feat: add allow_flags whitelist and rename decision constants for clarity

Rename NoOpinion->Prompt and DenyFlags->PromptFlags so names match actual
behavior, add AllowFlags whitelist to prompt on any unrecognized flag,
and add gofmt/gofumpt/goimports rules using the new whitelist.

Author: arnarg

AGENTS.md

@@ -33,28 +33,28 @@ stdin (hook JSON, Crush or Claude Code format)
 | `internal/bash` | Tree-sitter–based bash parser. Extracts `Command` structs from a bash AST. Detects "complex" constructs (command substitution `$()`, subshells `()`, process substitution `<()`, arithmetic `$(())`) and parse errors, both will not auto-allow. |
 | `internal/checker` | Orchestrates parse + rule check. Tracks `cd` to ensure the working directory stays within `RootDir`. Resolves `~/...` paths against `HomeDir`. Any `cd` that would escape the root causes a deny. |
 | `internal/config` | Layered config loading. Reads global (`$XDG_CONFIG_HOME/crushout/crushout.{yml,yaml}`) and repo (`<rootDir>/.crushout.{yml,yaml}`) config, deep-merges both over built-in defaults. Repo config wins over global. Supports `overwrite_defaults: true` per-layer to replace the accumulated base entirely. |
-| `internal/rules` | Recursive rule engine (`Rule` struct with `Subcommands`, `DenyFlags`, `Default`). `defaults.go` contains the full built-in ruleset mapping command names to their allow/deny rules. |
+| `internal/rules` | Recursive rule engine (`Rule` struct with `Subcommands`, `PromptFlags`, `AllowFlags`, `Default`). `defaults.go` contains the full built-in ruleset mapping command names to their allow/deny rules. |
 
 ## Key Design Decisions
 
-- **Fail-closed**: anything ambiguous or unknown falls through to the normal permission prompt. Parse errors, complex bash constructs, unknown commands, commands with `$` in the name, and missing rules all produce a "no opinion" / "ask" result.
-- **Three outcomes**: `allow` (auto-approve), `deny` (hard-block with reason), and the default "no opinion" (fall through to normal permission flow). The built-in rules never deny; deny rules come from `.crushout.yml` config only.
+- **Fail-closed**: anything ambiguous or unknown falls through to the normal permission prompt. Parse errors, complex bash constructs, unknown commands, commands with `$` in the name, and missing rules all produce a `prompt` result.
+- **Three outcomes**: `allow` (auto-approve), `deny` (hard-block with reason), and `prompt` (fall through to normal permission flow). The built-in rules never deny; deny rules come from `.crushout.yml` config only.
 - **"Complex" bash is rejected outright**: command substitution, process substitution, subshells, and arithmetic expansion set `IsComplex=true` and skip command extraction entirely.
 - **Layered config**: crushout reads two config layers merged in order — global (`$XDG_CONFIG_HOME/crushout/crushout.{yml,yaml}`) then repo (`<rootDir>/.crushout.{yml,yaml}`). Each layer is deep-merged over the accumulated base, with later layers winning. `overwrite_defaults: true` in a layer replaces the accumulated base entirely (so a global `overwrite_defaults: true` drops built-ins that no later layer can recover). Scalar fields like `rtk_rewrite` use `*bool` internally so an unset value is distinguishable from an explicit `false`.
 - **`cd` tracking**: the checker tracks the current working directory across `cd` commands in a chain. `cd` with `$VAR`, `~` (if home is outside root), `-`, or any path resolving outside `RootDir` denies the whole command.
-- **Output convention**: returning a protocol-specific "no opinion" payload (`{}` for Crush, `ask` for Claude Code) means fall through to normal prompt. `allow` auto-approves. `deny` hard-blocks with a reason string.
+- **Output convention**: returning a protocol-specific `prompt` payload (`{}` for Crush, `ask` for Claude Code) means fall through to normal prompt. `allow` auto-approves. `deny` hard-blocks with a reason string.
 
 ## Testing Patterns
 
 - Standard `testing` package only, no assertion libraries. Tests define local helpers (`assertNoError`, `assertCommand`).
 - `checker_test.go` uses `newTestChecker()` with `RootDir: "/home/user/project"` and `HomeDir: "/home/user"`.
 - Config tests in `config_test.go` cover YAML parsing, shorthand syntax, single-layer loading (`loadFirst`), layered merging (`load`), `resolveRtkRewrite`, and `applyLayer`/`buildRules` overwrite matrix.
-- Rule tests in `rule_test.go` construct minimal `Rule` trees to test subcommand resolution, deny flags, and nesting, then also test the full `Default` ruleset.
+- Rule tests in `rule_test.go` construct minimal `Rule` trees to test subcommand resolution, `PromptFlags`, `AllowFlags`, and nesting, then also test the full `Default` ruleset.
 - E2E tests in `tests/e2e/` run the full binary against JSONL test cases (`cases_crush.jsonl`, `cases_claude.jsonl`) via `run.sh`.
 - The `cmd/crushout` and `internal/hook` packages have no unit tests.
 
 ## Gotchas
 
-- The tree-sitter bash grammar treats `git -C /tmp status` with `-C` as an anonymous (un-named) child node. This means `-C` does **not** appear in `cmd.Args`. The deny works via `DenyFlags` on the rule which checks the raw args, but the tree-sitter parse won't include it in the structured args. This is why `checker.isReadOnly` uses `filepath.Base` on names with `/` and rejects names containing `$` or backticks.
-- `Rule.resolve` walks args as a subcommand chain. The first arg matching a subcommand key descends into that sub-rule, consuming the arg. Remaining args are then checked against `DenyFlags` at the new level. This means flag position matters: `git -C /tmp status` has `-C` checked at the top-level git rule, but `git branch -l` descends into the `branch` sub-rule.
+- The tree-sitter bash grammar treats `git -C /tmp status` with `-C` as an anonymous (un-named) child node. This means `-C` does **not** appear in `cmd.Args`. The deny works via `PromptFlags` on the rule which checks the raw args, but the tree-sitter parse won't include it in the structured args. This is why `checker.isReadOnly` uses `filepath.Base` on names with `/` and rejects names containing `$` or backticks.
+- `Rule.resolve` walks args as a subcommand chain. The first arg matching a subcommand key descends into that sub-rule, consuming the arg. Remaining args are then checked against `PromptFlags` and `AllowFlags` at the new level. This means flag position matters: `git -C /tmp status` has `-C` checked at the top-level git rule, but `git branch -l` descends into the `branch` sub-rule.
 - `cd` with no arguments (bare `cd`) resolves to `$HOME`. It's only allowed if `HomeDir` is within `RootDir`.

README.md

@@ -146,7 +146,7 @@ Or use a full path in either:
 | `git push` | 🔒 prompt | mutable subcommand |
 | `git commit -m 'fix'` | 🔒 prompt | mutable subcommand |
 | `git branch new-feature` | 🔒 prompt | `branch` without list flag |
-| `git branch -D old` | 🔒 prompt | `-D` in deny flags |
+| `git branch -D old` | 🔒 prompt | `-D` in prompt flags |
 | `git tag v1.0.0` | 🔒 prompt | `tag` without `-l` |
 | `git stash` | 🔒 prompt | bare `stash` = push |
 | `git -C /tmp status` | 🔒 prompt | `-C` is denied |
@@ -189,15 +189,16 @@ Edit `internal/rules/defaults.go`. The rule type is recursive:
 ```go
 var Default = map[string]*Rule{
     "my-tool": {
-        Default:   rules.Allow,                    // allow unknown subcommands
-        DenyFlags: []string{"--dangerous"},        // prompt on these flags
+        Default:      rules.Allow,                 // allow unknown subcommands
+        PromptFlags:  []string{"--dangerous"},     // prompt on these flags
+        AllowFlags:   []string{"-l", "-d", "-s"},  // only these flags are safe
         Subcommands: map[string]*Rule{
             "read":  {Default: rules.Allow},
-            "write": {Default: rules.NoOpinion},   // prompt
+            "write": {Default: rules.Prompt},
             "db": {
                 Subcommands: map[string]*Rule{
-                    "migrate": {Default: rules.NoOpinion},
-                    "seed":    {Default: rules.NoOpinion},
+                    "migrate": {Default: rules.Prompt},
+                    "seed":    {Default: rules.Prompt},
                 },
             },
         },
@@ -207,9 +208,10 @@ var Default = map[string]*Rule{
 
 Resolution walks arguments left-to-right:
 
-1. `DenyFlags` are checked at each level against all remaining args
-2. If an arg matches a `Subcommands` key, descend into that rule
-3. When no deeper match is found, use `Default`
+1. `PromptFlags` are checked at each level against all remaining args. If any arg matches, the result is `prompt`.
+2. `AllowFlags` are checked at each level against all remaining args starting with `-`. If any flag is not in the allow list, the result is `prompt`.
+3. If an arg matches a `Subcommands` key, descend into that rule
+4. When no deeper match is found, use `Default`
 
 ## Config files
 
@@ -273,7 +275,8 @@ Because layers build on each other, a `overwrite_defaults: true` in the global l
 | `rules` | map | Map of command name → rule. |
 | `rules.*` | string or map | Shorthand (`allow`, `deny`, `prompt`) or full rule mapping. |
 | `rules.*.decision` | string | Decision for unknown subcommands: `allow`, `deny`, or `prompt`. Defaults to `prompt` if not set. |
-| `rules.*.deny_flags` | []string | Flags that always require confirmation. |
+| `rules.*.prompt_flags` | []string | Flags that always trigger a prompt (blacklist). |
+| `rules.*.allow_flags` | []string | If set, any flag-like arg (`-` prefix) not in this list triggers a prompt (whitelist). |
 | `rules.*.message` | string | Custom message shown when denied. Only used with `decision: deny`. |
 | `rules.*.subcommands` | map | Recursive map of subcommand name → rule. |
 

cmd/crushout/main.go

@@ -20,7 +20,7 @@ func main() {
 
 	// If tool is not bash we just skip it
 	if !hook.IsBashTool(input) {
-		out, err := input.FormatDecision(rules.NoOpinion, "", "")
+		out, err := input.FormatDecision(rules.Prompt, "", "")
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "could not serialize output: %v\n", err)
 			os.Exit(1)

default.nix

@@ -3,7 +3,7 @@
   buildGoApplication,
 }:
 let
-  version = "0.7.0";
+  version = "0.8.0";
 in
 buildGoApplication {
   inherit version;

internal/checker/checker.go

@@ -16,24 +16,24 @@ type Checker struct {
 }
 
 // Check evaluates the input command string and returns a Decision.
-// Allow means auto-approve, Deny means hard block, NoOpinion means
+// Allow means auto-approve, Deny means hard block, Prompt means
 // let the normal permission prompt handle it.
 func (c *Checker) Check(input string) (rules.Decision, string, error) {
 	result, err := bash.Parse(input)
 	if err != nil {
-		return rules.NoOpinion, "", nil
+		return rules.Prompt, "", nil
 	}
 
 	if result.HasError || result.IsComplex || result.HasRedirect || len(result.Commands) == 0 {
-		return rules.NoOpinion, "", nil
+		return rules.Prompt, "", nil
 	}
 
 	final := rules.Allow
 	cwd := c.RootDir
 	for _, cmd := range result.Commands {
 		if cmd.Name == "cd" {
 			if !c.isSafeCD(cmd, &cwd) {
-				return rules.NoOpinion, "", nil
+				return rules.Prompt, "", nil
 			}
 			continue
 		} else if cmd.Name == "rtk" && len(cmd.Args) > 0 {
@@ -51,8 +51,8 @@ func (c *Checker) Check(input string) (rules.Decision, string, error) {
 		switch d {
 		case rules.Deny:
 			return rules.Deny, msg, nil
-		case rules.NoOpinion:
-			final = rules.NoOpinion
+		case rules.Prompt:
+			final = rules.Prompt
 		}
 	}
 
@@ -65,12 +65,12 @@ func (c *Checker) checkCommand(cmd bash.Command) (rules.Decision, string) {
 		name = filepath.Base(name)
 	}
 	if strings.Contains(name, "$") || strings.Contains(name, "`") {
-		return rules.NoOpinion, ""
+		return rules.Prompt, ""
 	}
 
 	rule, exists := c.Rules[name]
 	if !exists {
-		return rules.NoOpinion, ""
+		return rules.Prompt, ""
 	}
 
 	d, msg := rule.Resolve(cmd.Args)