: `block X in ${token} mode` }, OUT_OF_SCOPE_KEYWORDS);
+    assert.deepEqual(r.warnings, []);
+  });
+}
+
 // §6.2 step 5: collapse runs of >=2 newlines to a single newline.
 test('preflight: collapses three consecutive newlines to one', () => {
-  const r = validatePromptPreflight({ prompt: 'line1\n\n\nline2' });
+  const r = validatePromptPreflight({ prompt: 'line1\n\n\nline2' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'line1\nline2');
 });
 
 test('preflight: collapses two consecutive newlines to one', () => {
-  const r = validatePromptPreflight({ prompt: 'a\n\nb' });
+  const r = validatePromptPreflight({ prompt: 'a\n\nb' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'a\nb');
 });
 
 test('preflight: a single newline is left alone', () => {
-  const r = validatePromptPreflight({ prompt: 'a\nb' });
+  const r = validatePromptPreflight({ prompt: 'a\nb' }, OUT_OF_SCOPE_KEYWORDS);
   assert.equal(r.sanitizedPrompt, 'a\nb');
 });
 
+// A stripped character must not join the words it separated: pasted text
+// carries non-breaking spaces, and "inproduction" names no environment.
+test('preflight: a non-breaking space becomes a space, not nothing', () => {
+  const r = validatePromptPreflight({ prompt: 'block terraform destroy in production' }, OUT_OF_SCOPE_KEYWORDS);
+  assert.equal(r.sanitizedPrompt, 'block terraform destroy in production');
+});
+
+// A negated environment is an exception clause, which policies cannot express.
+for (const prompt of ['block schema drops in non-prod', 'block schema drops in non production', 'block schema drops in non-production']) {
+  test(`preflight: "${prompt}" reports a negated environment as out of scope`, () => {
+    const r = validatePromptPreflight({ prompt }, OUT_OF_SCOPE_KEYWORDS);
+    assert.ok(r.warnings.some((w) => w.startsWith('non')), `expected a negation warning, got ${JSON.stringify(r.warnings)}`);
+  });
+}
+
+test('preflight: "non-interactive" is not a negated environment', () => {
+  const r = validatePromptPreflight({ prompt: 'audit non-interactive scripts' }, OUT_OF_SCOPE_KEYWORDS);
+  assert.deepEqual(r.warnings, []);
+});
+
 // §6.2: warning is informational only; under --yes the caller logs it and
 // continues. The helper itself never throws for warnings — it just reports.
 test('preflight: warnings do not throw', () => {
-  // Use a keyword that is NOT a substring of "production" (the keyword set
-  // contains "prod" which would also match): pick a non-overlapping one.
-  const r = validatePromptPreflight({ prompt: 'block weekend pushes' });
+  const r = validatePromptPreflight({ prompt: 'block weekend pushes' }, OUT_OF_SCOPE_KEYWORDS);
   assert.ok(r.warnings.includes('weekend'));
   // No throw — the function returned and we got here.
 });

package/test/policy-ai-assist.test.js

@@ -94,6 +94,20 @@ async function runCreate(argv) {
   await program.parseAsync(full);
 }
 
+// Answer every readline question (promptYesNo) with `answer`; records the
+// questions asked.
+function stubReadline(answer) {
+  const readline = require('readline');
+  const origCreate = readline.createInterface;
+  const questions = [];
+  readline.createInterface = () => ({
+    on() {},
+    question(q, cb) { questions.push(q); cb(answer); },
+    close() {},
+  });
+  return { questions, restore: () => { readline.createInterface = origCreate; } };
+}
+
 beforeEach(() => {
   process.exitCode = 0;
 });
@@ -470,6 +484,112 @@ test('happy path: builds policy body and POSTs to /command-policies/', async ()
   }
 });
 
+// --- Multi-condition replies (form_updates.conditions) ------------------------
+// The assist endpoint returns every AND condition in `conditions`; selected_field
+// and field_value only mirror conditions[0], which need not be the environment.
+
+const TERRAFORM_PROD_REPLY = {
+  success: true,
+  form_updates: {
+    command_family: 'cloud_destroy',
+    selected_field: 'provider',
+    field_value: '*terraform*',
+    conditions: [
+      { field: 'provider', value: '*terraform*' },
+      { field: 'environment', value: '*prod*' },
+    ],
+    action: 'block',
+    name: 'Block terraform destroy in production',
+  },
+  explanation: 'terraform destroy, production only',
+};
+
+test('conditions: every AND condition reaches the create body and the preview', async () => {
+  const h = buildHarness({ assistResponse: TERRAFORM_PROD_REPLY });
+  try {
+    await runCreate([
+      '--prompt', 'block terraform destroy in production',
+      '--custom-message', 'Not in prod.', '--yes',
+    ]);
+    const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(createCall, 'create POST should have fired');
+    assert.deepEqual(createCall.body.config, { provider: '*terraform*', environment: '*prod*' });
+    const out = h.captured.stdout.join('\n');
+    const preview = out.slice(0, out.indexOf('AI assist explanation'));
+    for (const text of ['provider', '*terraform*', 'environment', '*prod*']) {
+      assert.ok(preview.includes(text), `preview missing ${text}: ${preview}`);
+    }
+    const andIdx = preview.indexOf('all must match (AND)');
+    assert.ok(andIdx !== -1 && andIdx < preview.indexOf('provider'), `AND line must precede the conditions: ${preview}`);
+    assert.deepEqual(h.captured.warn, [], 'environment is applied, so no environment warning');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('conditions: an empty conditions list falls back to selected_field / field_value', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'git', selected_field: 'command', field_value: 'git push*',
+        conditions: [], action: 'AUDIT', name: 'Audit pushes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit git pushes', '--yes']);
+    const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(createCall, 'create POST should have fired');
+    assert.deepEqual(createCall.body.config, { command: 'git push*' });
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [source, conditions] of [['conditions', [{ field: 'command', value: ' git push* ' }]], ['selected_field', undefined]]) {
+  test(`conditions: values from ${source} are trimmed, as the dashboard does`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'git', selected_field: 'command', field_value: ' git push* ',
+          conditions, action: 'AUDIT', name: 'Audit pushes',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', 'audit git pushes', '--yes']);
+      const createCall = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(createCall, 'create POST should have fired');
+      assert.deepEqual(createCall.body.config, { command: 'git push*' });
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// --field / --config stay mutually exclusive with --prompt: they never merge
+// into, or override, the AI's conditions.
+for (const [flag, value] of [['--field', 'environment=*staging*'], ['--config', '{"environment":"*staging*"}']]) {
+  test(`conditions: --prompt + ${flag} is still rejected before the assist call`, async () => {
+    const h = buildHarness({ assistResponse: TERRAFORM_PROD_REPLY });
+    try {
+      await runCreate(['--prompt', 'block terraform destroy in production', flag, value, '--yes']);
+      assert.equal(process.exitCode, 1);
+      assert.ok(
+        h.captured.error.includes('Pass --prompt for AI-assist or the field flags for explicit creation, not both.'),
+        `expected mutex error, got: ${JSON.stringify(h.captured.error)}`
+      );
+      assert.equal(h.calls.posts.length, 0, 'neither assist nor create should fire');
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
 // --- (b.1) Greptile follow-up regressions -------------------------------------
 
 test('AI returns BLOCK without --custom-message → exit 2 with guard message', async () => {
@@ -758,7 +878,7 @@ test('routing: assist succeeds but create POST 401 → exit 3 + admin-required w
 
 // --- (d) --yes + out-of-scope keyword: warns AND proceeds ---------------------
 
-test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint', async () => {
+test('out-of-scope: --yes + "weekend" warns but still calls the assist endpoint', async () => {
   const h = buildHarness({
     assistResponse: {
       success: true,
@@ -770,10 +890,14 @@ test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint'
     },
   });
   try {
-    await runCreate(['--prompt', 'block staging deploys', '--yes']);
+    await runCreate(['--prompt', 'block git pushes on weekends', '--yes']);
     assert.ok(
-      h.captured.warn.some((m) => m.includes('`staging`')),
-      `expected staging warning, got: ${JSON.stringify(h.captured.warn)}`
+      h.captured.warn.some((m) => m.includes('`weekend`')),
+      `expected weekend warning, got: ${JSON.stringify(h.captured.warn)}`
+    );
+    assert.ok(
+      !h.captured.warn.some((m) => m.includes('environment')),
+      `terminal warning must not claim environment is out of scope, got: ${JSON.stringify(h.captured.warn)}`
     );
     assert.ok(
       h.calls.posts.some((c) => c.path === '/api/v1/command-policies/assist/'),
@@ -784,6 +908,627 @@ test('out-of-scope: --yes + "staging" warns but still calls the assist endpoint'
   }
 });
 
+test('out-of-scope: without --yes, "except" asks to continue; "n" aborts before the assist call', async () => {
+  const h = buildHarness();
+  const rl = stubReadline('n');
+  try {
+    await runCreate(['--prompt', 'block git pushes except on main']);
+    assert.equal(process.exitCode, 0);
+    assert.ok(
+      h.captured.warn.some((m) => m.includes('`except`')),
+      `expected except warning, got: ${JSON.stringify(h.captured.warn)}`
+    );
+    assert.equal(rl.questions.length, 1);
+    assert.ok(rl.questions[0].includes('Continue anyway?'), `got: ${JSON.stringify(rl.questions)}`);
+    assert.equal(h.calls.posts.length, 0, 'assist must not be called after the user aborts');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// Terminal policies can scope by environment (cloud_*, database_* and
+// build_operation carry an `environment` field), so environment words are in
+// scope here.
+for (const [word, prompt, environment] of [
+  ['production', 'audit aws deletes in production', '*prod*'],
+  ['prod', 'block terraform destroy against prod', '*prod*'],
+  ['staging', 'audit database drops in staging', '*stg*'],
+]) {
+  test(`in-scope: "${word}" in a terminal prompt neither warns nor asks to continue`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'environment',
+          field_value: environment, action: 'AUDIT', name: `Audit ${word} cloud deletes`,
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', prompt]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+      assert.deepEqual(rl.questions, ['Create policy? [Y/n] '], 'only the create confirmation should be asked');
+      const assist = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/assist/');
+      assert.ok(assist, 'assist endpoint should be called');
+      assert.equal(assist.body.user_input, prompt);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should fire after confirmation');
+      assert.deepEqual(create.body.config, { environment });
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// Only some families carry `environment`; when the resolved policy has none,
+// an environment named in the prompt was dropped. Warn and, interactively,
+// default the confirmation to No; never block --yes / --json.
+const GIT_PUSH_REPLY = {
+  success: true,
+  form_updates: {
+    command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+    conditions: [{ field: 'operation', value: 'push' }],
+    action: 'block', name: 'Block git push',
+  },
+  explanation: 'ok',
+};
+
+for (const [mode, flags] of [['interactive', []], ['--yes', ['--yes']], ['--json', ['--json']]]) {
+  test(`environment (${mode}): an environment the resolved family cannot scope by warns; policy still created`, async () => {
+    const h = buildHarness({ assistResponse: GIT_PUSH_REPLY });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', 'block git push to production', '--custom-message', 'No.', ...flags]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        'Your prompt mentions `production`, but this git_action policy has no environment condition, so it applies in all environments.',
+      ]);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should still fire');
+      assert.deepEqual(create.body.config, { operation: 'push' });
+      assert.deepEqual(rl.questions, mode === 'interactive' ? ['Create policy anyway? [y/N] '] : []);
+      if (mode === '--json') {
+        assert.deepEqual(JSON.parse(h.captured.stdout.join('\n')), { id: 1, name: 'ok' }, 'stdout stays pure JSON');
+      }
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment (interactive): Enter on the warned confirmation aborts; no create POST', async () => {
+  const h = buildHarness({ assistResponse: GIT_PUSH_REPLY });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block git push to production', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(h.captured.warn.includes('Aborted.'), `expected Aborted., got: ${JSON.stringify(h.captured.warn)}`);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+test('environment: warns once for each prompt environment no condition applies', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+        conditions: [
+          { field: 'operation', value: 'push' },
+          { field: 'branch', value: '*dev*' },
+        ],
+        action: 'block', name: 'Block git push to dev',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate([
+      '--prompt', 'block git push to dev, staging and production; production especially',
+      '--custom-message', 'No.', '--yes',
+    ]);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `staging`, but this git_action policy has no environment condition, so it applies in all environments.',
+      'Your prompt mentions `production`, but this git_action policy has no environment condition, so it applies in all environments.',
+    ]);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [mode, flags] of [['--yes', ['--yes']], ['interactive', []]]) {
+  test(`environment (${mode}): an environment condition of qa warns that qa is not a recognised label`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+          conditions: [
+            { field: 'provider', value: '*terraform*' },
+            { field: 'environment', value: '*QA*' },
+          ],
+          action: 'audit', name: 'Audit terraform destroy in qa',
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('y');
+    try {
+      await runCreate(['--prompt', 'audit terraform destroy in qa', ...flags]);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        '`qa` is not a recognised environment label (recognised: production, staging, dev, test, local, and their aliases prod, prd, live, mainnet, stg, stage, uat, preprod, preproduction, development, sandbox, sbx, testing, tst, localhost, 127.0.0.1), so this policy may not match.',
+      ]);
+      assert.deepEqual(rl.questions, mode === 'interactive' ? ['Create policy anyway? [y/N] '] : []);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should still fire');
+      assert.equal(create.body.config.environment, '*QA*');
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// An environment condition for a different environment than the prompt names.
+test('environment (interactive): a prompt environment the environment condition does not cover warns; Enter aborts', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '*prod*' },
+        ],
+        action: 'block', name: 'Block terraform destroy in production',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block terraform destroy in staging and production', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `staging`, but this policy's environment condition is `*prod*`, so it does not apply in staging.",
+      'Aborted.',
+    ]);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// An environment condition decides scope by itself, so another field holding
+// the prompt's word must not count as evidence that the scope was applied.
+test('environment: another condition holding the word does not excuse a mismatched environment', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'service', field_value: '*prod-api*',
+        conditions: [
+          { field: 'service', value: '*prod-api*' },
+          { field: 'environment', value: '*staging*' },
+        ],
+        action: 'block', name: 'Block prod-api destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block cloud destroy in prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `prod`, but this policy's environment condition is `*staging*`, so it does not apply in prod.",
+      'Aborted.',
+    ]);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// `pre-prod` is pre-production, which maps to staging, never to production.
+test('environment: pre-prod given a production condition warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '*prod*' },
+        ],
+        action: 'block', name: 'Block terraform destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block terraform destroy in pre-prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      "Your prompt mentions `pre-prod`, but this policy's environment condition is `*prod*`, so it does not apply in pre-prod.",
+      'Aborted.',
+    ]);
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+// A separated pre-production condition does not cover production, however it is
+// spelled: the `prod` inside it must not read as the environment asked for.
+for (const value of ['*pre-prod*', '*pre_prod*', '*pre production*', '*pre-production*']) {
+  test(`environment: a production prompt given ${value} warns`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+          conditions: [
+            { field: 'provider', value: '*terraform*' },
+            { field: 'environment', value },
+          ],
+          action: 'block', name: 'Block terraform destroy',
+        },
+        explanation: 'ok',
+      },
+    });
+    const rl = stubReadline('');
+    try {
+      await runCreate(['--prompt', 'block terraform destroy in production', '--custom-message', 'No.']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`production\`, but this policy's environment condition is \`${value}\`, so it does not apply in production.`,
+        'Aborted.',
+      ]);
+    } finally {
+      rl.restore();
+      h.restoreLog();
+    }
+  });
+}
+
+// A separator inside an alias survives, so these spellings are already scoped.
+for (const [prompt, field, value] of [
+  ['block terraform destroy in pre-prod', 'environment', '*preprod*'],
+  ['block terraform destroy in pre-prod', 'environment', '*pre-prod*'],
+  ['block terraform destroy in pre-prod', 'environment', '*staging*'],
+  ['block terraform destroy in staging', 'environment', '*pre-prod*'],
+  ['block db writes in local', 'host', '127.0.0.1'],
+  ['block db writes in localhost', 'host', '127.0.0.1'],
+  ['block terraform destroy in production', 'environment', '*'],
+]) {
+  test(`environment: "${prompt}" with ${field} ${value} does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'database_write', selected_field: field, field_value: value,
+          conditions: [{ field, value }],
+          action: 'block', name: 'Block it',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', prompt, '--custom-message', 'No.', '--yes']);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// A missed warning is the dangerous direction: both of these name an
+// environment the resolved policy does not scope to.
+for (const [label, prompt, conditions, word] of [
+  ['an underscore-separated name', 'block schema drops on prod_db', [{ field: 'command', value: 'drop table' }], 'prod'],
+  [
+    'a blank environment condition no other field can vouch for',
+    'block schema drops in production',
+    [{ field: 'environment', value: '' }, { field: 'command', value: '*prod*' }],
+    'production',
+  ],
+]) {
+  test(`environment: ${label} warns`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'database_write',
+          selected_field: conditions[0].field, field_value: conditions[0].value,
+          conditions,
+          action: 'block', name: 'Block it',
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', prompt, '--custom-message', 'No.', '--yes']);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`${word}\`, but this database_write policy has no environment condition, so it applies in all environments.`,
+      ]);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment: a blank environment condition counts as none; warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'cloud_destroy', selected_field: 'provider', field_value: '*terraform*',
+        conditions: [
+          { field: 'provider', value: '*terraform*' },
+          { field: 'environment', value: '  ' },
+        ],
+        action: 'audit', name: 'Audit terraform destroy',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit terraform destroy in production', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `production`, but this cloud_destroy policy has no environment condition, so it applies in all environments.',
+    ]);
+  } finally {
+    h.restoreLog();
+  }
+});
+
+// Condition values are matched by whole token, so a value that merely contains
+// the word ('product-catalog', 'device') does not count as applying it.
+test('environment (interactive): "prod" is not applied by a *product-catalog* path; warns and Enter aborts', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'write_file', selected_field: 'path', field_value: '*product-catalog*',
+        action: 'block', name: 'Block product-catalog writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'block filesystem writes to product-catalog in prod', '--custom-message', 'No.']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `prod`, but this write_file policy has no environment condition, so it applies in all environments.',
+      'Aborted.',
+    ]);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
+test('environment: "dev" is not applied by a *device* path; warns', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'write_file', selected_field: 'path', field_value: '*device*',
+        action: 'audit', name: 'Audit device writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit writes to device files in dev', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, [
+      'Your prompt mentions `dev`, but this write_file policy has no environment condition, so it applies in all environments.',
+    ]);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('environment: "prod" applied by a custom make release-prod pattern does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'custom', selected_field: 'command', field_value: 'make release-prod',
+        action: 'audit', name: 'Audit prod releases',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit make release-prod', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+test('environment: an environment word another condition matches on (namespace *prod*) does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'container', selected_field: 'operation', field_value: 'exec',
+        conditions: [
+          { field: 'operation', value: 'exec' },
+          { field: 'namespace', value: '*prod*' },
+        ],
+        action: 'audit', name: 'Audit kubectl exec in prod namespaces',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit kubectl exec in the prod namespace', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+    assert.ok(create, 'create POST should fire');
+    assert.deepEqual(create.body.config, { operation: 'exec', namespace: '*prod*' });
+  } finally {
+    h.restoreLog();
+  }
+});
+
+for (const [word, namespace] of [['production', '*prod*'], ['production', 'prod-*'], ['staging', '*stg*'], ['staging', '*stage*']]) {
+  test(`environment: "${word}" with a namespace alias of the same environment (${namespace}) does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: {
+        success: true,
+        form_updates: {
+          command_family: 'container', selected_field: 'operation', field_value: 'exec',
+          conditions: [
+            { field: 'operation', value: 'exec' },
+            { field: 'namespace', value: namespace },
+          ],
+          action: 'audit', name: `Audit kubectl exec in ${word} namespaces`,
+        },
+        explanation: 'ok',
+      },
+    });
+    try {
+      await runCreate(['--prompt', `audit kubectl exec in ${word} namespaces`, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+      const create = h.calls.posts.find((c) => c.path === '/api/v1/command-policies/');
+      assert.ok(create, 'create POST should fire');
+      assert.deepEqual(create.body.config, { operation: 'exec', namespace });
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+// The condition-value side of this is covered above; this pins the prompt scan.
+test('environment: "product-catalog" in the prompt is not the word prod; does not warn', async () => {
+  const h = buildHarness({
+    assistResponse: {
+      success: true,
+      form_updates: {
+        command_family: 'filesystem', selected_field: 'command', field_value: '*product-catalog*',
+        action: 'audit', name: 'Audit product-catalog writes',
+      },
+      explanation: 'ok',
+    },
+  });
+  try {
+    await runCreate(['--prompt', 'audit product-catalog writes', '--yes']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(h.captured.warn, []);
+    assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+  } finally {
+    h.restoreLog();
+  }
+});
+
+// Environment words that are also everyday English (test, live, stage, local,
+// ...) count only in an environment context; the others count anywhere.
+function auditPushReply(conditions) {
+  return {
+    success: true,
+    form_updates: {
+      command_family: 'git_action', selected_field: 'operation', field_value: 'push',
+      conditions, action: 'audit', name: 'Audit git push',
+    },
+    explanation: 'ok',
+  };
+}
+
+for (const [prompt, word] of [
+  ['audit git push to mainnet', 'mainnet'],
+  ['audit git push to the stg branch', 'stg'],
+  ['audit git push in the test environment', 'test'],
+  ['audit git push to live', 'live'],
+  ['audit git push in the local cluster', 'local'],
+]) {
+  test(`environment: "${prompt}" warns about ${word}`, async () => {
+    const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+    try {
+      await runCreate(['--prompt', prompt, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, [
+        `Your prompt mentions \`${word}\`, but this git_action policy has no environment condition, so it applies in all environments.`,
+      ]);
+      assert.ok(h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'create POST should fire');
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+for (const prompt of ['audit npm test runs', 'audit git stage files', 'audit live reload', 'audit scripts that run tests locally']) {
+  test(`environment: "${prompt}" does not warn (everyday word, no environment context)`, async () => {
+    const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+    try {
+      await runCreate(['--prompt', prompt, '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+for (const branch of ['*tst*', 'test-*']) {
+  test(`environment: "in the test environment" applied by branch ${branch} does not warn`, async () => {
+    const h = buildHarness({
+      assistResponse: auditPushReply([{ field: 'operation', value: 'push' }, { field: 'branch', value: branch }]),
+    });
+    try {
+      await runCreate(['--prompt', 'audit git push in the test environment', '--yes']);
+      assert.equal(process.exitCode, 0);
+      assert.deepEqual(h.captured.warn, []);
+    } finally {
+      h.restoreLog();
+    }
+  });
+}
+
+test('environment (interactive): "in the test environment" warns and Enter aborts', async () => {
+  const h = buildHarness({ assistResponse: auditPushReply([{ field: 'operation', value: 'push' }]) });
+  const rl = stubReadline('');
+  try {
+    await runCreate(['--prompt', 'audit git push in the test environment']);
+    assert.equal(process.exitCode, 0);
+    assert.deepEqual(rl.questions, ['Create policy anyway? [y/N] ']);
+    assert.ok(!h.calls.posts.some((c) => c.path === '/api/v1/command-policies/'), 'no create POST after the default No');
+  } finally {
+    rl.restore();
+    h.restoreLog();
+  }
+});
+
 // --- Preview rendering (Acceptance #6 and #7) ---------------------------------
 
 test('--yes prints the preview AND skips confirmation AND issues create POST', async () => {
@@ -807,6 +1552,7 @@ test('--yes prints the preview AND skips confirmation AND issues create POST', a
     assert.ok(out.includes('Audit pushes'), `name row missing: ${out}`);
     assert.ok(out.includes('TERMINAL_COMMAND'), `type row missing: ${out}`);
     assert.ok(out.includes('git push*'), `pattern row missing: ${out}`);
+    assert.ok(!out.includes('all must match'), `single condition needs no AND line: ${out}`);
     assert.ok(out.includes('AUDIT'), `action row missing: ${out}`);
     assert.ok(out.includes('AI assist explanation'), `explanation line missing: ${out}`);
     assert.ok(out.includes('audit git activity'), `explanation body missing: ${out}`);
@@ -836,13 +1582,7 @@ test('without --yes: preview prints; "n" declines; no create POST fires', async
       explanation: 'ok',
     },
   });
-  // Stub readline.createInterface — the lib's confirmCreate uses it.
-  const readline = require('readline');
-  const origCreate = readline.createInterface;
-  readline.createInterface = () => ({
-    question(_q, cb) { cb('n'); },
-    close() {},
-  });
+  const rl = stubReadline('n');
   try {
     await runCreate(['--prompt', 'audit git pushes']);
     // Preview header (stdout) must have printed BEFORE the prompt. And the
@@ -855,7 +1595,7 @@ test('without --yes: preview prints; "n" declines; no create POST fires', async
       'no create POST should fire when user declines'
     );
   } finally {
-    readline.createInterface = origCreate;
+    rl.restore();
     h.restoreLog();
   }
 });