damage-control-dev 0.1.0__py3-none-any.whl

damage_control/rules/outbound.yaml

@@ -0,0 +1,58 @@
+# Outbound communication damage control rules
+#
+# Outward-facing "send" verbs — email, SMS, push. These are irreversible (you
+# can't un-send) and reach real people, so they must NOT sail through an
+# UNATTENDED (scheduler) session silently. They're classified `ask: true`:
+#   - interactive bypass/auto session  → allow (no friction, the common case)
+#   - interactive non-bypass session   → confirm prompt
+#   - UNATTENDED (AGENTWIRE_UNATTENDED) → fail closed: block + email owner,
+#     unless the rule id is on the task's `unattended_allow`.
+#
+# These patterns gate the Bash shell-out (an agent or a scheduled task's `post:`
+# step running `agentwire email`/`quo`). Agents inside agentwire sessions usually
+# send via the MCP tools `email_send` / `quo_send` instead — those are gated by
+# the dedicated `mcp-tool-damage-control.py` PreToolUse hook (#457), which
+# synthesizes the equivalent `agentwire email`/`quo` command and reuses
+# `outbound.agentwire-email` / `outbound.agentwire-quo` below verbatim (same IDs,
+# same `unattended_allow`). See docs/wiki/internals/damage-control.md.
+
+bashToolPatterns:
+  # ---------------------------------------------------------------------------
+  # TWILIO (SMS / messaging)
+  # ---------------------------------------------------------------------------
+  - pattern: '\btwilio\s+api[:\w.]*messages[:\w.]*create\b'
+    reason: twilio messages create (sends an SMS/MMS)
+    ask: true
+    id: outbound.twilio-messages
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # AWS messaging (SES email, SNS publish)
+  # ---------------------------------------------------------------------------
+  - pattern: '\baws\s+ses(v2)?\s+send-email\b'
+    reason: aws ses send-email (sends an external email)
+    ask: true
+    id: outbound.aws-ses
+    anchored: true
+
+  - pattern: '\baws\s+sns\s+publish\b'
+    reason: aws sns publish (sends an SMS/notification)
+    ask: true
+    id: outbound.aws-sns
+    anchored: true
+
+  # ---------------------------------------------------------------------------
+  # GENERIC MAIL TRANSPORTS
+  # ---------------------------------------------------------------------------
+  - pattern: '\bsendmail\b'
+    reason: sendmail (sends external email)
+    ask: true
+    id: outbound.sendmail
+    anchored: true
+
+  - pattern: '\b(mail|mailx)\s+(?:(?!--(?:\s|$))[^\s;&|]+\s+)*?-s\b'
+    pattern_src: '\b(mail|mailx)\s+{ARGS}-s\b'
+    reason: mail -s (sends external email)
+    ask: true
+    id: outbound.mail
+    anchored: true

damage_control/rules/payloads.json

@@ -0,0 +1,120 @@
+{
+ "bashToolPatterns": [
+  {
+   "pattern": "shutil\\.rmtree",
+   "reason": "shutil.rmtree recursive delete (equivalent to rm -rf)",
+   "id": "core.shutil-rmtree-recursive-delete-equivalent-to-rm-rf",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bperl\\b.*\\bunlink\\b",
+   "reason": "perl unlink delete (use git clean or manual cleanup)",
+   "bypassable": true,
+   "id": "core.perl-unlink-delete-use-git-clean-or-manual-cleanup",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bmongosh.*dropDatabase",
+   "reason": "MongoDB dropDatabase",
+   "id": "databases.mongodb-dropdatabase",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bmongo.*dropDatabase",
+   "reason": "MongoDB dropDatabase",
+   "id": "databases.mongodb-dropdatabase-2",
+   "anchored": false
+  },
+  {
+   "pattern": "DELETE\\s+FROM\\s+\\w+\\s*;",
+   "reason": "DELETE without WHERE clause (will delete ALL rows)",
+   "id": "databases.delete-without-where-clause-will-delete-all-rows",
+   "anchored": false
+  },
+  {
+   "pattern": "DELETE\\s+FROM\\s+\\w+\\s*$",
+   "reason": "DELETE without WHERE clause (will delete ALL rows)",
+   "id": "databases.delete-without-where-clause-will-delete-all-rows-2",
+   "anchored": false
+  },
+  {
+   "pattern": "DELETE\\s+\\*\\s+FROM",
+   "reason": "DELETE * (will delete ALL rows)",
+   "id": "databases.delete-will-delete-all-rows",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bTRUNCATE\\s+TABLE\\b",
+   "reason": "TRUNCATE TABLE (will delete ALL rows)",
+   "id": "databases.truncate-table-will-delete-all-rows",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bDROP\\s+TABLE\\b",
+   "reason": "DROP TABLE",
+   "id": "databases.drop-table",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bDROP\\s+DATABASE\\b",
+   "reason": "DROP DATABASE",
+   "id": "databases.drop-database",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bDELETE\\s+FROM\\s+\\w+\\s+WHERE\\b.*\\bid\\s*=",
+   "reason": "SQL DELETE with specific ID",
+   "ask": true,
+   "id": "databases.sql-delete-with-specific-id",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bpsql\\b.*\\b(INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET|ALTER\\s+TABLE|CREATE\\s+TABLE|GRANT\\s+|REVOKE\\s+)",
+   "reason": "psql executing a write statement (INSERT/UPDATE/ALTER/CREATE/GRANT)",
+   "ask": true,
+   "id": "db.psql-write",
+   "anchored": false
+  },
+  {
+   "pattern": "\\b(mysql|mariadb)\\b.*\\b(INSERT\\s+INTO|UPDATE\\s+\\w+\\s+SET|ALTER\\s+TABLE|CREATE\\s+TABLE|GRANT\\s+|REVOKE\\s+)",
+   "reason": "mysql executing a write statement (INSERT/UPDATE/ALTER/CREATE/GRANT)",
+   "ask": true,
+   "id": "db.mysql-write",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bmongosh?\\b.*\\.(insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|replaceOne|bulkWrite)\\b",
+   "reason": "mongosh executing a write operation (insert/update/delete)",
+   "ask": true,
+   "id": "db.mongosh-write",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bdocker\\s+rm\\s+.*-f.*\\$\\(docker\\s+ps",
+   "reason": "docker rm -f $(docker ps) (force removes containers)",
+   "id": "containers.docker-rm-f-docker-ps-force-removes-containers",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bgit\\b[^;&|]*\\s-c\\s*(?:alias\\.[^.=\\s]+=!|(?:core\\.(?:sshcommand|fsmonitor|pager|editor|askpass|alternaterefscommand)|sequence\\.editor|gpg\\.program|diff\\.external|credential\\.helper|uploadpack\\.packobjectshook|filter\\.[^.=\\s]+\\.(?:clean|smudge|process)|difftool\\.[^.=\\s]+\\.cmd|mergetool\\.[^.=\\s]+\\.cmd|merge\\.[^.=\\s]+\\.driver|remote\\.[^.=\\s]+\\.(?:uploadpack|receivepack)|browser\\.[^.=\\s]+\\.cmd|man\\.[^.=\\s]+\\.cmd)=)",
+   "reason": "git -c sets a config key that names a program git will execute",
+   "ask": true,
+   "id": "git.config-exec-key",
+   "anchored": false
+  },
+  {
+   "pattern": "(?:^|[;&|(`]|\\$\\(|(?:\\s-c|\\bssh\\s+\\S+)\\s+['\"])\\s*(?:\\w+=\\S*\\s+|(?:sudo|doas|env|nohup|time|command|exec|timeout|gtimeout|nice|xargs|stdbuf|ionice|setsid|caffeinate|unbuffer)\\s+(?:-\\S+\\s+|\\d+[smhd]?\\s+)*)*git\\b[^;&|]*?\\sconfig\\b(?![^;&|]*\\s(?:--(?:get|unset|list|edit)|-l\\b|-e\\b))[^;&|]*?\\s(?:core\\.(?:sshcommand|fsmonitor|pager|editor|askpass|alternaterefscommand)|sequence\\.editor|gpg\\.program|diff\\.external|credential\\.helper|uploadpack\\.packobjectshook|filter\\.[^.\\s]+\\.(?:clean|smudge|process)|difftool\\.[^.\\s]+\\.cmd|mergetool\\.[^.\\s]+\\.cmd|merge\\.[^.\\s]+\\.driver|remote\\.[^.\\s]+\\.(?:uploadpack|receivepack)|browser\\.[^.\\s]+\\.cmd|man\\.[^.\\s]+\\.cmd)\\s+(?!(?:(?:vim|nvim|vi|view|nano|pico|micro|emacs|ed|ex|less|more|cat|bat|most|true|false|code|subl|mate|zed)(?:\\s+-{1,2}[A-Za-z][\\w-]*(?:=[\\w.-]+)?)*(?=(?:\\s+--(?:global|local|system|worktree|replace-all|add))*\\s*(?:$|[;&|)`]))|(['\\\"])(?:vim|nvim|vi|view|nano|pico|micro|emacs|ed|ex|less|more|cat|bat|most|true|false|code|subl|mate|zed)(?:\\s+-{1,2}[A-Za-z][\\w-]*(?:=[\\w.-]+)?)*\\1(?=(?:\\s+--(?:global|local|system|worktree|replace-all|add))*\\s*(?:$|[;&|)`]))))[^\\s\\x00]",
+   "reason": "git config sets a key that names a program git will execute",
+   "ask": true,
+   "id": "git.config-set-exec-key",
+   "anchored": false
+  },
+  {
+   "pattern": "\\bgit\\s+config\\b(?![^;&|]*\\s(?:--(?:get|unset|list|edit)|-l\\b|-e\\b))[^;&|]*?\\salias\\.[^.=\\s]+\\s+['\"]?!",
+   "reason": "git config sets a shell-command alias (alias.x = !cmd)",
+   "ask": true,
+   "id": "git.config-set-alias-bang",
+   "anchored": false
+  }
+ ]
+}

damage_control/rules/payloads.yaml

@@ -0,0 +1,155 @@
+# Wrapped-payload damage control rules
+#
+# Every rule here matches text that arrives INSIDE another command's quoted
+# argument -- a SQL statement handed to psql, a script handed to python -c /
+# perl -e / mongosh --eval, a $(...) substitution. They are the rules that fail
+# the anchoring shape test, so they live together in one uniformly UNANCHORED
+# file (#915).
+#
+# WHY A FILE AND NOT A PER-RULE FLAG. `anchored: true` swaps the haystack for
+# masked_subcommands(), which blanks every fully-quoted token containing
+# whitespace regardless of position. That is lossless for a command-prefix rule
+# and fatal here: masking removes exactly the text these rules exist to catch.
+# Anchoring is therefore decided per FILE, gated on the git.yaml shape test --
+# every rule command-prefix shaped AND the tool takes no inner-command payload
+# -- so there is no per-rule skip-list to keep in sync (see
+# ~/.claude/rules/architecture.md). remote.yaml is the other unanchored file:
+# ssh's payload is the same shape, and its rules are kept whole there because
+# they double-cover the local rules in core.yaml.
+#
+# Each rule carries an explicit `id:` pinned to the id it had before the move,
+# so `safety.disabled_rules` / `unattended_allow` entries keep working.
+#
+# DO NOT add `anchored: true` to anything in this file. The invariant is
+# enforced by tests/unit/test_damage_control_payload_anchoring.py.
+
+bashToolPatterns:
+
+  # ---------------------------------------------------------------------------
+  # INTERPRETER / CLIENT EVAL PAYLOADS
+  # ---------------------------------------------------------------------------
+
+  - pattern: 'shutil\.rmtree'
+    reason: shutil.rmtree recursive delete (equivalent to rm -rf)
+    id: core.shutil-rmtree-recursive-delete-equivalent-to-rm-rf
+    anchored: false
+
+  - pattern: '\bperl\b.*\bunlink\b'
+    reason: perl unlink delete (use git clean or manual cleanup)
+    bypassable: true
+    id: core.perl-unlink-delete-use-git-clean-or-manual-cleanup
+    anchored: false
+
+  - pattern: '\bmongosh.*dropDatabase'
+    reason: MongoDB dropDatabase
+    id: databases.mongodb-dropdatabase
+    anchored: false
+
+  - pattern: '\bmongo.*dropDatabase'
+    reason: MongoDB dropDatabase
+    id: databases.mongodb-dropdatabase-2
+    anchored: false
+
+  # ---------------------------------------------------------------------------
+  # SQL STATEMENTS
+  # ---------------------------------------------------------------------------
+
+  - pattern: 'DELETE\s+FROM\s+\w+\s*;'
+    reason: DELETE without WHERE clause (will delete ALL rows)
+    id: databases.delete-without-where-clause-will-delete-all-rows
+    anchored: false
+
+  - pattern: 'DELETE\s+FROM\s+\w+\s*$'
+    reason: DELETE without WHERE clause (will delete ALL rows)
+    id: databases.delete-without-where-clause-will-delete-all-rows-2
+    anchored: false
+
+  - pattern: 'DELETE\s+\*\s+FROM'
+    reason: DELETE * (will delete ALL rows)
+    id: databases.delete-will-delete-all-rows
+    anchored: false
+
+  - pattern: '\bTRUNCATE\s+TABLE\b'
+    reason: TRUNCATE TABLE (will delete ALL rows)
+    id: databases.truncate-table-will-delete-all-rows
+    anchored: false
+
+  - pattern: '\bDROP\s+TABLE\b'
+    reason: DROP TABLE
+    id: databases.drop-table
+    anchored: false
+
+  - pattern: '\bDROP\s+DATABASE\b'
+    reason: DROP DATABASE
+    id: databases.drop-database
+    anchored: false
+
+  - pattern: '\bDELETE\s+FROM\s+\w+\s+WHERE\b.*\bid\s*='
+    reason: SQL DELETE with specific ID
+    ask: true
+    id: databases.sql-delete-with-specific-id
+    anchored: false
+
+  - pattern: '\bpsql\b.*\b(INSERT\s+INTO|UPDATE\s+\w+\s+SET|ALTER\s+TABLE|CREATE\s+TABLE|GRANT\s+|REVOKE\s+)'
+    reason: psql executing a write statement (INSERT/UPDATE/ALTER/CREATE/GRANT)
+    ask: true
+    id: db.psql-write
+    anchored: false
+
+  - pattern: '\b(mysql|mariadb)\b.*\b(INSERT\s+INTO|UPDATE\s+\w+\s+SET|ALTER\s+TABLE|CREATE\s+TABLE|GRANT\s+|REVOKE\s+)'
+    reason: mysql executing a write statement (INSERT/UPDATE/ALTER/CREATE/GRANT)
+    ask: true
+    id: db.mysql-write
+    anchored: false
+
+  - pattern: '\bmongosh?\b.*\.(insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|replaceOne|bulkWrite)\b'
+    reason: mongosh executing a write operation (insert/update/delete)
+    ask: true
+    id: db.mongosh-write
+    anchored: false
+
+  # ---------------------------------------------------------------------------
+  # COMMAND SUBSTITUTION
+  # ---------------------------------------------------------------------------
+
+  - pattern: '\bdocker\s+rm\s+.*-f.*\$\(docker\s+ps'
+    reason: docker rm -f $(docker ps) (force removes containers)
+    id: containers.docker-rm-f-docker-ps-force-removes-containers
+    anchored: false
+
+  # ---------------------------------------------------------------------------
+  # GIT CONFIG KEYS THAT NAME AN EXECUTABLE (#921)
+  # ---------------------------------------------------------------------------
+  # A subset of `git -c` keys name a program git will RUN (core.sshCommand,
+  # core.fsmonitor, core.pager, ...). The value is additionally re-scanned as a
+  # command in its own right (`_git_exec_config_payloads`), so a dangerous
+  # payload hits its own block rule; this rule is the confirm tier for
+  # payloads no rule recognizes. Unanchored: the key sits in an option's
+  # attached/separate value, never at command position.
+
+  - pattern: '\bgit\b[^;&|]*\s-c\s*(?:alias\.[^.=\s]+=!|(?:core\.(?:sshcommand|fsmonitor|pager|editor|askpass|alternaterefscommand)|sequence\.editor|gpg\.program|diff\.external|credential\.helper|uploadpack\.packobjectshook|filter\.[^.=\s]+\.(?:clean|smudge|process)|difftool\.[^.=\s]+\.cmd|mergetool\.[^.=\s]+\.cmd|merge\.[^.=\s]+\.driver|remote\.[^.=\s]+\.(?:uploadpack|receivepack)|browser\.[^.=\s]+\.cmd|man\.[^.=\s]+\.cmd)=)'
+    reason: git -c sets a config key that names a program git will execute
+    ask: true
+    id: git.config-exec-key
+    anchored: false
+
+  # Set-form `git config <exec-key> <value>` (#1133): git runs the value through
+  # a shell, so only a known editor/pager word is bare-safe -- either bare, or
+  # quoted with plain flags (`'vim -f'`, `'code --wait'`). Anything else asks:
+  # a separator or substitution inside quotes (`'less;sh'`), an escape
+  # (`less\;sh`), `$'..'`, an unknown program. Unanchored: the quoting and
+  # escaping that decide safety are invisible in the masked view. Command
+  # position is required, so a message that merely quotes the command passes.
+  - pattern: '(?:^|[;&|(`]|\$\(|(?:\s-c|\bssh\s+\S+)\s+[''"])\s*(?:\w+=\S*\s+|(?:sudo|doas|env|nohup|time|command|exec|timeout|gtimeout|nice|xargs|stdbuf|ionice|setsid|caffeinate|unbuffer)\s+(?:-\S+\s+|\d+[smhd]?\s+)*)*git\b[^;&|]*?\sconfig\b(?![^;&|]*\s(?:--(?:get|unset|list|edit)|-l\b|-e\b))[^;&|]*?\s(?:core\.(?:sshcommand|fsmonitor|pager|editor|askpass|alternaterefscommand)|sequence\.editor|gpg\.program|diff\.external|credential\.helper|uploadpack\.packobjectshook|filter\.[^.\s]+\.(?:clean|smudge|process)|difftool\.[^.\s]+\.cmd|mergetool\.[^.\s]+\.cmd|merge\.[^.\s]+\.driver|remote\.[^.\s]+\.(?:uploadpack|receivepack)|browser\.[^.\s]+\.cmd|man\.[^.\s]+\.cmd)\s+(?!(?:(?:vim|nvim|vi|view|nano|pico|micro|emacs|ed|ex|less|more|cat|bat|most|true|false|code|subl|mate|zed)(?:\s+-{1,2}[A-Za-z][\w-]*(?:=[\w.-]+)?)*(?=(?:\s+--(?:global|local|system|worktree|replace-all|add))*\s*(?:$|[;&|)`]))|([''\"])(?:vim|nvim|vi|view|nano|pico|micro|emacs|ed|ex|less|more|cat|bat|most|true|false|code|subl|mate|zed)(?:\s+-{1,2}[A-Za-z][\w-]*(?:=[\w.-]+)?)*\1(?=(?:\s+--(?:global|local|system|worktree|replace-all|add))*\s*(?:$|[;&|)`]))))[^\s\x00]'
+    reason: git config sets a key that names a program git will execute
+    ask: true
+    id: git.config-set-exec-key
+    anchored: false
+
+  # Set-form alias with the bang form (`git config alias.x '!cmd'`): the `!` sits
+  # inside a quoted value, which the anchored git.yaml rules see masked.
+  - pattern: '\bgit\s+config\b(?![^;&|]*\s(?:--(?:get|unset|list|edit)|-l\b|-e\b))[^;&|]*?\salias\.[^.=\s]+\s+[''"]?!'
+    reason: git config sets a shell-command alias (alias.x = !cmd)
+    ask: true
+    id: git.config-set-alias-bang
+    anchored: false

damage_control/rules/publish.json

@@ -0,0 +1,46 @@
+{
+ "bashToolPatterns": [
+  {
+   "pattern": "\\bcargo\\s+publish\\b",
+   "reason": "cargo publish (publishes a crate to crates.io)",
+   "ask": true,
+   "id": "publish.cargo",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bpoetry\\s+publish\\b",
+   "reason": "poetry publish (publishes a package to PyPI)",
+   "ask": true,
+   "id": "publish.poetry",
+   "anchored": true
+  },
+  {
+   "pattern": "\\btwine\\s+upload\\b",
+   "reason": "twine upload (publishes a package to PyPI)",
+   "ask": true,
+   "id": "publish.twine",
+   "anchored": true
+  },
+  {
+   "pattern": "\\b(pnpm|yarn)\\s+publish\\b",
+   "reason": "pnpm/yarn publish (publishes a package to npm registry)",
+   "ask": true,
+   "id": "publish.pnpm-yarn",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bgem\\s+push\\b",
+   "reason": "gem push (publishes a gem to RubyGems)",
+   "ask": true,
+   "id": "publish.gem",
+   "anchored": true
+  },
+  {
+   "pattern": "\\bmvn\\s+(deploy|.*\\bdeploy:deploy)\\b",
+   "reason": "mvn deploy (publishes artifacts to a Maven repository)",
+   "ask": true,
+   "id": "publish.maven",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/publish.yaml

@@ -0,0 +1,46 @@
+# Package publish damage control rules
+#
+# Publishing to a public registry is irreversible and outward-facing (downstream
+# users pull what you push), so it must be caught in UNATTENDED sessions. All
+# `ask: true` — see outbound.yaml for how `ask` resolves per session mode.
+#
+# Note: `npm publish` and `uv publish` are already `ask`-tier via the write-access
+# tooldef commands (agentwire/tooldefs/{npm,uv}.yaml). These rules cover the
+# registries that have no tooldef.
+
+bashToolPatterns:
+  - pattern: '\bcargo\s+publish\b'
+    reason: cargo publish (publishes a crate to crates.io)
+    ask: true
+    id: publish.cargo
+    anchored: true
+
+  - pattern: '\bpoetry\s+publish\b'
+    reason: poetry publish (publishes a package to PyPI)
+    ask: true
+    id: publish.poetry
+    anchored: true
+
+  - pattern: '\btwine\s+upload\b'
+    reason: twine upload (publishes a package to PyPI)
+    ask: true
+    id: publish.twine
+    anchored: true
+
+  - pattern: '\b(pnpm|yarn)\s+publish\b'
+    reason: pnpm/yarn publish (publishes a package to npm registry)
+    ask: true
+    id: publish.pnpm-yarn
+    anchored: true
+
+  - pattern: '\bgem\s+push\b'
+    reason: gem push (publishes a gem to RubyGems)
+    ask: true
+    id: publish.gem
+    anchored: true
+
+  - pattern: '\bmvn\s+(deploy|.*\bdeploy:deploy)\b'
+    reason: mvn deploy (publishes artifacts to a Maven repository)
+    ask: true
+    id: publish.maven
+    anchored: true

damage_control/rules/registry.json

@@ -0,0 +1,10 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "registry.npm-unpublish-removes-package-from-registry",
+   "pattern": "\\bnpm\\s+unpublish\\b",
+   "reason": "npm unpublish (removes package from registry)",
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/registry.yaml

@@ -0,0 +1,11 @@
+# Package registry damage control (default-on group `registry`, #1141)
+#
+# Vendor-neutral registry operations that must stay protected on a fresh install,
+# independent of whether the `publish` pack is enabled. `npm publish` itself is
+# ask-tier through the npm tooldef, which belongs to this same group.
+
+bashToolPatterns:
+  - id: registry.npm-unpublish-removes-package-from-registry
+    pattern: '\bnpm\s+unpublish\b'
+    reason: npm unpublish (removes package from registry)
+    anchored: true

damage_control/rules/remote.json

@@ -0,0 +1,31 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "remote.ssh-remote-reboot",
+   "pattern": "\\bssh\\s+.*\\breboot\\b",
+   "reason": "SSH remote reboot",
+   "ask": true,
+   "anchored": false
+  },
+  {
+   "id": "remote.ssh-remote-shutdown",
+   "pattern": "\\bssh\\s+.*\\bshutdown\\b",
+   "reason": "SSH remote shutdown",
+   "ask": true,
+   "anchored": false
+  },
+  {
+   "id": "remote.ssh-remote-service-stop",
+   "pattern": "\\bssh\\s+.*\\bsystemctl\\s+stop\\b",
+   "reason": "SSH remote service stop",
+   "ask": true,
+   "anchored": false
+  },
+  {
+   "id": "remote.ssh-remote-docker-rm-f",
+   "pattern": "\\bssh\\s+.*\\bdocker\\s+rm\\s+.*-f",
+   "reason": "SSH remote docker rm -f",
+   "anchored": false
+  }
+ ]
+}

damage_control/rules/remote.yaml

@@ -0,0 +1,53 @@
+# Remote execution damage control rules
+# SSH remote execution safeguards
+#
+# MOSTLY SUPERSEDED BY THE WRAPPER-PAYLOAD RESCAN (#924). ssh's remote command
+# is now extracted and re-scanned as a command in its own right
+# (`_ssh_remote_payload` in agentwire/safety/_core.py), so EVERY rule —
+# anchored ones included, at real command positions — applies to the wrapped
+# form automatically. The hand-written ssh twins of local rules (rm -rf,
+# sudo rm, mkfs, dd-to-device, dropdb, mysqladmin drop, redis FLUSHALL,
+# docker system prune) were measured redundant against the full corpus and
+# deleted; do not add new twins here — a rule written once applies over ssh.
+#
+# What remains is the ssh-ONLY surface: operations with no local rule twin
+# (rebooting/stopping a REMOTE machine is a risk locally unruled), plus one
+# rule that is deliberately STRICTER than its local tooldef tier.
+#
+# WHY THIS FILE STAYS UNANCHORED (#915)
+#
+# The dangerous text is ssh's quoted payload; `anchored: true` matches against
+# masked_subcommands(), which blanks any fully-quoted token containing
+# whitespace -- so anchoring would blank exactly the half these rules read.
+#
+# DO NOT add `anchored: true` to anything in this file. Enforced by
+# tests/unit/test_damage_control_payload_anchoring.py.
+
+bashToolPatterns:
+  # Remote machine-state operations — no local rule twin exists for these, so
+  # the rescan alone leaves them uncovered.
+  - id: remote.ssh-remote-reboot
+    pattern: '\bssh\s+.*\breboot\b'
+    reason: SSH remote reboot
+    ask: true
+    anchored: false
+
+  - id: remote.ssh-remote-shutdown
+    pattern: '\bssh\s+.*\bshutdown\b'
+    reason: SSH remote shutdown
+    ask: true
+    anchored: false
+
+  - id: remote.ssh-remote-service-stop
+    pattern: '\bssh\s+.*\bsystemctl\s+stop\b'
+    reason: SSH remote service stop
+    ask: true
+    anchored: false
+
+  # Deliberately STRICTER than the local tier: `docker rm -f` locally is
+  # ask-tier (tooldef); on a remote box it stays a hard block — deleting this
+  # twin would downgrade the wrapped form from block to ask.
+  - id: remote.ssh-remote-docker-rm-f
+    pattern: '\bssh\s+.*\bdocker\s+rm\s+.*-f'
+    reason: SSH remote docker rm -f
+    anchored: false

damage_control/rules/tmux.json

@@ -0,0 +1,17 @@
+{
+ "bashToolPatterns": [
+  {
+   "id": "agentwire.tmux-kill-server-destroys-all-tmux-sessions-including-agentw",
+   "pattern": "\\btmux\\s+kill-server\\b",
+   "reason": "tmux kill-server (destroys ALL tmux sessions)",
+   "anchored": true
+  },
+  {
+   "id": "agentwire.tmux-kill-session-a-kills-all-except-current",
+   "pattern": "\\btmux\\s+kill-session\\s+.*-a\\b",
+   "reason": "tmux kill-session -a (kills all except current)",
+   "ask": true,
+   "anchored": true
+  }
+ ]
+}

damage_control/rules/tmux.yaml

@@ -0,0 +1,16 @@
+# tmux hazards (opt-in pack `tmux`)
+#
+# Destroying every tmux session at once is a hazard for anyone who keeps
+# long-running work in tmux, agent or not.
+
+bashToolPatterns:
+  - id: agentwire.tmux-kill-server-destroys-all-tmux-sessions-including-agentw
+    pattern: '\btmux\s+kill-server\b'
+    reason: tmux kill-server (destroys ALL tmux sessions)
+    anchored: true
+
+  - id: agentwire.tmux-kill-session-a-kills-all-except-current
+    pattern: '\btmux\s+kill-session\s+.*-a\b'
+    reason: tmux kill-session -a (kills all except current)
+    ask: true
+    anchored: true

damage_control/ruleset.py

@@ -0,0 +1,94 @@
+"""The enforced rule set as ``{stable id: "tier:fingerprint"}``, and the diff between two of them (#1209 M5).
+
+``install.json`` records one of these at every acknowledged install. ``status`` compares the
+current set against it ("ruleset changed since last acknowledged") and ``init --refresh``
+prints the diff by id. A refresh that WIDENS what is permitted must say so (#916): a removed
+rule, a lowered tier, a new allow-path and a new default unattended grant are marked ``!!``.
+
+Standard library only.
+"""
+
+import hashlib
+import json
+from typing import Any, Dict, Iterable, List, NamedTuple, Optional, Tuple
+
+TIER_RANK = {"block": 3, "ask": 2, "allow": 1}
+_PATH_LISTS = (("zeroAccessPaths", "block"), ("readOnlyPaths", "block"), ("noDeletePaths", "block"))
+ALLOW_NAMESPACE = "allowedPaths:"
+
+
+class Change(NamedTuple):
+    loosening: bool
+    text: str
+
+
+def _fingerprint(value: Any) -> str:
+    return hashlib.sha256(json.dumps(value, sort_keys=True, default=str).encode()).hexdigest()[:10]
+
+
+def _label(item: Any) -> str:
+    if isinstance(item, str):
+        return item
+    if isinstance(item, dict):
+        for key in ("path", "pattern", "entry", "id"):
+            if isinstance(item.get(key), str):
+                return item[key]
+    return json.dumps(item, sort_keys=True, default=str)
+
+
+def digest(config: Dict[str, Any]) -> Dict[str, str]:
+    """Every enforced rule of ``config`` (an effective config) keyed by its stable id."""
+    out: Dict[str, str] = {}
+    for rule in config.get("bashToolPatterns") or []:
+        if isinstance(rule, dict) and rule.get("id"):
+            out.setdefault(rule["id"], f"{'ask' if rule.get('ask') else 'block'}:{_fingerprint(rule.get('pattern'))}")
+    for policy in config.get("mcpToolPolicies") or []:
+        if isinstance(policy, dict) and policy.get("id"):
+            match = policy.get("match") or policy.get("tool") or policy.get("pattern")
+            out.setdefault(policy["id"], f"{policy.get('tier', 'allow')}:{_fingerprint(match)}")
+    for key, tier in _PATH_LISTS:
+        for item in config.get(key) or []:
+            out.setdefault(f"{key}:{_label(item)}", f"{tier}:-")
+    for item in config.get("allowedPaths") or []:
+        out.setdefault(f"{ALLOW_NAMESPACE}{_label(item)}", "allow:-")
+    return out
+
+
+def _tier(value: Optional[str]) -> str:
+    return (value or "").split(":", 1)[0]
+
+
+def diff(old: Dict[str, str], new: Dict[str, str],
+         old_grants: Iterable[str] = (), new_grants: Iterable[str] = ()) -> List[Change]:
+    """Added / removed / changed ids between two digests, plus new default grants. Loosening is flagged."""
+    changes: List[Change] = []
+    for rid in sorted(set(old) | set(new)):
+        before, after = old.get(rid), new.get(rid)
+        if before == after:
+            continue
+        allow_entry = rid.startswith(ALLOW_NAMESPACE)
+        if before is None:
+            changes.append(Change(allow_entry, f"+ {rid} ({_tier(after)})" + (" widens what is allowed" if allow_entry else "")))
+        elif after is None:
+            changes.append(Change(not allow_entry, f"- {rid} (was {_tier(before)})"))
+        elif _tier(before) != _tier(after):
+            lowered = TIER_RANK.get(_tier(after), 0) < TIER_RANK.get(_tier(before), 0)
+            changes.append(Change(lowered, f"~ {rid} {_tier(before)} -> {_tier(after)}"))
+        else:
+            changes.append(Change(False, f"~ {rid} pattern changed (review: a narrower pattern permits more)"))
+    for grant in sorted(set(new_grants) - set(old_grants)):
+        changes.append(Change(True, f"+ default unattended grant {grant}"))
+    return changes
+
+
+def render(changes: List[Change]) -> List[str]:
+    return [f"{'!!' if c.loosening else '  '} {c.text}" for c in changes]
+
+
+def has_loosening(changes: List[Change]) -> bool:
+    return any(c.loosening for c in changes)
+
+
+def summary(changes: List[Change]) -> Tuple[int, int]:
+    """``(total changes, loosening changes)``."""
+    return len(changes), sum(1 for c in changes if c.loosening)