command-policy.mjs

const probe = "codex-policy-test-block";

const blockedPatterns = [
  [/\bgit(?:\.exe)?\b[^\r\n;&|]*?\bpush\b/i, "git push is disabled"],
  [/\bgit(?:\.exe)?\s+reset\s+--hard\b/i, "git reset --hard is disabled"],
  [/\bgit(?:\.exe)?\s+clean\b/i, "git clean is disabled"],
  [/\bgit(?:\.exe)?\s+restore\b/i, "git restore is disabled"],
  [/\bgit(?:\.exe)?\s+checkout\s+(?:--(?:\s|$)|\.(?:\s|$))/i, "destructive git checkout is disabled"],
  [/\bgit(?:\.exe)?\s+branch\s+-D(?:\s|$)/i, "forced branch deletion is disabled"],
  [/\bgit(?:\.exe)?\s+rebase\b/i, "git rebase is disabled"],
  [/\bgit(?:\.exe)?\s+branch\s+(?:--set-upstream-to(?:=|\s)|-u(?:\s|$))/i, "branch upstream changes are disabled"],
  [/\bgit(?:\.exe)?\s+checkout\s+-b\b[^\r\n;&|]*\borigin\//i, "tracked checkout branch creation is disabled"],
  [/\bgit(?:\.exe)?\s+switch\s+-c\b[^\r\n;&|]*(?:\borigin\/|--track\b)/i, "tracked switch branch creation is disabled"],
  [/(?:^|\s)--no-verify(?:\s|$)/i, "hook bypass with --no-verify is disabled"],
  [/\bgit(?:\.exe)?\s+commit\s+-n(?:\s|$)/i, "hook bypass with git commit -n is disabled"],
  [/\bgit(?:\.exe)?\b[^\r\n;&|]*--force(?:-with-lease)?(?:\s|$)/i, "forced Git operations are disabled"],
  [/\bgh(?:\.exe)?\s+api\b[^\r\n;&|]*(?:--method(?:=|\s+)|-X\s+)(?:POST|PUT|PATCH|DELETE)(?:\s|$)/i, "mutating GitHub API calls are disabled"],
  [/\bgh(?:\.exe)?\s+api\b[^\r\n;&|]*(?:--input(?:=|\s+)|-F\s+|-f\s+)/i, "GitHub API calls with request bodies are disabled"],
  [/\bgh(?:\.exe)?\s+pr\s+merge\b/i, "GitHub PR merge is disabled"],
  [/\bgh(?:\.exe)?\s+release\s+(?:create|upload|edit|delete|delete-asset|verify-asset)\b/i, "GitHub release publishing is disabled"],
  [/(?:^|[\s;&|])rm(?:\.exe)?\s+[^\r\n;&|]*-(?:r|rf|fr)(?:\s|$)/i, "recursive deletion with rm is disabled"],
  [/(?:^|[\s;&|])rmdir(?:\.exe)?(?:\s|$)/i, "rmdir is disabled"],
  [/\bRemove-Item\b[^\r\n;&|]*(?:-Recurse\b|-r(?:\s|$))/i, "recursive PowerShell deletion is disabled"],
];

const command = (await Bun.stdin.json())?.tool_input?.command ?? "";
const match = typeof command === "string" && (
  command.trim().toLowerCase() === probe
    ? [null, "harmless policy probe blocked"]
    : blockedPatterns.find(([pattern]) => pattern.test(command))
);

if (match) {
  console.log(JSON.stringify({
    hookSpecificOutput: {
      hookEventName: "PreToolUse",
      permissionDecision: "deny",
      permissionDecisionReason: `Global command policy: ${match[1]}.`,
    },
  }));
}