Remote D1 SQL write guard: permission rules can't express it, so pick a plugin hook, an ask rule or nothing #18

mezbano's .agents/hooks/d1-guard.mjs goes away with setkernel/mezbano#105. It denied a remote D1 statement that writes or changes the schema, denied a remote --file run (its SQL is not on the command line), and asked before any other remote statement. The managed deny list can hold only part of that.

What the deny list can hold (in the agent-plugins PR that links here): wrangler d1 migrations apply and wrangler d1 execute with both --remote and --file, bare and npx. Those are literal flags.

What it can't hold: SQL write detection for wrangler d1 execute --remote --command "…". Bash rules match the literal command text, with * standing in for any text (permissions docs), so:

• SQL keywords are case-insensitive (INSERT, insert, Insert), and the docs state case-insensitive matching only for PowerShell and WebFetch rules;
• spacing defeats a literal phrase (DELETE FROM, a newline between the words);
• --remote before or after --command doubles every rule;
• the guard covered about 12 statement shapes (insert/replace into, update … set, delete from, drop/alter/create …, pragma x =), so rules would run to about 100 and still miss forms;
• the docs warn: "Bash permission patterns that try to constrain command arguments are fragile", and point to a PreToolUse hook.

Options (Raghav's call):

1. A PreToolUse hook in the setkernel plugin, POSIX sh plus jq (the VMs have no Node): read tool_input.command; when it runs wrangler d1 execute with --remote, deny it if it matches the guard's write pattern (grep -Eiq), and ask otherwise. Add tests in tests/run.sh. This goes against AGENTS.md's "Org-wide denials go in permissions.deny, not in hooks", so it needs your OK.
2. An ask rule in managed settings, Bash(wrangler d1 execute *--remote*) and the npx form. Every remote statement, reads included, then needs a person's yes, even in auto mode. It's simple, but it adds prompts in every repo that probes D1.

Not confirmed (I didn't test it): what an ask, from a rule or a hook, does under sk-agent's --dangerously-skip-permissions. Check on a VM with #5 before relying on 1's ask or on 2.
3. Nothing more: the rule stays in mezbano's AGENTS.md ("never a write or DDL wrangler d1 execute --remote"), as #105 leaves it.

• Raghav picks an option
• Build it with tests, or close this issue with the reason

Refs setkernel/mezbano#52

— Claude Lead