fix(policy): prioritize trusted PostHog command risk

[mohanagy]

Fixes #142

Why

A trusted static readOnlyHint was evaluated before Miftah's origin-pinned PostHog command adapter. A destructive PostHog command could therefore be classified as read.

Change

Evaluate the internal PostHog command metadata before trusted upstream annotations, while keeping local overrides highest priority.

TDD evidence

• Added the regression with both readOnlyHint: true and call dashboard-delete {}.
• Before the fix it failed as read / trusted-upstream-annotation.
• After the fix it returns destructive / trusted-command-adapter.

Validation

• npm test -- tests/risk-classifier.test.ts
• npm test -- tests/mcp-wrapper.test.ts
• npm run lint
• npm run typecheck

Summary by CodeRabbit

• Bug Fixes

  • Improved tool risk classification so trusted command evidence takes precedence over conflicting static annotations.
  • Destructive commands are now identified with the appropriate high-confidence classification.

• Tests

  • Added coverage to verify correct risk classification when trusted command data conflicts with read-only annotations.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

📝 Walkthrough

Walkthrough

classifyToolRisk now prioritizes trusted PostHog command metadata over static annotations, with regression coverage for destructive command classification and its source and confidence.

Changes

Risk classification

Layer / File(s)	Summary
Command precedence and regression coverage src/policy/risk-classifier.ts, tests/risk-classifier.test.ts	Trusted PostHog commands are classified before trusted static annotations; the test verifies a destructive result with trusted-command-adapter as the source and high confidence.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mohanagy/miftah#64: Earlier trusted-annotation risk classification changes in the same classifier.
• mohanagy/miftah#109: Related PostHog command-wrapper risk classification flow.

Poem

A rabbit found a command in flight,
And ranked its danger true and right.
Static hints now wait their turn,
While trusted commands clearly burn.
“Hop!” says the test, “the risks are bright!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly summarizes the main change: prioritizing trusted PostHog command risk over other policy signals.
Description check	✅ Passed	It covers the motivation, implementation, TDD evidence, and validation commands, though it does not follow the template exactly.
Linked Issues check	✅ Passed	The code and regression test match #142 by giving PostHog command metadata precedence over static read-only hints.
Out of Scope Changes check	✅ Passed	The diff stays focused on classifier precedence and one regression test, with no unrelated changes evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/142-posthog-risk-precedence

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mohanagy]

The Windows Node 24 failure is not in this policy change: the completed log shows the pre-existing cold-provider marker test timing out. It is tracked in #148 and addressed by the already-open #147 / #144 readiness-barrier PR. I will rebase and revalidate this PR after that fix is integrated; no timeout increase or unrelated change will be made here.

[mohanagy]

@coderabbitai full review