Harden command-policy parity validation

Author: Cipher-85

.codex/lib/validate_rules.py

@@ -5,6 +5,7 @@
 
 import argparse
 import json
+import re
 import sys
 import tomllib
 from pathlib import Path
@@ -16,6 +17,26 @@
     "git_branch": "git-branch",
 }
 
+REQUIRED_FORBIDDEN_COMMAND_EXAMPLES = (
+    "rm -rf",
+    "git reset --hard",
+    "git clean -f",
+    "git clean -fd",
+    "git clean -fx",
+    "git clean -fdx",
+    "git push --force",
+    "git push -f",
+    "sudo",
+    "chmod 777",
+    "cat ~/.ssh",
+    "cat .env",
+    "cat *.env",
+    "cat ~/.env",
+    "type .env",
+    "type *.env",
+    "type ~/.env",
+)
+
 
 def emit(root: Path, errors: list[str], warnings: list[str]) -> int:
     status = "pass" if not errors else "fail"
@@ -85,9 +106,17 @@ def main() -> int:
             errors.append(".codex/rules/settings.rules: match is a prefix_rule field, not a top-level function")
         if 'decision = "deny"' in text:
             errors.append('.codex/rules/settings.rules: use decision = "forbidden", not "deny"')
-        for required in ("git reset --hard", "rm -rf", "force push"):
-            if required not in text:
-                warnings.append(f".codex/rules/settings.rules: missing example text for {required}")
+        if 'decision = "forbidden"' not in text:
+            errors.append('.codex/rules/settings.rules: missing decision = "forbidden" for denied command policy')
+        quoted_examples = set(re.findall(r'"([^"]*)"', text))
+        missing_forbidden_examples = [
+            example for example in REQUIRED_FORBIDDEN_COMMAND_EXAMPLES if example not in quoted_examples
+        ]
+        if missing_forbidden_examples:
+            errors.append(
+                ".codex/rules/settings.rules: missing parity-critical forbidden command coverage for "
+                + ", ".join(missing_forbidden_examples)
+            )
     else:
         warnings.append(".codex/rules/settings.rules not present yet")
 

.codex/rules/settings.rules

@@ -11,7 +11,7 @@ prefix_rule(
     pattern = ["rm", "-rf"],
     decision = "forbidden",
     justification = "Use a scoped non-destructive command, or ask the user for an explicit cleanup plan.",
-    match = ["rm -rf build"],
+    match = ["rm -rf"],
 )
 prefix_rule(
     pattern = ["git", "reset", "--hard"],
@@ -25,21 +25,92 @@ prefix_rule(
     justification = "Use git status and ask the user before removing untracked files.",
     match = ["git clean -fdx"],
 )
+prefix_rule(
+    pattern = ["git", "clean", "-f"],
+    decision = "forbidden",
+    justification = "Use git status and ask the user before removing untracked files.",
+    match = ["git clean -f"],
+)
+prefix_rule(
+    pattern = ["git", "clean", "-fd"],
+    decision = "forbidden",
+    justification = "Use git status and ask the user before removing untracked files.",
+    match = ["git clean -fd"],
+)
+prefix_rule(
+    pattern = ["git", "clean", "-fx"],
+    decision = "forbidden",
+    justification = "Use git status and ask the user before removing untracked files.",
+    match = ["git clean -fx"],
+)
 prefix_rule(
     pattern = ["git", "push", "--force"],
     decision = "forbidden",
     justification = "Do not force push or rewrite remote history without explicit user approval.",
     match = ["git push --force"],
 )
+prefix_rule(
+    pattern = ["git", "push", "-f"],
+    decision = "forbidden",
+    justification = "Do not force push or rewrite remote history without explicit user approval.",
+    match = ["git push -f"],
+)
+prefix_rule(
+    pattern = ["sudo"],
+    decision = "forbidden",
+    justification = "Do not escalate privileges from project automation.",
+    match = ["sudo"],
+)
+prefix_rule(
+    pattern = ["chmod", "777"],
+    decision = "forbidden",
+    justification = "Use the narrowest file mode required instead of world-writable permissions.",
+    match = ["chmod 777"],
+)
 prefix_rule(
     pattern = ["cat", "~/.ssh"],
     decision = "forbidden",
     justification = "Do not read local SSH secrets.",
     match = ["cat ~/.ssh"],
 )
+
+# Prefix rules can cover direct tokenized .env reads, including the literal
+# shell glob token users type before expansion. Upstream .env redirection or
+# write patterns are outside this syntax and must stay handled by prompts,
+# hooks, or manual review rather than unsupported redirection rules.
+prefix_rule(
+    pattern = ["cat", ".env"],
+    decision = "forbidden",
+    justification = "Do not read local environment secret files.",
+    match = ["cat .env"],
+)
+prefix_rule(
+    pattern = ["cat", "*.env"],
+    decision = "forbidden",
+    justification = "Do not read local environment secret files.",
+    match = ["cat *.env"],
+)
 prefix_rule(
     pattern = ["cat", "~/.env"],
     decision = "forbidden",
     justification = "Do not read local environment secret files.",
     match = ["cat ~/.env"],
 )
+prefix_rule(
+    pattern = ["type", ".env"],
+    decision = "forbidden",
+    justification = "Do not read local environment secret files.",
+    match = ["type .env"],
+)
+prefix_rule(
+    pattern = ["type", "*.env"],
+    decision = "forbidden",
+    justification = "Do not read local environment secret files.",
+    match = ["type *.env"],
+)
+prefix_rule(
+    pattern = ["type", "~/.env"],
+    decision = "forbidden",
+    justification = "Do not read local environment secret files.",
+    match = ["type ~/.env"],
+)