Module policy 

Write-boundary primitives.

Stateless classifiers shared by the armed guard ([super::decide]) and pipeline::detect-stray-writes: which tools write, which Bash commands mutate state outside a sandbox, and whether a path falls under an allowed root.

Constants

WRITE_TOOLS

Tools that mutate the filesystem and carry a target path argument.

Functions

apply_patch_paths

Extract file paths from a Codex apply_patch hook payload. Codex can expose patch targets as a structured files list or as freeform patch text; collect both so the guard can deny unknown or out-of-bounds patches before they run.

classify_bash

If a Bash command matches a mutation pattern and is not scoped to one of allowed_roots, return the human reason; otherwise None. A command is treated as scoped when it textually references an allowed root.

is_under

True when target resolves to dir or a descendant of it. Relative targets resolve against repo_root. Path::starts_with matches whole path components, so skills-workspace2 is correctly not under skills-workspace.

is_under_any

True when target is under any of dirs.

is_write_tool

True for a tool name that writes the filesystem with a path argument.

path_arg

Pull the target path from a write tool’s arguments (file_path → notebook_path → path). Returns None when the input is not an object or carries no string path.