security.yaml

rules:
  # ===========================================================================
  # 1. CREDENTIAL PROTECTION
  # ===========================================================================
  - name: protect-env-files
    locked: true
    block: ["**/.env", "**/.env.*"]
    except: ["**/.env.example", "**/.env.template"]
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: .env files contain secrets (API keys, passwords). Ask the user to provide values instead."
    severity: critical

  - name: protect-ssh-keys
    locked: true
    block:
      - "$HOME/.ssh/*"
      - "**/.ssh/*"
    except:
      - "$HOME/.ssh/*.pub"
      - "**/.ssh/*.pub"
      - "$HOME/.ssh/known_hosts"
      - "**/.ssh/known_hosts"
      - "$HOME/.ssh/known_hosts.*"
      - "**/.ssh/known_hosts.*"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: SSH directory contains private keys and sensitive config."
    severity: critical

  # ===========================================================================
  # 2. SYSTEM AUTHENTICATION FILES
  # ===========================================================================
  - name: protect-system-auth
    locked: true
    block:
      - "/etc/passwd"
      - "/etc/shadow"
      - "/etc/master.passwd"
      - "/etc/sudoers"
      - "/etc/sudoers.d/**"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: system authentication files contain credentials (/etc/shadow, /etc/sudoers)."
    severity: critical

  # ===========================================================================
  # 3. SELF PROTECTION
  # ===========================================================================
  - name: protect-crust
    locked: true
    block:
      - "**/.crust/**"
      - "**/crust*.db"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: Crust internal data is protected from tampering."
    severity: critical

  # ===========================================================================
  # 4. SHELL HISTORY PROTECTION
  # ===========================================================================
  - name: protect-shell-history
    locked: true
    block:
      - "$HOME/.bash_history"
      - "$HOME/.zsh_history"
      - "$HOME/.sh_history"
      - "$HOME/.history"
      - "$HOME/.python_history"
      - "$HOME/.node_repl_history"
      - "$HOME/.mysql_history"
      - "$HOME/.psql_history"
      - "$HOME/.sqlite_history"
      - "$HOME/.lesshst"
      # Fish stores history in XDG data dir, not dotfile
      - "$HOME/.local/share/fish/fish_history"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: shell history may contain passwords and tokens typed on the command line."
    severity: high

  # ===========================================================================
  # 5. CLOUD CREDENTIALS PROTECTION
  # ===========================================================================
  - name: protect-cloud-credentials
    locked: true
    block:
      # AWS (credentials only — .aws/config has non-sensitive region/profile settings)
      - "$HOME/.aws/credentials"
      # Google Cloud
      - "$HOME/.config/gcloud/**"
      # Azure
      - "$HOME/.azure/**"
      # Kubernetes (config only — .kube/cache has non-sensitive API discovery metadata)
      - "$HOME/.kube/config"
      # Docker
      - "$HOME/.docker/config.json"
      # Terraform (home-scoped)
      - "$HOME/.terraform.d/credentials.tfrc.json"
      # Terraform (project-scoped)
      - "**/terraform.tfstate"
      - "**/terraform.tfstate.backup"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: cloud credential files contain authentication secrets. Use environment variables instead."
    severity: critical

  # ===========================================================================
  # 6. GPG/PGP KEY PROTECTION
  # ===========================================================================
  - name: protect-gpg-keys
    locked: true
    block:
      - "$HOME/.gnupg/private-keys-v1.d/**"
      - "$HOME/.gnupg/secring.gpg"
      - "$HOME/.gnupg/trustdb.gpg"
      - "$HOME/.gnupg/random_seed"
    # No except needed — block list targets only private key material
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: GPG private keys are cryptographic credentials."
    severity: critical

  # ===========================================================================
  # 7. BROWSER DATA PROTECTION
  # ===========================================================================
  - name: protect-browser-data
    locked: true
    block:
      # Chrome
      - "$HOME/Library/Application Support/Google/Chrome/**/Login Data"
      - "$HOME/Library/Application Support/Google/Chrome/**/Cookies"
      - "$HOME/Library/Application Support/Google/Chrome/**/History"
      - "$HOME/.config/google-chrome/**/Login Data"
      - "$HOME/.config/google-chrome/**/Cookies"
      - "$HOME/.config/google-chrome/**/History"
      - "$HOME/AppData/Local/Google/Chrome/User Data/**/Login Data"
      - "$HOME/AppData/Local/Google/Chrome/User Data/**/Cookies"
      - "$HOME/AppData/Local/Google/Chrome/User Data/**/History"
      # Firefox
      - "$HOME/Library/Application Support/Firefox/Profiles/**/logins.json"
      - "$HOME/Library/Application Support/Firefox/Profiles/**/key*.db"
      - "$HOME/Library/Application Support/Firefox/Profiles/**/cookies.sqlite"
      - "$HOME/.mozilla/firefox/**/logins.json"
      - "$HOME/.mozilla/firefox/**/key*.db"
      - "$HOME/.mozilla/firefox/**/cookies.sqlite"
      - "$HOME/AppData/Roaming/Mozilla/Firefox/Profiles/**/logins.json"
      - "$HOME/AppData/Roaming/Mozilla/Firefox/Profiles/**/key*.db"
      - "$HOME/AppData/Roaming/Mozilla/Firefox/Profiles/**/cookies.sqlite"
      # Safari (macOS only)
      - "$HOME/Library/Safari/History.db"
      - "$HOME/Library/Cookies/Cookies.binarycookies"
      # Microsoft Edge (Chromium-based — same file layout as Chrome)
      - "$HOME/Library/Application Support/Microsoft Edge/**/Login Data"
      - "$HOME/Library/Application Support/Microsoft Edge/**/Cookies"
      - "$HOME/.config/microsoft-edge/**/Login Data"
      - "$HOME/.config/microsoft-edge/**/Cookies"
      - "$HOME/AppData/Local/Microsoft/Edge/User Data/**/Login Data"
      - "$HOME/AppData/Local/Microsoft/Edge/User Data/**/Cookies"
      # Brave (Chromium-based)
      - "$HOME/Library/Application Support/BraveSoftware/Brave-Browser/**/Login Data"
      - "$HOME/Library/Application Support/BraveSoftware/Brave-Browser/**/Cookies"
      - "$HOME/.config/BraveSoftware/Brave-Browser/**/Login Data"
      - "$HOME/.config/BraveSoftware/Brave-Browser/**/Cookies"
      - "$HOME/AppData/Local/BraveSoftware/Brave-Browser/User Data/**/Login Data"
      - "$HOME/AppData/Local/BraveSoftware/Brave-Browser/User Data/**/Cookies"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: browser data contains saved passwords, cookies, and session tokens."
    severity: high

  # ===========================================================================
  # 8. GIT CREDENTIALS PROTECTION
  # ===========================================================================
  - name: protect-git-credentials
    locked: true
    block:
      - "**/.git-credentials"
      - "**/.config/git/credentials"
      # .netrc stores plaintext credentials for HTTP services (git, curl, ftp)
      - "$HOME/.netrc"
      - "$HOME/_netrc"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: git credential files (.git-credentials, .netrc) contain plaintext auth tokens."
    severity: critical

  # ===========================================================================
  # 9. PACKAGE MANAGER TOKENS
  # ===========================================================================
  - name: protect-package-tokens
    locked: true
    block:
      # npm
      - "**/.npmrc"
      # Yarn
      - "**/.yarnrc"
      - "**/.yarnrc.yml"
      # pip/PyPI
      - "**/.pypirc"
      - "**/.pip/pip.conf"
      # Cargo
      - "**/.cargo/credentials"
      - "**/.cargo/credentials.toml"
      # Composer
      - "**/.composer/auth.json"
      # NuGet
      - "**/.nuget/NuGet.Config"
      # Gem
      - "**/.gem/credentials"
      # Gradle
      - "$HOME/.gradle/gradle.properties"
      # Maven (settings.xml contains server credentials)
      - "$HOME/.m2/settings.xml"
      - "$HOME/.m2/settings-security.xml"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: package manager configs (.npmrc, .pypirc) may contain registry auth tokens."
    severity: high

  # ===========================================================================
  # 10. PERSISTENCE PROTECTION - Shell RC Files
  # ===========================================================================
  - name: protect-shell-rc
    locked: true
    block:
      - "$HOME/.bashrc"
      - "$HOME/.bash_profile"
      - "$HOME/.bash_login"
      - "$HOME/.zshrc"
      - "$HOME/.zprofile"
      - "$HOME/.zshenv"
      - "$HOME/.zlogin"
      - "$HOME/.profile"
      - "$HOME/.config/fish/config.fish"
      - "$HOME/.config/fish/conf.d/**"
    actions: [write, delete]
    message: "Blocked: modifying shell startup files is a persistence attack vector."
    severity: critical

  # ===========================================================================
  # 11. SSH AUTHORIZED KEYS PROTECTION
  # ===========================================================================
  - name: protect-ssh-authorized-keys
    locked: true
    block:
      - "$HOME/.ssh/authorized_keys"
      - "$HOME/.ssh/authorized_keys2"
      - "$HOME/.ssh/known_hosts"
      - "**/.ssh/authorized_keys"
      - "**/.ssh/authorized_keys2"
      - "**/.ssh/known_hosts"
    actions: [write, delete]
    message: "Blocked: modifying authorized_keys enables unauthorized remote access."
    severity: critical

  # ===========================================================================
  # 12. DESKTOP APP TOKEN PROTECTION
  # ===========================================================================
  - name: protect-desktop-app-tokens
    locked: true
    block:
      # Electron apps store session tokens in LevelDB/SQLite under app data dirs.
      # No legitimate AI coding agent reads these — MCP integrations use API
      # tokens via env vars, not local session files.
      #
      # $HOME expands to the current user's home directory at engine init.
      # Cross-OS paths are listed under $HOME — wrong-OS patterns compile
      # but never match (e.g., $HOME/Library/... on Linux is harmless).
      #
      # --- Chat / Communication (account takeover risk) ---
      # Discord (+ PTB / Canary variants)
      - "$HOME/Library/Application Support/discord/**"
      - "$HOME/Library/Application Support/discordptb/**"
      - "$HOME/Library/Application Support/discordcanary/**"
      - "$HOME/.config/discord/**"
      - "$HOME/.config/discordptb/**"
      - "$HOME/.config/discordcanary/**"
      - "$HOME/AppData/Roaming/discord/**"
      - "$HOME/AppData/Roaming/discordptb/**"
      - "$HOME/AppData/Roaming/discordcanary/**"
      # Slack
      - "$HOME/Library/Application Support/Slack/**"
      - "$HOME/.config/Slack/**"
      - "$HOME/AppData/Roaming/Slack/**"
      # Telegram Desktop
      - "$HOME/Library/Application Support/Telegram Desktop/**"
      - "$HOME/.local/share/TelegramDesktop/**"
      - "$HOME/AppData/Roaming/Telegram Desktop/**"
      # Signal
      - "$HOME/Library/Application Support/Signal/**"
      - "$HOME/.config/Signal/**"
      - "$HOME/AppData/Roaming/Signal/**"
      # WhatsApp Desktop
      - "$HOME/Library/Application Support/WhatsApp/**"
      - "$HOME/.config/WhatsApp/**"
      - "$HOME/AppData/Roaming/WhatsApp/**"
      # Microsoft Teams
      - "$HOME/Library/Application Support/Microsoft Teams/**"
      - "$HOME/.config/Microsoft/Microsoft Teams/**"
      - "$HOME/AppData/Roaming/Microsoft/Teams/**"
      # Element (Matrix)
      - "$HOME/Library/Application Support/Element/**"
      - "$HOME/.config/Element/**"
      - "$HOME/AppData/Roaming/Element/**"
      # Skype
      - "$HOME/Library/Application Support/Microsoft/Skype for Desktop/**"
      - "$HOME/.config/skypeforlinux/**"
      - "$HOME/AppData/Roaming/Microsoft/Skype for Desktop/**"
      # --- Developer Tools (API keys / OAuth tokens) ---
      # Postman
      - "$HOME/Library/Application Support/Postman/**"
      - "$HOME/.config/Postman/**"
      - "$HOME/AppData/Roaming/Postman/**"
      # GitHub Desktop
      - "$HOME/Library/Application Support/GitHub Desktop/**"
      - "$HOME/.config/GitHub Desktop/**"
      - "$HOME/AppData/Roaming/GitHub Desktop/**"
      # Figma
      - "$HOME/Library/Application Support/Figma/**"
      - "$HOME/.config/Figma/**"
      - "$HOME/AppData/Roaming/Figma/**"
      # Insomnia
      - "$HOME/Library/Application Support/Insomnia/**"
      - "$HOME/.config/Insomnia/**"
      - "$HOME/AppData/Roaming/Insomnia/**"
      # --- Password Managers (local vault = all passwords) ---
      # Bitwarden
      - "$HOME/Library/Application Support/Bitwarden/**"
      - "$HOME/.config/Bitwarden/**"
      - "$HOME/AppData/Roaming/Bitwarden/**"
      # 1Password
      - "$HOME/Library/Group Containers/*.com.1password/**"
      - "$HOME/.config/1Password/**"
      - "$HOME/AppData/Local/1Password/**"
      # KeePass / KeePassXC
      - "$HOME/Library/Application Support/KeePassXC/**"
      - "$HOME/.config/keepassxc/**"
      - "$HOME/AppData/Roaming/KeePassXC/**"
      # LastPass
      - "$HOME/Library/Application Support/LastPass/**"
      - "$HOME/.lastpass/**"
      - "$HOME/AppData/Roaming/LastPass/**"
      # --- Productivity ---
      # Notion
      - "$HOME/Library/Application Support/Notion/**"
      - "$HOME/.config/Notion/**"
      - "$HOME/AppData/Roaming/Notion/**"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: desktop app data contains session tokens (Discord, Slack, Telegram, etc.)."
    severity: critical

  # ===========================================================================
  # 13. OS KEYCHAIN / SECRET STORE PROTECTION
  # ===========================================================================
  - name: protect-os-keychains
    locked: true
    block:
      # macOS Keychain files (login.keychain-db contains all saved passwords)
      - "$HOME/Library/Keychains/**"
      - "/Library/Keychains/**"
      # GNOME Keyring (Linux desktop secret store)
      - "$HOME/.local/share/keyrings/**"
      # KDE Wallet
      - "$HOME/.local/share/kwalletd/**"
      # Mobile keychain (iOS Keychain / Android Keystore via virtual paths)
      - "mobile://keychain/**"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: OS keychain contains all saved passwords and credentials."
    severity: critical

  # ===========================================================================
  # 14. GITHUB CLI TOKEN PROTECTION
  # ===========================================================================
  - name: protect-github-cli
    locked: true
    block:
      - "$HOME/.config/gh/hosts.yml"
      - "$HOME/AppData/Roaming/GitHub CLI/hosts.yml"
    actions: [read, execute, write, delete, copy, move, network]
    message: "Blocked: GitHub CLI hosts.yml contains OAuth tokens. Use `gh` CLI or env vars instead."
    severity: critical

  # ===========================================================================
  # 15. PRIVATE KEY CONTENT DETECTION
  # ===========================================================================
  - name: detect-private-key-write
    match:
      content: "re:-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"
    actions: [write]
    message: "Blocked: writing private key material is a potential exfiltration vector."
    severity: critical

  # ===========================================================================
  # 16. SHELL EVASION PATTERNS (defense-in-depth for command regex rules)
  # ===========================================================================
  - name: block-eval-exec
    match:
      command: "re:\\beval\\b|\\bexec\\b"
    actions: [execute]
    message: "Blocked: eval/exec prevents static security analysis. Use direct commands instead."
    severity: high

  # ===========================================================================
  # 17. SYSTEM CONFIGURATION PROTECTION
  # Protects critical OS config files from agent tampering.
  # Read is allowed (debugging); only writes/deletes are blocked.
  # ===========================================================================
  - name: protect-system-config
    locked: true
    block:
      # DNS — silent traffic redirection
      - "/etc/hosts"
      - "/etc/resolv.conf"
      # SSH server config — weaken remote access security
      - "/etc/ssh/**"
      # PAM — bypass or weaken authentication
      - "/etc/pam.d/**"
      # Dynamic linker — library injection / rootkit
      - "/etc/ld.so.preload"
      - "/etc/ld.so.conf"
      - "/etc/ld.so.conf.d/**"
      # System-wide shell config — persistence for all users
      - "/etc/profile"
      - "/etc/profile.d/**"
      - "/etc/environment"
      - "/etc/bash.bashrc"
      - "/etc/zsh/**"
      - "/etc/zshrc"
    actions: [write, delete]
    message: "Blocked: system config files (/etc/hosts, /etc/ssh, PAM) control OS security."
    severity: critical

  # ===========================================================================
  # 18. PERSISTENCE VECTOR PROTECTION
  # Blocks agent writes to scheduled tasks, init scripts, and autostart entries.
  # Shell RC files are covered separately by protect-shell-rc.
  # ===========================================================================
  - name: protect-persistence
    locked: true
    block:
      # cron (Linux)
      - "/etc/crontab"
      - "/etc/cron.d/**"
      - "/etc/cron.daily/**"
      - "/etc/cron.hourly/**"
      - "/etc/cron.weekly/**"
      - "/etc/cron.monthly/**"
      - "/var/spool/cron/**"
      # cron (macOS)
      - "/var/at/**"
      - "/usr/lib/cron/**"
      # init / rc (legacy SysV)
      - "/etc/init.d/**"
      - "/etc/rc.local"
      - "/etc/rc.d/**"
      # systemd (system-level)
      - "/etc/systemd/system/**"
      - "/usr/lib/systemd/system/**"
      # systemd (user-level)
      - "$HOME/.config/systemd/user/**"
      - "$HOME/.local/share/systemd/user/**"
      # launchd (macOS)
      - "/Library/LaunchDaemons/**"
      - "/Library/LaunchAgents/**"
      - "$HOME/Library/LaunchAgents/**"
      # XDG autostart (Linux desktop)
      - "$HOME/.config/autostart/**"
      - "/etc/xdg/autostart/**"
      # Mobile background tasks (iOS Background App Refresh / Android JobScheduler)
      - "mobile://autostart/**"
    actions: [write, delete]
    message: "Blocked: cron/launchd/systemd/mobile-background entries are persistence vectors — malware uses these to survive reboot."
    severity: critical

  # ===========================================================================
  # 18b. CRONTAB COMMAND DETECTION
  # The crontab binary bypasses file-based cron rules because it writes to
  # /var/spool/cron internally. Block the command itself when used to install
  # new entries (pipe or heredoc into `crontab -` or `crontab` with no file
  # arg is read-only and harmless, but `crontab -` accepts stdin writes).
  # ===========================================================================
  - name: detect-crontab-write
    locked: true
    match:
      command: "re:\\bcrontab\\b\\s+(?:-[^lr\\s]|[^-\\s])|\\bcrontab\\s*$|\\|\\s*crontab\\b|\\bat\\b\\s+(?:-f\\b|now\\b)"
    actions: [execute]
    message: "Blocked: crontab/at command installs scheduled tasks — a persistence vector."
    severity: critical

  # ===========================================================================
  # 18c. EXFILTRATION VIA BASH REDIRECT
  # Defense-in-depth: the primary check is AST-based in the shell parser
  # (extractor_shell.go:detectExfilRedirect, engine.go step 6). This regex
  # rule is a fallback for evasive/unparseable commands where the AST check
  # cannot run. Requires redirect target to start with a path character
  # [/~$.] to avoid false positives on arbitrary strings containing ">".
  # ===========================================================================
  - name: detect-exfil-redirect
    locked: true
    match:
      command: "re:(?s)>\\s*[/~$.]\\S*.*(?:\\$\\(cat\\b|curl\\b|wget\\b|nc\\b)"
    actions: [execute, write]
    message: "Blocked: file redirect with exfiltration commands (curl, wget, cat)."
    severity: critical

  # ===========================================================================
  # 19. REVERSE SHELL DETECTION
  # Blocks unambiguous reverse shell patterns in commands.
  # /dev/tcp is a bash built-in network device with no legitimate coding use.
  # nc/ncat -e and socat exec bind a shell to a network socket.
  # ===========================================================================
  - name: detect-reverse-shell
    locked: true
    match:
      command: "re:/dev/tcp/|/dev/udp/|\\bnc(?:\\.traditional|\\.openbsd)?\\b.*\\s-e\\s|\\bncat\\b.*(\\s-e\\s|\\s--exec[\\s=]|\\s--sh-exec[\\s=])|\\bsocat\\b.*\\bexec\\b"
    actions: [execute, read, network]
    message: "Blocked: reverse shell pattern detected (/dev/tcp, nc -e, socat exec)."
    severity: critical

  # ===========================================================================
  # 20. CLOUD METADATA SSRF PROTECTION
  # Blocks agent access to cloud instance metadata endpoints (IMDS).
  # Covers AWS, Azure, GCP, DigitalOcean, Oracle Cloud, Alibaba Cloud.
  # ===========================================================================
  - name: block-ssrf-metadata
    locked: true
    match:
      host: "re:^169\\.254\\.169\\.254$|^metadata\\.google\\.internal$|^100\\.100\\.100\\.200$|^fd00:ec2::254$"
    actions: [read, execute, write, network]
    message: "Blocked: cloud metadata endpoint exposes IAM credentials — SSRF attack vector."
    severity: critical

  - name: block-ssrf-private-network
    locked: true
    match:
      # RFC1918 (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16),
      # CGN/shared (100.64/10), benchmarking (198.18/15), documentation (192.0.2/24,
      # 198.51.100/24, 203.0.113/24), IETF protocol (192.0.0/24), all-zeros,
      # IPv6 private (fc/fd ULA, fe80 link-local)
      host: "re:^10\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.|^192\\.168\\.|^127\\.|^0\\.0\\.0\\.0$|^169\\.254\\.|^100\\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\.|^198\\.1[89]\\.|^192\\.0\\.[02]\\.|^198\\.51\\.100\\.|^203\\.0\\.113\\.|^\\[?fc|^\\[?fd|^\\[?fe80"
    actions: [network]
    message: "Blocked: request targets private/reserved network — potential SSRF attack."
    severity: high

  # ===========================================================================
  # 21. AGENT CONFIGURATION PROTECTION
  # Prevents agents from modifying their own IDE/agent config to escalate
  # privileges. These files control hooks, MCP server trust, and consent —
  # an agent that writes its own config can achieve arbitrary code execution.
  #
  # CVE-2025-59536: .claude/settings.json hooks → auto-execute on session start
  # CVE-2025-54135: .cursor/mcp.json → MCP Auto-Run without consent
  # CVE-2026-21852: .mcp.json → enableAllProjectMcpServers bypasses consent
  # ===========================================================================
  - name: protect-agent-config
    locked: true
    block:
      # Claude Code hooks (CVE-2025-59536)
      - "**/.claude/settings*.json"
      # Cursor MCP Auto-Run (CVE-2025-54135)
      - "**/.cursor/mcp.json"
      # Project-level MCP consent bypass (CVE-2026-21852)
      - "**/.mcp.json"
      # Cursor CLI config (CVE-2025-61592)
      - "**/.cursor/cli.json"
      # Codex CLI config (CVE-2025-61260)
      - "**/.codex/config.toml"
      - "$HOME/.codex/config.toml"
      # Roo Code config (CVE-2025-53536)
      - "**/.roo/mcp.json"
      - "**/.roo/settings.json"
      # Zed agent config (CVE-2025-55012)
      - "$HOME/.config/zed/settings.json"
      - "$HOME/.config/zed/tasks.json"
      - "$HOME/.config/zed/extensions.json"
    actions: [write, delete]
    message: "Blocked: agent config files control hooks and MCP trust — modifying them is a privilege escalation vector."
    severity: critical

  # ===========================================================================
  # 22. VS CODE SETTINGS PROTECTION
  # Blocks agent writes to VS Code settings that can escalate privileges.
  # Not locked — agents sometimes need to edit VS Code workspace settings
  # for formatting, linting, or debug config. Users who need this can disable.
  #
  # CVE-2025-53773: prompt injection → chat.tools.autoApprove → YOLO mode → RCE
  # CVE-2025-54130: prompt injection → executablePath → malicious binary → RCE
  # ===========================================================================
  - name: protect-vscode-settings
    block:
      - "**/.vscode/settings.json"
      - "**/.vscode/launch.json"
      - "**/.vscode/tasks.json"
      # Workspace files can override VS Code settings (CVE-2025-61590)
      - "**/*.code-workspace"
    actions: [write, delete]
    message: "Blocked: .vscode config and workspace files can be abused to auto-approve commands, specify malicious executables, or define arbitrary shell tasks (CVE-2025-53773, CVE-2025-54130, CVE-2025-64660, CVE-2025-61590). Disable this rule if your agent needs to edit VS Code settings."
    severity: high

  # ===========================================================================
  # 23. GIT HOOKS PROTECTION
  # Git hooks auto-execute on operations like commit, push, and checkout.
  # An agent writing hooks achieves persistence across all future git usage.
  #
  # CVE-2025-68143/68144/68145: Git MCP Server chain → hook injection → RCE
  # ===========================================================================
  - name: protect-git-hooks
    locked: true
    block:
      - "**/.git/hooks/**"
    actions: [write, delete]
    message: "Blocked: git hooks auto-execute on commit/push/checkout — a persistence and RCE vector."
    severity: critical

  # ===========================================================================
  # 24. MOBILE PII PROTECTION
  # Blocks mobile AI agents from accessing sensitive personal data.
  # Uses virtual paths (mobile://pii/*) mapped by the extractor from tool
  # names like read_contacts, read_photos, read_calendar, etc.
  # ===========================================================================
  - name: protect-mobile-pii
    locked: true
    block:
      - "mobile://pii/**"
    actions: [read, write, delete, copy, move, network]
    message: "Blocked: accessing contacts, photos, calendar, location, or health data is a privacy violation."
    severity: critical

  # ===========================================================================
  # 25. MOBILE CLIPBOARD PROTECTION
  # Clipboard often contains passwords, OTPs, and sensitive data.
  # Only blocks reads — writes (copy-to-clipboard) are generally benign.
  # ===========================================================================
  - name: protect-mobile-clipboard
    locked: true
    block:
      - "mobile://clipboard"
    actions: [read]
    message: "Blocked: reading clipboard may expose passwords, OTPs, or sensitive data copied by the user."
    severity: high

  # ===========================================================================
  # 26. MOBILE URL SCHEME PROTECTION
  # Blocks invocation of sensitive URL schemes that can trigger phone calls,
  # send messages, install enterprise profiles, or modify system settings.
  # Common safe schemes (https, http) are not blocked.
  # ===========================================================================
  - name: protect-mobile-url-schemes
    locked: true
    block:
      - "mobile://url-scheme/tel"
      - "mobile://url-scheme/sms"
      - "mobile://url-scheme/facetime"
      - "mobile://url-scheme/facetime-audio"
      - "mobile://url-scheme/itms-services"
      - "mobile://url-scheme/itms-appss"
      - "mobile://url-scheme/app-settings"
      - "mobile://url-scheme/prefs"
    actions: [execute]
    message: "Blocked: invoking sensitive URL schemes (tel:, sms:, itms-services:) without user consent."
    severity: critical

  # ===========================================================================
  # 27. MOBILE HARDWARE ACCESS PROTECTION
  # Blocks AI agents from accessing Bluetooth and NFC hardware.
  # These can be used for device fingerprinting, unauthorized pairing,
  # or proximity-based attacks.
  # ===========================================================================
  - name: protect-mobile-hardware
    locked: true
    block:
      - "mobile://hardware/**"
    actions: [read, write, execute, network]
    message: "Blocked: accessing Bluetooth or NFC hardware without user consent."
    severity: high

  # ===========================================================================
  # 28. MOBILE BIOMETRIC AUTHENTICATION PROTECTION
  # Prevents AI agents from triggering biometric authentication prompts.
  # An agent should never be able to silently authorize actions via
  # Face ID / Touch ID — this must be user-initiated.
  # ===========================================================================
  - name: protect-mobile-biometric
    locked: true
    block:
      - "mobile://auth/biometric"
    actions: [execute]
    message: "Blocked: triggering biometric authentication (Face ID / Touch ID) must be user-initiated."
    severity: critical

  # ===========================================================================
  # 29. MOBILE IN-APP PURCHASE PROTECTION
  # Prevents AI agents from initiating purchases or financial transactions.
  # ===========================================================================
  - name: protect-mobile-purchases
    locked: true
    block:
      - "mobile://purchase/**"
    actions: [execute]
    message: "Blocked: AI agents cannot initiate in-app purchases or financial transactions."
    severity: critical

  # ===========================================================================
  # 30. GIT CONFIG FILE PROTECTION
  # .git/config can define filter/diff/merge drivers that execute commands.
  # .gitattributes can trigger those filters on checkout/diff/merge.
  # .gitmodules can define update commands that run on submodule update.
  # An agent writing these achieves arbitrary code execution on git operations.
  # ===========================================================================
  - name: protect-git-config
    locked: true
    block:
      # Per-repo config
      - "**/.git/config"
      - "**/.gitattributes"
      - "**/.gitmodules"
      # Global config (can define fsmonitor, filter drivers, hooksPath)
      - "$HOME/.gitconfig"
      - "$HOME/.config/git/config"
      # System-wide config
      - "/etc/gitconfig"
    actions: [write, delete]
    message: "Blocked: git config files can define commands that execute on git operations."
    severity: critical

  # ===========================================================================
  # 31. HOOK CONFIG FILE PROTECTION
  # Pre-commit, Husky, and Lefthook configs auto-execute commands on git
  # commit/push/checkout. An agent writing these achieves persistence.
  # ===========================================================================
  - name: protect-hook-configs
    locked: true
    block:
      - "**/.pre-commit-config.yaml"
      - "**/.husky/**"
      - "**/lefthook.yml"
      - "**/lefthook.yaml"
      - "**/.lefthook/**"
    actions: [write, delete]
    message: "Blocked: hook config files auto-execute commands on git commit/push."
    severity: critical

  # ===========================================================================
  # 32. MOBILE CALL LOG / SMS HISTORY PROTECTION
  # Call logs and SMS history contain highly sensitive communication metadata.
  # Already partially covered by protect-mobile-pii (mobile://pii/**), but
  # explicitly listed for clarity.
  # ===========================================================================

  # ===========================================================================
  # 33. WORLD-WRITABLE PERMISSION DETECTION
  # Detects chmod creating world-writable files (777, 666) or granting
  # others/all write access via symbolic modes.
  # ===========================================================================
  - name: detect-chmod-world-writable
    locked: true
    match:
      command: "re:\\bchmod\\b\\s+(?:777|666|o\\+[rwx]|a\\+[rwx])"
    actions: [execute, write]
    message: "Blocked: chmod creates world-writable permissions — potential security weakness."
    severity: high

  # ===========================================================================
  # 33b. SETUID/SETGID DETECTION
  # Detects chmod setting setuid/setgid bits via octal (4xxx, 2xxx, 6xxx)
  # or symbolic (+s) modes — classic privilege escalation vectors.
  # ===========================================================================
  - name: detect-chmod-setuid
    locked: true
    match:
      command: "re:\\bchmod\\b\\s+(?:[2467]\\d{3}|[ugoa]*\\+[rwxst]*s[rwxst]*)"
    actions: [execute, write]
    message: "Blocked: chmod sets setuid/setgid bit — privilege escalation vector."
    severity: critical

  # ===========================================================================
  # 33c. UMASK / SETCAP / SETFACL DETECTION
  # Detects umask 0 (world-writable default), setcap (capabilities), and
  # setfacl (ACL manipulation).
  # ===========================================================================
  - name: detect-permission-tools
    locked: true
    match:
      command: "re:\\bumask\\b\\s+0{1,3}(?:\\s|$)|\\bsetcap\\b|\\bsetfacl\\b"
    actions: [execute, write]
    message: "Blocked: umask 0/setcap/setfacl can weaken system security."
    severity: high

  # ===========================================================================
  # 34. ADDITIONAL PERSISTENCE VECTORS
  # Blocks agent writes to boot-time, container, and build-system configs
  # that auto-execute code.
  # ===========================================================================
  - name: protect-persistence-extended
    locked: true
    block:
      # Kernel module loading
      - "/etc/modprobe.conf"
      - "/etc/modprobe.d/**"
      # Docker Compose overrides (auto-merged with docker-compose.yml)
      - "**/docker-compose.override.yml"
      - "**/docker-compose.override.yaml"
      # Gradle init scripts (run on every build)
      - "$HOME/.gradle/init.gradle"
      - "$HOME/.gradle/init.gradle.kts"
      - "$HOME/.gradle/init.d/**"
      # GRUB bootloader
      - "/etc/default/grub"
      - "/etc/grub.d/**"
      - "/boot/grub/grub.cfg"
      - "/boot/grub2/grub.cfg"
    actions: [write, delete]
    message: "Blocked: modprobe, Docker Compose override, Gradle init, and GRUB configs are persistence vectors."
    severity: critical