@posthog/wizard 2.70.0 → 2.70.1

package/dist/{security-lqzh7NaZ.js → security-BwOvjMaq.js}

@@ -1,7 +1,7 @@
-import { s as logToFile } from "./debug-D5YT7Lil.js";
-import { n as analytics } from "./analytics-DXPSL5IY.js";
-import { a as wizardCanUseTool } from "./agent-interface-NZHof8u3.js";
-import { C as publishBlockingMatch, c as isWizardDocumentationPath, d as repeatBlockReason, f as scanAndTriage, i as createRepeatBlockTracker, u as recordExternalScan, w as scanVerdict } from "./yara-hooks-gZxdqlkx.js";
+import { s as logToFile } from "./debug-BM0fZaGl.js";
+import { n as analytics } from "./analytics-DTyJClPr.js";
+import { a as wizardCanUseTool } from "./agent-interface-Lu7tnLr0.js";
+import { C as publishBlockingMatch, c as isWizardDocumentationPath, d as repeatBlockReason, f as scanAndTriage, i as createRepeatBlockTracker, u as recordExternalScan, w as scanVerdict } from "./yara-hooks-BpngckdZ.js";
 import fs from "fs";
 import path from "path";
 //#region src/lib/agent/runner/harness/pi/security.ts
@@ -351,4 +351,4 @@ function createSecurityExtension(ctx = {}) {
 //#endregion
 export { createSecurityExtension };
 
-//# sourceMappingURL=security-lqzh7NaZ.js.map
+//# sourceMappingURL=security-BwOvjMaq.js.map

package/dist/{security-lqzh7NaZ.js.map → security-BwOvjMaq.js.map}

@@ -1 +1 @@
-{"version":3,"file":"security-lqzh7NaZ.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/security.ts"],"sourcesContent":["/**\n * Fail-closed security for the pi backend (#525). pi has no built-in\n * permission layer, so we attach an extension that intercepts every tool call\n * — built-in (bash/read/edit/write/grep) AND custom — through pi's `tool_call`\n * hook and reuses the EXACT anthropic policy: `wizardCanUseTool` (the bash\n * allowlist + .env fencing) plus the YARA pre-scan. A `tool_result` hook\n * post-scans output. Both fail closed: a scanner error blocks, and a critical\n * post-scan violation latches so every subsequent tool call is blocked and the\n * run terminates as a YARA violation.\n *\n * Scanning runs through @posthog/warlock via yara-hooks' `scanAndTriage` — the\n * same engine, rules, chunking, and LLM triage policy as the anthropic\n * harness. pi handlers are async (pi's ExtensionHandler accepts promises), so\n * the WASM scan awaits inline.\n *\n * This is the one fence. Subagents run their own pi session with the SAME\n * extension installed (see subagent.ts), so a child cannot escape it.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport type { LLMProvider, ScanMatch } from '@posthog/warlock';\nimport { wizardCanUseTool } from '@lib/agent/agent-interface';\nimport {\n  createRepeatBlockTracker,\n  isWizardDocumentationPath,\n  recordExternalScan,\n  repeatBlockReason,\n  scanAndTriage,\n  type RepeatBlockTracker,\n} from '@lib/yara-hooks';\nimport {\n  publishBlockingMatch,\n  scanVerdict,\n  type ScanContext,\n} from '@lib/yara-policy';\nimport { logToFile } from '@utils/debug';\nimport { analytics } from '@utils/analytics';\n\n/** warlock ScanMatch → the report shape `recordExternalScan` expects. */\nfunction toReportViolation(m: ScanMatch) {\n  return {\n    rule: m.rule,\n    severity: m.metadata.severity ?? 'unknown',\n    category: m.metadata.category ?? 'unknown',\n    description: m.metadata.description ?? '',\n  };\n}\n\n/** Runaway backstop: hard cap on tool calls per (sub)agent session. */\nexport const MAX_TOOL_CALLS = 250;\n\n/**\n * Passive telemetry for an unfixed upstream failure: gpt-5.x streaming with\n * tools leaks its function-call grammar into string values, and the leak lands\n * on disk (run 9704a73e shipped `…functions.complete_task (commentary…` plus a\n * DEL byte inside a customer's global-error.tsx). Observe-only — never blocks.\n * Prior art: https://github.com/BerriAI/litellm/issues/14260 (closed stale),\n * https://community.openai.com/t/1386422 (gpt-5.6-luna, no fix).\n */\nconst TRANSPORT_LEAK_PATTERNS: readonly { pattern: RegExp; label: string }[] = [\n  // The litellm#14260 signature, scoped to the wizard's own tool names — a\n  // generic `functions.*` would false-positive on real code (Firebase).\n  {\n    pattern: /functions\\.(?:complete_task|enqueue_task|read_handoffs)/,\n    label: 'leaked tool-call tokens',\n  },\n  {\n    pattern: /<\\|(?:channel|constrain|message|call|end|start|return)\\|>/,\n    label: 'leaked channel markers',\n  },\n  // C0 controls and DEL minus tab/newline/CR — never valid in source text.\n  // eslint-disable-next-line no-control-regex\n  { pattern: /[\\0-\\x08\\x0B\\f\\x0E-\\x1F\\x7F]/, label: 'control characters' },\n];\n\n/** Capture one event per leaking write/edit: which pattern fired and where it sat — no matched text, ever. */\nexport function observeTransportLeak(tool: string, content: string): void {\n  for (const { pattern, label } of TRANSPORT_LEAK_PATTERNS) {\n    const match = pattern.exec(content);\n    if (!match) continue;\n    analytics.wizardCapture('file content leak observed', {\n      tool,\n      leak: label,\n      leak_offset: match.index,\n      content_length: content.length,\n      // End-of-string leaks are the upstream decoder signature.\n      at_end: content.length - match.index < 80,\n    });\n    logToFile(\n      `[transport-leak] observed ${tool}: ${label} at ${match.index}/${content.length}`,\n    );\n    return;\n  }\n}\n\nexport interface ToolGateContext {\n  disallowedTools?: readonly string[];\n  /** True while a wizard_ask overlay is open (interactive); blocks Write/Edit. */\n  getWizardAskPending?: () => boolean;\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → every flagged match is acted on. */\n  triageProvider?: LLMProvider;\n  /**\n   * Per-run tracker of YARA-blocked payloads. When the agent retries content\n   * that was already blocked, the block reason escalates (\"change the code,\n   * not the retry\" → \"report it and move on\"). The extension wires one in;\n   * absent (tests calling `evaluateToolCall` directly) every block reads as\n   * a first attempt.\n   */\n  repeatTracker?: RepeatBlockTracker;\n  /** Project root; rm is only allowed for files resolving strictly inside it. */\n  workingDirectory?: string;\n}\n\nexport interface GateDecision {\n  block: boolean;\n  reason?: string;\n  /** End the run, don't just refuse the call. Set when a blocked publish_handoff would otherwise leave no report. */\n  terminate?: boolean;\n}\n\nconst str = (v: unknown): string => (typeof v === 'string' ? v : '');\n\n// Shell metacharacters that chain, substitute, or redirect. A command carrying\n// any of these is more than one action, so we never treat it as a plain `rm`.\nconst SHELL_OPERATORS = /[;&|`$(){}<>\\n'\"\\\\]/;\n\n/** True when a target resolves to a file strictly inside the project root. */\nfunction isDeletableProjectFile(\n  target: string,\n  root: string,\n  p: typeof path,\n): boolean {\n  if (target.startsWith('-')) return false; // a flag, not a file\n  if (/[*?[\\]~]/.test(target)) return false; // glob / home expansion\n  if (p.basename(target).startsWith('.env')) return false; // secrets\n\n  const resolved = p.resolve(root, target);\n  return resolved !== root && resolved.startsWith(root + p.sep);\n}\n\n/**\n * A plain `rm [-f] <file...>` whose every target is a file inside the project\n * root — the deletion shape the anthropic arm permits (there bash isn't\n * allowlisted; the shared YARA destructive-delete rules catch the dangerous\n * forms). pi rescues the same shape so the fall-through YARA scan can judge\n * it, but refuses any shell operator so it can't smuggle a second command.\n * Path checks run through the host's `path` (win32 on Windows, posix elsewhere);\n * pi always executes commands via a POSIX bash, so targets use forward slashes.\n */\nexport function isScopedFileRemoval(\n  command: string,\n  rawRoot: string | undefined,\n  p: typeof path = path,\n): boolean {\n  if (!rawRoot) return false; // no root to contain against → never rescue\n  const root = p.resolve(rawRoot);\n  const trimmed = command.trim();\n  if (SHELL_OPERATORS.test(trimmed)) return false;\n\n  const [executable, ...args] = trimmed.split(/\\s+/);\n  if (executable !== 'rm') return false;\n\n  if (args[0] === '-f') args.shift();\n  if (args.length === 0) return false;\n\n  return args.every((arg) => isDeletableProjectFile(arg, root, p));\n}\n\n/** A write that removes more than this fraction of an existing file's\n * non-whitespace content reads as a destructive whole-file rewrite. */\nconst OVERWRITE_SHRINK_LIMIT = 0.3;\n\n/** Existing files below this many non-whitespace chars are stubs; replacing one\n * wholesale is legitimate, so the shrink guard leaves them alone. */\nconst OVERWRITE_MIN_CHARS = 400;\n\nconst nonWhitespaceLength = (s: string): number => s.replace(/\\s+/g, '').length;\n\n/**\n * Refuse a write that replaces an existing file with far less content than it\n * held, steering the agent back to targeted edits. Prior art — the destructive\n * whole-file rewrite is a known model failure that targeted-edit formats exist to\n * prevent: Aider's search/replace and unified-diff, OpenAI's apply_patch,\n * Anthropic's str_replace with replace_all; pi's edit tool has no replace_all, so\n * a rejected scoped edit can fall back to a lossy full write. Additive by design:\n * the wizard only adds instrumentation, so a large shrink is the rewrite, not intent.\n */\nexport function overwriteShrinkReason(\n  existing: string,\n  next: string,\n): string | undefined {\n  const before = nonWhitespaceLength(existing);\n  if (before < OVERWRITE_MIN_CHARS) return undefined;\n  const after = nonWhitespaceLength(next);\n  if (after >= before * (1 - OVERWRITE_SHRINK_LIMIT)) return undefined;\n  const removed = Math.round((1 - after / before) * 100);\n  return `This write replaces an existing file and removes ~${removed}% of its content. Make targeted edits instead of rewriting the whole file; only write a file in full when creating it.`;\n}\n\n/**\n * Read the file a write would replace and flag a destructive shrink. A path that\n * does not exist yet is a new file, so it never triggers; with no project root to\n * resolve against (unit tests calling `evaluateToolCall` bare), it stays inert.\n */\nasync function overwriteShrinkBlock(\n  input: Record<string, unknown>,\n  workingDirectory: string | undefined,\n): Promise<string | undefined> {\n  const target = str(input.path);\n  if (!workingDirectory || !target) return undefined;\n  let existing: string;\n  try {\n    existing = await fs.promises.readFile(\n      path.resolve(workingDirectory, target),\n      'utf8',\n    );\n  } catch {\n    return undefined; // new file (ENOENT) or unreadable — nothing to preserve\n  }\n  return overwriteShrinkReason(existing, str(input.content));\n}\n\n/**\n * Translate a pi tool name to the claude-cased name + input the shared policy\n * expects. pi field names (from the live tool stream): bash{command},\n * read/edit/write{path}, write adds {content}, edit adds {edits}, grep{path}.\n */\nfunction toClaudePolicyCall(\n  toolName: string,\n  input: Record<string, unknown>,\n): { name: string; input: Record<string, unknown> } {\n  switch (toolName) {\n    case 'bash':\n      return { name: 'Bash', input: { command: str(input.command) } };\n    case 'read':\n      return { name: 'Read', input: { file_path: input.path } };\n    case 'write':\n      return { name: 'Write', input: { file_path: input.path } };\n    case 'edit':\n      return { name: 'Edit', input: { file_path: input.path } };\n    case 'grep':\n      return { name: 'Grep', input: { path: input.path } };\n    default:\n      // Custom tools (load_skill_menu, set_env_values, dispatch_agent, …) +\n      // find/ls: no path/command, policy allows (their own handlers are fenced).\n      return { name: toolName, input };\n  }\n}\n\n/**\n * The agent-facing block message. Includes the rule's remediation so a blocked\n * agent can self-correct (e.g. \"move PII to identify()/$set\") instead of\n * retrying near-identical content.\n */\nfunction blockMessage(m: ScanMatch): string {\n  const remediation = m.metadata.remediation\n    ? ` Fix: ${m.metadata.remediation}.`\n    : '';\n  return `[YARA] ${m.rule}: ${\n    m.metadata.description ?? 'security rule matched'\n  }.${remediation} Blocked for security.`;\n}\n\n/**\n * YARA scan of the content a tool is about to act on, BEFORE it executes.\n * - bash → scan the command ('command'-context rules: exfiltration,\n *   destructive, force-push). No triage — a flagged command always blocks,\n *   same as the anthropic PreToolUse hook, so the LLM call would be wasted.\n * - write/edit → scan the content being written ('output'-context rules:\n *   hardcoded keys, PII), WITH triage, and with the same wizard-doc\n *   `posthog_pii` suppression the anthropic path uses so the agent's own\n *   event-plan files aren't blocked.\n * - publish_handoff → scan the report ('output'-context rules) with triage,\n *   but only a CRITICAL match refuses the publish — it's the only channel.\n * Returns a block reason, or undefined to allow. Read/grep are post-scanned on\n * their output (in the tool_result hook), not here.\n */\nasync function preExecutionYaraBlock(\n  toolName: string,\n  input: Record<string, unknown>,\n  llmProvider: LLMProvider | undefined,\n  repeatTracker?: RepeatBlockTracker,\n): Promise<string | undefined> {\n  let content: string;\n  let ctx: ScanContext;\n  let triage: LLMProvider | undefined;\n  // Report labels for the scan report (phase/tool), matching the anthropic\n  // hooks so pi and anthropic runs read the same in telemetry.\n  let phase: string;\n  let tool: string;\n  switch (toolName) {\n    case 'bash':\n      content = str(input.command);\n      ctx = 'command';\n      triage = undefined;\n      phase = 'PreToolUse';\n      tool = 'Bash';\n      break;\n    case 'write':\n      content = str(input.content);\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PostToolUse';\n      tool = 'Write';\n      break;\n    case 'edit':\n      // Scan ONLY the replacement text. `edits` is [{oldText, newText}] and\n      // oldText is pre-existing file content the agent is changing — scanning\n      // it blocks edits whose *surroundings* contain a violation, and even\n      // edits that are removing one (field FPs: capture edits adjacent to\n      // existing identify() PII; pre-existing violations blocking their own\n      // replacement). Matches the anthropic path, which scans new_string only.\n      content = (Array.isArray(input.edits) ? input.edits : [])\n        .map((e) => str((e as Record<string, unknown>)?.newText))\n        .join('\\n');\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PostToolUse';\n      tool = 'Edit';\n      break;\n    case 'publish_handoff':\n      // Agent-authored content persisted to the task stream and the host file.\n      // Own labels, not Write's — the block bar differs (critical only).\n      content = str(input.content);\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PreToolUse';\n      tool = 'publish_handoff';\n      break;\n    default:\n      return undefined;\n  }\n  if (!content) return undefined;\n  if (ctx === 'output') observeTransportLeak(tool, content);\n\n  let matches = await scanAndTriage(content, ctx, triage);\n  if (ctx === 'output' && isWizardDocumentationPath(str(input.path))) {\n    matches = matches.filter((m) => m.metadata.category !== 'posthog_pii');\n  }\n  // Any match blocks — except publish_handoff, critical only.\n  const blocking =\n    toolName === 'publish_handoff'\n      ? publishBlockingMatch(matches)\n      : matches[0] ?? null;\n\n  recordExternalScan(\n    phase,\n    tool,\n    matches.map(toReportViolation),\n    blocking ? 'blocked' : 'warned',\n  );\n  if (!blocking) return undefined;\n\n  const attempt = repeatTracker?.attempt(toolName, content) ?? 1;\n  return repeatBlockReason(attempt, toolName, blockMessage(blocking));\n}\n\n/**\n * The pure gate decision for a single tool call. Reuses `wizardCanUseTool`\n * (deny → block) then the YARA content scan (match → block). Fail-closed: any\n * thrown error blocks.\n */\nexport async function evaluateToolCall(\n  toolName: string,\n  input: Record<string, unknown>,\n  ctx: ToolGateContext = {},\n  llmProvider?: LLMProvider,\n): Promise<GateDecision> {\n  try {\n    const policy = toClaudePolicyCall(toolName, input);\n    const decision = wizardCanUseTool(policy.name, policy.input, {\n      disallowedTools: ctx.disallowedTools,\n      wizardAskPending: ctx.getWizardAskPending?.() ?? false,\n    });\n    // The allowlist is a pi-only restriction; the anthropic arm runs bash\n    // unrestricted and leans on the shared YARA scan. Let a plain `rm` of\n    // project files through to that same scan so pi matches that behavior.\n    const allowedLikeAnthropic =\n      toolName === 'bash' &&\n      isScopedFileRemoval(str(input.command), ctx.workingDirectory);\n\n    if (decision.behavior === 'deny' && !allowedLikeAnthropic) {\n      return { block: true, reason: decision.message };\n    }\n\n    const yaraReason = await preExecutionYaraBlock(\n      toolName,\n      input,\n      llmProvider,\n      ctx.repeatTracker,\n    );\n    if (yaraReason) return { block: true, reason: yaraReason };\n\n    if (toolName === 'write') {\n      const shrinkReason = await overwriteShrinkBlock(\n        input,\n        ctx.workingDirectory,\n      );\n      if (shrinkReason) return { block: true, reason: shrinkReason };\n    }\n\n    return { block: false };\n  } catch (err) {\n    logToFile('[pi-security] gate error — failing closed:', err);\n    // A publish_handoff the gate can't clear leaves the run with no report at\n    // all, so end it visibly instead of letting the agent reword and retry.\n    return {\n      block: true,\n      reason: 'Security check failed; tool blocked (fail-closed).',\n      terminate: toolName === 'publish_handoff',\n    };\n  }\n}\n\n/** pi result tool names whose OUTPUT gets scanned for 'input'-context rules. */\nfunction isPostScanTool(toolName: string): boolean {\n  return toolName === 'read' || toolName === 'bash';\n}\n\n/** Mutable state the backend reads after the run to classify the outcome. */\nexport interface SecurityState {\n  criticalViolation: boolean;\n  blockedCount: number;\n  toolCalls: number;\n}\n\n/**\n * Build the pi security extension + the shared state the backend inspects.\n * Install the returned factory via `extensionFactories`; pass the same factory\n * into every subagent session so the fence is inherited.\n */\nexport function createSecurityExtension(ctx: ToolGateContext = {}): {\n  factory: (pi: PiExtensionApiLike) => void;\n  state: SecurityState;\n} {\n  const state: SecurityState = {\n    criticalViolation: false,\n    blockedCount: 0,\n    toolCalls: 0,\n  };\n\n  // One triage provider per extension. Undefined (no gateway auth) means\n  // triage is skipped and every flagged match is acted on — fail closed.\n  const llmProvider = ctx.triageProvider;\n\n  // One tracker per extension = per (sub)agent session, so an identical\n  // payload retried after a block gets the escalating reason.\n  const gateCtx: ToolGateContext = {\n    ...ctx,\n    repeatTracker: ctx.repeatTracker ?? createRepeatBlockTracker(),\n  };\n\n  const factory = (pi: PiExtensionApiLike): void => {\n    pi.on('tool_call', async (event) => {\n      // A latched post-scan violation blocks everything that follows.\n      if (state.criticalViolation) {\n        return {\n          block: true,\n          reason: 'Run terminated by a security violation.',\n        };\n      }\n      state.toolCalls += 1;\n      if (state.toolCalls > MAX_TOOL_CALLS) {\n        return {\n          block: true,\n          reason: `Stopped: exceeded ${MAX_TOOL_CALLS} tool calls (runaway guard).`,\n        };\n      }\n      const decision = await evaluateToolCall(\n        event.toolName,\n        event.input ?? {},\n        gateCtx,\n        llmProvider,\n      );\n      if (decision.block) {\n        state.blockedCount += 1;\n        if (decision.terminate) state.criticalViolation = true;\n        logToFile(`[pi-security] BLOCK ${event.toolName}: ${decision.reason}`);\n        return { block: true, reason: decision.reason };\n      }\n      return {};\n    });\n\n    pi.on('tool_result', async (event) => {\n      if (!isPostScanTool(event.toolName)) return {};\n      const text = (event.content ?? [])\n        .map((c) => (c && c.type === 'text' ? c.text : ''))\n        .join('\\n');\n      if (!text) return {};\n      try {\n        // 'input'-context rules (prompt injection in read content), with\n        // triage — same policy as the anthropic PostToolUse Read hook.\n        const matches = await scanAndTriage(text, 'input', llmProvider);\n        const verdict = scanVerdict(matches);\n        // Count the scan even when clean, like the anthropic hooks do.\n        recordExternalScan(\n          'PostToolUse',\n          event.toolName === 'read' ? 'Read' : 'Bash',\n          matches.map(toReportViolation),\n          verdict?.action ?? 'warned',\n        );\n        if (!verdict) return {};\n        if (verdict.terminal) {\n          state.criticalViolation = true;\n          logToFile(\n            `[pi-security] POST-SCAN VIOLATION ${event.toolName}: ${verdict.match.rule}`,\n          );\n        } else {\n          logToFile(\n            `[pi-security] POST-SCAN WARNING ${event.toolName}: ${\n              verdict.match.rule\n            } (severity: ${verdict.match.metadata.severity ?? 'unknown'})`,\n          );\n        }\n      } catch (err) {\n        // Fail closed: a scanner error on output latches a violation.\n        state.criticalViolation = true;\n        logToFile('[pi-security] post-scan error — failing closed:', err);\n      }\n      return {};\n    });\n  };\n\n  return { factory, state };\n}\n\n/**\n * Minimal structural type for pi's ExtensionAPI — just the `on` overloads we\n * use. Kept local so this module has no value import from the pi SDK (so the\n * CommonJS unit tests can load it directly). Handlers may return promises —\n * pi's real ExtensionHandler is `(event, ctx) => Promise<R | void> | R | void`.\n */\nexport interface PiExtensionApiLike {\n  on(\n    event: 'tool_call',\n    handler: (event: {\n      toolName: string;\n      input?: Record<string, unknown>;\n    }) =>\n      | { block?: boolean; reason?: string }\n      | Promise<{ block?: boolean; reason?: string }>,\n  ): void;\n  on(\n    event: 'tool_result',\n    handler: (event: {\n      toolName: string;\n      content?: Array<{ type: string; text?: string }>;\n      isError?: boolean;\n    }) => Record<string, never> | Promise<Record<string, never>>,\n  ): void;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,kBAAkB,GAAc;AACvC,QAAO;EACL,MAAM,EAAE;EACR,UAAU,EAAE,SAAS,YAAY;EACjC,UAAU,EAAE,SAAS,YAAY;EACjC,aAAa,EAAE,SAAS,eAAe;EACxC;;;;;;;;;;AAcH,MAAM,0BAAyE;CAG7E;EACE,SAAS;EACT,OAAO;EACR;CACD;EACE,SAAS;EACT,OAAO;EACR;CAGD;EAAE,SAAS;EAAgC,OAAO;EAAsB;CACzE;;AAGD,SAAgB,qBAAqB,MAAc,SAAuB;AACxE,MAAK,MAAM,EAAE,SAAS,WAAW,yBAAyB;EACxD,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AACnC,MAAI,CAAC,MAAO;AACZ,YAAU,cAAc,8BAA8B;GACpD;GACA,MAAM;GACN,aAAa,MAAM;GACnB,gBAAgB,QAAQ;GAExB,QAAQ,QAAQ,SAAS,MAAM,QAAQ;GACxC,CAAC;AACF,YACE,6BAA6B,KAAK,IAAI,MAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,SAC1E;AACD;;;AA6BJ,MAAM,OAAO,MAAwB,OAAO,MAAM,WAAW,IAAI;AAIjE,MAAM,kBAAkB;;AAGxB,SAAS,uBACP,QACA,MACA,GACS;AACT,KAAI,OAAO,WAAW,IAAI,CAAE,QAAO;AACnC,KAAI,WAAW,KAAK,OAAO,CAAE,QAAO;AACpC,KAAI,EAAE,SAAS,OAAO,CAAC,WAAW,OAAO,CAAE,QAAO;CAElD,MAAM,WAAW,EAAE,QAAQ,MAAM,OAAO;AACxC,QAAO,aAAa,QAAQ,SAAS,WAAW,OAAO,EAAE,IAAI;;;;;;;;;;;AAY/D,SAAgB,oBACd,SACA,SACA,IAAiB,MACR;AACT,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,OAAO,EAAE,QAAQ,QAAQ;CAC/B,MAAM,UAAU,QAAQ,MAAM;AAC9B,KAAI,gBAAgB,KAAK,QAAQ,CAAE,QAAO;CAE1C,MAAM,CAAC,YAAY,GAAG,QAAQ,QAAQ,MAAM,MAAM;AAClD,KAAI,eAAe,KAAM,QAAO;AAEhC,KAAI,KAAK,OAAO,KAAM,MAAK,OAAO;AAClC,KAAI,KAAK,WAAW,EAAG,QAAO;AAE9B,QAAO,KAAK,OAAO,QAAQ,uBAAuB,KAAK,MAAM,EAAE,CAAC;;;;AAKlE,MAAM,yBAAyB;;;AAI/B,MAAM,sBAAsB;AAE5B,MAAM,uBAAuB,MAAsB,EAAE,QAAQ,QAAQ,GAAG,CAAC;;;;;;;;;;AAWzE,SAAgB,sBACd,UACA,MACoB;CACpB,MAAM,SAAS,oBAAoB,SAAS;AAC5C,KAAI,SAAS,oBAAqB,QAAO,KAAA;CACzC,MAAM,QAAQ,oBAAoB,KAAK;AACvC,KAAI,SAAS,UAAU,IAAI,wBAAyB,QAAO,KAAA;AAE3D,QAAO,qDADS,KAAK,OAAO,IAAI,QAAQ,UAAU,IAAI,CACc;;;;;;;AAQtE,eAAe,qBACb,OACA,kBAC6B;CAC7B,MAAM,SAAS,IAAI,MAAM,KAAK;AAC9B,KAAI,CAAC,oBAAoB,CAAC,OAAQ,QAAO,KAAA;CACzC,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,GAAG,SAAS,SAC3B,KAAK,QAAQ,kBAAkB,OAAO,EACtC,OACD;SACK;AACN;;AAEF,QAAO,sBAAsB,UAAU,IAAI,MAAM,QAAQ,CAAC;;;;;;;AAQ5D,SAAS,mBACP,UACA,OACkD;AAClD,SAAQ,UAAR;EACE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,SAAS,IAAI,MAAM,QAAQ,EAAE;GAAE;EACjE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC5D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,MAAM,MAAM,MAAM;GAAE;EACtD,QAGE,QAAO;GAAE,MAAM;GAAU;GAAO;;;;;;;;AAStC,SAAS,aAAa,GAAsB;CAC1C,MAAM,cAAc,EAAE,SAAS,cAC3B,SAAS,EAAE,SAAS,YAAY,KAChC;AACJ,QAAO,UAAU,EAAE,KAAK,IACtB,EAAE,SAAS,eAAe,wBAC3B,GAAG,YAAY;;;;;;;;;;;;;;;;AAiBlB,eAAe,sBACb,UACA,OACA,aACA,eAC6B;CAC7B,IAAI;CACJ,IAAI;CACJ,IAAI;CAGJ,IAAI;CACJ,IAAI;AACJ,SAAQ,UAAR;EACE,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS,KAAA;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AAOH,cAAW,MAAM,QAAQ,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,EACrD,KAAK,MAAM,IAAK,GAA+B,QAAQ,CAAC,CACxD,KAAK,KAAK;AACb,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AAGH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,QACE;;AAEJ,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,KAAI,QAAQ,SAAU,sBAAqB,MAAM,QAAQ;CAEzD,IAAI,UAAU,MAAM,cAAc,SAAS,KAAK,OAAO;AACvD,KAAI,QAAQ,YAAY,0BAA0B,IAAI,MAAM,KAAK,CAAC,CAChE,WAAU,QAAQ,QAAQ,MAAM,EAAE,SAAS,aAAa,cAAc;CAGxE,MAAM,WACJ,aAAa,oBACT,qBAAqB,QAAQ,GAC7B,QAAQ,MAAM;AAEpB,oBACE,OACA,MACA,QAAQ,IAAI,kBAAkB,EAC9B,WAAW,YAAY,SACxB;AACD,KAAI,CAAC,SAAU,QAAO,KAAA;AAGtB,QAAO,kBADS,eAAe,QAAQ,UAAU,QAAQ,IAAI,GAC3B,UAAU,aAAa,SAAS,CAAC;;;;;;;AAQrE,eAAsB,iBACpB,UACA,OACA,MAAuB,EAAE,EACzB,aACuB;AACvB,KAAI;EACF,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAClD,MAAM,WAAW,iBAAiB,OAAO,MAAM,OAAO,OAAO;GAC3D,iBAAiB,IAAI;GACrB,kBAAkB,IAAI,uBAAuB,IAAI;GAClD,CAAC;EAIF,MAAM,uBACJ,aAAa,UACb,oBAAoB,IAAI,MAAM,QAAQ,EAAE,IAAI,iBAAiB;AAE/D,MAAI,SAAS,aAAa,UAAU,CAAC,qBACnC,QAAO;GAAE,OAAO;GAAM,QAAQ,SAAS;GAAS;EAGlD,MAAM,aAAa,MAAM,sBACvB,UACA,OACA,aACA,IAAI,cACL;AACD,MAAI,WAAY,QAAO;GAAE,OAAO;GAAM,QAAQ;GAAY;AAE1D,MAAI,aAAa,SAAS;GACxB,MAAM,eAAe,MAAM,qBACzB,OACA,IAAI,iBACL;AACD,OAAI,aAAc,QAAO;IAAE,OAAO;IAAM,QAAQ;IAAc;;AAGhE,SAAO,EAAE,OAAO,OAAO;UAChB,KAAK;AACZ,YAAU,8CAA8C,IAAI;AAG5D,SAAO;GACL,OAAO;GACP,QAAQ;GACR,WAAW,aAAa;GACzB;;;;AAKL,SAAS,eAAe,UAA2B;AACjD,QAAO,aAAa,UAAU,aAAa;;;;;;;AAe7C,SAAgB,wBAAwB,MAAuB,EAAE,EAG/D;CACA,MAAM,QAAuB;EAC3B,mBAAmB;EACnB,cAAc;EACd,WAAW;EACZ;CAID,MAAM,cAAc,IAAI;CAIxB,MAAM,UAA2B;EAC/B,GAAG;EACH,eAAe,IAAI,iBAAiB,0BAA0B;EAC/D;CAED,MAAM,WAAW,OAAiC;AAChD,KAAG,GAAG,aAAa,OAAO,UAAU;AAElC,OAAI,MAAM,kBACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;AAEH,SAAM,aAAa;AACnB,OAAI,MAAM,YAAA,IACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;GAEH,MAAM,WAAW,MAAM,iBACrB,MAAM,UACN,MAAM,SAAS,EAAE,EACjB,SACA,YACD;AACD,OAAI,SAAS,OAAO;AAClB,UAAM,gBAAgB;AACtB,QAAI,SAAS,UAAW,OAAM,oBAAoB;AAClD,cAAU,uBAAuB,MAAM,SAAS,IAAI,SAAS,SAAS;AACtE,WAAO;KAAE,OAAO;KAAM,QAAQ,SAAS;KAAQ;;AAEjD,UAAO,EAAE;IACT;AAEF,KAAG,GAAG,eAAe,OAAO,UAAU;AACpC,OAAI,CAAC,eAAe,MAAM,SAAS,CAAE,QAAO,EAAE;GAC9C,MAAM,QAAQ,MAAM,WAAW,EAAE,EAC9B,KAAK,MAAO,KAAK,EAAE,SAAS,SAAS,EAAE,OAAO,GAAI,CAClD,KAAK,KAAK;AACb,OAAI,CAAC,KAAM,QAAO,EAAE;AACpB,OAAI;IAGF,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,YAAY;IAC/D,MAAM,UAAU,YAAY,QAAQ;AAEpC,uBACE,eACA,MAAM,aAAa,SAAS,SAAS,QACrC,QAAQ,IAAI,kBAAkB,EAC9B,SAAS,UAAU,SACpB;AACD,QAAI,CAAC,QAAS,QAAO,EAAE;AACvB,QAAI,QAAQ,UAAU;AACpB,WAAM,oBAAoB;AAC1B,eACE,qCAAqC,MAAM,SAAS,IAAI,QAAQ,MAAM,OACvE;UAED,WACE,mCAAmC,MAAM,SAAS,IAChD,QAAQ,MAAM,KACf,cAAc,QAAQ,MAAM,SAAS,YAAY,UAAU,GAC7D;YAEI,KAAK;AAEZ,UAAM,oBAAoB;AAC1B,cAAU,mDAAmD,IAAI;;AAEnE,UAAO,EAAE;IACT;;AAGJ,QAAO;EAAE;EAAS;EAAO"}
+{"version":3,"file":"security-BwOvjMaq.js","names":[],"sources":["../src/lib/agent/runner/harness/pi/security.ts"],"sourcesContent":["/**\n * Fail-closed security for the pi backend (#525). pi has no built-in\n * permission layer, so we attach an extension that intercepts every tool call\n * — built-in (bash/read/edit/write/grep) AND custom — through pi's `tool_call`\n * hook and reuses the EXACT anthropic policy: `wizardCanUseTool` (the bash\n * allowlist + .env fencing) plus the YARA pre-scan. A `tool_result` hook\n * post-scans output. Both fail closed: a scanner error blocks, and a critical\n * post-scan violation latches so every subsequent tool call is blocked and the\n * run terminates as a YARA violation.\n *\n * Scanning runs through @posthog/warlock via yara-hooks' `scanAndTriage` — the\n * same engine, rules, chunking, and LLM triage policy as the anthropic\n * harness. pi handlers are async (pi's ExtensionHandler accepts promises), so\n * the WASM scan awaits inline.\n *\n * This is the one fence. Subagents run their own pi session with the SAME\n * extension installed (see subagent.ts), so a child cannot escape it.\n */\n\nimport fs from 'fs';\nimport path from 'path';\nimport type { LLMProvider, ScanMatch } from '@posthog/warlock';\nimport { wizardCanUseTool } from '@lib/agent/agent-interface';\nimport {\n  createRepeatBlockTracker,\n  isWizardDocumentationPath,\n  recordExternalScan,\n  repeatBlockReason,\n  scanAndTriage,\n  type RepeatBlockTracker,\n} from '@lib/yara-hooks';\nimport {\n  publishBlockingMatch,\n  scanVerdict,\n  type ScanContext,\n} from '@lib/yara-policy';\nimport { logToFile } from '@utils/debug';\nimport { analytics } from '@utils/analytics';\n\n/** warlock ScanMatch → the report shape `recordExternalScan` expects. */\nfunction toReportViolation(m: ScanMatch) {\n  return {\n    rule: m.rule,\n    severity: m.metadata.severity ?? 'unknown',\n    category: m.metadata.category ?? 'unknown',\n    description: m.metadata.description ?? '',\n  };\n}\n\n/** Runaway backstop: hard cap on tool calls per (sub)agent session. */\nexport const MAX_TOOL_CALLS = 250;\n\n/**\n * Passive telemetry for an unfixed upstream failure: gpt-5.x streaming with\n * tools leaks its function-call grammar into string values, and the leak lands\n * on disk (run 9704a73e shipped `…functions.complete_task (commentary…` plus a\n * DEL byte inside a customer's global-error.tsx). Observe-only — never blocks.\n * Prior art: https://github.com/BerriAI/litellm/issues/14260 (closed stale),\n * https://community.openai.com/t/1386422 (gpt-5.6-luna, no fix).\n */\nconst TRANSPORT_LEAK_PATTERNS: readonly { pattern: RegExp; label: string }[] = [\n  // The litellm#14260 signature, scoped to the wizard's own tool names — a\n  // generic `functions.*` would false-positive on real code (Firebase).\n  {\n    pattern: /functions\\.(?:complete_task|enqueue_task|read_handoffs)/,\n    label: 'leaked tool-call tokens',\n  },\n  {\n    pattern: /<\\|(?:channel|constrain|message|call|end|start|return)\\|>/,\n    label: 'leaked channel markers',\n  },\n  // C0 controls and DEL minus tab/newline/CR — never valid in source text.\n  // eslint-disable-next-line no-control-regex\n  { pattern: /[\\0-\\x08\\x0B\\f\\x0E-\\x1F\\x7F]/, label: 'control characters' },\n];\n\n/** Capture one event per leaking write/edit: which pattern fired and where it sat — no matched text, ever. */\nexport function observeTransportLeak(tool: string, content: string): void {\n  for (const { pattern, label } of TRANSPORT_LEAK_PATTERNS) {\n    const match = pattern.exec(content);\n    if (!match) continue;\n    analytics.wizardCapture('file content leak observed', {\n      tool,\n      leak: label,\n      leak_offset: match.index,\n      content_length: content.length,\n      // End-of-string leaks are the upstream decoder signature.\n      at_end: content.length - match.index < 80,\n    });\n    logToFile(\n      `[transport-leak] observed ${tool}: ${label} at ${match.index}/${content.length}`,\n    );\n    return;\n  }\n}\n\nexport interface ToolGateContext {\n  disallowedTools?: readonly string[];\n  /** True while a wizard_ask overlay is open (interactive); blocks Write/Edit. */\n  getWizardAskPending?: () => boolean;\n  /** Scan-triage classifier, resolved once in bootstrap. Absent → every flagged match is acted on. */\n  triageProvider?: LLMProvider;\n  /**\n   * Per-run tracker of YARA-blocked payloads. When the agent retries content\n   * that was already blocked, the block reason escalates (\"change the code,\n   * not the retry\" → \"report it and move on\"). The extension wires one in;\n   * absent (tests calling `evaluateToolCall` directly) every block reads as\n   * a first attempt.\n   */\n  repeatTracker?: RepeatBlockTracker;\n  /** Project root; rm is only allowed for files resolving strictly inside it. */\n  workingDirectory?: string;\n}\n\nexport interface GateDecision {\n  block: boolean;\n  reason?: string;\n  /** End the run, don't just refuse the call. Set when a blocked publish_handoff would otherwise leave no report. */\n  terminate?: boolean;\n}\n\nconst str = (v: unknown): string => (typeof v === 'string' ? v : '');\n\n// Shell metacharacters that chain, substitute, or redirect. A command carrying\n// any of these is more than one action, so we never treat it as a plain `rm`.\nconst SHELL_OPERATORS = /[;&|`$(){}<>\\n'\"\\\\]/;\n\n/** True when a target resolves to a file strictly inside the project root. */\nfunction isDeletableProjectFile(\n  target: string,\n  root: string,\n  p: typeof path,\n): boolean {\n  if (target.startsWith('-')) return false; // a flag, not a file\n  if (/[*?[\\]~]/.test(target)) return false; // glob / home expansion\n  if (p.basename(target).startsWith('.env')) return false; // secrets\n\n  const resolved = p.resolve(root, target);\n  return resolved !== root && resolved.startsWith(root + p.sep);\n}\n\n/**\n * A plain `rm [-f] <file...>` whose every target is a file inside the project\n * root — the deletion shape the anthropic arm permits (there bash isn't\n * allowlisted; the shared YARA destructive-delete rules catch the dangerous\n * forms). pi rescues the same shape so the fall-through YARA scan can judge\n * it, but refuses any shell operator so it can't smuggle a second command.\n * Path checks run through the host's `path` (win32 on Windows, posix elsewhere);\n * pi always executes commands via a POSIX bash, so targets use forward slashes.\n */\nexport function isScopedFileRemoval(\n  command: string,\n  rawRoot: string | undefined,\n  p: typeof path = path,\n): boolean {\n  if (!rawRoot) return false; // no root to contain against → never rescue\n  const root = p.resolve(rawRoot);\n  const trimmed = command.trim();\n  if (SHELL_OPERATORS.test(trimmed)) return false;\n\n  const [executable, ...args] = trimmed.split(/\\s+/);\n  if (executable !== 'rm') return false;\n\n  if (args[0] === '-f') args.shift();\n  if (args.length === 0) return false;\n\n  return args.every((arg) => isDeletableProjectFile(arg, root, p));\n}\n\n/** A write that removes more than this fraction of an existing file's\n * non-whitespace content reads as a destructive whole-file rewrite. */\nconst OVERWRITE_SHRINK_LIMIT = 0.3;\n\n/** Existing files below this many non-whitespace chars are stubs; replacing one\n * wholesale is legitimate, so the shrink guard leaves them alone. */\nconst OVERWRITE_MIN_CHARS = 400;\n\nconst nonWhitespaceLength = (s: string): number => s.replace(/\\s+/g, '').length;\n\n/**\n * Refuse a write that replaces an existing file with far less content than it\n * held, steering the agent back to targeted edits. Prior art — the destructive\n * whole-file rewrite is a known model failure that targeted-edit formats exist to\n * prevent: Aider's search/replace and unified-diff, OpenAI's apply_patch,\n * Anthropic's str_replace with replace_all; pi's edit tool has no replace_all, so\n * a rejected scoped edit can fall back to a lossy full write. Additive by design:\n * the wizard only adds instrumentation, so a large shrink is the rewrite, not intent.\n */\nexport function overwriteShrinkReason(\n  existing: string,\n  next: string,\n): string | undefined {\n  const before = nonWhitespaceLength(existing);\n  if (before < OVERWRITE_MIN_CHARS) return undefined;\n  const after = nonWhitespaceLength(next);\n  if (after >= before * (1 - OVERWRITE_SHRINK_LIMIT)) return undefined;\n  const removed = Math.round((1 - after / before) * 100);\n  return `This write replaces an existing file and removes ~${removed}% of its content. Make targeted edits instead of rewriting the whole file; only write a file in full when creating it.`;\n}\n\n/**\n * Read the file a write would replace and flag a destructive shrink. A path that\n * does not exist yet is a new file, so it never triggers; with no project root to\n * resolve against (unit tests calling `evaluateToolCall` bare), it stays inert.\n */\nasync function overwriteShrinkBlock(\n  input: Record<string, unknown>,\n  workingDirectory: string | undefined,\n): Promise<string | undefined> {\n  const target = str(input.path);\n  if (!workingDirectory || !target) return undefined;\n  let existing: string;\n  try {\n    existing = await fs.promises.readFile(\n      path.resolve(workingDirectory, target),\n      'utf8',\n    );\n  } catch {\n    return undefined; // new file (ENOENT) or unreadable — nothing to preserve\n  }\n  return overwriteShrinkReason(existing, str(input.content));\n}\n\n/**\n * Translate a pi tool name to the claude-cased name + input the shared policy\n * expects. pi field names (from the live tool stream): bash{command},\n * read/edit/write{path}, write adds {content}, edit adds {edits}, grep{path}.\n */\nfunction toClaudePolicyCall(\n  toolName: string,\n  input: Record<string, unknown>,\n): { name: string; input: Record<string, unknown> } {\n  switch (toolName) {\n    case 'bash':\n      return { name: 'Bash', input: { command: str(input.command) } };\n    case 'read':\n      return { name: 'Read', input: { file_path: input.path } };\n    case 'write':\n      return { name: 'Write', input: { file_path: input.path } };\n    case 'edit':\n      return { name: 'Edit', input: { file_path: input.path } };\n    case 'grep':\n      return { name: 'Grep', input: { path: input.path } };\n    default:\n      // Custom tools (load_skill_menu, set_env_values, dispatch_agent, …) +\n      // find/ls: no path/command, policy allows (their own handlers are fenced).\n      return { name: toolName, input };\n  }\n}\n\n/**\n * The agent-facing block message. Includes the rule's remediation so a blocked\n * agent can self-correct (e.g. \"move PII to identify()/$set\") instead of\n * retrying near-identical content.\n */\nfunction blockMessage(m: ScanMatch): string {\n  const remediation = m.metadata.remediation\n    ? ` Fix: ${m.metadata.remediation}.`\n    : '';\n  return `[YARA] ${m.rule}: ${\n    m.metadata.description ?? 'security rule matched'\n  }.${remediation} Blocked for security.`;\n}\n\n/**\n * YARA scan of the content a tool is about to act on, BEFORE it executes.\n * - bash → scan the command ('command'-context rules: exfiltration,\n *   destructive, force-push). No triage — a flagged command always blocks,\n *   same as the anthropic PreToolUse hook, so the LLM call would be wasted.\n * - write/edit → scan the content being written ('output'-context rules:\n *   hardcoded keys, PII), WITH triage, and with the same wizard-doc\n *   `posthog_pii` suppression the anthropic path uses so the agent's own\n *   event-plan files aren't blocked.\n * - publish_handoff → scan the report ('output'-context rules) with triage,\n *   but only a CRITICAL match refuses the publish — it's the only channel.\n * Returns a block reason, or undefined to allow. Read/grep are post-scanned on\n * their output (in the tool_result hook), not here.\n */\nasync function preExecutionYaraBlock(\n  toolName: string,\n  input: Record<string, unknown>,\n  llmProvider: LLMProvider | undefined,\n  repeatTracker?: RepeatBlockTracker,\n): Promise<string | undefined> {\n  let content: string;\n  let ctx: ScanContext;\n  let triage: LLMProvider | undefined;\n  // Report labels for the scan report (phase/tool), matching the anthropic\n  // hooks so pi and anthropic runs read the same in telemetry.\n  let phase: string;\n  let tool: string;\n  switch (toolName) {\n    case 'bash':\n      content = str(input.command);\n      ctx = 'command';\n      triage = undefined;\n      phase = 'PreToolUse';\n      tool = 'Bash';\n      break;\n    case 'write':\n      content = str(input.content);\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PostToolUse';\n      tool = 'Write';\n      break;\n    case 'edit':\n      // Scan ONLY the replacement text. `edits` is [{oldText, newText}] and\n      // oldText is pre-existing file content the agent is changing — scanning\n      // it blocks edits whose *surroundings* contain a violation, and even\n      // edits that are removing one (field FPs: capture edits adjacent to\n      // existing identify() PII; pre-existing violations blocking their own\n      // replacement). Matches the anthropic path, which scans new_string only.\n      content = (Array.isArray(input.edits) ? input.edits : [])\n        .map((e) => str((e as Record<string, unknown>)?.newText))\n        .join('\\n');\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PostToolUse';\n      tool = 'Edit';\n      break;\n    case 'publish_handoff':\n      // Agent-authored content persisted to the task stream and the host file.\n      // Own labels, not Write's — the block bar differs (critical only).\n      content = str(input.content);\n      ctx = 'output';\n      triage = llmProvider;\n      phase = 'PreToolUse';\n      tool = 'publish_handoff';\n      break;\n    default:\n      return undefined;\n  }\n  if (!content) return undefined;\n  if (ctx === 'output') observeTransportLeak(tool, content);\n\n  let matches = await scanAndTriage(content, ctx, triage);\n  if (ctx === 'output' && isWizardDocumentationPath(str(input.path))) {\n    matches = matches.filter((m) => m.metadata.category !== 'posthog_pii');\n  }\n  // Any match blocks — except publish_handoff, critical only.\n  const blocking =\n    toolName === 'publish_handoff'\n      ? publishBlockingMatch(matches)\n      : matches[0] ?? null;\n\n  recordExternalScan(\n    phase,\n    tool,\n    matches.map(toReportViolation),\n    blocking ? 'blocked' : 'warned',\n  );\n  if (!blocking) return undefined;\n\n  const attempt = repeatTracker?.attempt(toolName, content) ?? 1;\n  return repeatBlockReason(attempt, toolName, blockMessage(blocking));\n}\n\n/**\n * The pure gate decision for a single tool call. Reuses `wizardCanUseTool`\n * (deny → block) then the YARA content scan (match → block). Fail-closed: any\n * thrown error blocks.\n */\nexport async function evaluateToolCall(\n  toolName: string,\n  input: Record<string, unknown>,\n  ctx: ToolGateContext = {},\n  llmProvider?: LLMProvider,\n): Promise<GateDecision> {\n  try {\n    const policy = toClaudePolicyCall(toolName, input);\n    const decision = wizardCanUseTool(policy.name, policy.input, {\n      disallowedTools: ctx.disallowedTools,\n      wizardAskPending: ctx.getWizardAskPending?.() ?? false,\n    });\n    // The allowlist is a pi-only restriction; the anthropic arm runs bash\n    // unrestricted and leans on the shared YARA scan. Let a plain `rm` of\n    // project files through to that same scan so pi matches that behavior.\n    const allowedLikeAnthropic =\n      toolName === 'bash' &&\n      isScopedFileRemoval(str(input.command), ctx.workingDirectory);\n\n    if (decision.behavior === 'deny' && !allowedLikeAnthropic) {\n      return { block: true, reason: decision.message };\n    }\n\n    const yaraReason = await preExecutionYaraBlock(\n      toolName,\n      input,\n      llmProvider,\n      ctx.repeatTracker,\n    );\n    if (yaraReason) return { block: true, reason: yaraReason };\n\n    if (toolName === 'write') {\n      const shrinkReason = await overwriteShrinkBlock(\n        input,\n        ctx.workingDirectory,\n      );\n      if (shrinkReason) return { block: true, reason: shrinkReason };\n    }\n\n    return { block: false };\n  } catch (err) {\n    logToFile('[pi-security] gate error — failing closed:', err);\n    // A publish_handoff the gate can't clear leaves the run with no report at\n    // all, so end it visibly instead of letting the agent reword and retry.\n    return {\n      block: true,\n      reason: 'Security check failed; tool blocked (fail-closed).',\n      terminate: toolName === 'publish_handoff',\n    };\n  }\n}\n\n/** pi result tool names whose OUTPUT gets scanned for 'input'-context rules. */\nfunction isPostScanTool(toolName: string): boolean {\n  return toolName === 'read' || toolName === 'bash';\n}\n\n/** Mutable state the backend reads after the run to classify the outcome. */\nexport interface SecurityState {\n  criticalViolation: boolean;\n  blockedCount: number;\n  toolCalls: number;\n}\n\n/**\n * Build the pi security extension + the shared state the backend inspects.\n * Install the returned factory via `extensionFactories`; pass the same factory\n * into every subagent session so the fence is inherited.\n */\nexport function createSecurityExtension(ctx: ToolGateContext = {}): {\n  factory: (pi: PiExtensionApiLike) => void;\n  state: SecurityState;\n} {\n  const state: SecurityState = {\n    criticalViolation: false,\n    blockedCount: 0,\n    toolCalls: 0,\n  };\n\n  // One triage provider per extension. Undefined (no gateway auth) means\n  // triage is skipped and every flagged match is acted on — fail closed.\n  const llmProvider = ctx.triageProvider;\n\n  // One tracker per extension = per (sub)agent session, so an identical\n  // payload retried after a block gets the escalating reason.\n  const gateCtx: ToolGateContext = {\n    ...ctx,\n    repeatTracker: ctx.repeatTracker ?? createRepeatBlockTracker(),\n  };\n\n  const factory = (pi: PiExtensionApiLike): void => {\n    pi.on('tool_call', async (event) => {\n      // A latched post-scan violation blocks everything that follows.\n      if (state.criticalViolation) {\n        return {\n          block: true,\n          reason: 'Run terminated by a security violation.',\n        };\n      }\n      state.toolCalls += 1;\n      if (state.toolCalls > MAX_TOOL_CALLS) {\n        return {\n          block: true,\n          reason: `Stopped: exceeded ${MAX_TOOL_CALLS} tool calls (runaway guard).`,\n        };\n      }\n      const decision = await evaluateToolCall(\n        event.toolName,\n        event.input ?? {},\n        gateCtx,\n        llmProvider,\n      );\n      if (decision.block) {\n        state.blockedCount += 1;\n        if (decision.terminate) state.criticalViolation = true;\n        logToFile(`[pi-security] BLOCK ${event.toolName}: ${decision.reason}`);\n        return { block: true, reason: decision.reason };\n      }\n      return {};\n    });\n\n    pi.on('tool_result', async (event) => {\n      if (!isPostScanTool(event.toolName)) return {};\n      const text = (event.content ?? [])\n        .map((c) => (c && c.type === 'text' ? c.text : ''))\n        .join('\\n');\n      if (!text) return {};\n      try {\n        // 'input'-context rules (prompt injection in read content), with\n        // triage — same policy as the anthropic PostToolUse Read hook.\n        const matches = await scanAndTriage(text, 'input', llmProvider);\n        const verdict = scanVerdict(matches);\n        // Count the scan even when clean, like the anthropic hooks do.\n        recordExternalScan(\n          'PostToolUse',\n          event.toolName === 'read' ? 'Read' : 'Bash',\n          matches.map(toReportViolation),\n          verdict?.action ?? 'warned',\n        );\n        if (!verdict) return {};\n        if (verdict.terminal) {\n          state.criticalViolation = true;\n          logToFile(\n            `[pi-security] POST-SCAN VIOLATION ${event.toolName}: ${verdict.match.rule}`,\n          );\n        } else {\n          logToFile(\n            `[pi-security] POST-SCAN WARNING ${event.toolName}: ${\n              verdict.match.rule\n            } (severity: ${verdict.match.metadata.severity ?? 'unknown'})`,\n          );\n        }\n      } catch (err) {\n        // Fail closed: a scanner error on output latches a violation.\n        state.criticalViolation = true;\n        logToFile('[pi-security] post-scan error — failing closed:', err);\n      }\n      return {};\n    });\n  };\n\n  return { factory, state };\n}\n\n/**\n * Minimal structural type for pi's ExtensionAPI — just the `on` overloads we\n * use. Kept local so this module has no value import from the pi SDK (so the\n * CommonJS unit tests can load it directly). Handlers may return promises —\n * pi's real ExtensionHandler is `(event, ctx) => Promise<R | void> | R | void`.\n */\nexport interface PiExtensionApiLike {\n  on(\n    event: 'tool_call',\n    handler: (event: {\n      toolName: string;\n      input?: Record<string, unknown>;\n    }) =>\n      | { block?: boolean; reason?: string }\n      | Promise<{ block?: boolean; reason?: string }>,\n  ): void;\n  on(\n    event: 'tool_result',\n    handler: (event: {\n      toolName: string;\n      content?: Array<{ type: string; text?: string }>;\n      isError?: boolean;\n    }) => Record<string, never> | Promise<Record<string, never>>,\n  ): void;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,kBAAkB,GAAc;AACvC,QAAO;EACL,MAAM,EAAE;EACR,UAAU,EAAE,SAAS,YAAY;EACjC,UAAU,EAAE,SAAS,YAAY;EACjC,aAAa,EAAE,SAAS,eAAe;EACxC;;;;;;;;;;AAcH,MAAM,0BAAyE;CAG7E;EACE,SAAS;EACT,OAAO;EACR;CACD;EACE,SAAS;EACT,OAAO;EACR;CAGD;EAAE,SAAS;EAAgC,OAAO;EAAsB;CACzE;;AAGD,SAAgB,qBAAqB,MAAc,SAAuB;AACxE,MAAK,MAAM,EAAE,SAAS,WAAW,yBAAyB;EACxD,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AACnC,MAAI,CAAC,MAAO;AACZ,YAAU,cAAc,8BAA8B;GACpD;GACA,MAAM;GACN,aAAa,MAAM;GACnB,gBAAgB,QAAQ;GAExB,QAAQ,QAAQ,SAAS,MAAM,QAAQ;GACxC,CAAC;AACF,YACE,6BAA6B,KAAK,IAAI,MAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,SAC1E;AACD;;;AA6BJ,MAAM,OAAO,MAAwB,OAAO,MAAM,WAAW,IAAI;AAIjE,MAAM,kBAAkB;;AAGxB,SAAS,uBACP,QACA,MACA,GACS;AACT,KAAI,OAAO,WAAW,IAAI,CAAE,QAAO;AACnC,KAAI,WAAW,KAAK,OAAO,CAAE,QAAO;AACpC,KAAI,EAAE,SAAS,OAAO,CAAC,WAAW,OAAO,CAAE,QAAO;CAElD,MAAM,WAAW,EAAE,QAAQ,MAAM,OAAO;AACxC,QAAO,aAAa,QAAQ,SAAS,WAAW,OAAO,EAAE,IAAI;;;;;;;;;;;AAY/D,SAAgB,oBACd,SACA,SACA,IAAiB,MACR;AACT,KAAI,CAAC,QAAS,QAAO;CACrB,MAAM,OAAO,EAAE,QAAQ,QAAQ;CAC/B,MAAM,UAAU,QAAQ,MAAM;AAC9B,KAAI,gBAAgB,KAAK,QAAQ,CAAE,QAAO;CAE1C,MAAM,CAAC,YAAY,GAAG,QAAQ,QAAQ,MAAM,MAAM;AAClD,KAAI,eAAe,KAAM,QAAO;AAEhC,KAAI,KAAK,OAAO,KAAM,MAAK,OAAO;AAClC,KAAI,KAAK,WAAW,EAAG,QAAO;AAE9B,QAAO,KAAK,OAAO,QAAQ,uBAAuB,KAAK,MAAM,EAAE,CAAC;;;;AAKlE,MAAM,yBAAyB;;;AAI/B,MAAM,sBAAsB;AAE5B,MAAM,uBAAuB,MAAsB,EAAE,QAAQ,QAAQ,GAAG,CAAC;;;;;;;;;;AAWzE,SAAgB,sBACd,UACA,MACoB;CACpB,MAAM,SAAS,oBAAoB,SAAS;AAC5C,KAAI,SAAS,oBAAqB,QAAO,KAAA;CACzC,MAAM,QAAQ,oBAAoB,KAAK;AACvC,KAAI,SAAS,UAAU,IAAI,wBAAyB,QAAO,KAAA;AAE3D,QAAO,qDADS,KAAK,OAAO,IAAI,QAAQ,UAAU,IAAI,CACc;;;;;;;AAQtE,eAAe,qBACb,OACA,kBAC6B;CAC7B,MAAM,SAAS,IAAI,MAAM,KAAK;AAC9B,KAAI,CAAC,oBAAoB,CAAC,OAAQ,QAAO,KAAA;CACzC,IAAI;AACJ,KAAI;AACF,aAAW,MAAM,GAAG,SAAS,SAC3B,KAAK,QAAQ,kBAAkB,OAAO,EACtC,OACD;SACK;AACN;;AAEF,QAAO,sBAAsB,UAAU,IAAI,MAAM,QAAQ,CAAC;;;;;;;AAQ5D,SAAS,mBACP,UACA,OACkD;AAClD,SAAQ,UAAR;EACE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,SAAS,IAAI,MAAM,QAAQ,EAAE;GAAE;EACjE,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,QACH,QAAO;GAAE,MAAM;GAAS,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC5D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,WAAW,MAAM,MAAM;GAAE;EAC3D,KAAK,OACH,QAAO;GAAE,MAAM;GAAQ,OAAO,EAAE,MAAM,MAAM,MAAM;GAAE;EACtD,QAGE,QAAO;GAAE,MAAM;GAAU;GAAO;;;;;;;;AAStC,SAAS,aAAa,GAAsB;CAC1C,MAAM,cAAc,EAAE,SAAS,cAC3B,SAAS,EAAE,SAAS,YAAY,KAChC;AACJ,QAAO,UAAU,EAAE,KAAK,IACtB,EAAE,SAAS,eAAe,wBAC3B,GAAG,YAAY;;;;;;;;;;;;;;;;AAiBlB,eAAe,sBACb,UACA,OACA,aACA,eAC6B;CAC7B,IAAI;CACJ,IAAI;CACJ,IAAI;CAGJ,IAAI;CACJ,IAAI;AACJ,SAAQ,UAAR;EACE,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS,KAAA;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AACH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AAOH,cAAW,MAAM,QAAQ,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,EACrD,KAAK,MAAM,IAAK,GAA+B,QAAQ,CAAC,CACxD,KAAK,KAAK;AACb,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,KAAK;AAGH,aAAU,IAAI,MAAM,QAAQ;AAC5B,SAAM;AACN,YAAS;AACT,WAAQ;AACR,UAAO;AACP;EACF,QACE;;AAEJ,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,KAAI,QAAQ,SAAU,sBAAqB,MAAM,QAAQ;CAEzD,IAAI,UAAU,MAAM,cAAc,SAAS,KAAK,OAAO;AACvD,KAAI,QAAQ,YAAY,0BAA0B,IAAI,MAAM,KAAK,CAAC,CAChE,WAAU,QAAQ,QAAQ,MAAM,EAAE,SAAS,aAAa,cAAc;CAGxE,MAAM,WACJ,aAAa,oBACT,qBAAqB,QAAQ,GAC7B,QAAQ,MAAM;AAEpB,oBACE,OACA,MACA,QAAQ,IAAI,kBAAkB,EAC9B,WAAW,YAAY,SACxB;AACD,KAAI,CAAC,SAAU,QAAO,KAAA;AAGtB,QAAO,kBADS,eAAe,QAAQ,UAAU,QAAQ,IAAI,GAC3B,UAAU,aAAa,SAAS,CAAC;;;;;;;AAQrE,eAAsB,iBACpB,UACA,OACA,MAAuB,EAAE,EACzB,aACuB;AACvB,KAAI;EACF,MAAM,SAAS,mBAAmB,UAAU,MAAM;EAClD,MAAM,WAAW,iBAAiB,OAAO,MAAM,OAAO,OAAO;GAC3D,iBAAiB,IAAI;GACrB,kBAAkB,IAAI,uBAAuB,IAAI;GAClD,CAAC;EAIF,MAAM,uBACJ,aAAa,UACb,oBAAoB,IAAI,MAAM,QAAQ,EAAE,IAAI,iBAAiB;AAE/D,MAAI,SAAS,aAAa,UAAU,CAAC,qBACnC,QAAO;GAAE,OAAO;GAAM,QAAQ,SAAS;GAAS;EAGlD,MAAM,aAAa,MAAM,sBACvB,UACA,OACA,aACA,IAAI,cACL;AACD,MAAI,WAAY,QAAO;GAAE,OAAO;GAAM,QAAQ;GAAY;AAE1D,MAAI,aAAa,SAAS;GACxB,MAAM,eAAe,MAAM,qBACzB,OACA,IAAI,iBACL;AACD,OAAI,aAAc,QAAO;IAAE,OAAO;IAAM,QAAQ;IAAc;;AAGhE,SAAO,EAAE,OAAO,OAAO;UAChB,KAAK;AACZ,YAAU,8CAA8C,IAAI;AAG5D,SAAO;GACL,OAAO;GACP,QAAQ;GACR,WAAW,aAAa;GACzB;;;;AAKL,SAAS,eAAe,UAA2B;AACjD,QAAO,aAAa,UAAU,aAAa;;;;;;;AAe7C,SAAgB,wBAAwB,MAAuB,EAAE,EAG/D;CACA,MAAM,QAAuB;EAC3B,mBAAmB;EACnB,cAAc;EACd,WAAW;EACZ;CAID,MAAM,cAAc,IAAI;CAIxB,MAAM,UAA2B;EAC/B,GAAG;EACH,eAAe,IAAI,iBAAiB,0BAA0B;EAC/D;CAED,MAAM,WAAW,OAAiC;AAChD,KAAG,GAAG,aAAa,OAAO,UAAU;AAElC,OAAI,MAAM,kBACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;AAEH,SAAM,aAAa;AACnB,OAAI,MAAM,YAAA,IACR,QAAO;IACL,OAAO;IACP,QAAQ;IACT;GAEH,MAAM,WAAW,MAAM,iBACrB,MAAM,UACN,MAAM,SAAS,EAAE,EACjB,SACA,YACD;AACD,OAAI,SAAS,OAAO;AAClB,UAAM,gBAAgB;AACtB,QAAI,SAAS,UAAW,OAAM,oBAAoB;AAClD,cAAU,uBAAuB,MAAM,SAAS,IAAI,SAAS,SAAS;AACtE,WAAO;KAAE,OAAO;KAAM,QAAQ,SAAS;KAAQ;;AAEjD,UAAO,EAAE;IACT;AAEF,KAAG,GAAG,eAAe,OAAO,UAAU;AACpC,OAAI,CAAC,eAAe,MAAM,SAAS,CAAE,QAAO,EAAE;GAC9C,MAAM,QAAQ,MAAM,WAAW,EAAE,EAC9B,KAAK,MAAO,KAAK,EAAE,SAAS,SAAS,EAAE,OAAO,GAAI,CAClD,KAAK,KAAK;AACb,OAAI,CAAC,KAAM,QAAO,EAAE;AACpB,OAAI;IAGF,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,YAAY;IAC/D,MAAM,UAAU,YAAY,QAAQ;AAEpC,uBACE,eACA,MAAM,aAAa,SAAS,SAAS,QACrC,QAAQ,IAAI,kBAAkB,EAC9B,SAAS,UAAU,SACpB;AACD,QAAI,CAAC,QAAS,QAAO,EAAE;AACvB,QAAI,QAAQ,UAAU;AACpB,WAAM,oBAAoB;AAC1B,eACE,qCAAqC,MAAM,SAAS,IAAI,QAAQ,MAAM,OACvE;UAED,WACE,mCAAmC,MAAM,SAAS,IAChD,QAAQ,MAAM,KACf,cAAc,QAAQ,MAAM,SAAS,YAAY,UAAU,GAC7D;YAEI,KAAK;AAEZ,UAAM,oBAAoB;AAC1B,cAAU,mDAAmD,IAAI;;AAEnE,UAAO,EAAE;IACT;;AAGJ,QAAO;EAAE;EAAS;EAAO"}

package/dist/{setup-utils-DeIoqwPw.js → setup-utils-Bo3WZt3a.js}

@@ -1,13 +1,13 @@
 import { t as __exportAll } from "./rolldown-runtime-B_-DWIq7.js";
-import { H as POSTHOG_DEV_CLIENT_ID, I as ISSUES_URL, R as OAUTH_PORTS, X as POSTHOG_STATUS_PAGE_URL, Y as POSTHOG_PROXY_CLIENT_ID, f as getUI, k as DUMMY_PROJECT_API_KEY, ot as WIZARD_OAUTH_SCOPES, pt as WIZARD_USER_AGENT, rt as WIZARD_CONTACT_EMAIL, s as logToFile, ut as WIZARD_PROVISIONING_SCOPES, z as OAUTH_TIMEOUT_MS } from "./debug-D5YT7Lil.js";
+import { H as POSTHOG_DEV_CLIENT_ID, I as ISSUES_URL, R as OAUTH_PORTS, X as POSTHOG_STATUS_PAGE_URL, Y as POSTHOG_PROXY_CLIENT_ID, f as getUI, k as DUMMY_PROJECT_API_KEY, ot as WIZARD_OAUTH_SCOPES, pt as WIZARD_USER_AGENT, rt as WIZARD_CONTACT_EMAIL, s as logToFile, ut as WIZARD_PROVISIONING_SCOPES, z as OAUTH_TIMEOUT_MS } from "./debug-BM0fZaGl.js";
 import { n as MCP_LOCAL_URL } from "./local-dev-DPZiIPCK.js";
 import "./wizard-session-Bki7dQhv.js";
-import { n as analytics } from "./analytics-DXPSL5IY.js";
-import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-DfZNqwpb.js";
-import { r as readFileHead } from "./bounded-fs-DdHuSE1X.js";
-import { a as detectRegion, c as getLlmGatewayUrl, d as resolveBaseUrl, l as getOAuthUrl, n as provisionNewAccount, o as getCloudUrl, s as getHost, t as ProvisionedAccountUnreadableError, u as getUiHostFromHost } from "./provisioning-DoKcXygK.js";
-import { a as fetchUserData, r as fetchProjectData } from "./api-CeapT_rn.js";
-import { i as wizardAbort } from "./wizard-abort-XQFt0vkZ.js";
+import { n as analytics } from "./analytics-DTyJClPr.js";
+import { i as withUtm, n as openTrackedLink, t as withProgress } from "./telemetry-CickTk_7.js";
+import { r as readFileHead } from "./bounded-fs-BWX25ixc.js";
+import { a as detectRegion, c as getLlmGatewayUrl, d as resolveBaseUrl, l as getOAuthUrl, n as provisionNewAccount, o as getCloudUrl, s as getHost, t as ProvisionedAccountUnreadableError, u as getUiHostFromHost } from "./provisioning-Di5GNV9k.js";
+import { a as fetchUserData, r as fetchProjectData } from "./api-j-OfJ8Dz.js";
+import { i as wizardAbort } from "./wizard-abort-CooWEh9N.js";
 import { major, minVersion } from "semver";
 import * as fs$2 from "fs";
 import * as path$2 from "path";
@@ -1427,4 +1427,4 @@ async function askForProvisioningSignup(email, region, baseUrl, localMcp, progra
 //#endregion
 export { createVersionBucket as a, mcpUrlFor as c, tryGetPackageJson as i, detectAllPackageManagers as l, isUsingTypeScript as n, extractOAuthCode as o, setup_utils_exports as r, HostResolution as s, getOrAskForProjectData as t };
 
-//# sourceMappingURL=setup-utils-DeIoqwPw.js.map
+//# sourceMappingURL=setup-utils-Bo3WZt3a.js.map