{ "$schema": "tools.json \u2014 wrapper registry read by deny-gate.mjs. GLOBAL scope.", "_doc": "Each rule denies a NAIVE-WRONG raw command (whose obvious form misbehaves) and points to the tested wrapper. Match on the ALWAYS-WRONG signature, never a full-cluster shape. Partial by design \u2014 add rules as wrappers emerge. Escape any one command with a trailing '# raw-ok' comment.", "version": 1, "rules": [ { "id": "ccr-start-raw", "shim_binary": "ccr", "any_of": [ "\\bccr\\s+start\\b" ], "unless_contains": [ "ccr-up.sh" ], "wrapper": "bash ~/.claude/workflows/lib/ccr-up.sh ", "reason": "`ccr start` is a long-lived daemon. Naive foreground (or `ccr start | tail`) HANGS the whole run ~46min. The one correct, non-blocking launch is the tested wrapper (detached + flock + readiness-poll, idempotent, cannot hang)." }, { "id": "north-rig-raw", "all_of": [ "ANTHROPIC_BASE_URL", "claude" ], "any_of": [ "127\\.0\\.0\\.1:3456", "ANTHROPIC_MODEL" ], "unless_contains": [ "na.sh" ], "wrapper": "~/.claude/skills/north-orchestrator/na.sh --workspace --trust \"\" --task-slug ", "reason": "Hand-typed north rig leaks the OpenRouter env into your real-Anthropic shell and can hang on an unbounded claude -p. na.sh sources NORTH.env in its own subprocess (no leak), folds ccr-up (fail-closed), and bounds + stdin-closes the dispatch." }, { "id": "model-verification-purpose-raw", "argv_route_any_of": [ [ "(?:^|/)(?:opencode|codex|na)\\.sh$" ], [ "^opencode$", "^run$" ], [ "^cdx$", "^exec$" ], [ "^codex$", "^(?:exec|e)$" ], [ "^claude$", "^-p$" ] ], "argv_option_all_of": [ { "name": "--purpose", "value": "verification" } ], "unless_contains": [ "cdx exec", "cdx --profile" ], "wrapper": "model-test-fixture --purpose verification --backend --workspace --trust \"\" --task-slug ", "reason": "Model-backed tests, probes, smoke checks, canaries, and integration verification require the fixed free-route fixture. Raw wrappers and CLIs can select another engine, model, config, account, or fallback. EXEMPT: `cdx exec` \u2014 cdx is itself the sanctioned account-routing wrapper (see codex-auth-symlink-mutate), pins model/effort explicitly via `-m`/`-c model_reasoning_effort=`, and auto-logs every run, so it lacks the silent-engine/account-swap property this rule exists to catch. A probe whose SUBJECT is the cdx offload path itself (e.g. verifying the cdx sandbox can bootstrap a toolchain) can only be exercised by invoking cdx directly \u2014 routing it through model-test-fixture would pick a different engine and defeat the test." }, { "id": "model-verification-probe-raw", "all_of": [ "(?:^|[\\s\"'])(?:[^\\s\"']*/)?(?:opencode|codex|na)\\.sh\\b|\\bopencode\\s+run\\b|\\bcodex\\s+(?:exec|e)\\b|\\bclaude\\s+-p\\b", "(?:--task-slug(?:=|\\s+)[^\\s]*(?:test|probe|smoke|canary|integration)|\\b(?:AUTH-OK|[Rr]eply with exactly|[Rr]eply exactly|[Rr]espond with exactly|[Ss]ay exactly|[Rr]eply only with)\\b)" ], "wrapper": "model-test-fixture --purpose verification --backend --workspace --trust \"\" --task-slug ", "reason": "Model-backed tests, probes, smoke checks, canaries, and integration verification require the fixed free-route fixture. Raw wrappers and CLIs can select another engine, model, config, account, or fallback. EXEMPT: `cdx exec` \u2014 cdx is itself the sanctioned account-routing wrapper (see codex-auth-symlink-mutate), pins model/effort explicitly via `-m`/`-c model_reasoning_effort=`, and auto-logs every run, so it lacks the silent-engine/account-swap property this rule exists to catch. A probe whose SUBJECT is the cdx offload path itself can only be exercised by invoking cdx directly." }, { "id": "worktree-outside-repo", "all_of": [ "\\bgit\\b[^|;&]*\\bworktree\\s+add\\b" ], "any_of": [ "worktree\\s+add\\s+(?:-\\S+\\s+|\\S+\\s+)*?['\"]?(?:~|\\$HOME|/|\\.\\./)" ], "unless_contains": [ "od-worktree", "/.worktrees/", "/.claude/worktrees/" ], "wrapper": "od-worktree add (creates /.worktrees/; `od-worktree list` shows strays, `od-worktree adopt ` moves one back in)", "reason": "NEVER create a checkout outside the repo. Worktrees in $HOME, ~/Projects/-wt-*, or ~/.cache are exactly the laptop-wide sprawl overdeck exists to eliminate \u2014 the user has repeatedly said so, and no memory or prior agent's choice authorizes it. od-worktree can only write to /.worktrees/ and has no flag to escape it." }, { "id": "worktree-add-raw-suggest", "band": "suggest", "all_of": [ "\\bgit\\b[^|;&]*\\bworktree\\s+add\\b" ], "unless_contains": [ "od-worktree" ], "wrapper": "od-worktree add (same result, plus `od-worktree list`/`adopt` bookkeeping)", "reason": "A raw `git worktree add` inside the repo is not unsafe here, but od-worktree keeps the salvage/vault bookkeeping (od-wip) in sync \u2014 worth the one extra keystroke." }, { "id": "codex-auth-symlink-mutate", "all_of": [ "\\.codex/auth\\.json" ], "any_of": [ "\\bln\\s+-", "\\brm\\b", "\\bmv\\b", "\\bcp\\b", "\\bunlink\\b", "\\btee\\b", ">\\s*\\S*\\.codex/auth" ], "wrapper": "cdx --profile (select the account per-invocation; NEVER repoint the symlink)", "reason": "NEVER touch the ~/.codex/auth.json symlink. Repointing it swaps the active codex account for EVERY session sharing ~/.claude (silent account leak) and can outlive your script if the restoring trap is killed. To run codex on another account, select it per-invocation with `cdx --profile ` \u2014 no global mutable state. Reads (readlink/ls) are fine; only mutation is blocked." }, { "id": "codex-review-raw", "any_of": [ "\\bcodex\\s+exec\\b", "\\bcodex\\s+review\\b", "\\bcodex\\s+e\\b" ], "unless_contains": [ "cdx" ], "rewrite_from": "\\bcodex\\s+(exec|e)\\b", "rewrite_to": "cdx exec", "wrapper": "cdx exec --skip-git-repo-check -C -m \"gpt-5.6-sol\" -c \"model_reasoning_effort=low\" 'PROMPT'", "reason": "Naive `codex` binds to whatever account the auth symlink points at and picks codex's config-default model/effort (not gpt-5.6-sol/low). cdx routes to a healthy account per-invocation (no global auth mutation) and passes exec args through \u2014 the caller pins -m/-c explicitly. `codex exec` is auto-rewritten to `cdx exec`. (cx.sh was archived to workflows/.archive/ \u2014 this rule previously pointed there.)" }, { "id": "raw-heavy-build-local-gate", "any_of": [ "\\bturbo\\s+run\\b", "\\bpnpm\\s+(build|test|exec\\s+vitest)\\b", "\\bnpm\\s+(run\\s+build|test)\\b", "\\bnpx\\s+vitest\\b", "(^|[;&|]\\s*)vitest\\b", "\\bastro\\s+build\\b", "\\bvite\\s+build\\b", "(^|[;&|]\\s*)tsc\\b", "\\bplaywright\\s+test\\b", "\\bnode\\s+[^|;&]*--test\\b", "\\bcargo\\s+(test|build)\\b", "\\bgo\\s+(test|build)\\b", "\\bbun\\s+(test|run\\s+(build|test)|x\\s+vitest)\\b", "\\bbunx\\s+(vitest|playwright)\\b", "\\byarn\\s+(test|build)\\b" ], "unless_contains": [ "/home/user/.claude/bin/local-gate", "~/.claude/bin/local-gate", "/home/user/.claude/lib/cpu-guard.sh", "~/.claude/lib/cpu-guard.sh", "command -v", "which ", "type -a", "--version" ], "wrapper": "~/.claude/bin/local-gate --key --mode full -- ", "reason": "Raw heavy build/test/gate commands can saturate the workstation or bypass adaptive slots. Run them through local-gate so current load, memory, swap, dedupe, and cpu-guard wrapping are enforced." }, { "id": "gh-run-watch-unbounded", "any_of": [ "\\bgh\\s+run\\s+watch\\b" ], "unless_contains": [ "timeout " ], "rewrite_from": "\\bgh\\s+run\\s+watch\\b", "rewrite_to": "timeout -k 30 1500 gh run watch", "wrapper": "timeout -k 30 1500 gh run watch --exit-status (exit 124 = still running after 25min: check ONCE with `gh run view `, then decide \u2014 never re-watch in a loop)", "reason": "`gh run watch` blocks the turn until the CI run ends and hangs indefinitely on network flaps; with the 24h Bash ceiling one naive watch has held a turn 3.5h (measured: 18 hangs / 1136 min in 3 days). Auto-rewritten to a 25min-capped watch." }, { "id": "unbounded-wait-loop", "all_of": [ "\\b(while|until)\\s", "\\bsleep\\s", "^(?![\\s\\S]*\\btimeout\\s+\\d+[smh]?\\s+bash\\s+-c\\b)" ], "wrapper": "timeout bash -c 'until ; do sleep ; done' \u2014 the timeout must wrap the WHOLE loop; a `timeout` on the command INSIDE the loop still retries forever", "reason": "An unbounded while/until+sleep poll loop never returns when its condition never flips \u2014 measured 12 hangs / 1142 min in 3 days, worst 8.6h (that one had `timeout 900` inside the loop body, bounding each attempt but not the loop). Cap the whole loop with `timeout N bash -c '...'` so the turn can lose minutes, not hours." }, { "id": "follow-forever", "any_of": [ "\\btail\\b(\\s+(-{1,2}[A-Za-z0-9=_-]+|\\d+))*\\s+-[A-Za-z]*[fF]\\b", "\\bjournalctl\\b[^|;&]*(\\s-f\\b|--follow)", "\\b(docker|kubectl)\\s+logs\\b[^|;&]*(\\s-f\\b|--follow)" ], "all_of": [ "^(?![\\s\\S]*\\btimeout\\s+\\d)" ], "wrapper": "timeout tail -f (or take a snapshot: tail -n 200 )", "reason": "A follow-mode reader (`tail -f`, `journalctl -f`, `docker/kubectl logs -f`) never exits on its own, so it blocks the turn until the 24h Bash ceiling. Bound it with `timeout`, or read a snapshot instead." }, { "id": "raw-e2e-pair-local", "any_of": [ "\\bnode\\s+[^|;&]*\\b(shoot|capture|screenshot|measure|visual)[A-Za-z0-9._-]*\\.(mjs|cjs|js|ts)\\b", "\\b(astro|vite|next)\\s+dev\\b[^|;]*&\\s*\\S", "\\bpnpm\\s+(exec\\s+|run\\s+)?(astro|vite|next|dev)\\b[^|;]*&\\s*\\S" ], "unless_contains": [ "/home/user/.claude/bin/e2e-remote", "~/.claude/bin/e2e-remote", "e2e-remote", "command -v", "which ", "type -a", "--version", "--help" ], "wrapper": "e2e-remote --server \" --host 127.0.0.1 --port

\" --wait-port

--env PORT=

--mkdir -- ", "reason": "A browser client and its dev server are ONE coupled pair (the browser resolves the site to 127.0.0.1), so neither half offloads alone and cpu-guard cannot route them: `dev` is an explicit not-heavy early-return, and a bare `node