@ddtcorex/dsh-maestro-guard 0.1.0 → 0.2.0

package/lib/sandbox.d.ts

@@ -0,0 +1,95 @@
+/**
+ * True if path points to a blocked credential / secret location.
+ * Covers: ~/.dsh/.credentials.yaml (any expansion), ~/.cloudflared, NPM_TOKEN, .credentials.yaml substring
+ * credentialPaths: additional custom paths from config (guard.credentialPaths) — merged with always-blocked defaults.
+ * The 3 always-blocked substrings stay blocked even when credentialPaths is empty.
+ */
+export declare function isBlockedPath(input: string, credentialPaths?: string[]): boolean;
+/**
+ * True if command string is a publish command (pnpm|npm publish)
+ */
+/**
+ * Resolve the working directory a command actually executes in, when it names
+ * one explicitly (cd <dir> / git -C <dir>). Falls back to the passed cwd when
+ * the command has no explicit target — preserving the historical session-cwd
+ * semantics for commands that run in place.
+ */
+export declare function getCommandWorkingDir(command: string | undefined, cwd: string | undefined): string | undefined;
+/**
+ * Choose the branch used for protected-branch detection: the branch of the repo
+ * the command targets (via `getCommandWorkingDir`), falling back to the session
+ * cwd when the command runs in place. If the command cd's into a directory that
+ * is not a git repo, no protected branch applies (the push would fail there
+ * anyway) — do NOT fall back to the session cwd, that reintroduces the
+ * false-positive where a feature-branch push inside a sub-repo is blocked
+ * because the session cwd repo happens to sit on master.
+ */
+export declare function resolveCurrentBranch(command: string | undefined, sessionCwd: string | undefined, branchOf: (dir: string) => string | undefined): string | undefined;
+/**
+ * The executed command surface of a tool call. Shell-style tools carry their
+ * script in `args.command` (bash/exec/shell/govard_shell); bare string args are
+ * the command itself. Tools with no command field (read/write/memory/...) have
+ * no execution surface, so protected-op detection must not apply to their
+ * content — that was the source of the analysis-tool false positives.
+ */
+export declare function extractCommandText(args: unknown): string | undefined;
+export declare function isBlockedCommand(cmd: string): boolean;
+/**
+ * True when the command executes a protected git operation. Detection is
+ * per-command-segment (split on && / ; / | / newline) so a `gh pr create
+ * --base master` mention after a feature push — or quoted text anywhere — does
+ * not turn a safe push into a blocked one. Hard rules (gh pr merge, gh release,
+ * protection deletion, protected branch words in the push segment, being
+ * checked out on a protected branch) keep their unconditional coverage.
+ */
+export declare function isBlockedGitCommand(cmd: string, currentBranch?: string, branches?: string[]): boolean;
+export declare function isPublishBlocked(cmd: string, approved: boolean): boolean;
+/**
+ * True if target path is outside cwd (strict containment).
+ * Uses resolve for absolute comparison; expanded ~/ handled.
+ */
+export declare function isOutsideCwd(target: string, cwd: string): boolean;
+export interface SandboxCheckResult {
+    blocked: boolean;
+    reason?: string;
+}
+export interface CheckSandboxOpts {
+    cwd?: string;
+    currentBranch?: string;
+    approved?: boolean;
+    credentialPaths?: string[];
+    gitProtection?: {
+        enabled: boolean;
+        branches: string[];
+    };
+    publishBlocked?: boolean;
+    cwdContainment?: boolean;
+}
+/**
+ * Central sandbox check. Combines credential-path, git-protection, publish, and cwd containment.
+ * @param tool tool name (e.g. maestro_read_file, exec, bash)
+ * @param args tool arguments (object, string, or unknown)
+ * @param opts.cwd session cwd (exec.agent.session.header.cwd)
+ * @param opts.currentBranch git current branch (from getCurrentBranch)
+ * @param opts.approved whether publish/git is APPROVED (via ApprovalStore)
+ * @param opts.credentialPaths additional blocked credential paths from guard config
+ * @param opts.gitProtection git protection toggle + branches from guard config
+ * @param opts.publishBlocked whether publish is blocked (default true)
+ * @param opts.cwdContainment whether cwd containment is enforced (default true)
+ */
+export declare function checkSandbox(tool: string, args: unknown, opts?: CheckSandboxOpts): SandboxCheckResult;
+/**
+ * Simple guard per task 5 snippet: guard(p) => false if blocked, true if allowed.
+ * For publish, second arg approved indicates APPROVED.
+ */
+export declare function guard(p: string, approved?: boolean): boolean;
+export declare const sandbox: {
+    isBlockedPath: typeof isBlockedPath;
+    isBlockedCommand: typeof isBlockedCommand;
+    isBlockedGitCommand: typeof isBlockedGitCommand;
+    isPublishBlocked: typeof isPublishBlocked;
+    isOutsideCwd: typeof isOutsideCwd;
+    checkSandbox: typeof checkSandbox;
+    guard: typeof guard;
+};
+//# sourceMappingURL=sandbox.d.ts.map

package/lib/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/host/sandbox.ts"],"names":[],"mappings":"AAoBA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAoChF;AAED;;GAEG;AACH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAkB7G;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC5C,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOpE;AAOD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAkCrG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAGxE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACxD,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,kBAAkB,CAsEpB;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,eAAO,MAAM,OAAO;;;;;;;;CAAgH,CAAA"}

package/lib/sandbox.js

@@ -0,0 +1,317 @@
+import { homedir } from 'node:os';
+import { join, resolve, normalize } from 'node:path';
+function expandHome(p) {
+    if (!p)
+        return p;
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/'))
+        return join(homedir(), p.slice(2));
+    if (p.startsWith('$HOME/'))
+        return join(homedir(), p.slice(6));
+    if (p.startsWith('${HOME}/'))
+        return join(homedir(), p.slice(8));
+    return p;
+}
+function normalizePath(p) {
+    try {
+        return normalize(expandHome(p));
+    }
+    catch {
+        return expandHome(p);
+    }
+}
+/**
+ * True if path points to a blocked credential / secret location.
+ * Covers: ~/.dsh/.credentials.yaml (any expansion), ~/.cloudflared, NPM_TOKEN, .credentials.yaml substring
+ * credentialPaths: additional custom paths from config (guard.credentialPaths) — merged with always-blocked defaults.
+ * The 3 always-blocked substrings stay blocked even when credentialPaths is empty.
+ */
+export function isBlockedPath(input, credentialPaths) {
+    if (!input || typeof input !== 'string')
+        return false;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return false;
+    // Direct substring checks (covers JSON-stringified args, env leakage, etc.) — always blocked
+    if (trimmed.includes('.credentials.yaml'))
+        return true;
+    if (trimmed.includes('.cloudflared'))
+        return true;
+    if (trimmed.includes('NPM_TOKEN'))
+        return true;
+    if (trimmed.includes('.dsh') && trimmed.includes('credentials'))
+        return true;
+    // Normalized expanded check for defaults
+    const norm = normalizePath(trimmed);
+    if (norm.includes('.credentials.yaml'))
+        return true;
+    if (norm.includes('.cloudflared'))
+        return true;
+    // Check absolute homedir variant
+    const absCred = join(homedir(), '.dsh', '.credentials.yaml');
+    if (norm === absCred || norm.startsWith(absCred))
+        return true;
+    const absCf = join(homedir(), '.cloudflared');
+    if (norm === absCf || norm.startsWith(absCf + '/') || norm.includes('.cloudflared'))
+        return true;
+    // Injected credentialPaths from config (additional) — substring + normalized + prefix
+    if (credentialPaths && credentialPaths.length > 0) {
+        for (const p of credentialPaths) {
+            if (!p || typeof p !== 'string')
+                continue;
+            const t = p.trim();
+            if (!t)
+                continue;
+            if (trimmed.includes(t))
+                return true;
+            const normP = normalizePath(t);
+            if (norm.includes(normP))
+                return true;
+            if (norm === normP)
+                return true;
+            if (norm.startsWith(normP + '/'))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * True if command string is a publish command (pnpm|npm publish)
+ */
+/**
+ * Resolve the working directory a command actually executes in, when it names
+ * one explicitly (cd <dir> / git -C <dir>). Falls back to the passed cwd when
+ * the command has no explicit target — preserving the historical session-cwd
+ * semantics for commands that run in place.
+ */
+export function getCommandWorkingDir(command, cwd) {
+    if (!command || !cwd)
+        return cwd ?? undefined;
+    const hasCdVerb = /\bcd\b/.test(command) || /\bgit\s+-C\b/.test(command);
+    const cd = /\bcd\s+([^\s;&|"'`${}]+)(?:\s*(?:[;&|]|$))/.exec(command);
+    const c = /\bgit\s+-C\s+([^\s;&|"'`${}]+)/.exec(command);
+    const dir = cd?.[1] ?? c?.[1];
+    if (!dir) {
+        // A cd/-C verb is present but its target cannot be parsed (quoted, $VAR,
+        // wildcard, bare `cd`): do NOT assume the session cwd — that reintroduces
+        // the false positive when the session cwd repo sits on a protected branch.
+        // Unknown target means no protected-branch assumption (segment word checks
+        // still apply); commands with no cd verb keep the session-cwd semantics.
+        if (hasCdVerb)
+            return undefined;
+        return cwd;
+    }
+    if (dir === '~')
+        return homedir();
+    if (dir.startsWith('~/'))
+        return join(homedir(), dir.slice(2));
+    return resolve(cwd, dir);
+}
+/**
+ * Choose the branch used for protected-branch detection: the branch of the repo
+ * the command targets (via `getCommandWorkingDir`), falling back to the session
+ * cwd when the command runs in place. If the command cd's into a directory that
+ * is not a git repo, no protected branch applies (the push would fail there
+ * anyway) — do NOT fall back to the session cwd, that reintroduces the
+ * false-positive where a feature-branch push inside a sub-repo is blocked
+ * because the session cwd repo happens to sit on master.
+ */
+export function resolveCurrentBranch(command, sessionCwd, branchOf) {
+    const dir = getCommandWorkingDir(command, sessionCwd);
+    if (!dir)
+        return undefined;
+    return branchOf(dir);
+}
+/**
+ * The executed command surface of a tool call. Shell-style tools carry their
+ * script in `args.command` (bash/exec/shell/govard_shell); bare string args are
+ * the command itself. Tools with no command field (read/write/memory/...) have
+ * no execution surface, so protected-op detection must not apply to their
+ * content — that was the source of the analysis-tool false positives.
+ */
+export function extractCommandText(args) {
+    if (args == null)
+        return undefined;
+    if (typeof args === 'string')
+        return args;
+    if (typeof args === 'object' && typeof args.command === 'string') {
+        return args.command;
+    }
+    return undefined;
+}
+/** Collapse quoted spans — text inside quotes is data (echo/printf/script bodies), not argv. */
+function stripQuoted(cmd) {
+    return cmd.replace(/"[^"]*"/g, ' ').replace(/'[^']*'/g, ' ');
+}
+export function isBlockedCommand(cmd) {
+    if (!cmd || typeof cmd !== 'string')
+        return false;
+    // package-manager publish verbs as a whole-word sequence
+    return /\b(pnpm|npm)\s+publish\b/.test(stripQuoted(cmd));
+}
+/**
+ * True when the command executes a protected git operation. Detection is
+ * per-command-segment (split on && / ; / | / newline) so a `gh pr create
+ * --base master` mention after a feature push — or quoted text anywhere — does
+ * not turn a safe push into a blocked one. Hard rules (gh pr merge, gh release,
+ * protection deletion, protected branch words in the push segment, being
+ * checked out on a protected branch) keep their unconditional coverage.
+ */
+export function isBlockedGitCommand(cmd, currentBranch, branches) {
+    if (!cmd || typeof cmd !== 'string')
+        return false;
+    const effectiveBranches = branches && branches.length > 0 ? branches : ['master', 'main'];
+    const lowerBranches = effectiveBranches.map((b) => b.toLowerCase());
+    const escBranch = (b) => b.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const segments = cmd.split(/\s*(?:&&|\|\||;|\||\r?\n)+\s*/);
+    for (const seg of segments) {
+        const lower = stripQuoted(seg).toLowerCase();
+        // hard rules are unconditional per segment
+        if (/\bgh\s+pr\s+merge\b/.test(lower))
+            return true;
+        if (/\bgh\s+release\s+(create|publish)\b/.test(lower))
+            return true;
+        for (const b of lowerBranches) {
+            const re = new RegExp(`gh\\s+api\\b.*delete.*\\/branches\\/${escBranch(b)}\\/protection`);
+            if (re.test(lower))
+                return true;
+        }
+        // git push: protected branch word in THIS segment, checked out on one, or
+        // pushing a release tag (version tags trigger the CI publish workflow and
+        // must follow the same human-approval rule as gh release create)
+        if (/\bgit\s+push\b/.test(lower)) {
+            for (const b of lowerBranches) {
+                if (new RegExp(`\\b${escBranch(b)}\\b`).test(lower))
+                    return true;
+            }
+            if (/refs\/tags\//.test(lower))
+                return true;
+            // semver-like tag as a push refspec: standalone token (space/start
+            // preceded), so a branch name like feat/1.2.3 is not a false positive
+            if (/(?:^|\s)v?\d+\.\d+\.\d+(?:[-+][0-9a-z.]+)?\b/.test(lower))
+                return true;
+            if (currentBranch) {
+                const curLower = currentBranch.toLowerCase();
+                if (lowerBranches.includes(curLower))
+                    return true;
+            }
+        }
+    }
+    // git tag push that includes protected branch (rare) — already covered by push regex
+    return false;
+}
+export function isPublishBlocked(cmd, approved) {
+    if (!isBlockedCommand(cmd))
+        return false;
+    return !approved;
+}
+/**
+ * True if target path is outside cwd (strict containment).
+ * Uses resolve for absolute comparison; expanded ~/ handled.
+ */
+export function isOutsideCwd(target, cwd) {
+    if (!target || !cwd)
+        return false;
+    const expTarget = expandHome(target);
+    const expCwd = expandHome(cwd);
+    const resolvedTarget = resolve(expTarget);
+    const resolvedCwd = resolve(expCwd);
+    if (resolvedTarget === resolvedCwd)
+        return false;
+    // Ensure cwd prefix with separator to avoid /tmp/proj matching /tmp/proj2
+    return !resolvedTarget.startsWith(resolvedCwd + '/');
+}
+/**
+ * Central sandbox check. Combines credential-path, git-protection, publish, and cwd containment.
+ * @param tool tool name (e.g. maestro_read_file, exec, bash)
+ * @param args tool arguments (object, string, or unknown)
+ * @param opts.cwd session cwd (exec.agent.session.header.cwd)
+ * @param opts.currentBranch git current branch (from getCurrentBranch)
+ * @param opts.approved whether publish/git is APPROVED (via ApprovalStore)
+ * @param opts.credentialPaths additional blocked credential paths from guard config
+ * @param opts.gitProtection git protection toggle + branches from guard config
+ * @param opts.publishBlocked whether publish is blocked (default true)
+ * @param opts.cwdContainment whether cwd containment is enforced (default true)
+ */
+export function checkSandbox(tool, args, opts) {
+    const approved = !!opts?.approved;
+    const cwd = opts?.cwd;
+    const currentBranch = opts?.currentBranch;
+    const credentialPaths = opts?.credentialPaths;
+    const gitProtection = opts?.gitProtection;
+    const publishBlocked = opts?.publishBlocked ?? true;
+    const cwdContainment = opts?.cwdContainment ?? true;
+    // Serialize args for generic substring checks
+    const asText = args != null ? (typeof args === 'string' ? args : JSON.stringify(args)) : '';
+    const combined = `${tool ?? ''} ${asText}`;
+    // Protected-op detection (git/publish) runs on the executed command surface
+    // only — non-shell tools (write/read/memory/...) have no command and must not
+    // be flagged for text that merely mentions a protected phrase.
+    const execText = extractCommandText(args);
+    // 1) Block credential paths anywhere in tool+args (always, with injected list)
+    if (isBlockedPath(tool, credentialPaths) || isBlockedPath(asText, credentialPaths) || isBlockedPath(combined, credentialPaths)) {
+        return { blocked: true, reason: 'credential path blocked: ~/.dsh/.credentials.yaml or ~/.cloudflared or NPM_TOKEN' };
+    }
+    // 2) Block git push to protected branches without APPROVED (branch-aware, toggle-aware)
+    const gitEnabled = gitProtection?.enabled ?? true;
+    const branches = gitProtection?.branches ?? ['master', 'main'];
+    if (gitEnabled && execText && isBlockedGitCommand(execText, currentBranch, branches) && !approved) {
+        return { blocked: true, reason: 'git push to master/main blocked without APPROVED: ' + execText.slice(0, 300) };
+    }
+    // 3) Block publish without APPROVED (toggle-aware)
+    if (publishBlocked && execText && isBlockedCommand(execText) && !approved) {
+        return { blocked: true, reason: 'publish blocked without APPROVED: pnpm publish requires approval' };
+    }
+    // 4) Block maestro file tools outside cwd (toggle-aware)
+    const fileTools = new Set(['maestro_read_file', 'maestro_write_file', 'fs_read', 'fs_write', 'read_file', 'write_file']);
+    if (cwdContainment && cwd && fileTools.has(tool)) {
+        let pathVal;
+        if (typeof args === 'object' && args !== null) {
+            const a = args;
+            // common keys
+            pathVal = a.path ?? a.file ?? a.file_path ?? a.filePath;
+            // array-like args: {0: 'path'}
+            if (!pathVal && typeof a[0] === 'string')
+                pathVal = a[0];
+            // if args itself has nested command with path
+            if (!pathVal && typeof a.command === 'string') {
+                // command may contain path; fallback to blocked path check already done, but also cwd check if command contains path
+                // no explicit path to check
+            }
+        }
+        else if (typeof args === 'string') {
+            pathVal = args;
+        }
+        if (pathVal) {
+            if (isBlockedPath(pathVal, credentialPaths)) {
+                return { blocked: true, reason: `credential path blocked: ${pathVal}` };
+            }
+            if (isOutsideCwd(pathVal, cwd)) {
+                return { blocked: true, reason: `path outside cwd: ${pathVal} not in ${cwd}` };
+            }
+        }
+    }
+    // Also check generic exec/bash tool with cwd containment if it looks like a file path arg
+    // (optional: not strictly required for credential/publish but supports broader sandbox)
+    if (cwd && (tool === 'exec' || tool === 'bash' || tool === 'shell')) {
+        // already covered publish; for credential path we already blocked above via substring
+        // No additional cwd check for shell commands unless they are obvious file paths
+    }
+    return { blocked: false };
+}
+/**
+ * Simple guard per task 5 snippet: guard(p) => false if blocked, true if allowed.
+ * For publish, second arg approved indicates APPROVED.
+ */
+export function guard(p, approved) {
+    if (!p || typeof p !== 'string')
+        return true;
+    if (isBlockedPath(p))
+        return false;
+    if (isBlockedCommand(p) && !approved)
+        return false;
+    return true;
+}
+export const sandbox = { isBlockedPath, isBlockedCommand, isBlockedGitCommand, isPublishBlocked, isOutsideCwd, checkSandbox, guard };
+//# sourceMappingURL=sandbox.js.map

package/lib/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/host/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEpD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9D,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAChE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,eAA0B;IACrE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,6FAA6F;IAC7F,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IAE5E,yCAAyC;IACzC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC5D,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhG,sFAAsF;IACtF,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAQ;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YAClB,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAChB,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACpC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAA;YAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B,EAAE,GAAuB;IACvF,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,IAAI,SAAS,CAAA;IAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxE,MAAM,EAAE,GAAG,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/B,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IACjC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9D,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA2B,EAC3B,UAA8B,EAC9B,QAA6C;IAE7C,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAA;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAgC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9F,OAAQ,IAAgC,CAAC,OAAiB,CAAA;IAC5D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,gGAAgG;AAChG,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACjD,yDAAyD;IACzD,OAAO,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,aAAsB,EAAE,QAAmB;IAC1F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,iBAAiB,GAAG,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACzF,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC3D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5C,2CAA2C;QAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClD,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,uCAAuC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;YACzF,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;QACjC,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;gBAC9B,IAAI,IAAI,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;YAClE,CAAC;YACD,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC3C,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC3E,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAA;gBAC5C,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,OAAO,IAAI,CAAA;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,QAAiB;IAC7D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,CAAC,QAAQ,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACjC,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,KAAK,CAAA;IAChD,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAA;AACtD,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAa,EACb,IAAuB;IAEvB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAA;IACrB,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAA;IACzC,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,CAAA;IAC7C,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAA;IACzC,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAA;IACnD,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,IAAI,CAAA;IAEnD,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3F,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,EAAE,IAAI,MAAM,EAAE,CAAA;IAC1C,4EAA4E;IAC5E,8EAA8E;IAC9E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAEzC,+EAA+E;IAC/E,IAAI,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;QAC/H,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAA;IACtH,CAAC;IAED,wFAAwF;IACxF,MAAM,UAAU,GAAG,aAAa,EAAE,OAAO,IAAI,IAAI,CAAA;IACjD,MAAM,QAAQ,GAAG,aAAa,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9D,IAAI,UAAU,IAAI,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,oDAAoD,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IACjH,CAAC;IAED,mDAAmD;IACnD,IAAI,cAAc,IAAI,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAA;IACtG,CAAC;IAED,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;IACxH,IAAI,cAAc,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,OAA2B,CAAA;QAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAA+B,CAAA;YACzC,cAAc;YACd,OAAO,GAAI,CAAC,CAAC,IAAe,IAAK,CAAC,CAAC,IAAe,IAAK,CAAC,CAAC,SAAoB,IAAK,CAAC,CAAC,QAAmB,CAAA;YACvG,+BAA+B;YAC/B,IAAI,CAAC,OAAO,IAAI,OAAQ,CAAS,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAI,CAAS,CAAC,CAAC,CAAW,CAAA;YACpF,8CAA8C;YAC9C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC9C,qHAAqH;gBACrH,4BAA4B;YAC9B,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,OAAO,EAAE,EAAE,CAAA;YACzE,CAAC;YACD,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,OAAO,WAAW,GAAG,EAAE,EAAE,CAAA;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,wFAAwF;IACxF,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACpE,sFAAsF;QACtF,gFAAgF;IAClF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,CAAS,EAAE,QAAkB;IACjD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5C,IAAI,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAClD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA"}

package/lib/secret-redactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../src/secret-redactor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAKpC,CAAA;AACD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AACD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3C"}
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../src/host/secret-redactor.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAKpC,CAAA;AACD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AACD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3C"}

package/lib/secret-redactor.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../src/secret-redactor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;CAC5B,CAAA;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAAC,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC;QAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAAC,CAAC;IACvF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../src/host/secret-redactor.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,2BAA2B;IAC3B,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;CAC5B,CAAA;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;AAC3E,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAAC,CAAC,CAAC,SAAS,GAAC,CAAC,CAAC;QAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAAC,CAAC;IACvF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@ddtcorex/dsh-maestro-guard",
-  "version": "0.1.0",
+  "version": "0.2.0",
+  "private": false,
   "description": "Maestro Guard — waterfall tools/pre-execute approval + blocklist stub (Phase A scaffold)",
   "type": "module",
   "main": "./lib/index.js",
@@ -20,11 +21,15 @@
       "patch": "./cordis.patch.yml"
     }
   },
+  "dependencies": {
+    "@ddtcorex/dsh-maestro-config-lib": "^0.1.2"
+  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-alpha.2",
     "typescript": "^5.8.0",
     "vitest": "^2.0.0",
     "@types/node": "^22.0.0"

package/src/host/approve-tool.ts

@@ -0,0 +1,61 @@
+import type { Context } from '@deepseek-ai/cordis'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import type { PendingRequest, PendingStore } from './pending.js'
+
+export const name = 'maestro-guard-approve-tools'
+export const inject = ['tools'] as const
+
+export interface ApproveResult { ok: boolean; requestId: string; scope: string; status: string; message?: string }
+export interface ListResult { ok: true; requests: PendingRequest[] }
+
+export function createApproveTools(deps: { pending: PendingStore }) {
+  return {
+    async approve(requestId: string): Promise<ApproveResult> {
+      if (typeof requestId !== 'string' || requestId.length === 0) {
+        return { ok: false, requestId: '', scope: '', status: 'error', message: 'requestId (string) is required' }
+      }
+      const req = await deps.pending.approve(requestId)
+      if (!req) {
+        return { ok: false, requestId, scope: '', status: 'error', message: `no pending request with id ${requestId}` }
+      }
+      return { ok: true, requestId: req.id, scope: req.scope, status: req.status }
+    },
+    async list(): Promise<ListResult> {
+      return { ok: true, requests: await deps.pending.list() }
+    },
+  }
+}
+
+export function applyApproveTools(ctx: Context, deps: { pending: PendingStore }): void {
+  const tools = createApproveTools(deps)
+  ctx.effect(() => ctx.tools.register(defineTool({
+    name: 'maestro_guard_approve',
+    description: 'Approve one recorded guard request so its exact blocked operation may run once. Call after the human approves the operation in the conversation.',
+    parameters: { requestId: { type: 'string', description: 'the request id from the guard block message or maestro_guard_list' } },
+    output: {
+      schema: {
+        type: 'object', additionalProperties: true,
+        properties: { ok: { type: 'boolean', required: true }, requestId: { type: 'string', required: true }, scope: { type: 'string', required: true }, status: { type: 'string', required: true }, message: { type: 'string' } },
+      },
+      render: (_a: unknown, v: any) => [{ type: 'text', text: v.ok ? `approved request ${v.requestId} (scope ${v.scope})` : `approve failed: ${v.message ?? v.status}` }],
+    },
+    async execute(args: any) {
+      return tools.approve((args as any)?.requestId) as any
+    },
+  })))
+  ctx.effect(() => ctx.tools.register(defineTool({
+    name: 'maestro_guard_list',
+    description: 'List guard tickets (pending/approved/consumed) with redacted commands. Read-only.',
+    parameters: {},
+    output: {
+      schema: {
+        type: 'object', additionalProperties: true,
+        properties: { ok: { type: 'boolean', required: true }, requests: { type: 'array', required: true, items: { type: 'object', additionalProperties: true } } },
+      },
+      render: (_a: unknown, v: any) => [{ type: 'text', text: (v.requests ?? []).map((r: any) => `${r.status} ${r.id} ${r.scope} @${r.requestedAt} ${String(r.command ?? '').slice(0, 80)}`).join('\n') || 'no guard requests' }],
+    },
+    async execute() {
+      return tools.list() as any
+    },
+  })))
+}

package/src/host/full-scan-tool.ts

@@ -0,0 +1,71 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { resolve, join } from 'node:path'
+import type { Context } from '@deepseek-ai/cordis'
+import { defineTool } from '@deepseek-ai/dsh-tools'
+export const name = 'maestro-full-scan-tool'
+export const inject = ['tools'] as const
+function workspaceRootFor(c:string|undefined, e:unknown): string {
+  if (c) return c
+  const cwd=(e as any)?.agent?.session?.header?.cwd
+  return typeof cwd==='string'&&cwd?cwd:process.cwd()
+}
+function resolveScript(root:string): string {
+  const direct = join(root, 'scripts/enforce-rules.mjs')
+  if (existsSync(direct)) return direct
+  // fallback: walk up from root and from process.cwd() to find workspace root containing scripts/enforce-rules.mjs
+  const candidates: string[] = []
+  // try ancestors of root
+  let cur = resolve(root)
+  for (let i=0;i<8;i++) {
+    const cand = join(cur, 'scripts/enforce-rules.mjs')
+    if (existsSync(cand)) return cand
+    candidates.push(cand)
+    const parent = resolve(cur, '..')
+    if (parent===cur) break
+    cur = parent
+  }
+  // try ancestors of process.cwd()
+  cur = process.cwd()
+  for (let i=0;i<8;i++) {
+    const cand = join(cur, 'scripts/enforce-rules.mjs')
+    if (existsSync(cand)) return cand
+    const parent = resolve(cur, '..')
+    if (parent===cur) break
+    cur = parent
+  }
+  // try maestro-harness workspace root resolved via __dirname ancestor search for packages/dsh-maestro-guard
+  // last resort: return direct (will error but report will contain command)
+  return direct
+}
+export function apply(ctx: Context, config:{rootPath?:string}={}) {
+  ctx.effect(()=> ctx.tools.register(defineTool({
+    name:'maestro_full_scan',
+    description:'Run full enforce-rules scan (blacklist + protection + publish gate) and return report. No approval needed; read-only.',
+    parameters:{ rootPath:{type:'string', description:'workspace root override'} },
+    output:{ schema:{type:'object', additionalProperties:true, properties:{ok:{type:'boolean', required:true}, report:{type:'string', required:true}, code:{type:'number', required:true}}}, render:(_a:any,v:any)=>[{type:'text', text: v.report.slice(0,4000)}] },
+    async execute(args:any, exec:unknown) {
+      const root = workspaceRootFor((args as any)?.rootPath ?? config.rootPath, exec)
+      const script = resolveScript(root)
+      if (!existsSync(script)) {
+        return {ok: true, report: `enforce-rules: no script found at ${script} (standalone repo, skipping)`, code: 0}
+      }
+      const run = (extra:string[])=>{
+        const r=spawnSync('node', [script, ...extra], {encoding:'utf-8', timeout: 30000})
+        return {code: r.status??0, out: (r.stdout??'')+(r.stderr??'')}
+      }
+      let combined=''
+      let ok=true
+      const a=run([])
+      combined+=`$ node scripts/enforce-rules.mjs\n${a.out}\n`
+      if (a.code!==0) ok=false
+      const b=run(['--check-protection'])
+      combined+=`$ node scripts/enforce-rules.mjs --check-protection\n${b.out}\n`
+      if (b.code!==0) combined+=`[warn] --check-protection non-zero (may need gh auth)\n`
+      const c=run(['--check-publish'])
+      combined+=`$ node scripts/enforce-rules.mjs --check-publish\n${c.out}\n`
+      // do not fail on --check-publish when no tag
+      return {ok, report: combined.slice(0,12000), code: ok?0:1}
+    }
+  })))
+}