fix: align the command bans across the two agent policy files

The two files carry the same block list in two languages and had drifted: expanding every
prefix_rule into its concrete argv prefixes and matching both directions turned up 24
asymmetries — 22 commands Codex forbids that Claude Code only prompted for (git filter-repo,
the rm flag spellings, fdisk/parted, redis-cli flush*, the npm/yarn/bun db: scripts, the
pnpm/bunx prisma launchers, aws ec2 delete-volume/delete-snapshot, aws rds delete-db-cluster),
and 2 the other way (prisma migrate reset, prisma db push --force-reset).

Bare "prisma migrate reset" never matched: folding the bare form into the launcher alternation
demanded four argv tokens where the command has three. It is now its own rule, as is
"prisma db push --force-reset".

Nothing is loosened — the allow list is untouched and every change is an addition or a
widening. The one remaining difference is structural and now says so in the Codex header:
Claude Code matches a command-string prefix, so "aws iam delete-:*" covers verbs AWS has not
shipped yet, while a prefix_rule matches whole argv tokens and can only enumerate today's.

Refs #38

Author: TitusKirch

.claude/settings.json

@@ -28,6 +28,7 @@
       "Bash(git checkout --:*)",
       "Bash(git branch -D:*)",
       "Bash(git filter-branch:*)",
+      "Bash(git filter-repo:*)",
       "Bash(git reflog expire:*)",
       "Bash(git gc --prune=now:*)",
       "Bash(git stash clear:*)",
@@ -38,20 +39,40 @@
       "Bash(gh release delete:*)",
       "Bash(gh secret delete:*)",
       "Bash(rm -rf /:*)",
+      "Bash(rm -fr /:*)",
+      "Bash(rm -Rf /:*)",
+      "Bash(rm -fR /:*)",
       "Bash(sudo rm:*)",
       "Bash(chmod -R:*)",
       "Bash(chown -R:*)",
       "Bash(dd:*)",
       "Bash(mkfs:*)",
       "Bash(shred:*)",
+      "Bash(fdisk:*)",
+      "Bash(parted:*)",
       "Bash(php artisan migrate:fresh:*)",
       "Bash(php artisan migrate:reset:*)",
       "Bash(php artisan db:wipe:*)",
       "Bash(prisma migrate reset:*)",
       "Bash(npx prisma migrate reset:*)",
+      "Bash(pnpm prisma migrate reset:*)",
+      "Bash(bunx prisma migrate reset:*)",
       "Bash(prisma db push --force-reset:*)",
-      "Bash(pnpm db:fresh)",
-      "Bash(pnpm db:reset)",
+      "Bash(npx prisma db push --force-reset:*)",
+      "Bash(pnpm prisma db push --force-reset:*)",
+      "Bash(bunx prisma db push --force-reset:*)",
+      "Bash(pnpm db:fresh:*)",
+      "Bash(pnpm db:reset:*)",
+      "Bash(npm db:fresh:*)",
+      "Bash(npm db:reset:*)",
+      "Bash(yarn db:fresh:*)",
+      "Bash(yarn db:reset:*)",
+      "Bash(bun db:fresh:*)",
+      "Bash(bun db:reset:*)",
+      "Bash(redis-cli flushall:*)",
+      "Bash(redis-cli flushdb:*)",
+      "Bash(redis-cli FLUSHALL:*)",
+      "Bash(redis-cli FLUSHDB:*)",
       "Bash(terraform destroy:*)",
       "Bash(terraform apply -auto-approve:*)",
       "Bash(terraform state rm:*)",
@@ -67,7 +88,10 @@
       "Bash(aws s3 rb:*)",
       "Bash(aws s3 rm:*)",
       "Bash(aws ec2 terminate-instances:*)",
+      "Bash(aws ec2 delete-volume:*)",
+      "Bash(aws ec2 delete-snapshot:*)",
       "Bash(aws rds delete-db-instance:*)",
+      "Bash(aws rds delete-db-cluster:*)",
       "Bash(aws cloudformation delete-stack:*)",
       "Bash(aws iam delete-:*)"
     ]

.codex/rules/default.rules

@@ -7,6 +7,24 @@
 #
 # Verify after editing:
 #   codex execpolicy check --pretty --rules .codex/rules/default.rules -- <command>
+#
+# Verify the two files still ban the same set:
+#   pnpm check:policy
+#
+# Two differences from .claude/settings.json are deliberate, because the rule
+# languages differ rather than the intent:
+#
+#   Claude Code matches a prefix of the command *string*; a prefix_rule below
+#   matches whole argv *tokens*. So an open-ended ban such as
+#   "Bash(aws iam delete-:*)" — every delete verb, present and future — has no
+#   equivalent here, and the aws iam rule enumerates the verbs AWS ships today
+#   instead. That enumeration is a snapshot, and no rule closes the rest.
+#
+#   Neither language normalises flag order or case, so a command is banned only
+#   in the spellings written down. "rm -rf /" and "rm -fr /" are both here;
+#   "rm -r -f /" and "redis-cli FlushAll" are not, and enumerating permutations
+#   never ends. Both files list the same spellings — that parity is what
+#   pnpm check:policy proves; it is not a claim that the set is complete.
 
 # ─────────────────────────── git: work and history ───────────────────────────
 
@@ -148,14 +166,41 @@ prefix_rule(
     not_match = ["php artisan migrate", "php artisan tinker"],
 )
 
+# The bare and launcher-prefixed forms are separate rules: a pattern matches a
+# fixed number of argv tokens, so folding "prisma" into the launcher list would
+# demand four tokens and never match the three-token bare command.
+prefix_rule(
+    pattern = ["prisma", "migrate", "reset"],
+    decision = "forbidden",
+    justification = "Drops and recreates the database",
+    match = ["prisma migrate reset", "prisma migrate reset --force"],
+    not_match = ["prisma migrate dev", "prisma generate"],
+)
+
 prefix_rule(
-    pattern = [["prisma", "npx", "pnpm", "bunx"], "prisma", "migrate", "reset"],
+    pattern = [["npx", "pnpm", "bunx"], "prisma", "migrate", "reset"],
     decision = "forbidden",
     justification = "Drops and recreates the database",
     match = ["npx prisma migrate reset", "bunx prisma migrate reset"],
     not_match = ["npx prisma migrate dev", "npx prisma generate"],
 )
 
+prefix_rule(
+    pattern = ["prisma", "db", "push", "--force-reset"],
+    decision = "forbidden",
+    justification = "Resets the database before pushing the schema",
+    match = ["prisma db push --force-reset"],
+    not_match = ["prisma db push", "prisma db seed"],
+)
+
+prefix_rule(
+    pattern = [["npx", "pnpm", "bunx"], "prisma", "db", "push", "--force-reset"],
+    decision = "forbidden",
+    justification = "Resets the database before pushing the schema",
+    match = ["npx prisma db push --force-reset"],
+    not_match = ["npx prisma db push", "npx prisma db seed"],
+)
+
 prefix_rule(
     pattern = [["pnpm", "npm", "yarn", "bun"], ["db:fresh", "db:reset"]],
     decision = "forbidden",
@@ -240,10 +285,42 @@ prefix_rule(
     not_match = ["aws cloudformation describe-stacks"],
 )
 
+# .claude/settings.json bans "aws iam delete-" as an open string prefix, which
+# covers verbs AWS has not shipped yet. A pattern matches whole argv tokens, so
+# the closest form is this enumeration of today's delete surface — a snapshot,
+# and the deliberate structural difference named in the header.
 prefix_rule(
-    pattern = ["aws", "iam", ["delete-user", "delete-role", "delete-policy", "delete-group"]],
+    pattern = [
+        "aws",
+        "iam",
+        [
+            "delete-access-key",
+            "delete-account-alias",
+            "delete-account-password-policy",
+            "delete-group",
+            "delete-group-policy",
+            "delete-instance-profile",
+            "delete-login-profile",
+            "delete-open-id-connect-provider",
+            "delete-policy",
+            "delete-policy-version",
+            "delete-role",
+            "delete-role-permissions-boundary",
+            "delete-role-policy",
+            "delete-saml-provider",
+            "delete-server-certificate",
+            "delete-service-linked-role",
+            "delete-service-specific-credential",
+            "delete-signing-certificate",
+            "delete-ssh-public-key",
+            "delete-user",
+            "delete-user-permissions-boundary",
+            "delete-user-policy",
+            "delete-virtual-mfa-device",
+        ],
+    ],
     decision = "forbidden",
-    justification = "Removes identities other systems depend on",
-    match = ["aws iam delete-role --role-name deploy"],
+    justification = "Removes identities and credentials other systems depend on",
+    match = ["aws iam delete-role --role-name deploy", "aws iam delete-access-key --access-key-id AKIA"],
     not_match = ["aws iam list-roles", "aws iam get-role --role-name deploy"],
 )