# Deny
prefix_rule(pattern = ["git", "push", ["--force", "-f", "--force-with-lease"]], decision = "forbidden",
            justification = "Force-push rewrites shared history.")
prefix_rule(pattern = ["git", "reset", "--hard"], decision = "forbidden", justification = "Discards work.")
prefix_rule(pattern = ["git", "clean"], decision = "forbidden", justification = "Deletes untracked files.")
prefix_rule(pattern = ["git", "add", ["-f", "--force"]], decision = "forbidden",
            justification = "Stages ignored files, e.g. secrets.")
prefix_rule(pattern = ["git", "commit", ["--no-verify", "-n"]], decision = "forbidden", justification = "Skips hooks.")
prefix_rule(pattern = ["rm", ["-r", "-R", "-rf", "-fr", "-Rf", "-fR", "--recursive"]], decision = "forbidden",
            justification = "Recursive delete.")
prefix_rule(pattern = ["sudo"], decision = "forbidden", justification = "No privilege escalation.")
prefix_rule(pattern = ["git", "clone", ["https://github.com/n8n-io/n8n", "https://github.com/n8n-io/n8n.git",
            "https://github.com/kestra-io/kestra", "https://github.com/windmill-labs/windmill",
            "https://github.com/activepieces/activepieces"]], decision = "forbidden",
            justification = "Clean room: never fetch source of the products we supersede (AGENTS.md).")
prefix_rule(pattern = [["npm", "bun"], ["view", "pack", "add"], ["n8n", "n8n-workflow", "n8n-core", "n8n-nodes-base"]],
            decision = "forbidden", justification = "Clean room: never fetch or depend on n8n packages.")
# Ask
prefix_rule(pattern = ["git", ["push", "merge", "rebase", "switch", "restore", "clone"]], decision = "prompt")
prefix_rule(pattern = ["git", "commit", "--amend"], decision = "prompt")
prefix_rule(pattern = ["rm"], decision = "prompt")
prefix_rule(pattern = ["bun", ["add", "remove", "update", "upgrade"]], decision = "prompt")
prefix_rule(pattern = [["bunx", "npx"]], decision = "prompt")