@blogic-cz/agent-tools 1.10.1 → 1.12.0

package/README.md

@@ -230,6 +230,10 @@ bun run agent-tools/example-tool/index.ts ping
 3. Run tools:
 
 ```bash
+bun gh-tool rate-limit                         # Inspect all GitHub API rate-limit resources
+bun gh-tool rate-limit --resource core         # Inspect one resource
+bun gh-tool telemetry                         # Report direct HTTP requests, gh invocations and ReadCache hits
+bun gh-tool telemetry --hours 24 --format json # Report one day of telemetry
 bun gh-tool pr status
 bun observability-tool trace get 0b7bdf0dde1c55458364ba5588a8075e --env local
 bun observability-tool trace search '{ status = error }' --env local --start now-6h
@@ -437,7 +441,7 @@ bun audit-tool list --limit 50 --format json
 bun audit-tool list --tool gh
 
 # Filter by project directory
-bun audit-tool list --project /Users/me/my-repo
+bun audit-tool list --project /home/user/my-repo
 
 # Purge entries older than 30 days
 bun audit-tool purge --days 30
@@ -547,6 +551,8 @@ Each tool uses its own auth method — no unified token store:
 | `api-tool`           | Caller capability and proxy HTTPS origin in client configuration                             |
 | `api-proxy`          | Private operator store and policy under a separated service identity                         |
 
+Set `tokenEnvVar` and `passwordEnvVar` to names that match `^[A-Z_][A-Z0-9_]*$`.
+
 The REST proxy uses its separate private operator store described in [REST proxy setup](docs/rest-api-proxy.md). Other tool configs reference credential sources. Provider secrets are **never** stored in the caller client config file. The `db-tool` config references env var **names** only:
 
 ```json5
@@ -574,7 +580,8 @@ These are **overrides with fallback**, not requirements — the opposite of `pas
 - variable unset or empty → the literal `host` / `port` in the config is used, and no error is raised;
 - `portEnvVar` set to something that is not an integer between 1 and 65535 → the command **fails**. It never falls back to the literal, because that would query a different database while you believe the override applied.
 
-The variable is read from the process environment first (Bun loads `.env` files into it), then from `~/.zshrc` exports.
+The variable is read from the process environment first (Bun loads `.env` files into it), then from the interactive zsh environment.
+The zsh child receives only `PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TERM`, `LANG`, `LC_ALL`, `TMPDIR`, `XDG_CONFIG_HOME`, and `ZDOTDIR`. If an rc file needs another parent process variable to select or load a value, that value will not resolve.
 
 The typical use is a repository where every git worktree runs its own database container on its own host port, published by that worktree's `.env`:
 
@@ -644,7 +651,7 @@ The wrappers check outgoing user content and redact recognized credentials in ag
 
 ## Credential Guard
 
-The guard blocks agents from accessing sensitive files, leaking secrets, and running dangerous commands. Every block message links to the source — if an agent thinks a block is wrong, it can fork the repo and submit a PR.
+The guard checks tool inputs for named credential sources, sensitive file access, and supplied code that it cannot inspect. Write/Edit content checks detect known secret formats. Shell output and existing program contents are outside these checks.
 
 **What it blocks:**
 
@@ -691,57 +698,27 @@ Claude Code uses shell command hooks. The package ships a ready-made wrapper scr
 
 That's it. The hook reads tool input from stdin, runs the guard, and exits with code 2 (blocked + reason on stderr) or 0 (allowed).
 
-The guard permits static `printenv` reads and simple `echo`/`printf` expansions only for exact names in `credentialGuard.allowedEnvironmentVariables`. Quoted empty defaults such as `"${NAME:-}"` follow the same display rules, including `printf` data arguments with a literal format; unquoted defaults, nonempty defaults, and other parameter operators stay blocked. The default list is empty. Multiple names are allowed only when each name is approved. Approved environment values may be displayed, but redirecting their pipeline or passing them to an executor stays blocked.
-
-Python inline programs and quoted stdin heredocs can also display approved values through `os.getenv("NAME")`, `os.environ.get("NAME", "default")`, or `os.environ["NAME"]`. The complete program must import unaliased `os`, plus `json` for JSON display, followed by `print(...)` statements. `json.dumps(...)` supports dictionaries and lists of approved reads, including comprehensions over a nonempty literal list of approved names. Every dictionary key and environment read must use an approved name. Each projection has at most 16 entries; the program has at most 65,536 characters. Computed or unbounded names, aliases, escaped or interpolated strings, additional statements, and whole-environment output remain unsupported. The same redirection and pipeline restrictions apply.
-
-Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, a single ASCII-letter path binding such as `cd PATH && A=docs/report.md && shasum -a 256 "$A"` or `F=README.md; cat "$F"`, including the existing `git add -- "$T/file"` form, and literal path braces such as `rg -n -i PATTERN src/{a,b} docs/{guide,api}.md`. Path braces work with supported passive text commands and `cat`, and support one unquoted comma list per path, at most 16 members per list and 32 generated paths per command, within 64 KiB. Nested braces, ranges, empty members, mixed quoting, command positions, and compound commands remain unsupported. Path bindings accept literal values and `;`, newline, or `&&` sequencing; a binding conditional on successful `cd` is proved only for uses in that same `&&` list. Their uses must be supported read-only file operands or explicit `git add --` paths. Rebinding, executable operands, startup-variable names, and uncertain scopes cannot establish this proof. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
-
-Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" status --short` do not need display permission. This does not authorize printing those values, using them as code/options, or reading unknown file paths. In `printf`, approved values belong in data arguments after a fixed nonmutating format, for example `printf -- '%s' "$WORKSPACE_LABEL"`.
-
-Literal `herdr agent prompt` commands can be composed with independent `cat` readers and passive text pipelines. Prompt text stays data; command substitutions, environment mutation, unknown consumers, and executable pipelines cannot establish the proof. All reader operands and redirects still receive the ordinary sensitive-path checks. Literal loops also support `herdr pane read ID --source recent-unwrapped --lines N`, with the binder restricted to `ID`, and `2>&1` file-descriptor duplication. A bounded Python stdin processor supports only `import json,sys; d=json.load(sys.stdin); print(d["result"].get("text","") if isinstance(d.get("result"),dict) else d)`, including insignificant spacing and single lowercase-letter local renaming. Extra imports, statements, calls, runtime options, arguments, and other Python programs cannot establish this loop proof. The existing loop size and command limits apply.
-
-Prompt composition also supports one `cd [--] PATH` with a literal relative or absolute directory at the start of the final `&&` chain. All subsequent inspection must remain in that chain, so a failed `cd` cannot reach its readers. Directory names may contain quoted spaces. Multiple `cd` commands, later `;` or newline boundaries, tilde or variable expansion, other `cd` options, background jobs, `||`, and navigation in pipelines remain unproved. Supported Git inspection can use literal `-C PATH` prefixes with `grep`, `status`, `rev-parse`, or `rev-list`; execution and startup options remain unsupported. Navigation composition refuses relative file redirects, including redirects on `cd` and Git commands, because those use the shell directory before the command runs. Absolute redirects still receive ordinary path checks. Named directories receive sensitive-path checks with directory-prefix semantics. Only a proved `cd` chain qualifies relative reader operands with that directory; Git `-C` qualifies that command's file operands without changing shell state. Git grep uses the shared grep pattern-versus-file checks. This checks textual operands and does not resolve aliases, symlinks, ambient directories, or command lookup.
-
-The guard recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes and checks commands in pipelines and chains. Quoted filenames, comments, and redirects retain sensitive-path checks. Jq filters and inline awk programs qualify only when their actual program and options establish passive behavior. Literal environment-command text in `rg`, `grep`, `git grep`, `echo`, and `printf` is allowed only with supported command roles and passive pipeline consumers. Environment-source evidence and startup identity checks also apply to the complete original invocation. Custom dangerous-command patterns apply to both the original input and proved expansions.
-
-Jq admission uses a closed grammar for `.field` traversal, literal string/numeric indexes, `[]`/`[]?`, parentheses, `//`, pipelines, nested objects/arrays, literal JSON values, comparisons, arithmetic and `and`/`or`. It admits the pure zero-argument filters `length`, `keys`, `keys_unsorted`, `type`, `values`, `empty`, `add`, `min`, `max`, `sort`, `unique`, `flatten`, `not`, `reverse`, `to_entries` and `from_entries`; single-argument calls are `map`, `map_values`, `select`, `contains`, `has`, `sort_by`, `group_by`, `unique_by`, `any`, `all` and `join`. Operator precedence remains jq's responsibility; the guard validates complete operands and delimiters without evaluating a filter. Unknown functions/syntax, comments, interpolation, variables, `env`/`$ENV`, imports/includes and program-loading options refuse. A string or field named `env` stays data. Limits are 65,536 UTF-8 bytes, 4,096 tokens and 64 nested expression levels. Known formatting/input flags must precede the literal filter. File operands, redirects, downstream consumers and configured command/path rules still apply. Unquoted file globs and tilde paths anywhere in a compound jq invocation refuse; quote or escape genuinely literal filenames, or provide explicit nonsensitive paths.
-
-This is a textual jq proof under trusted native executables and host startup configuration. Normal jq loads a home `.jq` file, which can redefine builtins; the guard does not inspect it or prove module provenance. `-L` does not suppress that startup file. The supported exact POSIX child-process form `env HOME=/dev/null jq 'FILTER' file.json` avoids the user home-file lookup. Other explicit startup assignments/env prefixes anywhere in the compound invocation do not receive the jq proof, including producer/consumer cwd mutations. Literal directory changes must satisfy the existing gated navigation proof. Neither form certifies JSON contents, native binaries, aliases or symlinks.
-
-Every jq compound command must have a supported native data, navigation, declared frontend or existing literal-script role. Unknown heads, `builtin` wrappers, directory-stack commands and shell state mutations cannot establish context. Declared CLI producers and literal script roles retain their ordinary policies; their source contents are not certified passive.
-
-Syntax compilation supports `python3 -I -S -m py_compile src/main.py`, also `python`, known RTK/command wrappers and combined/reordered `-I`, `-S`, `-B` flags before `-m`. Both isolation flags are required: `-I` excludes cwd/user imports and Python startup variables, and `-S` disables site hooks. The module must be exactly `py_compile`, followed by 1–32 literal nonsensitive `.py` paths. Stdin filename lists, unknown flags/modules, expansions, startup mutations and executable output consumers refuse. Target source is compiled without execution, but `__pycache__` writes still occur with `-B`, and error output may quote source. This does not inspect source contents or attest filesystem/runtime identity.
-
-With any `additionalBlockedPaths` rule, implicit compiler cache/temp filenames cannot be proved against that policy, so `py_compile` refuses. Use a cache-free syntax parse instead: `python3 -I -S -B -c 'import ast; ast.parse(open("src/main.py", "rb").read(), filename="src/main.py")'`. This form remains subject to source-path, inline-program and command policies. It parses the named source without executing it or writing target bytecode caches. The refusal explains the cache boundary separately from environment access.
-
-Paths are checked against sensitive filename patterns and configured path rules. Supported proofs apply those checks to their expanded operands. Ordinary parent-directory and absolute paths may be allowed; the guard does not resolve filesystem paths or symlinks, or enforce repository confinement. The default kubeconfig pattern protects every path segment containing `kubeconfig`, including ancestor directories and names without separators such as `mykubeconfig` or `kubeconfig2`. Only a final ordinary Markdown basename that does not start with `kubeconfig`, such as `check-kubeconfig-topology.md` or `cluster-kubeconfig-notes.md`, has the documentation exception; the `.md` suffix must be the exact end of the path. A kubeconfig-containing ancestor still matches the blocked pattern; `kubeconfig.md` remains protected. Existing explicit path allowances take precedence over blocked patterns, including template names such as `prod-kubeconfig/.env.example` and configured `additionalAllowedPaths`. Otherwise, configured blocked paths still apply to documentation names. This filename convention does not attest file contents, and there is no blanket Markdown or memory-directory exception.
-
-Recognized Linux process-environment paths such as `/proc/self/environ`, `/proc/thread-self/environ`, and PID/task variants are blocked before configured path exceptions.
-
-Single literal `echo`/`printf` writes with output redirection and single `cat`/`tee` heredoc writes are allowed. Heredoc braces are data. Use a quoted delimiter for literal code; unquoted heredocs containing `$`, backticks, or backslashes do not receive the literal-write exception. The exception permits only supported combinations with navigation or selected inspections; unsupported following commands remain outside it. Supported complete Python stdin heredocs are checked as inline programs, with the normal runtime-argument, path, execution, and environment checks.
-
-A supported Python stdin heredoc can be followed by complete literal `cat`/`tee` heredoc writers and passive consumers. The guard retains every writer header, file operand and redirect while excluding only the proved literal bodies from path evidence. Incomplete bodies, executable/unknown headers and unsupported following commands gain no exception. Heredoc composition is bounded to 32 bodies and 65,536 bytes. This separates prose from path operands; Bash writes/output are not content attestation, and Write/Edit secret scanning remains separate.
+### Shell policy
 
-Quoted single-letter literal bindings such as `D="/workspace/docs/topic"; ls -la "$D"; grep -n X "$D/file.md"` receive the existing closed path proof. Finite literal loops can use the binder inside a jq filename, for example `for i in 1 2; do jq '.rows // [] | length' sample-$i.json; done`; the filter/options and every materialized path are checked. A derived path list such as `f=$(git grep -l PATTERN -- '*.cs')` remains unproved: the input-only guard cannot inspect output paths, shell splitting or sensitive matches. Use direct `git grep` output or separately checked literal paths. This refusal identifies a local derived binding rather than claiming ambient environment access. A literal binding in a script/executable operand also remains outside the file-data proof.
+Bash and PowerShell use separate parsers and one shared policy. The policy checks that the command text names no secret source and supplies no code that the guard cannot inspect. A parse error, an analysis limit, or an unresolved executable, file path, environment name, or code operand refuses the command. Refusal messages identify the rule and give one recovery hint per rule family.
 
-The same finite loop proof admits numeric `--pr` selectors for `bun run gh-tool pr checks`, `checks-failed`, `info` and `review-triage`, with optional literal `--repo`, and `git diff [one literal revision-shaped operand] -- literal filenames`. Git diff loop prefix options, including output/order files and no-index mode, remain unproved. Git can implicitly compare filesystem paths outside a worktree or when a path points outside it. The optional operand also receives ordinary/custom file policy as a potential path, including proved cwd and Git `-C` qualification; the guard does not certify repository context or guarantee that it is a revision. Every generated path receives the ordinary policy. One literal local directory binding may be used only by the first successful gated `cd`, followed by supported literal commands including Git clone without executable configuration/upload-pack options. Variable script operands and HOME-dependent tilde bindings remain unproved.
+The guard follows local bindings, finite loops, substitutions, redirects, pipelines, nested supported shell bodies, and command chains. It checks each reachable command and each possible literal path. For example, `F=README.md; cat "$F"` passes. A binding made only after a successful `cd` does not become certain after a later semicolon. Command output does not establish a known filename or executable. Unsupported shell syntax and shell state changes refuse.
 
-Literal Herdr prompt pipelines may compose with independent commands such as pane close or a literal script operation. The prompt pipeline's consumers must be supported data commands; each sibling still receives ordinary path, environment, runtime and configured policy checks. If the lexer finds an unterminated quoted argument, recovery explains shell encoding. A single-quoted apostrophe can be encoded as `'don'"'"'t'`. File-input options are recommended only when the command documents one.
+`HOME`, `PWD`, `OLDPWD`, and `PATH` are built-in non-secret names in Bash and PowerShell. Other environment reads require exact names in `credentialGuard.allowedEnvironmentVariables`, whose default list is empty. Bash HOME resolves to the hook home directory, and PWD follows the analyzed working directory. A successful Bash `cd` also records OLDPWD. Unresolved values, including PowerShell environment-provider values, remain unknown for roles that require literal paths or code. All four names retain ordinary path, code, and startup checks: `ls "$HOME/projects"` can pass, `cat "$HOME/.env"` refuses, and changing PATH before an interpreter refuses. Local literal bindings are separate from ambient environment values. Environment dumps, process-environment files, credential-store commands, and startup or executable-lookup mutations refuse. Bash treats `%NAME%` as literal text. PowerShell environment providers and names use PowerShell rules.
 
-Bun's late startup-flag scan respects a separate `--` after a supported literal task/file operand. Words thereafter are tool argv for this scan, including `-p:Example=false`; actual startup controls before the separator still refuse. Missing targets, runtime subcommands and embedded/attached separator text do not receive this boundary. Task/file lookup retains the existing trusted host/project assumption, including task lifecycle hooks; source contents are not inspected. Explicit interpreter lookup/loader variables such as `BUN_OPTIONS`, `NODE_OPTIONS`, `PYTHONPATH` and `BASH_ENV` cannot establish startup context. Literal ordinary selector/deadline prefixes remain subject to the existing path/environment rules.
+Command argument roles distinguish data, paths, environment names, executables, and code. Literal search patterns and Herdr prompt text stay data. Names-only listing and staging commands may name files that content readers cannot open. An unknown executable with literal nonsensitive operands can pass. This does not inspect its implementation or certify the contents of existing scripts, project tasks, native executables, aliases, or host startup files. Known CLI operations that require a wrapper still refuse. Supported literal help and version requests can pass without the wrapper.
 
-Shared Git diff inspection uses a finite argv-role table. Output/order-file values and positional revision/file words receive ordinary/custom path policy, with proved cwd and Git `-C` qualification. Known required search/prefix values are data; optional context/rename/color/relative values attach to their option and never consume the next file. Short clusters are read left to right, so `-pO.env` has a file role and `-S-O.env` has a search-data role. Exact long options take priority over unique supported abbreviations; ambiguous/unknown options, incomplete roles and executable callbacks refuse with Git-specific recovery. This does not inspect repository state, trusted native executables/configuration, task contents, aliases or symlinks.
+Inline Python, JavaScript, and other runtime code refuse because they have no analyzer. This includes the Python and Node programs that older versions recognized with special-case patterns. Supported literal shell bodies receive recursive policy checks. Jq uses a closed passive grammar; it admits ordinary projections, literal objects and arrays, and supported pure filters. Environment access, imports, program files, interpolation, and unknown jq syntax refuse. Jq runs under the trusted host-startup assumption: the guard does not inspect the user's `.jq` file. The limited awk field-projection and sed print grammars also refuse unsupported programs.
 
-Python JSON parsing, dictionary iteration, and printing are not themselves evidence of credential access. They follow the same access and execution rules as other supported inline programs. This intentionally permits ordinary JSON output that older versions refused. Unknown secrets in ordinary files can therefore reach arbitrary shell output; wrapper content checks do not protect that output. A refusal caused by unsupported syntax means the guard could not establish its policy conditions, not that it observed a secret being read.
+`python3 -m py_compile src/main.py` is supported with literal nonsensitive source operands. Isolation flags and cache-location proofs are not required. Compilation can write bytecode caches and show source in error output. The guard checks the supplied operands; it does not inspect source contents or runtime identity. Inline cache-free Python alternatives remain unsupported.
 
-The bounded Python subprocess proof supports one immutable literal argv binding followed by one `subprocess.run` call. A literal `cwd` is replayed as a quoted, success-gated directory change before the nested argv, so relative reader operands and named directories receive the ordinary path policies. Supported directories are literal relative or absolute paths, including quoted spaces. Empty, dynamic, Unicode, escaped, tilde and other unsupported directory forms refuse rather than dropping the context. Cwd proof recursively unwraps only supported command, RTK proxy and environment wrappers. Environment directory/split-string options and unproved wrapper forms refuse. Only supported passive text, reader, metadata, literal Bun script and blocked CLI roles receive nested replay; shell executors, inline interpreter programs, unproved sed programs, find execution actions and unknown command roles refuse. Nested blocked CLI, environment, sensitive-path and custom-command policies remain active. Outer shell redirects retain their original shell directory. Arbitrary multi-call Python and `check_output` programs remain unsupported; direct Git metadata commands provide index/tree inspection.
+Literal heredoc bodies can be written as data. Unquoted heredoc expansion is analyzed, and code sent to an interpreter requires a code analyzer. Redirect destinations receive path checks. Files written or copied during a command do not become trusted existing scripts when invoked later in that command. Bash output and heredoc writes do not receive Write/Edit content scanning.
 
-Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with literal agent-get, pane-read and agent-read forms and passive consumers. Both read forms require a literal identifier followed by `--source recent-unwrapped --lines N`, with positive integer `N`. A separate `sleep N` command accepts one literal nonnegative integer or decimal duration; delay pipelines, options and extra operands receive no composition proof. Delay redirects receive the ordinary sensitive-path checks. The wrapper sleep-polling guard still applies. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Native `cut` joins those passive consumers for byte, character and field selection, including after a proved sed print program. Its literal file operands and redirects still receive the shared path checks, and expansion, environment, blocked CLI and configured command policies remain active. This recognizes textual native command roles; it does not verify binaries, aliases or command lookup. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
+Copy operations in a Herdr chain require `credentialGuard.chainCopyDestinations`. Copies also receive this destination proof whenever the configured list is nonempty. The synchronous filesystem check refuses errors, symlinks, missing parent directories, and destinations outside the configured directories. Ordinary copies without a Herdr invocation or configured destinations still receive normal source and destination checks.
 
-Literal shell bodies receive recursive shared policy replay under exact `sh -c`/`bash -c` and `zsh -f -c` invocations, using only these bare executable names or their `/bin/` and `/usr/bin/` paths and known RTK/command wrappers. Both protected paths and blocked CLIs remain enforced inside the body, along with environment and custom-command policies. A conventional shell-family name or numeric version in an unproved executing operand/control position refuses; proved literal text, reader and file-metadata operands remain data. Only the listed sh/bash/zsh identities receive body replay; rbash/rksh/ksh93 and versioned names refuse, and arbitrary renamed executables are outside this identity proof. Replay permits only existing closed body roles/materializations, at most eight shell levels and 64 KiB per invocation. Unproved options, environment prefixes, active exec/nohup/sudo wrappers, positional/script/stdin forms, executable binders, control flow and outer directory changes around a wrapper refuse. A body-internal proved cd affects body readers; outer redirects retain the outer shell directory. This is a textual body proof, not verification of native binaries or all host startup code. In particular, zsh -f still sources the global zshenv file. For unsupported executable inventories, use separate literal metadata requests and literal candidate invocations; no program name or --version flag receives a special exception.
+Sensitive paths include credential files and configured blocked paths. Known template paths and explicit allowed paths can provide exceptions. Process-environment files cannot be allowed by a path exception. Slash direction and Windows path case are normalized independently of the host OS. General path checks do not resolve filesystem symlinks or confine commands to the repository; the copy-destination check above is the bounded filesystem exception. Custom command patterns apply to the original text, nested shell text, and resolved invocations.
 
-A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
+The kubeconfig pattern protects path segments containing `kubeconfig`. A final ordinary Markdown basename such as `check-kubeconfig-topology.md` has a documentation exception; `kubeconfig.md` and kubeconfig-containing parent directories remain protected. Explicit allowed paths take precedence over ordinary blocked patterns. This filename convention does not attest file contents.
 
 ### Setup for OpenCode
 

package/dist/credential-guard/bash.d.ts

@@ -0,0 +1,3 @@
+import type { ParseError, Script } from "./ir";
+export declare function parseBash(text: string): Script | ParseError;
+//# sourceMappingURL=bash.d.ts.map

package/dist/credential-guard/bash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../src/credential-guard/bash.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAKV,UAAU,EAIV,MAAM,EAIP,MAAM,MAAM,CAAC;AAgvBd,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAE3D"}

package/dist/credential-guard/claude-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-hook.d.ts","sourceRoot":"","sources":["../../src/credential-guard/claude-hook.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}
+{"version":3,"file":"claude-hook.d.ts","sourceRoot":"","sources":["../../src/credential-guard/claude-hook.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC"}

package/dist/credential-guard/engine.test.d.ts

@@ -0,0 +1,5 @@
+export declare const bashPassProbes: string[];
+export declare const bashRefuseProbes: string[];
+export declare const powershellPassProbes: string[];
+export declare const powershellRefuseProbes: string[];
+//# sourceMappingURL=engine.test.d.ts.map

package/dist/credential-guard/engine.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/engine.test.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,cAAc,UAoI1B,CAAC;AACF,eAAO,MAAM,gBAAgB,UA0T5B,CAAC;AA4FF,eAAO,MAAM,oBAAoB,UAShC,CAAC;AACF,eAAO,MAAM,sBAAsB,UA+BlC,CAAC"}

package/dist/credential-guard/index.d.ts

@@ -1,18 +1,3 @@
-/**
- * Credential Guard
- *
- * Security patterns and functions for detecting sensitive files and secrets.
- * Used by AI coding agent hooks/plugins.
- *
- * Security layers:
- * 1. Path-based blocking (files that should never be read)
- * 2. Content scanning (detect secrets in write operations)
- * 3. Dangerous bash command detection
- * 4. CLI tool blocking (must use wrapper tools)
- *
- * Note: This is a convenience layer. Real security should be enforced
- * at infrastructure level (K8s RBAC, file permissions, etc.)
- */
 import type { CredentialGuardConfig } from "#config/types";
 export { findSecretMatches } from "#shared/credential-patterns";
 export { redactSensitiveText } from "#shared/content-security";
@@ -47,33 +32,21 @@ export declare function extractFilePath(args: Record<string, unknown>): string;
 export declare function extractContent(args: Record<string, unknown>): string;
 /** Extract command from hook arguments. */
 export declare function extractCommand(args: Record<string, unknown>): string;
-/**
- * Create a credential guard with optional extra patterns merged into defaults.
- *
- * @param config - Optional overrides. Arrays are concatenated with defaults (not replaced).
- * @returns Object with all guard functions bound to the merged pattern sets.
- */
 export declare function createCredentialGuard(config?: CredentialGuardConfig): CredentialGuard;
 /** Handle tool execution with default guard (no extra config). */
-export declare const handleToolExecuteBefore: (input: HookInput, output: HookOutput) => void;
+export declare const handleToolExecuteBefore: CredentialGuard["handleToolExecuteBefore"];
 /** Detect secrets in content with default guard. */
-export declare const detectSecrets: (content: string) => {
-    name: string;
-    match: string;
-} | null;
+export declare const detectSecrets: CredentialGuard["detectSecrets"];
 /** Check if a path is in the allowed exceptions list (default guard). */
-export declare const isPathAllowed: (filePath: string) => boolean;
+export declare const isPathAllowed: CredentialGuard["isPathAllowed"];
 /** Check if a path should be blocked (default guard). */
-export declare const isPathBlocked: (filePath: string) => boolean;
+export declare const isPathBlocked: CredentialGuard["isPathBlocked"];
 /** Check if a bash command might expose secrets (default guard). */
-export declare const isDangerousBashCommand: (command: string) => boolean;
+export declare const isDangerousBashCommand: CredentialGuard["isDangerousBashCommand"];
 /** Get blocked CLI tool info (default guard). */
-export declare const getBlockedCliTool: (command: string) => {
-    name: string;
-    wrapper: string;
-} | null;
+export declare const getBlockedCliTool: CredentialGuard["getBlockedCliTool"];
 /** Check if a gh command is allowed (default guard). */
-export declare const isGhCommandAllowed: (command: string) => boolean;
+export declare const isGhCommandAllowed: CredentialGuard["isGhCommandAllowed"];
 /** Detect sleep-polling with agent-tools wrapper commands (default guard). */
-export declare const detectSleepPolling: (command: string) => string | null;
+export declare const detectSleepPolling: CredentialGuard["detectSleepPolling"];
 //# sourceMappingURL=index.d.ts.map

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAO5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAsmHF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAwkBrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAxtID,SAAS,UAAU,UAAU,KAAK,IAwtIM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA1tIC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA0tIjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA5tIE,MAAM,KAAK,OA4tIgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA9tIE,MAAM,KAAK,OA8tIgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAhuIC,MAAM,KAAK,OAguI0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAluIC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAkuIf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YApuIC,MAAM,KAAK,OAouIsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAtuIC,MAAM,KAAK,MAAM,GAAG,IAsuIa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAY3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA8BF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQrE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAiFD,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4LrF;AAKD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,EAAE,eAAe,CAAC,yBAAyB,CAC3B,CAAC;AAErD,oDAAoD;AACpD,eAAO,MAAM,aAAa,EAAE,eAAe,CAAC,eAAe,CACjB,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,eAAe,CAAC,eAAe,CACjB,CAAC;AAE3C,yDAAyD;AACzD,eAAO,MAAM,aAAa,EAAE,eAAe,CAAC,eAAe,CACjB,CAAC;AAE3C,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,EAAE,eAAe,CAAC,wBAAwB,CAC1B,CAAC;AAEpD,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,EAAE,eAAe,CAAC,mBAAmB,CACrB,CAAC;AAE/C,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CACtB,CAAC;AAEhD,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CACtB,CAAC"}

package/dist/credential-guard/ir.d.ts

@@ -0,0 +1,150 @@
+export type Span = {
+    readonly start: number;
+    readonly end: number;
+};
+export type Script = {
+    readonly kind: "script";
+    readonly dialect: "bash" | "powershell";
+    readonly source: string;
+    readonly body: List;
+    readonly span: Span;
+};
+export type List = {
+    readonly items: readonly AndOr[];
+};
+export type AndOr = {
+    readonly first: Pipeline;
+    readonly background: boolean;
+    readonly rest: readonly {
+        readonly op: "&&" | "||";
+        readonly pipeline: Pipeline;
+    }[];
+};
+export type Pipeline = {
+    readonly negated: boolean;
+    readonly stderr: boolean;
+    readonly commands: readonly Command[];
+};
+export type Command = SimpleCommand | {
+    readonly kind: "group";
+    readonly subshell: boolean;
+    readonly body: List;
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "for";
+    readonly name: string;
+    readonly items: readonly Word[];
+    readonly body: List;
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "while";
+    readonly condition: List;
+    readonly body: List;
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "until";
+    readonly condition: List;
+    readonly body: List;
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "if";
+    readonly branches: readonly {
+        readonly condition: List;
+        readonly body: List;
+    }[];
+    readonly otherwise: List | null;
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "case";
+    readonly subject: Word;
+    readonly arms: readonly {
+        readonly patterns: readonly Word[];
+        readonly body: List;
+    }[];
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+} | {
+    readonly kind: "test";
+    readonly words: readonly Word[];
+    readonly span: Span;
+};
+export type SimpleCommand = {
+    readonly kind: "simple";
+    readonly assignments: readonly Assignment[];
+    readonly argv: readonly Word[];
+    readonly redirects: readonly Redirect[];
+    readonly span: Span;
+};
+export type Assignment = {
+    readonly operation: "replace" | "opaque";
+    readonly name: string;
+    readonly value: Word;
+    readonly exported: boolean;
+};
+export type Word = {
+    readonly split: boolean;
+    readonly parts: readonly WordPart[];
+    readonly span: Span;
+};
+export type WordPart = {
+    readonly kind: "literal";
+    readonly text: string;
+    readonly quoted: boolean;
+} | {
+    readonly kind: "glob";
+    readonly text: string;
+} | {
+    readonly kind: "brace";
+    readonly alternatives: readonly string[];
+} | {
+    readonly kind: "parameter";
+    readonly name: string;
+    readonly ambient: boolean;
+    readonly operator: "plain" | "default" | "alternate" | "length";
+    readonly operand: Word | null;
+    readonly span: Span;
+} | {
+    readonly kind: "special";
+    readonly name: string;
+} | {
+    readonly kind: "command-substitution";
+    readonly body: Script;
+} | {
+    readonly kind: "process-substitution";
+    readonly body: Script;
+};
+export type Redirect = ({
+    readonly kind: "file";
+    readonly op: "<" | ">" | ">>" | "<>" | ">|" | "&>" | "&>>";
+    readonly target: Word;
+} | {
+    readonly kind: "duplicate";
+    readonly input: boolean;
+    readonly target: string;
+} | {
+    readonly kind: "heredoc";
+    readonly body: Word;
+    readonly literal: boolean;
+} | {
+    readonly kind: "herestring";
+    readonly body: Word;
+}) & {
+    readonly fd: number | null;
+};
+export type ParseErrorCode = "syntax" | "unterminated-quote" | "unterminated-heredoc" | "unterminated-substitution" | "function-definition" | "unsupported-keyword" | "indirect-expansion" | "unsupported-parameter-operator" | "depth-limit" | "size-limit" | "work-limit";
+export type ParseError = {
+    readonly kind: "parse-error";
+    readonly code: ParseErrorCode;
+    readonly span: Span;
+};
+export declare const MAX_ANALYSIS_UNITS = 4096;
+export declare const MAX_PARSE_DEPTH = 8;
+export declare const MAX_SCRIPT_BYTES = 262144;
+export declare function literalWord(text: string, span?: Span): Word;
+export declare function wordText(word: Word): string | undefined;
+//# sourceMappingURL=ir.d.ts.map

package/dist/credential-guard/ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.d.ts","sourceRoot":"","sources":["../../src/credential-guard/ir.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACpE,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,CAAA;CAAE,CAAC;AACxD,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAC;CACrF,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC,CAAC;AACF,MAAM,MAAM,OAAO,GACf,aAAa,GACb;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAAE,CAAC;IAChF,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AACpF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,IAAI,GAAG;IACjB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACpE;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAChE,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,QAAQ,GAAG,CACnB;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;CACvB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CACvD,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AACnC,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,oBAAoB,GACpB,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,gCAAgC,GAChC,aAAa,GACb,YAAY,GACZ,YAAY,CAAC;AACjB,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,CAAC;AACF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,gBAAgB,SAAS,CAAC;AACvC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,IAA2B,GAAG,IAAI,CAEjF;AACD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAOvD"}

package/dist/credential-guard/literal-output.d.ts

@@ -0,0 +1,2 @@
+export declare function formatLiteralPrintf(argv: readonly string[]): string | null;
+//# sourceMappingURL=literal-output.d.ts.map

package/dist/credential-guard/literal-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"literal-output.d.ts","sourceRoot":"","sources":["../../src/credential-guard/literal-output.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAO1E"}

package/dist/credential-guard/passive-awk.d.ts

@@ -0,0 +1,2 @@
+export declare function isPassiveAwkProgram(text: string): boolean;
+//# sourceMappingURL=passive-awk.d.ts.map

package/dist/credential-guard/passive-awk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passive-awk.d.ts","sourceRoot":"","sources":["../../src/credential-guard/passive-awk.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA8OzD"}

package/dist/credential-guard/passive-jq.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passive-jq.d.ts","sourceRoot":"","sources":["../../src/credential-guard/passive-jq.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAoIzD;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAsBxE"}
+{"version":3,"file":"passive-jq.d.ts","sourceRoot":"","sources":["../../src/credential-guard/passive-jq.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAmSD,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAsBxE"}

package/dist/credential-guard/passive-sed.d.ts

@@ -0,0 +1,2 @@
+export declare function isPassiveSedProgram(text: string): boolean;
+//# sourceMappingURL=passive-sed.d.ts.map

package/dist/credential-guard/passive-sed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passive-sed.d.ts","sourceRoot":"","sources":["../../src/credential-guard/passive-sed.ts"],"names":[],"mappings":"AAAA,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA6EzD"}

package/dist/credential-guard/passive.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=passive.test.d.ts.map

package/dist/credential-guard/passive.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passive.test.d.ts","sourceRoot":"","sources":["../../src/credential-guard/passive.test.ts"],"names":[],"mappings":""}

package/dist/credential-guard/paths.d.ts

@@ -0,0 +1,14 @@
+export declare const CODE_OR_PROSE_EXTENSION: RegExp;
+export declare const DEFAULT_BLOCKED_PATH_PATTERNS: RegExp[];
+export declare const DEFAULT_ALLOWED_PATH_PATTERNS: RegExp[];
+export type PathContext = {
+    readonly home: string;
+    readonly cwd: string;
+    readonly contentRead?: boolean;
+    readonly additionalBlockedPaths?: readonly RegExp[];
+    readonly additionalAllowedPaths?: readonly RegExp[];
+};
+export declare function normalizePath(path: string, home?: string, cwd?: string): string;
+export declare function isSensitivePath(path: string, context: PathContext): boolean;
+export declare function expandGlobAlternatives(pattern: string): readonly string[] | null;
+//# sourceMappingURL=paths.d.ts.map

package/dist/credential-guard/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/credential-guard/paths.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,QAC8C,CAAC;AAEnF,eAAO,MAAM,6BAA6B,EAAE,MAAM,EAgBjD,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,MAAM,EAEjD,CAAC;AAKF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrD,CAAC;AACF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAmBzE;AAID,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CA2B3E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAkBhF"}

package/dist/credential-guard/policy.d.ts

@@ -0,0 +1,47 @@
+import type { ParseError, Script, Span } from "./ir";
+import type { PathContext } from "./paths";
+import type { Registry } from "./registry";
+export type RuleId = string & {
+    readonly __brand: "RuleId";
+};
+export type Finding = {
+    readonly rule: RuleId;
+    readonly detail: string;
+    readonly span: Span;
+};
+export type Decision = {
+    readonly kind: "pass";
+} | {
+    readonly kind: "violation";
+    readonly findings: readonly [Finding, ...Finding[]];
+} | {
+    readonly kind: "missing-knowledge";
+    readonly findings: readonly [Finding, ...Finding[]];
+};
+export type PolicyContext = PathContext & {
+    readonly approvedNames?: ReadonlySet<string>;
+    readonly onInvocation?: (executable: string, argv: readonly (string | undefined)[]) => void;
+    readonly registry?: Registry;
+    readonly dangerousPatterns?: readonly RegExp[];
+    readonly isPathBlocked?: (path: string) => boolean;
+    readonly chainCopyDestinations?: readonly string[];
+    readonly proveCopyDestination?: (path: string, source: string) => boolean;
+};
+export type Value = {
+    readonly kind: "literal";
+    readonly texts: readonly string[];
+} | {
+    readonly kind: "opaque";
+    readonly mentions: readonly string[];
+    readonly prefix: string;
+    readonly globPatterns?: readonly string[];
+    readonly supplied?: boolean;
+} | {
+    readonly kind: "stream";
+    readonly stdout: Value;
+};
+export declare const MAX_VALUE_ALTERNATIVES = 64;
+export declare const MAX_LOOP_PASSES = 8;
+export declare const MAX_FOLD_STEPS = 20000;
+export declare function judge(script: Script | ParseError, context: PolicyContext): Decision;
+//# sourceMappingURL=policy.d.ts.map

package/dist/credential-guard/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/credential-guard/policy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAiB,UAAU,EAAsB,MAAM,EAAE,IAAI,EAAQ,MAAM,MAAM,CAAC;AAO9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,EAAmB,QAAQ,EAAE,MAAM,YAAY,CAAC;AAqB5D,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQ7D,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3E,CAAC;AACF,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,CAAC;AAiBxD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,cAAc,QAAQ,CAAC;AAyHpC,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,QAAQ,CAy1CnF"}

package/dist/credential-guard/powershell.d.ts

@@ -0,0 +1,3 @@
+import type { ParseError, Script } from "./ir";
+export declare function parsePowerShell(text: string): Script | ParseError;
+//# sourceMappingURL=powershell.d.ts.map

package/dist/credential-guard/powershell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"powershell.d.ts","sourceRoot":"","sources":["../../src/credential-guard/powershell.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,UAAU,EAEV,MAAM,EAIP,MAAM,MAAM,CAAC;AAKd,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CA4MjE"}