@posthog/wizard 2.38.2 → 2.39.0

package/dist/yara-hooks-DNn1Jqih.js

@@ -0,0 +1,635 @@
+import { f as getUI, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-BZnZ7Gvh.js";
+import { n as analytics } from "./analytics-C7Oc3yWZ.js";
+import { r as AUDIT_REPORT_FILE } from "./types-evL_rPob.js";
+import fs from "fs";
+import path from "path";
+import fg from "fast-glob";
+import { createHash } from "crypto";
+//#region src/lib/skill-install.ts
+/**
+* Check if command is a PostHog skill installation from MCP.
+* We control the MCP server, so we only need to verify:
+* 1. It installs to .claude/skills/
+* 2. It downloads from our GitHub releases or localhost (dev)
+*
+* Extracted to its own module to avoid a circular dependency
+* between agent-interface.ts and yara-hooks.ts.
+*/
+function isSkillInstallCommand(command) {
+	if (!command.startsWith("mkdir -p .claude/skills/")) return false;
+	const urlMatch = command.match(/curl -sL ['"]([^'"]+)['"]/);
+	if (!urlMatch) return false;
+	const url = urlMatch[1];
+	return url.startsWith("https://github.com/PostHog/context-mill/releases/") || /^http:\/\/localhost:\d+\//.test(url);
+}
+//#endregion
+//#region src/lib/programs/events-audit/constants.ts
+/**
+* Leaf-level constants for the events-audit program.
+*
+* Kept separate from `index.ts` so files like `yara-hooks.ts` can import
+* the filename constants without dragging in `index.ts`'s heavier imports
+* (agent-runner, audit/seed, etc.) — which can create import cycles.
+*/
+const SETUP_REPORT_FILE = "posthog-events-audit-report.md";
+const EVENT_INVENTORY_FILE = ".posthog-events-inventory.json";
+/** Per-part filename pattern emitted by events-audit subagents (e.g. `.posthog-events-inventory.part-3.json`). */
+const EVENT_INVENTORY_PART_PATTERN = /^\.posthog-events-inventory\.part-\d+\.json$/;
+//#endregion
+//#region src/lib/programs/posthog-integration/constants.ts
+/**
+* Leaf-level constants for the posthog-integration program.
+*
+* Kept separate from `index.ts` so files like `yara-hooks.ts` can import
+* the filename constants without dragging in `index.ts`'s heavier imports
+* (agent-interface, framework-config, etc.) — which would create an import
+* cycle through agent-interface → yara-hooks.
+*/
+const EVENT_PLAN_FILE = ".posthog-events.json";
+//#endregion
+//#region src/lib/yara-hooks.ts
+/**
+* YARA hook wiring for the Claude Agent SDK.
+*
+* Creates PreToolUse and PostToolUse hook callback arrays that integrate the
+* real @posthog/warlock security scanner (YARA-X via WASM) into the wizard's
+* agent loop. These hooks are registered in the SDK's query() options alongside
+* the existing Stop hook.
+*
+* PreToolUse hooks block dangerous commands before execution. PostToolUse hooks
+* detect violations in written code and prompt injection in read content, and
+* scan context-mill skill downloads.
+*
+* Warlock owns the rules; this file owns the *policy* — how a match maps to a
+* block / revert / terminate response, plus the optional LLM triage pass that
+* filters false positives before we act.
+*
+* Naming: "yara" is the technique — scanning content against YARA rules — so the
+* wizard-side wiring keeps that name. "warlock" is the engine package that runs
+* the rules. Both names showing up here is intentional.
+*
+* This is Layer 2 (L2) in the wizard's defense-in-depth model, complementing the
+* prompt-based commandments (L0) and the canUseTool() allowlist (L1).
+*/
+let warlockModulePromise = null;
+function getWarlock() {
+	if (!warlockModulePromise) warlockModulePromise = import("@posthog/warlock").catch((err) => {
+		warlockModulePromise = null;
+		throw err;
+	});
+	return warlockModulePromise;
+}
+/**
+* Pay the WASM-init + rule-compile cost up front, off the hook path, so the
+* first real tool-call scan doesn't eat cold-start under a hook timeout.
+* Best-effort: a failure here is non-fatal — hooks still fail closed per scan.
+*/
+async function prewarmYaraScanner() {
+	try {
+		await (await getWarlock()).scan("");
+		logToFile("[YARA] warlock pre-warmed");
+	} catch (err) {
+		logToFile("[YARA] warlock pre-warm failed:", err);
+	}
+}
+let scanCount = 0;
+const scanViolations = [];
+function recordScan() {
+	scanCount++;
+}
+/**
+* Log a match to the run log + PostHog, and record it in the run's scan report.
+* Single entry point so every violation is reported consistently.
+*/
+function recordMatch(phase, tool, match, action) {
+	const triage = match.triage;
+	logYaraMatch(phase, tool, match, action);
+	scanViolations.push({
+		rule: match.rule,
+		severity: match.metadata.severity ?? "unknown",
+		category: match.metadata.category ?? "unknown",
+		action,
+		phase,
+		tool,
+		description: match.metadata.description ?? "",
+		triageVerdict: triage?.verdict,
+		triageReason: triage?.reason
+	});
+}
+/**
+* Scan bookkeeping for harnesses that run a scanner outside these hooks (pi):
+* counts the scan and routes violations through `recordMatch`, so they reach
+* the run log, per-match telemetry, and the end-of-run scan report.
+*/
+function recordExternalScan(phase, tool, violations, action) {
+	recordScan();
+	for (const v of violations) recordMatch(phase, tool, {
+		rule: v.rule,
+		metadata: {
+			severity: v.severity,
+			category: v.category,
+			description: v.description
+		},
+		matchedStrings: []
+	}, action);
+}
+/** Format the scan report summary. Returns null if no scans occurred */
+function formatScanReport() {
+	if (scanCount === 0) return null;
+	const lines = ["", "— YARA Scanner Summary —"];
+	const violationCount = scanViolations.length;
+	const cleanCount = scanCount - violationCount;
+	lines.push(`✓ ${scanCount} tool calls scanned, ${violationCount} violation${violationCount !== 1 ? "s" : ""} detected`);
+	if (violationCount > 0) {
+		lines.push("");
+		for (const v of scanViolations) {
+			const tag = v.action.toUpperCase();
+			lines.push(`  [${tag}] ${v.rule} (${v.severity.toUpperCase()}) — ${v.phase}:${v.tool}`);
+		}
+	}
+	if (cleanCount > 0) {
+		lines.push("");
+		lines.push(`No violations: ✓ ${cleanCount} clean scan${cleanCount !== 1 ? "s" : ""}`);
+	}
+	lines.push("");
+	return lines.join("\n");
+}
+/** Write the scan report to a JSON file. Returns the file path, or null if no scans occurred. */
+function writeScanReport() {
+	if (scanCount === 0) return null;
+	const report = {
+		summary: {
+			totalScans: scanCount,
+			violations: scanViolations.length,
+			clean: scanCount - scanViolations.length
+		},
+		violations: scanViolations
+	};
+	try {
+		fs.writeFileSync(WIZARD_YARA_REPORT_FILE, JSON.stringify(report, null, 2));
+	} catch (err) {
+		logToFile("[YARA] Failed to write scan report:", err);
+		return null;
+	}
+	return WIZARD_YARA_REPORT_FILE;
+}
+const CATEGORY_DESCRIPTIONS = {
+	prompt_injection: "hit hidden instructions in a file it read, a possible attempt to hijack the setup",
+	exfiltration: "tried to send data to an outside location",
+	destructive_operations: "tried to run a destructive command",
+	supply_chain: "tried to pull in untrusted code",
+	posthog_pii: "tried to write personal data (PII) into your project",
+	posthog_hardcoded_key: "tried to hardcode a PostHog key into your project",
+	hardcoded_secret: "tried to hardcode a secret into your project"
+};
+/** Most recent violation that terminated the run, or null. */
+function lastTerminatingViolation() {
+	for (let i = scanViolations.length - 1; i >= 0; i--) if (scanViolations[i].action === "aborted") return scanViolations[i];
+	return null;
+}
+/**
+* Build the user-facing copy for the security abort screen: what the scanner
+* caught and what we did about it. This screen renders only because the run was
+* stopped, so the "what we did" half is constant. Falls back to a generic line
+* when no specific violation was recorded (e.g. the scanner itself errored and
+* failed closed before a match was logged).
+*/
+function formatYaraAbortMessage() {
+	const v = lastTerminatingViolation();
+	return `Security check stopped the setup.
+
+The agent ${(v && CATEGORY_DESCRIPTIONS[v.category]) ?? "did something our security scanner flagged"}. We stopped the run to keep your project safe.\nNo unsafe changes were left in your project.
+
+If this looks wrong, let us know: wizard@posthog.com`;
+}
+/** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */
+const HOOK_TIMEOUT_MS = 3e4;
+/** Timeout for the skill install hook (filesystem I/O + multiple scans) */
+const SKILL_SCAN_HOOK_TIMEOUT_MS = 3e4;
+/**
+* Chunk size for scanning (100 KB). Oversized content is scanned in
+* overlapping chunks so coverage is complete — nothing is silently truncated.
+* The size also bounds what a single triage call pastes into the LLM prompt
+* (~25K tokens), so triage always sees the chunk its matches came from.
+*/
+const SCAN_CHUNK_SIZE = 1e5;
+/**
+* Overlap between adjacent chunks so a pattern straddling a chunk boundary
+* still lands whole inside at least one chunk. YARA rule strings are at most
+* a few hundred bytes; 4 KB is generous.
+*/
+const SCAN_CHUNK_OVERLAP = 4096;
+function logYaraMatch(phase, tool, match, action) {
+	const severity = match.metadata.severity ?? "unknown";
+	const category = match.metadata.category ?? "unknown";
+	const ruleAction = match.metadata.action ?? "unknown";
+	const description = match.metadata.description ?? "";
+	logToFile(`[YARA] ${phase}:${tool} [${action.toUpperCase()}] rule "${match.rule}" (severity: ${severity}, category: ${category}, action: ${ruleAction})\n  Description: ${description}`);
+	analytics.wizardCapture("yara rule matched", {
+		rule: match.rule,
+		severity: match.metadata.severity,
+		category: match.metadata.category,
+		rule_action: match.metadata.action,
+		action,
+		phase,
+		tool,
+		description: match.metadata.description,
+		triage_verdict: match.triage?.verdict
+	});
+}
+/**
+* Send the run's full scan report to PostHog so maintainers can see why a run
+* was flagged, warned, or aborted. This is the maintainer-facing report — it is
+* NEVER shown to the user. No-op if nothing was scanned. The free-text triage
+* reason is omitted to avoid sending scanned content off the user's machine.
+*/
+function captureScanReport() {
+	if (scanCount === 0) return;
+	analytics.wizardCapture("yara scan report", {
+		total_scans: scanCount,
+		violation_count: scanViolations.length,
+		clean_count: scanCount - scanViolations.length,
+		violations: scanViolations.map((v) => ({
+			rule: v.rule,
+			severity: v.severity,
+			category: v.category,
+			action: v.action,
+			phase: v.phase,
+			tool: v.tool,
+			description: v.description,
+			triage_verdict: v.triageVerdict
+		}))
+	});
+	scanCount = 0;
+	scanViolations.length = 0;
+}
+/**
+* End-of-run flush for the scan report. Wired once at the runner seam so every
+* harness (linear, orchestrator, and any future shape) reports without having
+* to know warlock exists — scanning is already harness-agnostic (it runs from
+* SDK Pre/PostToolUse hooks), and this keeps reporting at a single shared seam.
+*
+* Order matters: write the local --yara-report file FIRST (it reads scanCount /
+* scanViolations), THEN send telemetry. captureScanReport() zeroes scan state,
+* which is what makes this whole function idempotent — a second call from
+* another termination path (e.g. finally after an abort already flushed) finds
+* scanCount === 0 and every step no-ops.
+*/
+function flushScanReport(session) {
+	if (session.yaraReport) {
+		const reportPath = writeScanReport();
+		if (reportPath) {
+			const summary = formatScanReport();
+			getUI().log.info(`YARA scan report: ${reportPath}${summary ?? ""}`);
+		}
+	}
+	captureScanReport();
+}
+const WIZARD_DOC_BASENAMES = new Set([
+	EVENT_INVENTORY_FILE,
+	SETUP_REPORT_FILE,
+	AUDIT_REPORT_FILE,
+	EVENT_PLAN_FILE
+]);
+const WIZARD_DOC_PATTERNS = [EVENT_INVENTORY_PART_PATTERN];
+function isWizardDocumentationPath(filePath) {
+	if (!filePath) return false;
+	const basename = path.basename(filePath);
+	if (WIZARD_DOC_BASENAMES.has(basename)) return true;
+	return WIZARD_DOC_PATTERNS.some((re) => re.test(basename));
+}
+/** Identical-payload attempt at which the agent is told to move on. */
+const REPEAT_BLOCK_MOVE_ON_ATTEMPT = 3;
+/** Per-run tracker of YARA-blocked payloads (keyed by tool + content hash). */
+function createRepeatBlockTracker() {
+	const counts = /* @__PURE__ */ new Map();
+	return { attempt(tool, content) {
+		const key = `${tool} ${createHash("sha256").update(content).digest("hex")}`;
+		const next = (counts.get(key) ?? 0) + 1;
+		counts.set(key, next);
+		return next;
+	} };
+}
+/**
+* The block reason for the given attempt: the plain reason the first time,
+* an explicit "this exact retry can never work" on the second, and a
+* "report it and move on" instruction from the third on.
+*/
+function repeatBlockReason(attempt, tool, baseReason) {
+	if (attempt <= 1) return baseReason;
+	if (attempt < REPEAT_BLOCK_MOVE_ON_ATTEMPT) return `${baseReason} This exact ${tool} content was ALREADY blocked — the scan is deterministic, so retrying identical content will always block again. Change the code to remove the flagged pattern instead of retrying.`;
+	return `${baseReason} This exact ${tool} content has now been blocked ${attempt} times. STOP retrying it. Note the blocked change in the setup report and move on to the next task.`;
+}
+const SEVERITY_RANK = {
+	critical: 4,
+	high: 3,
+	medium: 2,
+	low: 1
+};
+/** Return the highest-severity match from a list of matches. */
+function highestSeverityMatch(matches) {
+	return matches.reduce((worst, m) => (SEVERITY_RANK[m.metadata.severity ?? ""] ?? 0) > (SEVERITY_RANK[worst.metadata.severity ?? ""] ?? 0) ? m : worst);
+}
+/**
+* Keep only matches whose rule targets this content surface. Rules carry a
+* `scan_context` of 'command' | 'input' | 'output'. An undefined context is
+* treated as "applies everywhere" (fail-safe — a rule that forgets the tag
+* still gets enforced rather than silently skipped).
+*/
+function matchesForContext(matches, ctx) {
+	return matches.filter((m) => {
+		const c = m.metadata.scan_context;
+		return c === ctx || c === void 0;
+	});
+}
+/**
+* Drop false positives via warlock's LLM triage. Fail-closed: if no provider is
+* available, or the triage call throws, every match is treated as real — we
+* never silently suppress a flagged match.
+*
+* Every overruled match is reported to PostHog (rule metadata only, never the
+* free-text reason) so maintainers can alert on triage-overrule patterns — the
+* signal that someone is either tripping a noisy rule or trying to talk the
+* triage model out of a real finding.
+*/
+async function triageFilter(content, matches, ctx, llmProvider) {
+	if (matches.length === 0) return [];
+	if (!llmProvider) {
+		logToFile(`[YARA] triage skipped (no provider) — treating ${matches.length} match(es) as real`);
+		return matches;
+	}
+	try {
+		const triaged = await (await getWarlock()).triageMatches(content, matches, llmProvider);
+		const kept = triaged.filter((m) => m.triage.verdict === "true_positive");
+		for (const m of triaged) {
+			if (m.triage.verdict === "true_positive") continue;
+			logToFile(`[YARA] triage overruled rule "${m.rule}" (${m.metadata.severity ?? "unknown"}) — not acting on it`);
+			analytics.wizardCapture("yara triage overruled", {
+				rule: m.rule,
+				severity: m.metadata.severity,
+				category: m.metadata.category,
+				scan_context: ctx
+			});
+		}
+		logToFile(`[YARA] triage: ${matches.length} flagged → ${kept.length} kept as real`);
+		return kept;
+	} catch (err) {
+		logToFile("[YARA] triage failed — treating all matches as real:", err);
+		return matches;
+	}
+}
+/**
+* Split oversized content into overlapping chunks so the scanner covers all
+* of it. Content that fits in one chunk is returned as-is.
+*/
+function chunkContent(content) {
+	if (content.length <= SCAN_CHUNK_SIZE) return [content];
+	const chunks = [];
+	const step = SCAN_CHUNK_SIZE - SCAN_CHUNK_OVERLAP;
+	for (let start = 0; start < content.length; start += step) {
+		chunks.push(content.slice(start, start + SCAN_CHUNK_SIZE));
+		if (start + SCAN_CHUNK_SIZE >= content.length) break;
+	}
+	return chunks;
+}
+/**
+* Scan content against warlock rules — chunked when oversized, so nothing is
+* skipped — and keep only matches for this content surface. Chunks scan
+* sequentially (the WASM engine is single-threaded; parallelism buys nothing).
+* Returns each flagged chunk with its matches so triage can later judge every
+* match against the exact content it came from.
+*/
+async function scanForContext(content, ctx) {
+	const warlock = await getWarlock();
+	const chunks = chunkContent(content);
+	if (chunks.length > 1) {
+		logToFile(`[YARA] content is ${content.length} chars — scanning ${chunks.length} overlapping chunks`);
+		analytics.wizardCapture("yara scan chunked", {
+			content_length: content.length,
+			chunk_count: chunks.length,
+			scan_context: ctx
+		});
+	}
+	const flagged = [];
+	for (const chunk of chunks) {
+		const result = await warlock.scan(chunk);
+		if (!result.matched) continue;
+		const matches = matchesForContext(result.matches, ctx);
+		if (matches.length === 0) continue;
+		flagged.push({
+			chunk,
+			matches
+		});
+	}
+	return flagged;
+}
+/** The overlap between chunks can surface the same rule twice; count it once. */
+function dedupeByRule(matches) {
+	const seen = /* @__PURE__ */ new Set();
+	return matches.filter((m) => {
+		if (seen.has(m.rule)) return false;
+		seen.add(m.rule);
+		return true;
+	});
+}
+/**
+* Triage each flagged chunk against its own content — the evidence is always
+* inside the window the LLM sees. Triage calls run in parallel (each is just
+* an HTTP round trip) so N flagged chunks cost ~1× triage latency, not N×.
+*/
+async function triageFlagged(flagged, ctx, llmProvider) {
+	return dedupeByRule((await Promise.all(flagged.map(({ chunk, matches }) => triageFilter(chunk, matches, ctx, llmProvider)))).flat());
+}
+/**
+* Scan content, filter to the relevant context, triage. Returns real matches.
+* Exported for harnesses that run their own hook loop (pi) so every harness
+* scans through the same warlock engine, chunking, and triage policy.
+*/
+async function scanAndTriage(content, ctx, llmProvider) {
+	return triageFlagged(await scanForContext(content, ctx), ctx, llmProvider);
+}
+/**
+* Create PreToolUse hook matchers for YARA scanning.
+* Scans Bash commands before execution for exfiltration, destructive
+* operations, and supply chain violations ('command'-context rules).
+*/
+function createPreToolUseYaraHooks(_llmProvider) {
+	const repeatTracker = createRepeatBlockTracker();
+	return [{
+		hooks: [async (input) => {
+			try {
+				if (input.tool_name !== "Bash") return {};
+				const toolInput = input.tool_input;
+				const command = typeof toolInput?.command === "string" ? toolInput.command : "";
+				if (!command) return {};
+				recordScan();
+				const matches = await scanAndTriage(command, "command", void 0);
+				if (matches.length === 0) return {};
+				const match = highestSeverityMatch(matches);
+				recordMatch("PreToolUse", "Bash", match, "blocked");
+				return {
+					decision: "block",
+					reason: repeatBlockReason(repeatTracker.attempt("Bash", command), "Bash", `[YARA] ${match.rule}: ${match.metadata.description ?? "security policy violation"}. Command blocked for security.`)
+				};
+			} catch (error) {
+				logToFile("[YARA] PreToolUse hook error:", error);
+				return {
+					decision: "block",
+					reason: "[YARA] Scanner error — command blocked as a precaution."
+				};
+			}
+		}],
+		timeout: HOOK_TIMEOUT_MS
+	}];
+}
+/**
+* Create PostToolUse hook matchers for YARA scanning.
+*
+* Three matchers:
+* 1. Write/Edit — scan written content ('output'-context rules: PII, secrets)
+* 2. Read/Grep — scan read content ('input'-context rules: prompt injection)
+* 3. Bash (skill install) — scan downloaded skill files for poisoned content
+*
+* `onTerminate` is invoked on the terminal paths (critical prompt injection in
+* read content, a poisoned skill, or a scanner error under fail-closed). It is
+* what ACTUALLY stops the run — returning `stopReason` from a PostToolUse hook
+* is not honored by the SDK, so the caller wires this to the run's
+* AbortController (see agent-interface).
+*/
+function createPostToolUseYaraHooks(llmProvider, onTerminate) {
+	return [
+		{
+			hooks: [async (input) => {
+				try {
+					const toolName = input.tool_name;
+					if (toolName !== "Write" && toolName !== "Edit") return {};
+					const toolInput = input.tool_input;
+					const content = toolName === "Write" ? toolInput?.content ?? "" : toolInput?.new_string ?? "";
+					if (!content) return {};
+					recordScan();
+					const flagged = await scanForContext(content, "output");
+					if (flagged.length === 0) return {};
+					const filePath = toolInput?.file_path;
+					const activeFlagged = isWizardDocumentationPath(filePath) ? flagged.map(({ chunk, matches }) => ({
+						chunk,
+						matches: matches.filter((m) => m.metadata.category !== "posthog_pii")
+					})).filter(({ matches }) => matches.length > 0) : flagged;
+					if (activeFlagged.length === 0) {
+						logToFile(`[YARA] posthog_pii match suppressed on wizard doc ${path.basename(filePath ?? "")} (rule: ${flagged[0]?.matches[0]?.rule})`);
+						return {};
+					}
+					const matches = await triageFlagged(activeFlagged, "output", llmProvider);
+					if (matches.length === 0) return {};
+					const match = highestSeverityMatch(matches);
+					recordMatch("PostToolUse", toolName, match, "reverted");
+					return { hookSpecificOutput: {
+						hookEventName: "PostToolUse",
+						additionalContext: `[YARA VIOLATION] ${match.rule}: ${match.metadata.description ?? ""}. You MUST revert this change immediately. The content you just wrote violates security policy.`
+					} };
+				} catch (error) {
+					logToFile("[YARA] PostToolUse Write/Edit hook error:", error);
+					const reason = "[YARA] Scanner error while scanning written content — session terminated as a precaution.";
+					onTerminate(reason);
+					return { stopReason: reason };
+				}
+			}],
+			timeout: HOOK_TIMEOUT_MS
+		},
+		{
+			hooks: [async (input) => {
+				try {
+					const toolName = input.tool_name;
+					if (toolName !== "Read" && toolName !== "Grep") return {};
+					const toolResponse = input.tool_response;
+					if (toolResponse == null) return {};
+					const content = typeof toolResponse === "string" ? toolResponse : JSON.stringify(toolResponse);
+					if (!content) return {};
+					recordScan();
+					const matches = await scanAndTriage(content, "input", llmProvider);
+					if (matches.length === 0) return {};
+					const match = highestSeverityMatch(matches);
+					if (match.metadata.severity === "critical" || match.metadata.action === "block") {
+						recordMatch("PostToolUse", toolName, match, "aborted");
+						const reason = `[YARA CRITICAL] ${match.rule}: Prompt injection detected in file content. Agent context is potentially poisoned. Session terminated for safety.`;
+						onTerminate(reason);
+						return { stopReason: reason };
+					}
+					recordMatch("PostToolUse", toolName, match, "warned");
+					return { hookSpecificOutput: {
+						hookEventName: "PostToolUse",
+						additionalContext: `[YARA WARNING] ${match.rule}: ${match.metadata.description ?? ""}`
+					} };
+				} catch (error) {
+					logToFile("[YARA] PostToolUse Read/Grep hook error:", error);
+					const reason = "[YARA] Scanner error while scanning read content — session terminated as a precaution.";
+					onTerminate(reason);
+					return { stopReason: reason };
+				}
+			}],
+			timeout: HOOK_TIMEOUT_MS
+		},
+		{
+			hooks: [async (input) => {
+				try {
+					if (input.tool_name !== "Bash") return {};
+					const toolInput = input.tool_input;
+					const command = typeof toolInput?.command === "string" ? toolInput.command : "";
+					if (!isSkillInstallCommand(command)) return {};
+					const dirMatch = command.match(/mkdir -p (.claude\/skills\/[^\s&]+)/);
+					if (!dirMatch) return {};
+					const skillDir = dirMatch[1];
+					const cwd = input.cwd ?? process.cwd();
+					recordScan();
+					const matches = await scanSkillFiles(cwd, skillDir, llmProvider);
+					if (matches.length === 0) return {};
+					const match = highestSeverityMatch(matches);
+					recordMatch("PostToolUse", "Bash (skill install)", match, "aborted");
+					const reason = `[YARA CRITICAL] Poisoned skill detected in ${skillDir}: ${match.rule}. The downloaded skill contains potential prompt injection. Session terminated for safety.`;
+					onTerminate(reason);
+					return { stopReason: reason };
+				} catch (error) {
+					logToFile("[YARA] PostToolUse skill install hook error:", error);
+					const reason = "[YARA] Scanner error while scanning skill files — session terminated as a precaution.";
+					onTerminate(reason);
+					return { stopReason: reason };
+				}
+			}],
+			timeout: SKILL_SCAN_HOOK_TIMEOUT_MS
+		}
+	];
+}
+/**
+* Read and scan all text files in a skill directory for prompt injection.
+* Scans each file sequentially (single-threaded WASM — parallelism buys
+* nothing), unions the 'input'-context matches, then triages once across the
+* combined content. Returns the real (post-triage) matches.
+*/
+async function scanSkillFiles(cwd, skillDir, llmProvider) {
+	const absoluteDir = path.resolve(cwd, skillDir);
+	if (!fs.existsSync(absoluteDir)) {
+		logToFile(`[YARA] Skill directory does not exist: ${absoluteDir}`);
+		return [];
+	}
+	const files = await fg("**/*.{md,txt,yaml,yml,json,js,ts,py,rb,sh}", {
+		cwd: absoluteDir,
+		absolute: true
+	});
+	const fileContents = [];
+	for (const filePath of files) try {
+		fileContents.push(fs.readFileSync(filePath, "utf-8"));
+	} catch (err) {
+		logToFile(`[YARA] Could not read skill file ${filePath}:`, err);
+	}
+	if (fileContents.length === 0) {
+		logToFile(`[YARA] No text files found in skill directory: ${absoluteDir}`);
+		return [];
+	}
+	logToFile(`[YARA] Scanning ${fileContents.length} files in skill directory: ${skillDir}`);
+	const flagged = [];
+	for (const content of fileContents) flagged.push(...await scanForContext(content, "input"));
+	return triageFlagged(flagged, "input", llmProvider);
+}
+//#endregion
+export { flushScanReport as a, isWizardDocumentationPath as c, repeatBlockReason as d, scanAndTriage as f, SETUP_REPORT_FILE as h, createRepeatBlockTracker as i, prewarmYaraScanner as l, EVENT_PLAN_FILE as m, createPostToolUseYaraHooks as n, formatScanReport as o, writeScanReport as p, createPreToolUseYaraHooks as r, formatYaraAbortMessage as s, captureScanReport as t, recordExternalScan as u };
+
+//# sourceMappingURL=yara-hooks-DNn1Jqih.js.map