rules:
- id: git.status
match: { command: git, subcommand: status }
effect: safe
undo: none
- id: git.reset-hard
match: { command: git, subcommand: reset, flags_any: ["--hard"] }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Discards uncommitted work; reflog does not cover the working tree."
- id: git.clean
match: { command: git, subcommand: clean }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Deletes untracked files git has never seen; unrecoverable via git."
- id: git.checkout
match: { command: git, subcommand: checkout }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Conservative: pathspec form (`git checkout -- .`) clobbers the working tree. Branch-switch refinement lands with the parser (step 2)."
- id: git.restore
match: { command: git, subcommand: restore }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Modern `git checkout -- <path>`: discards working-tree changes, unrecoverable via git."
- id: git.rm
match: { command: git, subcommand: rm }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Removes tracked files from the working tree. --cached (index-only) over-captures harmlessly."
- id: git.switch-discard
match: { command: git, subcommand: switch, flags_any: ["--discard-changes", "-f", "--force"] }
effect: destructive
scope: { paths: repo }
undo: snapshot-restore
notes: "Plain `git switch` refuses to lose changes; --discard-changes/-f overrides that guard."
- id: git.push
match: { command: git, subcommand: push }
effect: externalizing
undo: none
notes: "Leaves the machine. --force rewrites remote history — flagged HIGH in the journal."
- id: git.log
match: { command: git, subcommand: log }
effect: safe
undo: none
- id: git.diff
match: { command: git, subcommand: diff }
effect: safe
undo: none
- id: git.show
match: { command: git, subcommand: show }
effect: safe
undo: none