damage-control-dev 0.1.0__py3-none-any.whl

damage_control/rules/firebase.json

@@ -0,0 +1,34 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "firebase.firebase-projects-delete-deletes-entire-project",
+   "pattern": "\\bfirebase\\s+projects:delete\\b",
+   "reason": "firebase projects:delete (deletes entire project)",
+   "anchored": true
+  },
+  {
+   "id": "firebase.firebase-firestore-delete-all-collections-wipes-all-data",
+   "pattern": "\\bfirebase\\s+firestore:delete\\s+.*--all-collections",
+   "reason": "firebase firestore:delete --all-collections (wipes all data)",
+   "anchored": true
+  },
+  {
+   "id": "firebase.firebase-database-remove-wipes-realtime-db",
+   "pattern": "\\bfirebase\\s+database:remove\\b",
+   "reason": "firebase database:remove (wipes Realtime DB)",
+   "anchored": true
+  },
+  {
+   "id": "firebase.firebase-hosting-disable",
+   "pattern": "\\bfirebase\\s+hosting:disable\\b",
+   "reason": "firebase hosting:disable",
+   "anchored": true
+  },
+  {
+   "id": "firebase.firebase-functions-delete",
+   "pattern": "\\bfirebase\\s+functions:delete\\b",
+   "reason": "firebase functions:delete",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/firebase.yaml

@@ -0,0 +1,30 @@
+# Firebase CLI damage control rules
+
+bashToolPatterns:
+  # ---------------------------------------------------------------------------
+  # FIREBASE DESTRUCTIVE OPERATIONS
+  # ---------------------------------------------------------------------------
+  - id: firebase.firebase-projects-delete-deletes-entire-project
+    pattern: '\bfirebase\s+projects:delete\b'
+    reason: firebase projects:delete (deletes entire project)
+    anchored: true
+
+  - id: firebase.firebase-firestore-delete-all-collections-wipes-all-data
+    pattern: '\bfirebase\s+firestore:delete\s+.*--all-collections'
+    reason: firebase firestore:delete --all-collections (wipes all data)
+    anchored: true
+
+  - id: firebase.firebase-database-remove-wipes-realtime-db
+    pattern: '\bfirebase\s+database:remove\b'
+    reason: firebase database:remove (wipes Realtime DB)
+    anchored: true
+
+  - id: firebase.firebase-hosting-disable
+    pattern: '\bfirebase\s+hosting:disable\b'
+    reason: firebase hosting:disable
+    anchored: true
+
+  - id: firebase.firebase-functions-delete
+    pattern: '\bfirebase\s+functions:delete\b'
+    reason: firebase functions:delete
+    anchored: true

damage_control/rules/gcp.json

@@ -0,0 +1,60 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "gcp.gcloud-projects-delete-deletes-entire-project",
+   "pattern": "\\bgcloud\\s+projects\\s+delete\\b",
+   "reason": "gcloud projects delete (DELETES ENTIRE PROJECT)",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-compute-instances-delete",
+   "pattern": "\\bgcloud\\s+compute\\s+instances\\s+delete\\b",
+   "reason": "gcloud compute instances delete",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-sql-instances-delete",
+   "pattern": "\\bgcloud\\s+sql\\s+instances\\s+delete\\b",
+   "reason": "gcloud sql instances delete",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-container-clusters-delete-gke",
+   "pattern": "\\bgcloud\\s+container\\s+clusters\\s+delete\\b",
+   "reason": "gcloud container clusters delete (GKE)",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-storage-rm-r-recursive-delete",
+   "pattern": "\\bgcloud\\s+storage\\s+rm\\s+.*-r",
+   "reason": "gcloud storage rm -r (recursive delete)",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-functions-delete",
+   "pattern": "\\bgcloud\\s+functions\\s+delete\\b",
+   "reason": "gcloud functions delete",
+   "anchored": true
+  },
+  {
+   "id": "gcp.gcloud-iam-service-accounts-delete",
+   "pattern": "\\bgcloud\\s+iam\\s+service-accounts\\s+delete\\b",
+   "reason": "gcloud iam service-accounts delete",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bgcloud\\s+run\\s+deploy\\b",
+   "reason": "gcloud run deploy (ships a Cloud Run service)",
+   "ask": true,
+   "id": "deploy.gcloud-run",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bgcloud\\s+app\\s+deploy\\b",
+   "reason": "gcloud app deploy (ships an App Engine version)",
+   "ask": true,
+   "id": "deploy.gcloud-app",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/gcp.yaml

@@ -0,0 +1,57 @@
+# GCP (gcloud) damage control rules
+
+bashToolPatterns:
+  # ---------------------------------------------------------------------------
+  # GCP (gcloud) DESTRUCTIVE OPERATIONS
+  # ---------------------------------------------------------------------------
+  - id: gcp.gcloud-projects-delete-deletes-entire-project
+    pattern: '\bgcloud\s+projects\s+delete\b'
+    reason: gcloud projects delete (DELETES ENTIRE PROJECT)
+    anchored: true
+
+  - id: gcp.gcloud-compute-instances-delete
+    pattern: '\bgcloud\s+compute\s+instances\s+delete\b'
+    reason: gcloud compute instances delete
+    anchored: true
+
+  - id: gcp.gcloud-sql-instances-delete
+    pattern: '\bgcloud\s+sql\s+instances\s+delete\b'
+    reason: gcloud sql instances delete
+    anchored: true
+
+  - id: gcp.gcloud-container-clusters-delete-gke
+    pattern: '\bgcloud\s+container\s+clusters\s+delete\b'
+    reason: gcloud container clusters delete (GKE)
+    anchored: true
+
+  - id: gcp.gcloud-storage-rm-r-recursive-delete
+    pattern: '\bgcloud\s+storage\s+rm\s+.*-r'
+    reason: gcloud storage rm -r (recursive delete)
+    anchored: true
+
+  - id: gcp.gcloud-functions-delete
+    pattern: '\bgcloud\s+functions\s+delete\b'
+    reason: gcloud functions delete
+    anchored: true
+
+  - id: gcp.gcloud-iam-service-accounts-delete
+    pattern: '\bgcloud\s+iam\s+service-accounts\s+delete\b'
+    reason: gcloud iam service-accounts delete
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # GCP DEPLOYS (ask: true — outward-facing, caught in unattended sessions)
+  # ---------------------------------------------------------------------------
+  # `gcloud functions deploy` is already ask-tier via the gcp tooldef; these
+  # cover the other deploy surfaces (Cloud Run, App Engine).
+  - pattern: '\bgcloud\s+run\s+deploy\b'
+    reason: gcloud run deploy (ships a Cloud Run service)
+    ask: true
+    id: deploy.gcloud-run
+    anchored: true
+
+  - pattern: '\bgcloud\s+app\s+deploy\b'
+    reason: gcloud app deploy (ships an App Engine version)
+    ask: true
+    id: deploy.gcloud-app
+    anchored: true

damage_control/rules/git.json

@@ -0,0 +1,119 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "git.git-reset-hard-use-soft-or-stash",
+   "pattern": "\\bgit\\s+reset\\s+(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?--hard\\b",
+   "pattern_src": "\\bgit\\s+reset\\s+{ARGS}--hard\\b",
+   "reason": "git reset --hard (use --soft or stash)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-clean-with-force-directory-flags",
+   "pattern": "\\bgit\\s+clean\\s+(?!(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*n[a-z]*(?=[\\s;&|)`]|$)|--dry-run\\b))(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?(?:-(?!-)[a-z]*[fd][a-z]*|--force)(?=[\\s;&|)`]|$)",
+   "pattern_src": "\\bgit\\s+clean\\s+(?!(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*n[a-z]*(?=[\\s;&|)`]|$)|--dry-run\\b)){ARGS}(?:-(?!-)[a-z]*[fd][a-z]*|--force)(?=[\\s;&|)`]|$)",
+   "reason": "git clean with force/directory flags",
+   "anchored": true
+  },
+  {
+   "id": "git.git-push-force-use-force-with-lease",
+   "pattern": "\\bgit\\s+push\\s+.*--force(?!-with-lease)",
+   "reason": "git push --force (use --force-with-lease)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-push-f-use-force-with-lease",
+   "pattern": "\\bgit\\s+push\\s+(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?-(?!-)[a-z]*f[a-z]*(?=[\\s;&|)`]|$)",
+   "pattern_src": "\\bgit\\s+push\\s+{ARGS}-(?!-)[a-z]*f[a-z]*(?=[\\s;&|)`]|$)",
+   "reason": "git push -f (use --force-with-lease)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-stash-clear-deletes-all-stashes",
+   "pattern": "\\bgit\\s+stash\\s+clear\\b",
+   "reason": "git stash clear (deletes ALL stashes)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-reflog-expire-destroys-recovery-mechanism",
+   "pattern": "\\bgit\\s+reflog\\s+expire\\b",
+   "reason": "git reflog expire (destroys recovery mechanism)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-gc-prune-now-can-lose-dangling-commits",
+   "pattern": "\\bgit\\s+gc\\s+.*--prune=now",
+   "reason": "git gc --prune=now (can lose dangling commits)",
+   "anchored": true
+  },
+  {
+   "id": "git.git-filter-branch-rewrites-entire-history",
+   "pattern": "\\bgit\\s+filter-branch\\b",
+   "reason": "git filter-branch (rewrites entire history)",
+   "anchored": true
+  },
+  {
+   "id": "git.discards-all-uncommitted-changes",
+   "pattern": "\\bgit\\s+checkout\\s+--\\s*\\.",
+   "reason": "Discards all uncommitted changes",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.discards-all-uncommitted-changes-2",
+   "pattern": "\\bgit\\s+restore\\s+\\.",
+   "reason": "Discards all uncommitted changes",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.rm-tracked-files",
+   "pattern": "\\bgit\\s+rm\\b(?!.*--cached)",
+   "reason": "git rm deletes tracked files (use rm of a clean file, or confirm)",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.config-set-redirect-key",
+   "pattern": "\\bgit\\s+config\\b(?![^;&|]*\\s(?:--(?:get|unset|list|edit)|-l\\b|-e\\b))[^;&|]*?\\s(?:core\\.(?:worktree|hookspath)|include\\.path|includeif\\.\\S+\\.path)\\s+\\S",
+   "reason": "git config redirects the worktree, hooks dir, or an included config",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.permanently-deletes-a-stash",
+   "pattern": "\\bgit\\s+stash\\s+drop\\b",
+   "reason": "Permanently deletes a stash",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.force-deletes-branch-even-if-unmerged",
+   "pattern": "\\bgit\\s+branch\\s+(?:(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?-(?!-)[a-z]*(?-i:D)[a-z]*(?=[\\s;&|)`]|$)|(?=(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*d[a-z]*|--delete)(?=[\\s;&|)`]|$))(?=(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*f[a-z]*|--force)(?=[\\s;&|)`]|$)))",
+   "pattern_src": "\\bgit\\s+branch\\s+(?:{ARGS}-(?!-)[a-z]*(?-i:D)[a-z]*(?=[\\s;&|)`]|$)|(?=(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*d[a-z]*|--delete)(?=[\\s;&|)`]|$))(?=(?:[^;&|]*\\s)?(?:-(?!-)[a-z]*f[a-z]*|--force)(?=[\\s;&|)`]|$)))",
+   "reason": "Force deletes branch (even if unmerged)",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.deletes-remote-branch",
+   "pattern": "\\bgit\\s+push\\s+(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?--delete\\b",
+   "pattern_src": "\\bgit\\s+push\\s+{ARGS}--delete\\b",
+   "reason": "Deletes remote branch",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.deletes-remote-branch-old-syntax",
+   "pattern": "\\bgit\\s+push\\s+\\S+\\s+:\\S+",
+   "reason": "Deletes remote branch (old syntax)",
+   "ask": true,
+   "anchored": true
+  },
+  {
+   "id": "git.gh-repo-delete-deletes-repository",
+   "pattern": "\\bgh\\s+repo\\s+delete\\b",
+   "reason": "gh repo delete (deletes repository)",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/git.yaml

@@ -0,0 +1,120 @@
+# Git damage control rules
+# Destructive and confirmation-required git operations
+
+bashToolPatterns:
+  # ---------------------------------------------------------------------------
+  # GIT DESTRUCTIVE OPERATIONS
+  # ---------------------------------------------------------------------------
+  - id: git.git-reset-hard-use-soft-or-stash
+    pattern: '\bgit\s+reset\s+(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?--hard\b'
+    pattern_src: '\bgit\s+reset\s+{ARGS}--hard\b'
+    reason: git reset --hard (use --soft or stash)
+    anchored: true
+
+  - id: git.git-clean-with-force-directory-flags
+    pattern: '\bgit\s+clean\s+(?!(?:[^;&|]*\s)?(?:-(?!-)[a-z]*n[a-z]*(?=[\s;&|)`]|$)|--dry-run\b))(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?(?:-(?!-)[a-z]*[fd][a-z]*|--force)(?=[\s;&|)`]|$)'
+    pattern_src: '\bgit\s+clean\s+(?!(?:[^;&|]*\s)?(?:-(?!-)[a-z]*n[a-z]*(?=[\s;&|)`]|$)|--dry-run\b)){ARGS}(?:-(?!-)[a-z]*[fd][a-z]*|--force)(?=[\s;&|)`]|$)'
+    reason: git clean with force/directory flags
+    anchored: true
+
+  # Note: This blocks --force but NOT --force-with-lease
+  - id: git.git-push-force-use-force-with-lease
+    pattern: '\bgit\s+push\s+.*--force(?!-with-lease)'
+    reason: git push --force (use --force-with-lease)
+    anchored: true
+
+  - id: git.git-push-f-use-force-with-lease
+    pattern: '\bgit\s+push\s+(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?-(?!-)[a-z]*f[a-z]*(?=[\s;&|)`]|$)'
+    pattern_src: '\bgit\s+push\s+{ARGS}-(?!-)[a-z]*f[a-z]*(?=[\s;&|)`]|$)'
+    reason: git push -f (use --force-with-lease)
+    anchored: true
+
+  - id: git.git-stash-clear-deletes-all-stashes
+    pattern: '\bgit\s+stash\s+clear\b'
+    reason: git stash clear (deletes ALL stashes)
+    anchored: true
+
+  - id: git.git-reflog-expire-destroys-recovery-mechanism
+    pattern: '\bgit\s+reflog\s+expire\b'
+    reason: git reflog expire (destroys recovery mechanism)
+    anchored: true
+
+  - id: git.git-gc-prune-now-can-lose-dangling-commits
+    pattern: '\bgit\s+gc\s+.*--prune=now'
+    reason: git gc --prune=now (can lose dangling commits)
+    anchored: true
+
+  - id: git.git-filter-branch-rewrites-entire-history
+    pattern: '\bgit\s+filter-branch\b'
+    reason: git filter-branch (rewrites entire history)
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # GIT OPERATIONS REQUIRING CONFIRMATION (ask: true)
+  # ---------------------------------------------------------------------------
+  - id: git.discards-all-uncommitted-changes
+    pattern: '\bgit\s+checkout\s+--\s*\.'
+    reason: Discards all uncommitted changes
+    ask: true
+    anchored: true
+
+  - id: git.discards-all-uncommitted-changes-2
+    pattern: '\bgit\s+restore\s+\.'
+    reason: Discards all uncommitted changes
+    ask: true
+    anchored: true
+
+  # `git rm` deletes tracked files from the working tree AND the index; unlike a
+  # plain rm of a clean file it is a deliberate history-shaping act, rarely
+  # right for an agent. `--cached` only unstages (the file stays), so it passes.
+  - id: git.rm-tracked-files
+    pattern: '\bgit\s+rm\b(?!.*--cached)'
+    reason: git rm deletes tracked files (use rm of a clean file, or confirm)
+    ask: true
+    anchored: true
+
+  # SET-FORM config (`git config [--global] <key> <value>`, #1133/#9/#28): the
+  # same keys `git -c` is asked about (git.config-exec-key), plus the keys that
+  # REDIRECT git itself. Reads (`--get*`, `--list`, `--unset*`, `--edit`) and a
+  # keyless/valueless call never match.
+  # 1) Redirect keys: no benign value exists, always ask.
+  - id: git.config-set-redirect-key
+    pattern: '\bgit\s+config\b(?![^;&|]*\s(?:--(?:get|unset|list|edit)|-l\b|-e\b))[^;&|]*?\s(?:core\.(?:worktree|hookspath)|include\.path|includeif\.\S+\.path)\s+\S'
+    reason: git config redirects the worktree, hooks dir, or an included config
+    ask: true
+    anchored: true
+
+  - id: git.permanently-deletes-a-stash
+    pattern: '\bgit\s+stash\s+drop\b'
+    reason: Permanently deletes a stash
+    ask: true
+    anchored: true
+
+  - id: git.force-deletes-branch-even-if-unmerged
+    pattern: '\bgit\s+branch\s+(?:(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?-(?!-)[a-z]*(?-i:D)[a-z]*(?=[\s;&|)`]|$)|(?=(?:[^;&|]*\s)?(?:-(?!-)[a-z]*d[a-z]*|--delete)(?=[\s;&|)`]|$))(?=(?:[^;&|]*\s)?(?:-(?!-)[a-z]*f[a-z]*|--force)(?=[\s;&|)`]|$)))'
+    pattern_src: '\bgit\s+branch\s+(?:{ARGS}-(?!-)[a-z]*(?-i:D)[a-z]*(?=[\s;&|)`]|$)|(?=(?:[^;&|]*\s)?(?:-(?!-)[a-z]*d[a-z]*|--delete)(?=[\s;&|)`]|$))(?=(?:[^;&|]*\s)?(?:-(?!-)[a-z]*f[a-z]*|--force)(?=[\s;&|)`]|$)))'
+    reason: Force deletes branch (even if unmerged)
+    ask: true
+    anchored: true
+
+  - id: git.deletes-remote-branch
+    pattern: '\bgit\s+push\s+(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?--delete\b'
+    pattern_src: '\bgit\s+push\s+{ARGS}--delete\b'
+    reason: Deletes remote branch
+    ask: true
+    anchored: true
+
+  - id: git.deletes-remote-branch-old-syntax
+    pattern: '\bgit\s+push\s+\S+\s+:\S+'
+    reason: Deletes remote branch (old syntax)
+    ask: true
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # GITHUB CLI DESTRUCTIVE OPERATIONS (default-on: moved out of the cloud-hosting
+  # pack so a fresh install keeps it, #1141)
+  # ---------------------------------------------------------------------------
+  - id: git.gh-repo-delete-deletes-repository
+    pattern: '\bgh\s+repo\s+delete\b'
+    reason: gh repo delete (deletes repository)
+    anchored: true

damage_control/rules/infrastructure.json

@@ -0,0 +1,69 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "infrastructure.terraform-destroy-destroys-all-infrastructure",
+   "pattern": "\\bterraform\\s+destroy\\b",
+   "reason": "terraform destroy (destroys all infrastructure)",
+   "anchored": true
+  },
+  {
+   "id": "infrastructure.pulumi-destroy-destroys-all-resources",
+   "pattern": "\\bpulumi\\s+destroy\\b",
+   "reason": "pulumi destroy (destroys all resources)",
+   "anchored": true
+  },
+  {
+   "id": "infrastructure.serverless-remove-removes-stack",
+   "pattern": "\\bserverless\\s+remove\\b",
+   "reason": "serverless remove (removes stack)",
+   "anchored": true
+  },
+  {
+   "id": "infrastructure.sls-remove-removes-stack",
+   "pattern": "\\bsls\\s+remove\\b",
+   "reason": "sls remove (removes stack)",
+   "anchored": true
+  },
+  {
+   "id": "infrastructure.sam-delete-deletes-sam-application",
+   "pattern": "\\bsam\\s+delete\\b",
+   "reason": "sam delete (deletes SAM application)",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bpulumi\\s+up\\b",
+   "reason": "pulumi up (provisions/updates infrastructure)",
+   "ask": true,
+   "id": "deploy.pulumi-up",
+   "anchored": true
+  },
+  {
+   "pattern": "\\b(serverless|sls)\\s+deploy\\b",
+   "reason": "serverless deploy (ships a Serverless Framework stack)",
+   "ask": true,
+   "id": "deploy.serverless",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bsam\\s+deploy\\b",
+   "reason": "sam deploy (ships an AWS SAM application)",
+   "ask": true,
+   "id": "deploy.sam",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bcdk\\s+deploy\\b",
+   "reason": "cdk deploy (ships an AWS CDK stack)",
+   "ask": true,
+   "id": "deploy.cdk",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bansible-playbook\\b",
+   "reason": "ansible-playbook (applies configuration to remote hosts)",
+   "ask": true,
+   "id": "deploy.ansible",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/infrastructure.yaml

@@ -0,0 +1,66 @@
+# Infrastructure as Code damage control rules
+# Terraform, Pulumi, Serverless Framework, SAM
+
+bashToolPatterns:
+  # ---------------------------------------------------------------------------
+  # INFRASTRUCTURE AS CODE DESTRUCTIVE OPERATIONS
+  # ---------------------------------------------------------------------------
+  - id: infrastructure.terraform-destroy-destroys-all-infrastructure
+    pattern: '\bterraform\s+destroy\b'
+    reason: terraform destroy (destroys all infrastructure)
+    anchored: true
+
+  - id: infrastructure.pulumi-destroy-destroys-all-resources
+    pattern: '\bpulumi\s+destroy\b'
+    reason: pulumi destroy (destroys all resources)
+    anchored: true
+
+  - id: infrastructure.serverless-remove-removes-stack
+    pattern: '\bserverless\s+remove\b'
+    reason: serverless remove (removes stack)
+    anchored: true
+
+  - id: infrastructure.sls-remove-removes-stack
+    pattern: '\bsls\s+remove\b'
+    reason: sls remove (removes stack)
+    anchored: true
+
+  - id: infrastructure.sam-delete-deletes-sam-application
+    pattern: '\bsam\s+delete\b'
+    reason: sam delete (deletes SAM application)
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # IaC DEPLOYS (ask: true — provision/ship infra, caught in unattended sessions)
+  # ---------------------------------------------------------------------------
+  # `terraform apply` is already ask-tier via the terraform tooldef; these cover
+  # the other IaC apply verbs that were previously `allow`-tier.
+  - pattern: '\bpulumi\s+up\b'
+    reason: pulumi up (provisions/updates infrastructure)
+    ask: true
+    id: deploy.pulumi-up
+    anchored: true
+
+  - pattern: '\b(serverless|sls)\s+deploy\b'
+    reason: serverless deploy (ships a Serverless Framework stack)
+    ask: true
+    id: deploy.serverless
+    anchored: true
+
+  - pattern: '\bsam\s+deploy\b'
+    reason: sam deploy (ships an AWS SAM application)
+    ask: true
+    id: deploy.sam
+    anchored: true
+
+  - pattern: '\bcdk\s+deploy\b'
+    reason: cdk deploy (ships an AWS CDK stack)
+    ask: true
+    id: deploy.cdk
+    anchored: true
+
+  - pattern: '\bansible-playbook\b'
+    reason: ansible-playbook (applies configuration to remote hosts)
+    ask: true
+    id: deploy.ansible
+    anchored: true

damage_control/rules/mcp-tools.json

@@ -0,0 +1,11 @@
+{
+ "mcpToolPolicies": [
+  {
+   "match": "(write|edit|delete|remove|move|rename|create|append|patch|mkdir|rmdir|copy|upload|chmod|prune|kill|purge)",
+   "id": "mcp.writeish-name",
+   "tier": "allow",
+   "mutates": true,
+   "reason": "write-shaped MCP tool name — protected control-plane path arguments are refused"
+  }
+ ]
+}

damage_control/rules/mcp-tools.yaml

@@ -0,0 +1,47 @@
+# Per-tool policy for MCP tool calls (#923 option 1).
+#
+# The bash rules match shell command strings; an MCP call is a name plus a JSON
+# object, so coverage does not transfer — a tool is classified HERE instead.
+# First match wins. Fields: `tool` (exact full name) or `match` (regex on the
+# name), `tier` (allow | ask | block; default ask), `mutates` (screen protected
+# control-plane path arguments; defaults true for any non-allow tier), `id`
+# (stable — `unattended_allow` / `disabled_rules` name it), `reason`.
+#
+# Tier semantics are the Bash hook's, unchanged: `ask` is an interactive
+# confirm, demoted to allow under bypassPermissions/auto, and FAIL-CLOSED
+# (block + owner email) in an unattended session unless the id is granted.
+# A tool call names no directory, so a path-scoped grant refuses — grant these
+# ids unscoped, per task, deliberately.
+#
+# WHAT IS CLASSIFIED: the measured dangerous core — the kill/remove/teardown
+# class whose effect is not "a message to a guarded session". Each mirrors the
+# in-CLI safety its command path already carries (merge-verification, dirty
+# refusal, PR guards); the tier is additive on top, giving the tool call the
+# same unattended fail-closed posture its Bash spelling gets from the rules.
+#
+# WHAT IS DELIBERATELY NOT CLASSIFIED (pricing both halves — a wrongful tool
+# refusal in an unattended session is a silent loop):
+#   * session_send / session_send_keys / pane_send / msg_send — their effect is
+#     a message to a Claude session that runs its OWN damage control; the Bash
+#     twin (`agentwire send`) is unruled, and gating only the tool would
+#     recreate #923's channel asymmetry in reverse.
+#   * everything read-shaped or additive (create/list/status/output) — allow by
+#     falling through, with zero-access secret screening still applied to every
+#     tool's path arguments.
+#
+# UNCLASSIFIED TOOLS fall through to the final name-shape entry below (the
+# #1036 heuristic, now data a host can edit) and otherwise to allow-with-
+# screening. That default is the design decision #923 names: fail-closed would
+# kill every third-party tool and every future tool until classified.
+
+mcpToolPolicies:
+  # --- fallback for unclassified tools --------------------------------------
+  # The #1036 write-shaped-name heuristic, kept as DATA rather than code: a
+  # tool whose name declares a mutating operation gets its path-valued
+  # arguments screened against the protected control plane. `allow` tier — the
+  # name shape alone never blocks or asks; only a protected path argument does.
+  - match: "(write|edit|delete|remove|move|rename|create|append|patch|mkdir|rmdir|copy|upload|chmod|prune|kill|purge)"
+    id: mcp.writeish-name
+    tier: allow
+    mutates: true
+    reason: write-shaped MCP tool name — protected control-plane path arguments are refused

damage_control/rules/outbound.json

@@ -0,0 +1,40 @@
+{
+ "bashToolPatterns": [
+  {
+   "pattern": "\\btwilio\\s+api[:\\w.]*messages[:\\w.]*create\\b",
+   "reason": "twilio messages create (sends an SMS/MMS)",
+   "ask": true,
+   "id": "outbound.twilio-messages",
+   "anchored": true
+  },
+  {
+   "pattern": "\\baws\\s+ses(v2)?\\s+send-email\\b",
+   "reason": "aws ses send-email (sends an external email)",
+   "ask": true,
+   "id": "outbound.aws-ses",
+   "anchored": true
+  },
+  {
+   "pattern": "\\baws\\s+sns\\s+publish\\b",
+   "reason": "aws sns publish (sends an SMS/notification)",
+   "ask": true,
+   "id": "outbound.aws-sns",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bsendmail\\b",
+   "reason": "sendmail (sends external email)",
+   "ask": true,
+   "id": "outbound.sendmail",
+   "anchored": true
+  },
+  {
+   "pattern": "\\b(mail|mailx)\\s+(?:(?!--(?:\\s|$))[^\\s;&|]+\\s+)*?-s\\b",
+   "pattern_src": "\\b(mail|mailx)\\s+{ARGS}-s\\b",
+   "reason": "mail -s (sends external email)",
+   "ask": true,
+   "id": "outbound.mail",
+   "anchored": true
+  }
+ ]
+}