@fusengine/harness 0.1.43 → 0.1.45

package/dist/adapters/claude/index.d.mts

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as toClaudeResponse, i as denyResponse, n as blockResponse, o as guard, r as contextResponse, s as readClaudeInput, t as ClaudeHookInput } from "../../index-CwOdFBOr.mjs";
-export { ClaudeHookInput, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, readClaudeInput, toClaudeResponse };
+import { a as fileSizeGuard, c as systemMessage, i as denyResponse, l as toClaudeResponse, n as blockResponse, o as guard, r as contextResponse, s as readClaudeInput, t as ClaudeHookInput } from "../../index-BxjzFraL.mjs";
+export { ClaudeHookInput, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as guard, i as fileSizeGuard, n as contextResponse, o as readClaudeInput, r as denyResponse, s as toClaudeResponse, t as blockResponse } from "../../claude-CeRYMOaG.mjs";
-export { blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, readClaudeInput, toClaudeResponse };
+import { a as guard, c as toClaudeResponse, i as fileSizeGuard, n as contextResponse, o as readClaudeInput, r as denyResponse, s as systemMessage, t as blockResponse } from "../../claude-DLh0fHWM.mjs";
+export { blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
+import { t as evaluate } from "../../evaluate-d7Pp8XJH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.d.mts

@@ -1,2 +1,2 @@
-import { i as denyResponse, o as guard, r as contextResponse, s as readClaudeInput, t as ClaudeHookInput } from "../../index-CwOdFBOr.mjs";
+import { i as denyResponse, o as guard, r as contextResponse, s as readClaudeInput, t as ClaudeHookInput } from "../../index-BxjzFraL.mjs";
 export { type ClaudeHookInput as CodexHookInput, contextResponse, denyResponse, guard, readClaudeInput as readCodexInput };

package/dist/adapters/codex/index.mjs

@@ -1,2 +1,2 @@
-import { a as guard, n as contextResponse, o as readClaudeInput, r as denyResponse } from "../../claude-CeRYMOaG.mjs";
+import { a as guard, n as contextResponse, o as readClaudeInput, r as denyResponse } from "../../claude-DLh0fHWM.mjs";
 export { contextResponse, denyResponse, guard, readClaudeInput as readCodexInput };

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
+import { t as evaluate } from "../../evaluate-d7Pp8XJH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-CeivW6G0.mjs";
+import { t as evaluate } from "../../evaluate-d7Pp8XJH.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/cache/index.d.mts

@@ -1,2 +1,2 @@
-import { a as mcpCacheKey, c as extractText, d as summarizeIndex, f as compactMarkdown, i as cacheStore, l as IndexSummary, m as queryHash, n as cacheLookupSubstring, o as mcpCacheWrite, p as jaccardSimilar, r as cachePath, s as webfetchCacheWrite, t as cacheLookup, u as loadIndex } from "../index-BX-xcvhY.mjs";
-export { IndexSummary, cacheLookup, cacheLookupSubstring, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };
+import { _ as queryHash, a as cacheLookupSubstringMeta, c as mcpCacheKey, d as extractText, f as IndexSummary, g as jaccardSimilar, h as compactMarkdown, i as cacheLookupSubstring, l as mcpCacheWrite, m as summarizeIndex, n as cacheLookup, o as cachePath, p as loadIndex, r as cacheLookupMeta, s as cacheStore, t as CacheHit, u as webfetchCacheWrite } from "../index-BUwEmIK-.mjs";
+export { CacheHit, IndexSummary, cacheLookup, cacheLookupMeta, cacheLookupSubstring, cacheLookupSubstringMeta, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };

package/dist/cache/index.mjs

@@ -1,3 +1,3 @@
-import { a as cachePath, c as extractText, d as compactMarkdown, f as jaccardSimilar, i as cacheLookupSubstring, l as loadIndex, n as webfetchCacheWrite, o as cacheStore, p as queryHash, r as cacheLookup, s as mcpCacheKey, t as mcpCacheWrite, u as summarizeIndex } from "../mcp-store-CnsW9oFj.mjs";
+import { a as cacheLookupSubstring, c as cacheStore, d as loadIndex, f as summarizeIndex, h as queryHash, i as cacheLookupMeta, l as mcpCacheKey, m as jaccardSimilar, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, p as compactMarkdown, r as cacheLookup, s as cachePath, t as mcpCacheWrite, u as extractText } from "../mcp-store-BkBDmuxN.mjs";
 import "../cache-la_KkjCS.mjs";
-export { cacheLookup, cacheLookupSubstring, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };
+export { cacheLookup, cacheLookupMeta, cacheLookupSubstring, cacheLookupSubstringMeta, cachePath, cacheStore, compactMarkdown, extractText, jaccardSimilar, loadIndex, mcpCacheKey, mcpCacheWrite, queryHash, summarizeIndex, webfetchCacheWrite };

package/dist/{claude-CeRYMOaG.mjs → claude-DLh0fHWM.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CeivW6G0.mjs";
+import { t as evaluate } from "./evaluate-d7Pp8XJH.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
@@ -116,6 +116,10 @@ function contextResponse(event, text) {
 		additionalContext: text
 	} });
 }
+/** A raw `systemMessage` notice — shown to the user without blocking the tool. Mirrors the shared Python `hook_output.allow_pass`/`post_pass` convention. */
+function systemMessage(text) {
+	return JSON.stringify({ systemMessage: text });
+}
 /**
 * Render a portable {@link Prompt} as a Claude Code hook response:
 * `block` → `permissionDecision: deny`, `ask` → `permissionDecision: ask`
@@ -148,4 +152,4 @@ function guard(input) {
 /** @deprecated use {@link guard}. Kept for back-compat. */
 const fileSizeGuard = guard;
 //#endregion
-export { guard as a, collectFiles as c, sleep as d, spawnCapture as f, fileSizeGuard as i, pathExists as l, contextResponse as n, readClaudeInput as o, writeText as p, denyResponse as r, toClaudeResponse as s, blockResponse as t, readText as u };
+export { guard as a, toClaudeResponse as c, readText as d, sleep as f, fileSizeGuard as i, collectFiles as l, writeText as m, contextResponse as n, readClaudeInput as o, spawnCapture as p, denyResponse as r, systemMessage as s, blockResponse as t, pathExists as u };

package/dist/cli/bin.mjs

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
-import { r as resolveTtlSec } from "../ttl-BG55s6HZ.mjs";
-import { r as loadDotenv } from "../dotenv-DGyLln7U.mjs";
+import { r as loadDotenv, s as resolveTtlSec } from "../dotenv-B9nM4cuQ.mjs";
 import { t as detectHarness } from "../harness-C8Nxxyn_.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-jgivVDv6.mjs";
+import { t as claudeHome } from "../home-state-mKZxP4oZ.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DLXtA5DH.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { f as claudeHome } from "../store-CdWOQ9zD.mjs";
-import { Ot as todayUtc, t as handleHook } from "../handle-BTHcKWQ5.mjs";
+import { Mt as todayUtc, t as handleHook } from "../handle-DJaaD2BT.mjs";
 import { delimiter, dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -78,6 +77,222 @@ async function scanChangelog(now = Date.now(), home = homedir()) {
 	};
 }
 //#endregion
+//#region src/runtime/lifecycle/security/scan-patterns.ts
+/** OWASP scan patterns keyed by detected language (ported 1:1 from Python). */
+const PATTERNS = {
+	javascript: [
+		{
+			severity: "HIGH",
+			category: "XSS",
+			regex: /innerHTML\s*=/,
+			glob: "*.js"
+		},
+		{
+			severity: "HIGH",
+			category: "XSS",
+			regex: /dangerouslySetInnerHTML/,
+			glob: "*.js"
+		},
+		{
+			severity: "CRITICAL",
+			category: "CODE_EXEC",
+			regex: /eval\(/,
+			glob: "*.js"
+		},
+		{
+			severity: "CRITICAL",
+			category: "CODE_EXEC",
+			regex: /new Function\(/,
+			glob: "*.js"
+		},
+		{
+			severity: "CRITICAL",
+			category: "CMD_INJECTION",
+			regex: /child_process/,
+			glob: "*.js"
+		},
+		{
+			severity: "HIGH",
+			category: "CMD_INJECTION",
+			regex: /shell:\s*true/,
+			glob: "*.js"
+		},
+		{
+			severity: "MEDIUM",
+			category: "WEAK_CRYPTO",
+			regex: /Math\.random\(\)/,
+			glob: "*.js"
+		},
+		{
+			severity: "CRITICAL",
+			category: "SECRETS",
+			regex: /AKIA[0-9A-Z]{16}/,
+			glob: "*.js"
+		}
+	],
+	php: [
+		{
+			severity: "CRITICAL",
+			category: "RCE",
+			regex: /shell_exec|system\(|passthru\(/,
+			glob: "*.php"
+		},
+		{
+			severity: "CRITICAL",
+			category: "CODE_EXEC",
+			regex: /eval\(|assert\(/,
+			glob: "*.php"
+		},
+		{
+			severity: "HIGH",
+			category: "SQL_INJECTION",
+			regex: /mysql_query\(/,
+			glob: "*.php"
+		}
+	],
+	python: [
+		{
+			severity: "CRITICAL",
+			category: "CODE_EXEC",
+			regex: /eval\(|exec\(/,
+			glob: "*.py"
+		},
+		{
+			severity: "CRITICAL",
+			category: "CMD_INJECTION",
+			regex: /os\.system\(|subprocess.*shell=True/,
+			glob: "*.py"
+		},
+		{
+			severity: "HIGH",
+			category: "DESERIALIZATION",
+			regex: /pickle\.loads\(/,
+			glob: "*.py"
+		},
+		{
+			severity: "HIGH",
+			category: "TLS",
+			regex: /verify=False|ssl\.CERT_NONE/,
+			glob: "*.py"
+		}
+	],
+	swift: [
+		{
+			severity: "HIGH",
+			category: "INSECURE_STORAGE",
+			regex: /UserDefaults.*password|token|secret/,
+			glob: "*.swift"
+		},
+		{
+			severity: "MEDIUM",
+			category: "INSECURE_HTTP",
+			regex: /"http:\/\//,
+			glob: "*.swift"
+		},
+		{
+			severity: "HIGH",
+			category: "WEAK_KEYCHAIN",
+			regex: /kSecAttrAccessibleAlways/,
+			glob: "*.swift"
+		}
+	]
+};
+/** Return the scan patterns for a language ("" / go / rust / unknown → none). */
+function getPatterns(lang) {
+	return PATTERNS[lang] ?? [];
+}
+//#endregion
+//#region src/runtime/lifecycle/security/scan.ts
+/**
+* @module security/scan
+* OWASP vulnerability scanner. Ports the Python `security-scan.py`: detect the
+* project language, walk source files (excluding vendored/build dirs), match the
+* per-language {@link getPatterns} rules, and aggregate a JSON report. Invoked by
+* the `harness scan` CLI command (skill `/fuse-security:scan`), NOT a hook.
+* @packageDocumentation
+*/
+const EXCLUDE_RE = /(^|\/)(node_modules|vendor|\.git|dist|build)(\/|$)/;
+const LANG_FILES = [
+	["package.json", "javascript"],
+	["composer.json", "php"],
+	["requirements.txt", "python"],
+	["pyproject.toml", "python"],
+	["Package.swift", "swift"],
+	["go.mod", "go"],
+	["Cargo.toml", "rust"]
+];
+/** Detect the project language from its config files (first match wins). */
+function detectLanguage(dir) {
+	for (const [file, lang] of LANG_FILES) if (existsSync(join(dir, file))) return lang;
+	return "unknown";
+}
+/** Recursively collect files whose name ends with `ext`, skipping vendored dirs. */
+function collectFiles(dir, ext, out = []) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return out;
+	}
+	for (const e of entries) {
+		const full = join(dir, e.name);
+		if (EXCLUDE_RE.test(full)) continue;
+		if (e.isDirectory()) collectFiles(full, ext, out);
+		else if (e.name.endsWith(ext)) out.push(full);
+	}
+	return out;
+}
+/** Apply one pattern to every matching file and collect line-level findings. */
+function scanPattern(dir, p) {
+	const ext = p.glob.replace(/^\*/, "");
+	const findings = [];
+	for (const file of collectFiles(dir, ext)) {
+		let text;
+		try {
+			text = readFileSync(file, "utf8");
+		} catch {
+			continue;
+		}
+		text.split("\n").forEach((line, i) => {
+			if (p.regex.test(line)) findings.push({
+				severity: p.severity,
+				category: p.category,
+				pattern: p.regex.source,
+				file,
+				line: i + 1
+			});
+		});
+	}
+	return findings;
+}
+/** Run the OWASP scan over `dir` and return the aggregated {@link ScanReport}. */
+function runSecurityScan(dir) {
+	const language = detectLanguage(dir);
+	const counts = {
+		critical: 0,
+		high: 0,
+		medium: 0,
+		low: 0
+	};
+	const findings = [];
+	for (const p of getPatterns(language)) {
+		const hits = scanPattern(dir, p);
+		findings.push(...hits);
+		const key = p.severity.toLowerCase();
+		counts[key] = (counts[key] ?? 0) + hits.length;
+	}
+	const total = Object.values(counts).reduce((a, b) => a + b, 0);
+	return {
+		language,
+		directory: dir,
+		summary: {
+			...counts,
+			total
+		},
+		findings
+	};
+}
+//#endregion
 //#region src/refs/discover.ts
 /** Immediate subdirectory names of `p`, or `[]` when it is missing/inaccessible. */
 function subdirs(p) {
@@ -264,7 +479,8 @@ if (cmd === "--version" || cmd === "-v") {
 		"aipilot",
 		"lessons",
 		"seo",
-		"memory"
+		"memory",
+		"tailwindcss"
 	])).has(scopeArg) ? scopeArg : "core";
 	const marketplaces = (process.env.FUSE_HARNESS_MARKETPLACES ?? "fusengine-plugins").split(",").map((s) => s.trim()).filter(Boolean);
 	const refsDir = process.env.FUSE_HARNESS_REFS || discoverRefs(homedir(), process.cwd(), marketplaces) || void 0;
@@ -297,7 +513,11 @@ if (cmd === "--version" || cmd === "-v") {
 	}) + "\n");
 	process.exit(1);
 }
-else {
+else if (cmd === "scan") {
+	const dir = process.argv[3] ?? process.cwd();
+	process.stdout.write(JSON.stringify(runSecurityScan(dir), null, 2) + "\n");
+	process.exit(0);
+} else {
 	const files = stagedFiles();
 	if (files.length === 0) process.exit(0);
 	const violations = checkStaged(files, stagedContent);

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-jgivVDv6.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DLXtA5DH.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/config/index.d.mts

@@ -1,2 +1,2 @@
-import { _ as parseEnvInt, a as ProjectLayout, c as projectLayout, d as resolveMaxLines, f as splitTarget, g as ttlLabel, h as resolveTtlSec, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as TTL_ENV_KEY, n as envCandidates, o as STATE_GITIGNORE, p as DEFAULT_TTL_SEC, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as MAX_LINES_ENV_KEY } from "../index-DXQfL1u8.mjs";
+import { _ as parseEnvInt, a as ProjectLayout, c as projectLayout, d as resolveMaxLines, f as splitTarget, g as ttlLabel, h as resolveTtlSec, i as parseEnvFile, l as DEFAULT_MAX_LINES, m as TTL_ENV_KEY, n as envCandidates, o as STATE_GITIGNORE, p as DEFAULT_TTL_SEC, r as loadDotenv, s as STATE_ROOT, t as HOME_DIR, u as MAX_LINES_ENV_KEY } from "../index-BXPySPxE.mjs";
 export { DEFAULT_MAX_LINES, DEFAULT_TTL_SEC, HOME_DIR, MAX_LINES_ENV_KEY, ProjectLayout, STATE_GITIGNORE, STATE_ROOT, TTL_ENV_KEY, envCandidates, loadDotenv, parseEnvFile, parseEnvInt, projectLayout, resolveMaxLines, resolveTtlSec, splitTarget, ttlLabel };

package/dist/config/index.mjs

@@ -1,6 +1,5 @@
 import { a as parseEnvInt, i as splitTarget, n as MAX_LINES_ENV_KEY, r as resolveMaxLines, t as DEFAULT_MAX_LINES } from "../limits-CHn8AIL1.mjs";
-import { i as ttlLabel, n as TTL_ENV_KEY, r as resolveTtlSec, t as DEFAULT_TTL_SEC } from "../ttl-BG55s6HZ.mjs";
+import { a as DEFAULT_TTL_SEC, c as ttlLabel, i as parseEnvFile, n as envCandidates, o as TTL_ENV_KEY, r as loadDotenv, s as resolveTtlSec, t as HOME_DIR } from "../dotenv-B9nM4cuQ.mjs";
 import { n as STATE_ROOT, r as projectLayout, t as STATE_GITIGNORE } from "../layout-C0jaaCQC.mjs";
-import { i as parseEnvFile, n as envCandidates, r as loadDotenv, t as HOME_DIR } from "../dotenv-DGyLln7U.mjs";
 import "../config-la_KkjCS.mjs";
 export { DEFAULT_MAX_LINES, DEFAULT_TTL_SEC, HOME_DIR, MAX_LINES_ENV_KEY, STATE_GITIGNORE, STATE_ROOT, TTL_ENV_KEY, envCandidates, loadDotenv, parseEnvFile, parseEnvInt, projectLayout, resolveMaxLines, resolveTtlSec, splitTarget, ttlLabel };

package/dist/{doc-helpers-D14nkD5D.d.mts → doc-helpers-BNfYWvYv.d.mts}

@@ -22,7 +22,15 @@ interface DocSatisfactionStatus {
   web: boolean;
   viaCache: boolean;
 }
-/** True when ANY documentation source (Context7, Exa, or web) was satisfied for the session. */
+/**
+* True when documentation research is satisfied for the session. Primary path
+* is parity with the Python `mcp_research_done`
+* (`_shared/scripts/check_skill_common.py`): `"context7:" in content and
+* "exa:" in content`, a strict AND (the Python source has no web-alone path).
+* `web` (WebSearch/WebFetch/fuse-browser) is a deliberate TS-side addition —
+* it alone satisfies the gate, since fuse-browser is this harness's preferred
+* doc-research fast-path (see CLAUDE.md) and Context7/Exa can be unavailable.
+*/
 declare function isDocConsulted(authorizations: Record<string, AuthEntry> | undefined, sessionId: string): boolean;
 /** Report how each doc source was satisfied for a session. */
 declare function formatDocSatisfactionStatus(authorizations: Record<string, AuthEntry> | undefined, sessionId: string): DocSatisfactionStatus;

package/dist/{doc-helpers-BhzDmJ18.mjs → doc-helpers-CWZegVdR.mjs}

@@ -23,10 +23,18 @@ function evaluateDoc(auths) {
 		viaCache: !liveC7 && cacheC7 || !liveExa && cacheExa
 	};
 }
-/** True when ANY documentation source (Context7, Exa, or web) was satisfied for the session. */
+/**
+* True when documentation research is satisfied for the session. Primary path
+* is parity with the Python `mcp_research_done`
+* (`_shared/scripts/check_skill_common.py`): `"context7:" in content and
+* "exa:" in content`, a strict AND (the Python source has no web-alone path).
+* `web` (WebSearch/WebFetch/fuse-browser) is a deliberate TS-side addition —
+* it alone satisfies the gate, since fuse-browser is this harness's preferred
+* doc-research fast-path (see CLAUDE.md) and Context7/Exa can be unavailable.
+*/
 function isDocConsulted(authorizations, sessionId) {
 	const s = evaluateDoc(sessionAuthsFor(authorizations, sessionId));
-	return s.context7 || s.exa || s.web;
+	return s.context7 && s.exa || s.web;
 }
 /** Report how each doc source was satisfied for a session. */
 function formatDocSatisfactionStatus(authorizations, sessionId) {
@@ -35,9 +43,10 @@ function formatDocSatisfactionStatus(authorizations, sessionId) {
 /** Deny message when online documentation has not been consulted. */
 function formatDocDeny(framework) {
 	return [
-		`APEX: Online documentation not consulted for ${framework}!`,
-		"Use ANY ONE of: mcp__context7__query-docs, mcp__exa__web_search_exa (or — if Exa is down — mcp__fuse-browser__browser_fetch / browser_crawl / browser_serp_batch), WebSearch, or WebFetch.",
-		"This check is once per session — after consulting one source, Write/Edit will be allowed."
+		`BLOCKED: No MCP research done for ${framework}. Use BOTH:`,
+		"1) mcp__context7__query-docs AND 2) mcp__exa__web_search_exa",
+		"— OR a web fallback alone: mcp__fuse-browser__browser_fetch / browser_crawl / browser_serp_batch, WebSearch, or WebFetch.",
+		"This check is once per session — after consulting the required source(s), Write/Edit will be allowed."
 	].join("\n");
 }
 //#endregion

package/dist/{dotenv-DGyLln7U.mjs → dotenv-B9nM4cuQ.mjs}

@@ -1,6 +1,31 @@
+import { a as parseEnvInt } from "./limits-CHn8AIL1.mjs";
 import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
+//#region src/config/ttl.ts
+/**
+* Default enforcement-freshness window, in seconds (2 minutes). Matches the
+* plugin's original `FUSE_ENFORCE_TTL_SEC` default. This is the constant that
+* actually reaches production (via `resolveTtlSec` -> `bin.ts`); `gate.ts`'s
+* `DEFAULT_WINDOW_MS` is only a fallback for direct programmatic callers that
+* omit `windowMs` (e.g. tests) and never applies on the real CLI path.
+*/
+const DEFAULT_TTL_SEC = 120;
+/** Default env var name carrying the TTL override. */
+const TTL_ENV_KEY = "FUSE_ENFORCE_TTL_SEC";
+/**
+* Resolve the enforcement TTL (seconds) from an env map.
+* @param env - environment map (defaults to `process.env`)
+* @param key - env var name (defaults to `FUSE_ENFORCE_TTL_SEC`)
+*/
+function resolveTtlSec(env = process.env, key = TTL_ENV_KEY) {
+	return parseEnvInt(env[key], 120);
+}
+/** Human label for a TTL: 120 -> "2min", 240 -> "4min", 90 -> "90s". */
+function ttlLabel(sec) {
+	return sec % 60 === 0 ? `${sec / 60}min` : `${sec}s`;
+}
+//#endregion
 //#region src/config/dotenv.ts
 /**
 * Native .env loader. Ports the claude-plugins `services/env-file.ts`
@@ -52,4 +77,4 @@ function loadDotenv(id, env = process.env, home = homedir(), cwd = process.cwd()
 	for (const path of envCandidates(id, home, cwd)) for (const [k, v] of Object.entries(parseEnvFile(path))) if (env[k] === void 0) env[k] = v;
 }
 //#endregion
-export { parseEnvFile as i, envCandidates as n, loadDotenv as r, HOME_DIR as t };
+export { DEFAULT_TTL_SEC as a, ttlLabel as c, parseEnvFile as i, envCandidates as n, TTL_ENV_KEY as o, loadDotenv as r, resolveTtlSec as s, HOME_DIR as t };