# Railguard Policy Configuration
# https://github.com/railguard-dev/railguard
#
# This file controls how Railguard protects your development environment.
# Rules are evaluated in order: allowlist → blocklist → approve → default allow.

version: 1

# ── Blocklist ────────────────────────────────────────────────────────
# Commands matching these patterns are blocked immediately.
# The agent receives the message and must find an alternative approach.

blocklist:
  - name: terraform-destroy
    tool: Bash
    pattern: "terraform\\s+(destroy|apply\\s+.*-auto-approve)"
    action: block
    message: "Blocked: destructive infrastructure command"

  - name: rm-rf-critical
    tool: Bash
    pattern: "rm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+|--force\\s+).*(/\\s*$|/\\*|~/|\\$HOME|/home)"
    action: block
    message: "Blocked: recursive force delete of critical path"

  - name: sql-drop
    tool: Bash
    pattern: "(?i)(DROP\\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE\\s+TABLE)"
    action: block
    message: "Blocked: destructive SQL operation"

  - name: git-force-push
    tool: Bash
    pattern: "git\\s+push\\s+.*--force"
    action: block
    message: "Blocked: force push can overwrite remote history"

  - name: git-reset-hard
    tool: Bash
    pattern: "git\\s+reset\\s+--hard"
    action: block
    message: "Blocked: hard reset discards uncommitted work"

  - name: drizzle-force
    tool: Bash
    pattern: "drizzle-kit\\s+push\\s+--force"
    action: block
    message: "Blocked: drizzle-kit push --force can destroy database schema"

# ── Approve ──────────────────────────────────────────────────────────
# Commands matching these patterns pause for human approval.

approve:
  - name: npm-publish
    tool: Bash
    pattern: "npm\\s+publish"
    action: approve
    message: "npm publish requires approval"

# ── Allowlist ────────────────────────────────────────────────────────
# Commands matching these patterns skip all checks (use sparingly).

allowlist: []

# ── Path Fence ───────────────────────────────────────────────────────
# Restricts which directories the agent can read/write.

fence:
  enabled: true
  allowed_paths: []        # Empty = allow project directory only
  denied_paths:
    - "~/.ssh"
    - "~/.aws"
    - "~/.gnupg"
    - "~/.config/gcloud"
    - "/etc"

# ── Trace ────────────────────────────────────────────────────────────
# Structured audit log of every tool call.

trace:
  enabled: true
  directory: .railguard/traces

# ── Snapshot ─────────────────────────────────────────────────────────
# Per-edit file snapshots for rollback.

snapshot:
  enabled: true
  tools: [Write, Edit]
  directory: .railguard/snapshots
