omamori 0.10.13

# omamori default configuration
#
# Built-in rules are always inherited. This file shows the full schema.
# To customize, create ~/.config/omamori/config.toml with only the rules
# you want to change. Run `omamori init` to generate a starter template.

# --- Detectors (AI environment detection) ---

[[detectors]]
name = "claude-code"
type = "env_var"
env_key = "CLAUDECODE"
env_value = "1"

[[detectors]]
name = "codex-cli"
type = "env_var"
env_key = "CODEX_CI"
env_value = "1"

[[detectors]]
name = "cursor"
type = "env_var"
env_key = "CURSOR_AGENT"
env_value = "1"

[[detectors]]
name = "gemini-cli"
type = "env_var"
env_key = "GEMINI_CLI"
env_value = "1"

[[detectors]]
name = "cline"
type = "env_var"
env_key = "CLINE_ACTIVE"
env_value = "true"

[[detectors]]
name = "ai-guard-fallback"
type = "env_var"
env_key = "AI_GUARD"
env_value = "1"

# --- Rules (protection policies) ---

[[rules]]
name = "rm-recursive-to-trash"
command = "rm"
action = "trash"
match_any = ["-r", "-rf", "-fr", "--recursive"]
message = "omamori moved the recursive rm targets to Trash instead of deleting them"
# enabled = true  # default; set to false to disable

[[rules]]
name = "git-reset-hard-stash"
command = "git"
action = "stash-then-exec"
match_all = ["reset", "--hard"]
message = "omamori stashed changes before running git reset --hard"

[[rules]]
name = "git-push-force-block"
command = "git"
action = "block"
match_all = ["push"]
match_any = ["--force", "-f"]
message = "omamori blocked a force push"

[[rules]]
name = "git-clean-force-block"
command = "git"
action = "block"
match_all = ["clean"]
match_any = ["-f", "--force"]
message = "omamori blocked git clean because it would remove untracked files"

[[rules]]
name = "chmod-777-block"
command = "chmod"
action = "block"
match_any = ["777"]
message = "omamori blocked chmod 777"

[[rules]]
name = "find-delete-block"
command = "find"
action = "block"
match_any = ["-delete", "--delete"]
message = "omamori blocked find with -delete flag"

[[rules]]
name = "rsync-delete-block"
command = "rsync"
action = "block"
match_any = ["--delete", "--del", "--delete-before", "--delete-during", "--delete-after", "--delete-excluded", "--delete-delay", "--remove-source-files"]
message = "omamori blocked rsync with destructive flags"

# --- omamori self-modification protection (v0.10.3, DI-13) ---
# Phase 2 backstop for verb patterns moved out of Phase 1A `command.contains`
# by the data-flag allowlist. Without these, relaxing Phase 1A would let raw
# `omamori config disable` / `omamori uninstall` etc. through.
#
# Each rule uses `subcommand` so args[0] must match exactly, preventing
# false positives like `omamori exec -- echo disable config`.

[[rules]]
name = "omamori-config-modify-block"
command = "omamori"
action = "block"
subcommand = "config"
match_any = ["disable", "enable"]
message = "omamori blocked self-modification of rules"

[[rules]]
name = "omamori-uninstall-block"
command = "omamori"
action = "block"
subcommand = "uninstall"
message = "omamori blocked uninstall via AI"

[[rules]]
name = "omamori-init-force-block"
command = "omamori"
action = "block"
subcommand = "init"
match_any = ["--force"]
message = "omamori blocked init --force via AI"

[[rules]]
name = "omamori-override-block"
command = "omamori"
action = "block"
subcommand = "override"
message = "omamori blocked override via AI"

[[rules]]
name = "omamori-doctor-fix-block"
command = "omamori"
action = "block"
subcommand = "doctor"
match_any = ["--fix"]
message = "omamori blocked doctor --fix via AI"

[[rules]]
name = "omamori-explain-block"
command = "omamori"
action = "block"
subcommand = "explain"
message = "omamori blocked explain via AI (oracle attack prevention)"

# --- Example: move-to action (new in v0.2) ---
# [[rules]]
# name = "rm-to-backup"
# command = "rm"
# action = "move-to"
# destination = "/tmp/omamori-quarantine/"
# match_any = ["-r", "-rf", "-fr", "--recursive"]
# message = "omamori moved targets to backup instead of deleting"

# --- Context-aware evaluation (enabled by default since v0.10.9) ---
# Built-in defaults are active. Uncomment individual fields to customize.

[context]
protected_paths = ["src/", "lib/", ".git/", ".env", ".ssh/"]
regenerable_paths = ["target/", "node_modules/", ".next/", "dist/", "build/", "__pycache__/", ".cache/"]

[context.git]
enabled = true
timeout_ms = 100

[audit]
enabled = false
# retention_days = 90  # 0 = unlimited (default). Minimum 7 days.
# strict = false  # true = block AI commands when HMAC secret unavailable