{ "$schema": "tools.json — wrapper registry read by deny-gate.mjs. GLOBAL scope.", "_doc": "Each rule denies a NAIVE-WRONG raw command (whose obvious form misbehaves) and points to the tested wrapper. Match on the ALWAYS-WRONG signature, never a full-cluster shape. Partial by design — add rules as wrappers emerge. Escape any one command with a trailing '# raw-ok' comment.", "version": 1, "rules": [ { "id": "ccr-start-raw", "any_of": ["\\bccr\\s+start\\b"], "unless_contains": ["ccr-up.sh"], "wrapper": "bash ~/.claude/workflows/lib/ccr-up.sh ", "reason": "`ccr start` is a long-lived daemon. Naive foreground (or `ccr start | tail`) HANGS the whole run ~46min. The one correct, non-blocking launch is the tested wrapper (detached + flock + readiness-poll, idempotent, cannot hang)." }, { "id": "north-rig-raw", "all_of": ["ANTHROPIC_BASE_URL", "claude"], "any_of": ["127\\.0\\.0\\.1:3456", "ANTHROPIC_MODEL"], "unless_contains": ["na.sh"], "wrapper": "~/.claude/skills/north-orchestrator/na.sh --workspace --trust \"\" --task-slug ", "reason": "Hand-typed north rig leaks the OpenRouter env into your real-Anthropic shell and can hang on an unbounded claude -p. na.sh sources NORTH.env in its own subprocess (no leak), folds ccr-up (fail-closed), and bounds + stdin-closes the dispatch." }, { "id": "worktree-outside-repo", "all_of": ["\\bgit\\b[^|;&]*\\bworktree\\s+add\\b"], "any_of": ["worktree\\s+add\\s+(?:-\\S+\\s+|\\S+\\s+)*?['\"]?(?:~|\\$HOME|/|\\.\\./)"], "unless_contains": ["od-worktree", "/.worktrees/", "/.claude/worktrees/"], "wrapper": "od-worktree add (creates /.worktrees/; `od-worktree list` shows strays, `od-worktree adopt ` moves one back in)", "reason": "NEVER create a checkout outside the repo. Worktrees in $HOME, ~/Projects/-wt-*, or ~/.cache are exactly the laptop-wide sprawl overdeck exists to eliminate — the user has repeatedly said so, and no memory or prior agent's choice authorizes it. od-worktree can only write to /.worktrees/ and has no flag to escape it." }, { "id": "codex-auth-symlink-mutate", "all_of": ["\\.codex/auth\\.json"], "any_of": ["\\bln\\s+-", "\\brm\\b", "\\bmv\\b", "\\bcp\\b", "\\bunlink\\b", "\\btee\\b", ">\\s*\\S*\\.codex/auth"], "wrapper": "cdx --profile (select the account per-invocation; NEVER repoint the symlink)", "reason": "NEVER touch the ~/.codex/auth.json symlink. Repointing it swaps the active codex account for EVERY session sharing ~/.claude (silent account leak) and can outlive your script if the restoring trap is killed. To run codex on another account, select it per-invocation with `cdx --profile ` — no global mutable state. Reads (readlink/ls) are fine; only mutation is blocked." }, { "id": "codex-review-raw", "any_of": ["\\bcodex\\s+exec\\b", "\\bcodex\\s+review\\b", "\\bcodex\\s+e\\b"], "unless_contains": ["cdx"], "rewrite_from": "\\bcodex\\s+(exec|e)\\b", "rewrite_to": "cdx exec", "wrapper": "cdx exec --skip-git-repo-check -C -m \"gpt-5.6-sol\" -c \"model_reasoning_effort=low\" 'PROMPT'", "reason": "Naive `codex` binds to whatever account the auth symlink points at and picks codex's config-default model/effort (not gpt-5.6-sol/low). cdx routes to a healthy account per-invocation (no global auth mutation) and passes exec args through — the caller pins -m/-c explicitly. `codex exec` is auto-rewritten to `cdx exec`. (cx.sh was archived to workflows/.archive/ — this rule previously pointed there.)" }, { "id": "raw-heavy-build-local-gate", "any_of": [ "\\bturbo\\s+run\\b", "\\bpnpm\\s+(build|test|exec\\s+vitest)\\b", "\\bnpm\\s+(run\\s+build|test)\\b", "\\bnpx\\s+vitest\\b", "(^|[;&|]\\s*)vitest\\b", "\\bastro\\s+build\\b", "\\bvite\\s+build\\b", "(^|[;&|]\\s*)tsc\\b", "\\bplaywright\\s+test\\b", "\\bnode\\s+[^|;&]*--test\\b", "\\bcargo\\s+(test|build)\\b", "\\bgo\\s+(test|build)\\b" ], "unless_contains": [ "/home/user/.claude/bin/local-gate", "~/.claude/bin/local-gate", "/home/user/.claude/lib/cpu-guard.sh", "~/.claude/lib/cpu-guard.sh", "command -v", "which ", "type -a", "--version" ], "wrapper": "~/.claude/bin/local-gate --key --mode full -- ", "reason": "Raw heavy build/test/gate commands can saturate the workstation or bypass adaptive slots. Run them through local-gate so current load, memory, swap, dedupe, and cpu-guard wrapping are enforced." }, { "id": "gh-run-watch-unbounded", "any_of": ["\\bgh\\s+run\\s+watch\\b"], "unless_contains": ["timeout "], "rewrite_from": "\\bgh\\s+run\\s+watch\\b", "rewrite_to": "timeout -k 30 1500 gh run watch", "wrapper": "timeout -k 30 1500 gh run watch --exit-status (exit 124 = still running after 25min: check ONCE with `gh run view `, then decide — never re-watch in a loop)", "reason": "`gh run watch` blocks the turn until the CI run ends and hangs indefinitely on network flaps; with the 24h Bash ceiling one naive watch has held a turn 3.5h (measured: 18 hangs / 1136 min in 3 days). Auto-rewritten to a 25min-capped watch." }, { "id": "unbounded-wait-loop", "all_of": ["\\b(while|until)\\s", "\\bsleep\\s", "^(?![\\s\\S]*\\btimeout\\s+\\d+[smh]?\\s+bash\\s+-c\\b)"], "wrapper": "timeout bash -c 'until ; do sleep ; done' — the timeout must wrap the WHOLE loop; a `timeout` on the command INSIDE the loop still retries forever", "reason": "An unbounded while/until+sleep poll loop never returns when its condition never flips — measured 12 hangs / 1142 min in 3 days, worst 8.6h (that one had `timeout 900` inside the loop body, bounding each attempt but not the loop). Cap the whole loop with `timeout N bash -c '...'` so the turn can lose minutes, not hours." }, { "id": "follow-forever", "any_of": [ "\\btail\\b(\\s+(-{1,2}[A-Za-z0-9=_-]+|\\d+))*\\s+-[A-Za-z]*[fF]\\b", "\\bjournalctl\\b[^|;&]*(\\s-f\\b|--follow)", "\\b(docker|kubectl)\\s+logs\\b[^|;&]*(\\s-f\\b|--follow)" ], "all_of": ["^(?![\\s\\S]*\\btimeout\\s+\\d)"], "wrapper": "timeout tail -f (or take a snapshot: tail -n 200 )", "reason": "A follow-mode reader (`tail -f`, `journalctl -f`, `docker/kubectl logs -f`) never exits on its own, so it blocks the turn until the 24h Bash ceiling. Bound it with `timeout`, or read a snapshot instead." }, { "id": "raw-e2e-pair-local", "any_of": [ "\\bnode\\s+[^|;&]*\\b(shoot|capture|screenshot|measure|visual)[A-Za-z0-9._-]*\\.(mjs|cjs|js|ts)\\b", "\\b(astro|vite|next)\\s+dev\\b[^|;]*&\\s*\\S", "\\bpnpm\\s+(exec\\s+|run\\s+)?(astro|vite|next|dev)\\b[^|;]*&\\s*\\S" ], "unless_contains": [ "/home/user/.claude/bin/e2e-remote", "~/.claude/bin/e2e-remote", "e2e-remote", "command -v", "which ", "type -a", "--version", "--help" ], "wrapper": "e2e-remote --server \" --host 127.0.0.1 --port

\" --wait-port

--env PORT=

--mkdir -- ", "reason": "A browser client and its dev server are ONE coupled pair (the browser resolves the site to 127.0.0.1), so neither half offloads alone and cpu-guard cannot route them: `dev` is an explicit not-heavy early-return, and a bare `node