@aimarket/warden 0.20.0 → 0.22.0

package/dist/flow-guard-fragments.js

@@ -0,0 +1,122 @@
+/** Flow guard: short fragments of credentials, kept as hashes only, so a key sent in pieces is still recognised. */
+import { createHash } from 'node:crypto';
+import { strings } from './flow-guard-text.js';
+import { CONFUSABLE, KEY_STRUCTURE, alnum } from './flow-guard-fingerprints.js';
+import { scanCandidates } from './flow-guard-decode.js';
+const FRAGMENT_SIZE = 6;
+export const MAX_FRAGMENT_INDEX = 16_384;
+export const MAX_FRAGMENT_SEEN = 256;
+const fragmentHash = (s) => createHash('sha256').update(`warden-fragment-v1:${s}`).digest('hex').slice(0, 32);
+export const fragmentKey = (r) => `${r.group}:${r.offset}:${r.size ?? FRAGMENT_SIZE}:${r.edge ? 'edge' : 'atom'}:${r.hash}`;
+const CREDENTIAL_PREFIX = /^(?:[rs]k_(?:live|test)_|sk-ant-api[0-9]+-|sk-ant-|sk-proj-|sk-|gh[pousr]_|github_pat_|glpat-|npm_|xox[abprs]-|AKIA|ASIA|AIza)/i;
+const fragmentVisible = (s) => s.normalize('NFKC').toLowerCase().replace(/[^a-z0-9]/g, ch => CONFUSABLE[ch] ?? ch);
+export const SHORT_SIZES = [5, 6, 7];
+/** Weak evidence asks before its first transmission, never silently learns by sending it.
+ * Five-char windows require upper/lower/digit classes in the source, while 6/7-char atoms may be words.
+ * Exact prefix-boundary slices cover chunks that already contain payload but no full six-char window.
+ * Only hash/offset/size metadata is persisted; public format and DER structure alone do not count. */
+export function fragmentFingerprints(tokens, limit = MAX_FRAGMENT_INDEX) {
+    const out = [];
+    for (const raw of new Set(tokens)) {
+        const a = alnum(raw), prefix = CREDENTIAL_PREFIX.exec(raw)?.[0];
+        const normPrefix = /^(?:[rs]k(?:live|test)|skantapi[0-9]+|skant|skproj|sk|gh[pousr]|githubpat|glpat|npm|xox[abprs]|akia|asia|aiza)/.exec(a)?.[0];
+        const start = /^(mii|mig|mhc|mc4|mco)/.test(a) ? Math.max(48, /^[a-z]*/.exec(a)[0].length) : normPrefix?.length ?? /^[a-z]*/.exec(a)[0].length;
+        const group = fragmentHash(`key:${a}`);
+        // Preserve case only transiently to avoid indexing every short hex/hash or ordinary word.
+        const caseful = raw.normalize('NFKC').replace(/[^a-z0-9]/gi, '');
+        for (const size of SHORT_SIZES)
+            for (let offset = start; offset + size <= a.length; offset++) {
+                const piece = a.slice(offset, offset + size), original = caseful.slice(offset, offset + size);
+                if (size < FRAGMENT_SIZE && !(/[A-Z]/.test(original) && /[a-z]/.test(original) && /[0-9]/.test(original)))
+                    continue;
+                if (/^(.)\1+$/.test(piece) || KEY_STRUCTURE.some(k => k.includes(piece)))
+                    continue;
+                out.push({ group, hash: fragmentHash(piece), offset, size });
+                if (out.length > limit)
+                    return out;
+            }
+        if (prefix)
+            for (let offset = 0; offset < prefix.length; offset++) {
+                // Require a real format delimiter, or the entire delimiter-free prefix (AWS/Google).
+                const suffix = prefix.slice(offset);
+                if (offset !== 0 && (!/[_-]/.test(suffix) || !/[a-z]/i.test(suffix)))
+                    continue;
+                for (let length = 1; length <= 7 && prefix.length + length <= raw.length; length++) {
+                    const piece = fragmentVisible(raw.slice(offset, prefix.length + length));
+                    if (piece.length < 5)
+                        continue;
+                    out.push({ group, hash: fragmentHash(`edge:${piece}`), offset, size: piece.length, edge: true });
+                    if (out.length > limit)
+                        return out;
+                }
+            }
+    }
+    return out;
+}
+/** Full isolated atoms, not every substring of long ordinary hashes. Structured encoded candidates are included. */
+function fragmentAtoms(input) {
+    const hashes = new Set(), scan = scanCandidates(strings(input));
+    if (scan.incomplete)
+        return { hashes, incomplete: true };
+    for (const text of scan.values) {
+        const visible = fragmentVisible(text);
+        for (const run of visible.matchAll(/\b(?:[a-z0-9][\t ]+){4,6}[a-z0-9]\b/g)) {
+            const atom = alnum(run[0]);
+            hashes.add(fragmentHash(atom));
+            hashes.add(fragmentHash([...atom].reverse().join('')));
+        }
+        for (const m of visible.matchAll(/[a-z0-9+/_-]+/g)) {
+            const raw = m[0];
+            if (raw.length <= 64)
+                hashes.add(fragmentHash(`edge:${raw}`));
+            const joined = alnum(raw);
+            if (/^[a-z0-9]{5,7}$/.test(joined)) {
+                hashes.add(fragmentHash(joined));
+                hashes.add(fragmentHash([...joined].reverse().join('')));
+            }
+            // Separators delimit atoms; a long uninterrupted hash is never scanned with weak windows.
+            for (const atom of raw.matchAll(/[a-z0-9]+/g))
+                if (/^[a-z0-9]{5,7}$/.test(atom[0])) {
+                    hashes.add(fragmentHash(atom[0]));
+                    hashes.add(fragmentHash([...atom[0]].reverse().join('')));
+                }
+        }
+    }
+    return { hashes, incomplete: scan.incomplete };
+}
+/** Must run under the session lock when remembering evidence. Audit never consumes or whitelists a match. */
+export function checkFragments(input, state, hasLegacyTokens, remember) {
+    const f = state.fragments;
+    if (!f)
+        return hasLegacyTokens ? { unavailable: true } : {};
+    if (f.v !== 2 || f.full)
+        return { unavailable: true };
+    if (!f.index.length)
+        return {};
+    const { hashes, incomplete } = fragmentAtoms(input);
+    const matches = f.index.filter(r => hashes.has(r.hash));
+    if (!matches.length)
+        return incomplete ? { unavailable: true } : {};
+    const seen = new Map(f.seen.map(r => [fragmentKey(r), r]));
+    for (const r of matches)
+        seen.set(fragmentKey(r), r);
+    const all = [...seen.values()];
+    const offsets = new Map();
+    for (const r of all) {
+        if (r.edge || r.size !== FRAGMENT_SIZE)
+            continue;
+        const key = `${r.group}:${r.offset}`, at = offsets.get(key) ?? new Set();
+        at.add(r.hash);
+        offsets.set(key, at);
+    }
+    const paired = all.some(r => !r.edge && r.size === FRAGMENT_SIZE && [...(offsets.get(`${r.group}:${r.offset + FRAGMENT_SIZE}`) ?? [])].some(h => h !== r.hash));
+    if (remember) {
+        f.seen = all.slice(0, MAX_FRAGMENT_SEEN);
+        if (all.length > MAX_FRAGMENT_SEEN)
+            f.full = true;
+    }
+    if (paired)
+        return { secret: 'adjacent short fragments of a credential this session read' };
+    return { review: true, ...(incomplete || all.length > MAX_FRAGMENT_SEEN ? { unavailable: true } : {}) };
+}
+//# sourceMappingURL=flow-guard-fragments.js.map

package/dist/flow-guard-fragments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-fragments.js","sourceRoot":"","sources":["../src/flow-guard-fragments.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5I,MAAM,iBAAiB,GAAG,iIAAiI,CAAC;AAC5J,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAU,CAAC;AAE9C;;;sGAGsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,MAAyB,EAAE,KAAK,GAAG,kBAAkB;IACxF,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,gHAAgH,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjJ,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjJ,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,0FAA0F;QAC1F,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,WAAW;YAAE,KAAK,IAAI,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;gBAC9F,IAAI,IAAI,GAAG,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAE,SAAS;gBACpH,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAS;gBACnF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;oBAAE,OAAO,GAAG,CAAC;YACrC,CAAC;QACD,IAAI,MAAM;YAAE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBAClE,qFAAqF;gBACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAAE,SAAS;gBAC/E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;oBACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,SAAS;oBAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjG,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;wBAAE,OAAO,GAAG,CAAC;gBACrC,CAAC;YACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oHAAoH;AACpH,SAAS,aAAa,CAAC,KAA8B;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,EAAE,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,sCAAsC,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,0FAA0F;YAC1F,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnF,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,cAAc,CAAC,KAA8B,EAAE,KAAgB,EAAE,eAAwB,EAAE,QAAiB;IAC1H,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACjF,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChK,IAAI,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB;YAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;IACpD,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAC5F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC"}

package/dist/flow-guard-instructions.d.ts

@@ -0,0 +1,12 @@
+export declare const INJECTION_HINTS: RegExp;
+export interface InstructionSignal {
+    kind: string;
+    start: number;
+    end: number;
+}
+export interface InstructionSignals {
+    matches: InstructionSignal[];
+    limited: boolean;
+}
+export declare function instructionSignals(text: string): InstructionSignals;
+//# sourceMappingURL=flow-guard-instructions.d.ts.map

package/dist/flow-guard-instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-instructions.d.ts","sourceRoot":"","sources":["../src/flow-guard-instructions.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,eAAe,QAA2E,CAAC;AACxG,MAAM,WAAW,iBAAiB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAC/E,MAAM,WAAW,kBAAkB;IAAG,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAEtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAenE"}

package/dist/flow-guard-instructions.js

@@ -0,0 +1,36 @@
+/** Bounded, fallible signals in source text. Never an authority or a semantic verdict. */
+import { MAX_TEXT } from './flow-guard-text.js';
+const LEGACY = /ignore (all |any |the )?(previous|prior|above) (instructions|messages)|disregard (the|your|all) (previous|prior|system)|<\/?(important|system|instructions?|critical[_-]?requirement)\b|do not (tell|show|inform|mention to) the user|you are now|new instructions:|assistant must|before (any|every) (reply|response), (call|run|use)/i;
+// Require instruction syntax or an authority claim together with a nearby directive.
+// Ordinary amenities, preferences and approvals alone are not instruction signals.
+const RULES = [
+    ['legacy', LEGACY],
+    ['role-boundary', /\[im_start\][ \t]*(?:system|developer|assistant)\b|<\|start_header_id\|>[ \t]*(?:system|developer|assistant)\b|<(?:system|developer|assistant)(?:[ \t][^>\n]{0,80})?>/i],
+    ['relayed-preference', /(?:verified|latest|newer|updated|final)\s+(?:customer|user)\s+(?:update|preference|request)[^\n]{0,360}?\b(?:return|choose|select|recommend|put)\b|(?:customer|user)\s+(?:update|preference|request)[^\n]{0,160}?\b(?:newer than|supersedes|overrides)\b[^\n]{0,160}?\b(?:return|choose|select|recommend|put)\b/i],
+    ['claimed-prior-decision', /(?:cached|previous|prior)\s+(?:assistant\s+)?(?:analysis|reasoning|decision)[^\n]{0,360}?\b(?:continue|return|choose|select|recommend)\b|(?:customer|user)\s+(?:already|previously)\s+(?:approved|selected|chose)[^\n]{0,240}?\b(?:continue|return|choose|select|recommend)\b/i],
+    ['private-rubric', /(?:internal|private|hidden)\s+(?:evaluation\s+)?(?:rubric|evaluator|scoring|benchmark)[^\n]{0,240}?\b(?:must\s+(?:choose|select|recommend)|expects?\b|(?:return|put)\b[^\n]{0,80}?\b(?:id|answer|response))/i],
+    ['concealed-directive', /do not\s+(?:reveal|disclose|mention|describe)\s+(?:this|the|our)\s+(?:(?:internal|private|scoring|hidden|selection)\s+){0,2}(?:instruction|note|rubric|handoff|relay)\b|without\s+(?:asking for confirmation or\s+)?(?:mentioning|describing)\s+(?:this|the)\s+(?:relay|handoff|instruction)\b/i],
+    ['relayed-preference-ru', /(?:последнее|обновл[её]нное|новое)\s+предпочтение\s+(?:пользователя|клиента)[^\n]{0,300}?(?:выберите|верните|рекомендуйте)|не\s+(?:упоминайте|раскрывайте)\s+(?:это|данное)\s+(?:служебное\s+)?(?:сообщение|указание|инструкцию)/i],
+];
+// Kept non-global for callers using .test(). It has no mutable lastIndex state.
+export const INJECTION_HINTS = new RegExp(RULES.map(([, rule]) => `(?:${rule.source})`).join('|'), 'i');
+export function instructionSignals(text) {
+    const input = text.slice(0, MAX_TEXT);
+    const matches = [];
+    // Upstream text extraction may already have stopped at this budget. Treat an
+    // exactly full buffer conservatively as limited rather than declaring coverage.
+    let limited = text.length >= MAX_TEXT;
+    for (const [kind, rule] of RULES) {
+        let count = 0;
+        for (const match of input.matchAll(new RegExp(rule.source, 'gi'))) {
+            if (count++ === 16) {
+                limited = true;
+                break;
+            }
+            matches.push({ kind, start: match.index, end: match.index + match[0].length });
+        }
+    }
+    matches.sort((a, b) => a.start - b.start || a.end - b.end);
+    return { matches, limited };
+}
+//# sourceMappingURL=flow-guard-instructions.js.map

package/dist/flow-guard-instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-instructions.js","sourceRoot":"","sources":["../src/flow-guard-instructions.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,MAAM,MAAM,GAAG,yUAAyU,CAAC;AAEzV,qFAAqF;AACrF,mFAAmF;AACnF,MAAM,KAAK,GAAG;IACZ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAClB,CAAC,eAAe,EAAE,wKAAwK,CAAC;IAC3L,CAAC,oBAAoB,EAAE,kTAAkT,CAAC;IAC1U,CAAC,wBAAwB,EAAE,gRAAgR,CAAC;IAC5S,CAAC,gBAAgB,EAAE,8MAA8M,CAAC;IAClO,CAAC,qBAAqB,EAAE,iSAAiS,CAAC;IAC1T,CAAC,uBAAuB,EAAE,mOAAmO,CAAC;CACtP,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAIxG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAM,EAAE,GAAG,EAAE,KAAK,CAAC,KAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/flow-guard-labels.d.ts

@@ -0,0 +1,10 @@
+import type { FlowLabel } from './flow-guard-types.js';
+/** MCP tools that sessions used without an operator label, with the guard's guess and the sessions that used them. */
+export declare function unlabeledTools(env?: NodeJS.ProcessEnv): Array<{
+    tool: string;
+    guessed: FlowLabel[];
+    sessions: number;
+}>;
+/** `warden-mcp flow-labels`: the unlabeled tools, and a labels block to review and paste into the policy file. */
+export declare function flowLabelsReport(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=flow-guard-labels.d.ts.map

package/dist/flow-guard-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-labels.d.ts","sourceRoot":"","sources":["../src/flow-guard-labels.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,uBAAuB,CAAC;AAKlE,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBpI;AAED,kHAAkH;AAClH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAgB7E"}

package/dist/flow-guard-labels.js

@@ -0,0 +1,55 @@
+/** Flow guard: `warden-mcp flow-labels`, the MCP tools sessions used without an operator label. */
+import { readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { flowPaths, stateDir } from './flow-guard-paths.js';
+import { LABELS } from './flow-guard-policy.js';
+import { readFlowState, safeToolName } from './flow-guard-state.js';
+/** MCP tools that sessions used without an operator label, with the guard's guess and the sessions that used them. */
+export function unlabeledTools(env = process.env) {
+    const dir = flowPaths(stateDir(env), 'x').dir;
+    const seen = new Map();
+    let files = [];
+    try {
+        files = readdirSync(dir).filter(f => /^[0-9a-f]{64}\.json$/.test(f));
+    }
+    catch {
+        return [];
+    }
+    for (const f of files) {
+        let s;
+        try {
+            s = readFlowState(join(dir, f));
+        }
+        catch {
+            continue;
+        }
+        for (const [tool, labels] of Object.entries(s.unlabeled ?? {})) {
+            const e = seen.get(tool) ?? { guessed: new Set(), sessions: 0 };
+            for (const l of labels)
+                e.guessed.add(l);
+            e.sessions++;
+            seen.set(tool, e);
+        }
+    }
+    return [...seen].map(([tool, e]) => ({ tool, guessed: LABELS.filter(l => e.guessed.has(l)), sessions: e.sessions })).sort((a, b) => b.sessions - a.sessions || a.tool.localeCompare(b.tool));
+}
+/** `warden-mcp flow-labels`: the unlabeled tools, and a labels block to review and paste into the policy file. */
+export function flowLabelsReport(env = process.env) {
+    const tools = unlabeledTools(env);
+    const policyPath = env.WARDEN_FLOW_POLICY || join(stateDir(env), 'flow-policy.json');
+    if (!tools.length)
+        return `No MCP tool without a label has been used in a recorded session. Policy file: ${policyPath}\n`;
+    const lines = tools.map(t => `  ${safeToolName(t.tool).padEnd(48)} guessed: ${t.guessed.join(', ') || '-'}   sessions: ${t.sessions}`);
+    const labels = Object.fromEntries(tools.map(t => [t.tool, t.guessed]));
+    return [
+        `MCP tools used without an operator label (${tools.length}). The guard guessed from names and arguments; a guess only adds caution.`,
+        ...lines,
+        '',
+        `Check each guess against what the tool really does, then put the corrected labels into ${policyPath}:`,
+        '  private: returns the user\'s own data   untrusted: returns text others wrote   outbound: reaches a person or a host   destructive: changes or deletes things',
+        '',
+        JSON.stringify({ labels }, null, 2),
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=flow-guard-labels.js.map

package/dist/flow-guard-labels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-labels.js","sourceRoot":"","sources":["../src/flow-guard-labels.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEpE,sHAAsH;AACtH,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC9E,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAY,CAAC;QACjB,IAAI,CAAC;YAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/L,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,iFAAiF,UAAU,IAAI,CAAC;IAC1H,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,6CAA6C,KAAK,CAAC,MAAM,2EAA2E;QACpI,GAAG,KAAK;QACR,EAAE;QACF,0FAA0F,UAAU,GAAG;QACvG,gKAAgK;QAChK,EAAE;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/flow-guard-leak.d.ts

@@ -0,0 +1,29 @@
+import type { OutTail } from './flow-guard-types.js';
+import { flowPaths } from './flow-guard-paths.js';
+export declare function readFp(path: string): Set<string>;
+export interface FpStores {
+    secret: Set<string>;
+    fp: Set<string>;
+    pii: Set<string>;
+    tok: Set<string>;
+}
+export declare function readStores(paths: ReturnType<typeof flowPaths>): FpStores;
+export interface LeakCheck {
+    secret?: string;
+    private?: boolean;
+    pii?: boolean;
+    incomplete?: boolean;
+}
+/** `typed`: what the user typed this session. A value the user typed is theirs to send; it is skipped
+ * for ordinary private text, never for secrets. */
+export declare function checkLeak(paths: ReturnType<typeof flowPaths>, input: Record<string, unknown>, typed?: readonly string[], stores?: FpStores): LeakCheck;
+/**
+ * A value sent in pieces, one call each, is checked whole: each argument name keeps the tail of what it carried,
+ * and the windows that cross from that tail into this call are checked like any other. Only pieces sent back to back
+ * through the same argument join; words between them break the run. Returns the new tails.
+ */
+export declare function checkStream(input: Record<string, unknown>, tails: Readonly<Record<string, OutTail>>, stores: FpStores): {
+    leak: LeakCheck;
+    next: Record<string, OutTail>;
+};
+//# sourceMappingURL=flow-guard-leak.d.ts.map

package/dist/flow-guard-leak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-leak.d.ts","sourceRoot":"","sources":["../src/flow-guard-leak.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA6BlD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAShD;AAED,MAAM,WAAW,QAAQ;IAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;AACtG,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,GAAG,QAAQ,CAExE;AAED,MAAM,WAAW,SAAS;IAAG,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE;AACtG;mDACmD;AACnD,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,EAAE,MAAM,GAAE,QAA4B,GAAG,SAAS,CAkB7K;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgC1K"}

package/dist/flow-guard-leak.js

@@ -0,0 +1,135 @@
+/** Flow guard: an outgoing call's arguments checked against the session's fingerprint stores, within one call and across calls. */
+import { readFileSync } from 'node:fs';
+import { strings } from './flow-guard-text.js';
+import { TOKEN_WINDOWS, WINDOW, alnum, fpHash, normalizeText, piiTokens, secretPattern } from './flow-guard-fingerprints.js';
+import { candidates, scanCandidates } from './flow-guard-decode.js';
+// Long enough to join the longest personal-data token (34) across two calls.
+const ALNUM_TAIL = 33;
+function windowsAll(text) {
+    const n = normalizeText(text);
+    const out = new Set();
+    for (let i = 0; i + WINDOW <= n.length; i++)
+        out.add(fpHash(n.slice(i, i + WINDOW)));
+    return out;
+}
+function tokenHit(text, tokFp) {
+    for (const a of [alnum(text), alnum([...text].reverse().join(''))]) {
+        for (const size of TOKEN_WINDOWS)
+            for (let i = 0; i + size <= a.length; i++)
+                if (tokFp.has(fpHash(a.slice(i, i + size))))
+                    return true;
+    }
+    return false;
+}
+function windowHit(text, store) {
+    if (!store.size)
+        return false;
+    const value = normalizeText(text);
+    for (let i = 0; i + WINDOW <= value.length; i++)
+        if (store.has(fpHash(value.slice(i, i + WINDOW))))
+            return true;
+    return false;
+}
+export function readFp(path) {
+    try {
+        const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean);
+        if (lines.some(line => !/^[0-9a-f]{12}$/.test(line)))
+            throw new Error('invalid fingerprints');
+        return new Set(lines);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return new Set();
+        throw new Error('flow fingerprints cannot be read safely');
+    }
+}
+export function readStores(paths) {
+    return { secret: readFp(paths.secret), fp: readFp(paths.fp), pii: readFp(paths.pii), tok: readFp(paths.tok) };
+}
+/** `typed`: what the user typed this session. A value the user typed is theirs to send; it is skipped
+ * for ordinary private text, never for secrets. */
+export function checkLeak(paths, input, typed = [], stores = readStores(paths)) {
+    const all = strings(input);
+    const scan = scanCandidates(all);
+    const cands = scan.values;
+    const typedText = typed.join('\n');
+    const own = (s) => { const n = normalizeText(s); return n.length > 0 && typedText.includes(n); };
+    const pattern = secretPattern(cands);
+    if (pattern)
+        return { secret: pattern };
+    if (scan.incomplete)
+        return { incomplete: true };
+    const { secret: secretFp, fp: privateFp, pii: piiFp, tok: tokFp } = stores;
+    if (!secretFp.size && !privateFp.size && !tokFp.size && !piiFp.size)
+        return {};
+    for (const c of cands)
+        if (windowHit(c, secretFp))
+            return { secret: 'text from a credential file this session read' };
+    if (tokFp.size)
+        for (const c of cands)
+            if (tokenHit(c, tokFp))
+                return { secret: 'part of a credential this session read' };
+    const privateCands = candidates(all.filter(s => !own(s)));
+    const result = {};
+    if (piiFp.size)
+        for (const c of privateCands)
+            for (const t of piiTokens(c))
+                if (piiFp.has(fpHash(t))) {
+                    result.pii = true;
+                    break;
+                }
+    if (privateFp.size)
+        for (const c of privateCands)
+            if (windowHit(c, privateFp)) {
+                result.private = true;
+                break;
+            }
+    return result;
+}
+/**
+ * A value sent in pieces, one call each, is checked whole: each argument name keeps the tail of what it carried,
+ * and the windows that cross from that tail into this call are checked like any other. Only pieces sent back to back
+ * through the same argument join; words between them break the run. Returns the new tails.
+ */
+export function checkStream(input, tails, stores) {
+    const leak = {};
+    const next = {};
+    for (const [key, value] of Object.entries(input)) {
+        const n = normalizeText(strings(value).join(''));
+        if (!n)
+            continue;
+        const a = alnum(n);
+        const prev = tails[key] ?? { t: '', a: '' };
+        if (prev.t) {
+            for (const h of windowsAll(prev.t + n.slice(0, WINDOW - 1))) {
+                if (stores.secret.has(h))
+                    leak.secret = 'text from a credential file this session read, sent in pieces';
+                if (stores.fp.has(h))
+                    leak.private = true;
+            }
+        }
+        if (prev.a) {
+            for (const size of TOKEN_WINDOWS) {
+                const tok = prev.a.slice(-(size - 1)) + a.slice(0, size - 1);
+                for (let i = 0; i + size <= tok.length; i++)
+                    if (stores.tok.has(fpHash(tok.slice(i, i + size))))
+                        leak.secret = 'part of a credential this session read, sent in pieces';
+            }
+            if (stores.pii.size) {
+                // Personal-data tokens are 8-34 letters and digits: try every one that starts before this call and ends in it.
+                const joined = prev.a + a.slice(0, ALNUM_TAIL);
+                for (let i = 0; i < prev.a.length && !leak.pii; i++) {
+                    for (let len = 8; len <= 34 && i + len <= joined.length; len++) {
+                        if (i + len > prev.a.length && stores.pii.has(fpHash(joined.slice(i, i + len)))) {
+                            leak.pii = true;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        next[key] = { t: (prev.t + n).slice(-(WINDOW - 1)), a: (prev.a + a).slice(-ALNUM_TAIL) };
+    }
+    return { leak, next };
+}
+//# sourceMappingURL=flow-guard-leak.js.map

package/dist/flow-guard-leak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-leak.js","sourceRoot":"","sources":["../src/flow-guard-leak.ts"],"names":[],"mappings":"AAAA,mIAAmI;AACnI,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7H,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEpE,6EAA6E;AAC7E,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA0B;IACxD,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,aAAa;YAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;IACxI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAA0B;IACzD,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAChH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9F,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,KAAmC;IAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChH,CAAC;AAGD;mDACmD;AACnD,MAAM,UAAU,SAAS,CAAC,KAAmC,EAAE,KAA8B,EAAE,QAA2B,EAAE,EAAE,SAAmB,UAAU,CAAC,KAAK,CAAC;IAChK,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACtH,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC3H,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,YAAY;YAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;gBAAE,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;oBAAC,MAAM;gBAAC,CAAC;IACnI,IAAI,SAAS,CAAC,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,YAAY;YAAE,IAAI,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;IAChH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAA8B,EAAE,KAAwC,EAAE,MAAgB;IACpH,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YACX,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,MAAM,GAAG,+DAA+D,CAAC;gBACxG,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;oBAAE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;wBAAE,IAAI,CAAC,MAAM,GAAG,wDAAwD,CAAC;YAC1K,CAAC;YACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACpB,+GAA+G;gBAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;oBACpD,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;wBAC/D,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;4BAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;4BAAC,MAAM;wBAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/flow-guard-paths.d.ts

@@ -0,0 +1,21 @@
+export declare function stateDir(env?: NodeJS.ProcessEnv): string;
+export declare function sessionKey(sessionId: string): string;
+export declare function flowPaths(dir: string, sessionId: string): {
+    dir: string;
+    state: string;
+    fp: string;
+    secret: string;
+    pii: string;
+    tok: string;
+    hint: string;
+    log: string;
+};
+export declare function absPath(p: string, cwd: string): string;
+export declare function physicalPath(p: string): string;
+export declare function shellPath(p: string, cwd: string, env: NodeJS.ProcessEnv): string;
+export declare function inside(child: string, parent: string): boolean;
+export declare function isSecretPath(path: string): boolean;
+export declare const FOREIGN_DIRS: RegExp;
+/** Files that, if the agent could change them, would let it switch the guard off. */
+export declare function isProtectedPath(path: string, cwd: string, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=flow-guard-paths.d.ts.map

package/dist/flow-guard-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-paths.d.ts","sourceRoot":"","sources":["../src/flow-guard-paths.ts"],"names":[],"mappings":"AAMA,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;;;EAIvD;AAMD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAGD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAIhF;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG7D;AAGD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,eAAO,MAAM,YAAY,QAAmI,CAAC;AAE7J,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAgBxG"}

package/dist/flow-guard-paths.js

@@ -0,0 +1,72 @@
+/** Flow guard: where the guard keeps its state, which files are credentials, and which would let the agent switch it off. */
+import { createHash } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, normalize, resolve, sep } from 'node:path';
+export function stateDir(env = process.env) {
+    return env.WARDEN_STATE_DIR || join(env.XDG_STATE_HOME || join(homedir(), '.local', 'state'), 'warden');
+}
+export function sessionKey(sessionId) {
+    return createHash('sha256').update(sessionId).digest('hex');
+}
+export function flowPaths(dir, sessionId) {
+    const base = join(dir, 'claude-code', 'flow');
+    const key = sessionKey(sessionId);
+    return { dir: base, state: join(base, `${key}.json`), fp: join(base, `${key}.fp`), secret: join(base, `${key}.secret.fp`), pii: join(base, `${key}.pii.fp`), tok: join(base, `${key}.tok.fp`), hint: join(base, `${key}.hint.fp`), log: join(base, `${key}.log`) };
+}
+function expandHome(p) {
+    return p === '~' ? homedir() : p.startsWith('~/') ? join(homedir(), p.slice(2)) : p;
+}
+export function absPath(p, cwd) {
+    const e = expandHome(p);
+    return normalize(isAbsolute(e) ? e : resolve(cwd, e));
+}
+// Resolve existing ancestors too: a write to symlink-dir/new-file must protect the real target.
+export function physicalPath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        const parent = dirname(p);
+        return parent === p ? p : join(physicalPath(parent), basename(p));
+    }
+}
+export function shellPath(p, cwd, env) {
+    const expanded = p.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (match, braced, plain) => env[braced || plain] ?? match);
+    return absPath(expanded.replace(/^['"]|['"]$/g, '').replace(/^@/, ''), cwd);
+}
+export function inside(child, parent) {
+    const p = parent.endsWith(sep) ? parent : parent + sep;
+    return child === parent || child.startsWith(p);
+}
+const SECRET_PATH = /(^|\/)(\.ssh|\.aws|\.gnupg|\.kube|\.docker|\.config\/gh|\.config\/gcloud|\.azure|\.password-store|keychains?)(\/|$)|(^|\/)(\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.pgpass|id_(rsa|dsa|ecdsa|ed25519)[^/]*|[^/]*\.(pem|key|p12|pfx|kdbx|keystore|jks)|\.env(\.[^/]*)?|credentials?(\.[^/]*)?|secrets?(\.[^/]*)?)$/i;
+export function isSecretPath(path) {
+    return SECRET_PATH.test(path.replace(/\\/g, '/'));
+}
+export const FOREIGN_DIRS = /(^|\/)(node_modules|vendor|\.venv|venv|site-packages|dist-packages|bower_components|Pods|\.cargo\/registry|go\/pkg\/mod)(\/|$)/;
+/** Files that, if the agent could change them, would let it switch the guard off. */
+export function isProtectedPath(path, cwd, env = process.env) {
+    // join also normalizes a root home: `${home}/...` would produce a double slash
+    // for HOME=/ and fail to match the normalized /.claude.json or plugin path.
+    const homeConfig = join(homedir(), '.claude.json').replace(/\\/g, '/');
+    const homePlugins = join(homedir(), '.claude', 'plugins').replace(/\\/g, '/');
+    return [path, physicalPath(path)].some(candidate => {
+        const p = candidate.replace(/\\/g, '/');
+        if (inside(p, physicalPath(resolve(stateDir(env))).replace(/\\/g, '/')))
+            return true;
+        if (env.WARDEN_FLOW_POLICY && p === physicalPath(resolve(env.WARDEN_FLOW_POLICY)).replace(/\\/g, '/'))
+            return true;
+        if (/(^|\/)\.claude\/settings(\.local)?\.json$/.test(p))
+            return true;
+        if (p === homeConfig || /(^|\/)\.mcp\.json$/.test(p))
+            return true;
+        if (inside(p, homePlugins) || /(^|\/)\.claude\/hooks(\/|$)/.test(p))
+            return true;
+        if (/(^|\/)\.git\/(?:config$|hooks(?:\/|$))/.test(p))
+            return true;
+        if (/(^|\/)warden\.lock\.json$/.test(p) && inside(p, cwd.replace(/\\/g, '/')))
+            return true;
+        return false;
+    });
+}
+//# sourceMappingURL=flow-guard-paths.js.map

package/dist/flow-guard-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-paths.js","sourceRoot":"","sources":["../src/flow-guard-paths.ts"],"names":[],"mappings":"AAAA,6HAA6H;AAC7H,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzF,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,OAAO,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,SAAiB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC;AACrQ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAS,EAAE,GAAW;IAC5C,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,GAAW,EAAE,GAAsB;IACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,4DAA4D,EACrF,CAAC,KAAK,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC;IACvD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,WAAW,GAAG,wTAAwT,CAAC;AAC7U,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,gIAAgI,CAAC;AAE7J,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAW,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7F,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACjD,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,GAAG,CAAC,kBAAkB,IAAI,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,CAAC,KAAK,UAAU,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/flow-guard-policy.d.ts

@@ -0,0 +1,15 @@
+import type { FlowLabel, FlowPolicy } from './flow-guard-types.js';
+export declare const DEFAULT_POLICY: FlowPolicy;
+export declare const LABELS: readonly FlowLabel[];
+/** User-level policy only (`<state dir>/flow-policy.json`): a project file is something the agent can edit. */
+export declare function loadPolicy(env?: NodeJS.ProcessEnv): FlowPolicy;
+/** Read bounded, pinned operator configuration. The task runtime additionally validates the complete schema. */
+export declare function readPinnedTaskManifest(policy: FlowPolicy, env?: NodeJS.ProcessEnv): string;
+/** This delegates only fixed control IDs to our own enforcing adapter, never clicks or arbitrary MCP servers.
+ * The operator must bind this exact MCP server name to `warden-mcp task`; tool output cannot establish trust. */
+export declare function taskDelegation(tool: string, args: Record<string, unknown>, policy: FlowPolicy, env: NodeJS.ProcessEnv): boolean;
+/** Sorted JSON keys; array order and every argument/destination are significant. Never hashes a truncated input. */
+export declare function publicRequestDigest(tool: string, input: Record<string, unknown>): string | undefined;
+export declare function globMatch(glob: string, name: string): boolean;
+export declare function hostMatches(host: string, patterns: readonly string[]): boolean;
+//# sourceMappingURL=flow-guard-policy.d.ts.map

package/dist/flow-guard-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-guard-policy.d.ts","sourceRoot":"","sources":["../src/flow-guard-policy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAsC,SAAS,EAAY,UAAU,EAAwC,MAAM,uBAAuB,CAAC;AAIvJ,eAAO,MAAM,cAAc,EAAE,UAAiL,CAAC;AAE/M,eAAO,MAAM,MAAM,EAAE,SAAS,SAAS,EAAwD,CAAC;AAIhG,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CA6B3E;AAaD,gHAAgH;AAChH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAavG;AAED;iHACiH;AACjH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAc/H;AAmBD,oHAAoH;AACpH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAepG;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E"}