@pushary/agent-hooks 0.28.1 → 0.28.2

package/dist/chunk-BYNYYZWW.js

@@ -1,412 +0,0 @@
-import {
-  DEFAULT_SESSION,
-  cancelQuestion,
-  deriveReceiptMeta,
-  describeToolCall,
-  fetchModeState,
-  getMachineId,
-  isDefaultSession,
-  isPolicyConfig,
-  isToolResultError,
-  listPendingQuestions,
-  removePendingQuestion,
-  removePendingSession,
-  resolvePolicy
-} from "./chunk-6QWFMVCD.js";
-import {
-  withRetry
-} from "./chunk-DWED7BS3.js";
-import {
-  getApiKey,
-  getBaseUrl
-} from "./chunk-NKXSILEW.js";
-
-// src/codex-adapter.ts
-import { resolve } from "path";
-var CODEX_AGENT = { type: "codex", label: "Codex" };
-var codexAllow = () => ({ kind: "allow" });
-var codexDeny = (reason) => ({ kind: "deny", reason });
-var codexPass = () => ({ kind: "pass" });
-var toCodexWire = (event, decision) => {
-  if (event === "PermissionRequest") {
-    if (decision.kind === "allow") {
-      return {
-        hookSpecificOutput: {
-          hookEventName: "PermissionRequest",
-          decision: { behavior: "allow" }
-        }
-      };
-    }
-    if (decision.kind === "deny") {
-      return {
-        hookSpecificOutput: {
-          hookEventName: "PermissionRequest",
-          decision: { behavior: "deny", message: decision.reason }
-        }
-      };
-    }
-    return null;
-  }
-  if (event === "PreToolUse" && decision.kind === "deny") {
-    return {
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: decision.reason
-      }
-    };
-  }
-  return null;
-};
-var parseApplyPatchOps = (command) => {
-  if (typeof command !== "string") return [];
-  const ops = [];
-  for (const line of command.split("\n")) {
-    const file = line.match(/^\*\*\*\s+(Add|Update|Delete) File:\s+(.+?)\s*$/);
-    if (file) {
-      ops.push({ op: file[1].toLowerCase(), path: file[2] });
-      continue;
-    }
-    const move = line.match(/^\*\*\*\s+Move to:\s+(.+?)\s*$/);
-    if (move) ops.push({ op: "move", path: move[1] });
-  }
-  return ops;
-};
-var parseApplyPatchFiles = (command) => [...new Set(parseApplyPatchOps(command).map((entry) => entry.path))];
-var describeApplyPatch = (command) => {
-  const ops = parseApplyPatchOps(command);
-  if (ops.length === 0) return null;
-  const files = [...new Set(ops.map((entry) => entry.path))];
-  if (files.length === 1) {
-    const verb = ops[0].op === "add" ? "create" : ops[0].op === "delete" ? "delete" : ops[0].op === "move" ? "move" : "edit";
-    return `${verb} file: ${files[0]}`;
-  }
-  return `apply patch to ${files.length} files`;
-};
-var toPolicyLookup = (toolName, toolInput, cwd) => {
-  if (toolName !== "apply_patch") return { tool: toolName, input: toolInput };
-  const command = toolInput.command;
-  const files = parseApplyPatchFiles(command);
-  if (files.length === 1) {
-    return { tool: "Edit", input: { file_path: cwd ? resolve(cwd, files[0]) : files[0] } };
-  }
-  return { tool: "Edit", input: typeof command === "string" ? { file_path: command } : {} };
-};
-var permissionTimeoutDecision = (timeoutAction) => {
-  if (timeoutAction === "approve") return codexAllow();
-  if (timeoutAction === "deny") return codexDeny("No response within timeout");
-  return codexPass();
-};
-var preToolUseTimeoutDecision = (timeoutAction, denyReason = "No response within timeout") => timeoutAction === "deny" ? codexDeny(denyReason) : codexPass();
-
-// src/usage.ts
-import { closeSync, mkdirSync, openSync, readFileSync, readSync, statSync, writeFileSync } from "fs";
-import { join } from "path";
-import { tmpdir } from "os";
-var DEFAULT_PRICES = [
-  { match: "opus-4-1", in: 15, out: 75 },
-  { match: "opus-4-0", in: 15, out: 75 },
-  { match: "3-opus", in: 15, out: 75 },
-  { match: "opus", in: 5, out: 25 },
-  { match: "haiku", in: 1, out: 5 },
-  { match: "sonnet", in: 3, out: 15 }
-];
-var FALLBACK_PRICE = { match: "", in: 3, out: 15 };
-var CACHE_WRITE_MULTIPLIER = 1.25;
-var CACHE_READ_MULTIPLIER = 0.1;
-var RECENT_ID_LIMIT = 200;
-var READ_CHUNK_BYTES = 1024 * 1024;
-var isModelPrice = (value) => {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return typeof candidate.match === "string" && typeof candidate.in === "number" && typeof candidate.out === "number";
-};
-var priceTable = () => {
-  const raw = process.env.PUSHARY_MODEL_PRICING?.trim();
-  if (!raw) return DEFAULT_PRICES;
-  try {
-    const parsed = JSON.parse(raw);
-    if (Array.isArray(parsed) && parsed.length > 0 && parsed.every(isModelPrice)) return parsed;
-  } catch {
-  }
-  return DEFAULT_PRICES;
-};
-var estimateCostUsd = (usage, model) => {
-  const price = priceTable().find((p) => model.includes(p.match)) ?? FALLBACK_PRICE;
-  const perTokenIn = price.in / 1e6;
-  const perTokenOut = price.out / 1e6;
-  return usage.inputTokens * perTokenIn + usage.outputTokens * perTokenOut + usage.cacheCreationTokens * perTokenIn * CACHE_WRITE_MULTIPLIER + usage.cacheReadTokens * perTokenIn * CACHE_READ_MULTIPLIER;
-};
-var stateDir = () => process.env.PUSHARY_USAGE_DIR?.trim() || join(tmpdir(), "pushary-usage");
-var stateFile = (sessionId) => join(stateDir(), sessionId.replace(/[^a-zA-Z0-9_-]/g, "_"));
-var emptyState = () => ({ offset: 0, tokensIn: 0, tokensOut: 0, costUsd: 0, recentIds: [] });
-var readState = (path) => {
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
-    if (typeof parsed.offset === "number" && parsed.offset >= 0 && typeof parsed.tokensIn === "number" && typeof parsed.tokensOut === "number" && typeof parsed.costUsd === "number" && Array.isArray(parsed.recentIds)) {
-      return {
-        offset: parsed.offset,
-        tokensIn: parsed.tokensIn,
-        tokensOut: parsed.tokensOut,
-        costUsd: parsed.costUsd,
-        recentIds: parsed.recentIds.filter((id) => typeof id === "string")
-      };
-    }
-  } catch {
-  }
-  return emptyState();
-};
-var readRange = (path, start, end) => {
-  const fd = openSync(path, "r");
-  try {
-    const chunks = [];
-    let position = start;
-    while (position < end) {
-      const length = Math.min(READ_CHUNK_BYTES, end - position);
-      const buffer = Buffer.alloc(length);
-      const bytesRead = readSync(fd, buffer, 0, length, position);
-      if (bytesRead <= 0) break;
-      chunks.push(buffer.subarray(0, bytesRead));
-      position += bytesRead;
-    }
-    return Buffer.concat(chunks);
-  } finally {
-    closeSync(fd);
-  }
-};
-var toCount = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
-var applyLine = (state, line) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return 0;
-  }
-  if (parsed.type !== "assistant") return 0;
-  const usage = parsed.message?.usage;
-  if (!usage || typeof usage !== "object") return 0;
-  const model = typeof parsed.message?.model === "string" ? parsed.message.model : "";
-  if (model.includes("<synthetic>")) return 0;
-  const id = typeof parsed.message?.id === "string" ? parsed.message.id : null;
-  if (id) {
-    if (state.recentIds.includes(id)) return 0;
-    state.recentIds.push(id);
-    if (state.recentIds.length > RECENT_ID_LIMIT) state.recentIds.splice(0, state.recentIds.length - RECENT_ID_LIMIT);
-  }
-  const messageUsage = {
-    inputTokens: toCount(usage.input_tokens),
-    outputTokens: toCount(usage.output_tokens),
-    cacheCreationTokens: toCount(usage.cache_creation_input_tokens),
-    cacheReadTokens: toCount(usage.cache_read_input_tokens)
-  };
-  const cost = estimateCostUsd(messageUsage, model);
-  state.tokensIn += messageUsage.inputTokens + messageUsage.cacheCreationTokens + messageUsage.cacheReadTokens;
-  state.tokensOut += messageUsage.outputTokens;
-  state.costUsd += cost;
-  return cost;
-};
-var readNewUsage = (transcriptPath, sessionId) => {
-  try {
-    const size = statSync(transcriptPath).size;
-    const path = stateFile(sessionId);
-    let state = readState(path);
-    if (size < state.offset) state = { ...emptyState(), recentIds: state.recentIds };
-    let deltaUsd = 0;
-    if (size > state.offset) {
-      const buffer = readRange(transcriptPath, state.offset, size);
-      const lastNewline = buffer.lastIndexOf(10);
-      if (lastNewline >= 0) {
-        const complete = buffer.subarray(0, lastNewline + 1);
-        for (const line of complete.toString("utf-8").split("\n")) {
-          if (line.trim()) deltaUsd += applyLine(state, line);
-        }
-        state.offset += lastNewline + 1;
-      }
-    }
-    mkdirSync(stateDir(), { recursive: true });
-    writeFileSync(path, JSON.stringify(state), "utf-8");
-    if (state.tokensIn === 0 && state.tokensOut === 0) return null;
-    return {
-      tokensIn: state.tokensIn,
-      tokensOut: state.tokensOut,
-      costUsd: state.costUsd,
-      deltaUsd
-    };
-  } catch {
-    return null;
-  }
-};
-
-// src/events.ts
-import { basename, join as join2 } from "path";
-import { createHash } from "crypto";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-var cleanupPendingQuestions = async (sessionId) => {
-  try {
-    const files = listPendingQuestions(sessionId);
-    const apiKey = getApiKey();
-    for (const correlationId of files) {
-      try {
-        await cancelQuestion(apiKey, correlationId);
-      } catch {
-      }
-      removePendingQuestion(sessionId, correlationId);
-    }
-    if (!isDefaultSession(sessionId)) removePendingSession(sessionId);
-  } catch {
-  }
-};
-var CLAUDE_CODE_AGENT = { type: "claude_code", label: "Claude Code" };
-var POLICY_CACHE_TTL_MS = 5 * 60 * 1e3;
-var readFreshCachedPolicy = (apiKey) => {
-  const hash = createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
-  const path = join2(tmpdir2(), `pushary-policy-${hash}.json`);
-  if (!existsSync(path)) return null;
-  const cached = JSON.parse(readFileSync2(path, "utf-8"));
-  if (!isPolicyConfig(cached)) return null;
-  if (!cached._cachedAt || Date.now() - cached._cachedAt >= POLICY_CACHE_TTL_MS) return null;
-  return cached;
-};
-var deriveDecisionSource = (toolName, toolInput, liveMode) => {
-  try {
-    if (liveMode.kill) return "terminal";
-    const policy = readFreshCachedPolicy(getApiKey());
-    if (!policy) return void 0;
-    const resolved = resolvePolicy(policy, toolName, liveMode.mode, toolInput);
-    if (resolved.timeoutSeconds === 0 && resolved.timeoutAction === "approve") return "policy_auto";
-    if (resolved.mode === "push_only" || resolved.mode === "push_first") return "human";
-    return "terminal";
-  } catch {
-    return void 0;
-  }
-};
-var deriveUsage = (transcriptPath, sessionId) => {
-  if (!transcriptPath || process.env.PUSHARY_COST_TRACKING === "off") return void 0;
-  try {
-    return readNewUsage(transcriptPath, sessionId || DEFAULT_SESSION) ?? void 0;
-  } catch {
-    return void 0;
-  }
-};
-var reportEvent = async (event, options = {}) => {
-  const apiKey = getApiKey();
-  const baseUrl = getBaseUrl();
-  return withRetry(async () => {
-    const res = await fetch(`${baseUrl}/api/agent/event`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${apiKey}`
-      },
-      body: JSON.stringify({
-        ...event,
-        machineId: event.machineId ?? getMachineId()
-      }),
-      signal: AbortSignal.timeout(options.timeoutMs ?? 1e4)
-    });
-    try {
-      return await res.json();
-    } catch {
-      return null;
-    }
-  }, { maxAttempts: options.maxAttempts ?? 2, baseDelayMs: 300 });
-};
-var handlePostToolUse = async (input, agent = CLAUDE_CODE_AGENT) => {
-  try {
-    const projectName = basename(input.cwd ?? process.cwd());
-    const action = describeToolCall(input.tool_name, input.tool_input, "event");
-    const lookup = toPolicyLookup(input.tool_name, input.tool_input);
-    const isError = isToolResultError(input.tool_result);
-    const receiptsEnabled = process.env.PUSHARY_RECEIPTS !== "off";
-    const liveMode = await fetchModeState(getApiKey(), input.session_id);
-    await Promise.allSettled([
-      cleanupPendingQuestions(input.session_id || DEFAULT_SESSION),
-      reportEvent({
-        event: isError ? "tool_error" : "tool_complete",
-        agentType: agent.type,
-        agentName: `${agent.label} - ${projectName}`,
-        action,
-        sessionId: input.session_id,
-        error: isError ? String(input.tool_result?.error ?? input.tool_result?.stderr ?? "").slice(0, 500) : void 0,
-        decisionSource: deriveDecisionSource(lookup.tool, lookup.input, liveMode),
-        meta: receiptsEnabled ? deriveReceiptMeta(lookup.tool, lookup.input, input.tool_result, input.cwd ?? process.cwd()) : void 0,
-        usage: deriveUsage(input.transcript_path, input.session_id)
-      })
-    ]);
-  } catch {
-  }
-};
-var TASK_TITLE_MAX_LENGTH = 120;
-var handleUserPrompt = async (input, agent = CLAUDE_CODE_AGENT) => {
-  try {
-    const projectName = basename(input.cwd ?? process.cwd());
-    const titlesEnabled = process.env.PUSHARY_TASK_TITLES !== "off";
-    const taskTitle = titlesEnabled ? input.prompt?.replace(/\s+/g, " ").trim().slice(0, TASK_TITLE_MAX_LENGTH) || void 0 : void 0;
-    await reportEvent({
-      event: "user_prompt",
-      agentType: agent.type,
-      agentName: `${agent.label} - ${projectName}`,
-      sessionId: input.session_id,
-      taskTitle
-    }, { maxAttempts: 1, timeoutMs: 800 });
-  } catch {
-  }
-};
-var handleStop = async (input, agent = CLAUDE_CODE_AGENT) => {
-  try {
-    const projectName = basename(input.cwd ?? process.cwd());
-    const [, reported] = await Promise.allSettled([
-      cleanupPendingQuestions(input.session_id || DEFAULT_SESSION),
-      reportEvent({
-        event: "session_end",
-        agentType: agent.type,
-        agentName: `${agent.label} - ${projectName}`,
-        action: "Session ended",
-        sessionId: input.session_id,
-        usage: deriveUsage(input.transcript_path, input.session_id)
-      })
-    ]);
-    const pendingCommand = reported.status === "fulfilled" ? reported.value?.pendingCommand : void 0;
-    if (typeof pendingCommand === "string" && pendingCommand.trim().length > 0) {
-      return {
-        decision: "block",
-        reason: `The user sent a new instruction from their phone via Pushary: ${pendingCommand.trim()}`
-      };
-    }
-    return void 0;
-  } catch {
-    return void 0;
-  }
-};
-var handleNotification = async (input) => {
-  try {
-    const projectName = basename(input.cwd ?? process.cwd());
-    await reportEvent({
-      event: input.type === "error" ? "error" : "notification",
-      agentType: "claude_code",
-      agentName: `Claude Code - ${projectName}`,
-      action: input.title ?? input.message ?? "Notification",
-      sessionId: input.session_id,
-      error: input.type === "error" ? input.message : void 0
-    });
-  } catch {
-  }
-};
-
-export {
-  CODEX_AGENT,
-  codexAllow,
-  codexDeny,
-  codexPass,
-  toCodexWire,
-  describeApplyPatch,
-  toPolicyLookup,
-  permissionTimeoutDecision,
-  preToolUseTimeoutDecision,
-  reportEvent,
-  handlePostToolUse,
-  handleUserPrompt,
-  handleStop,
-  handleNotification
-};

package/dist/chunk-C4BMEVK7.js

@@ -1,208 +0,0 @@
-// ../contracts/src/index.ts
-var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
-var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
-var HOOK_BUDGETS = {
-  claude: { budgetSeconds: 120, guardSeconds: 10 },
-  codex: { budgetSeconds: 180, guardSeconds: 10 },
-  gemini: { budgetSeconds: 180, guardSeconds: 10 },
-  // The Cursor gate is a dependency-free .mjs that cannot import this module; it
-  // mirrors these as MAX_BLOCK_MS (45s) inside its 60s failClosed budget.
-  cursor: { budgetSeconds: 60, guardSeconds: 15 }
-};
-var hookMaxWaitSeconds = (agent) => Math.max(HOOK_BUDGETS[agent].budgetSeconds - HOOK_BUDGETS[agent].guardSeconds, 1);
-var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
-  const maxWait = hookMaxWaitSeconds(agent);
-  return Math.min(
-    nowMs + Math.min(Math.max(policyWaitSeconds, 0), maxWait) * 1e3,
-    startMs + maxWait * 1e3
-  );
-};
-var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
-var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
-var MATCH_RANKS = ["none", "tool", "prefix", "exact"];
-var matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank);
-var matchToolPattern = (pattern, toolName, arg) => {
-  const open = pattern.indexOf("(");
-  if (open === -1 || !pattern.endsWith(")")) {
-    return pattern === toolName ? "tool" : "none";
-  }
-  if (pattern.slice(0, open) !== toolName || arg === void 0) return "none";
-  const inner = pattern.slice(open + 1, -1);
-  if (inner.endsWith(":*")) {
-    return arg.startsWith(inner.slice(0, -2)) ? "prefix" : "none";
-  }
-  return arg === inner ? "exact" : "none";
-};
-var POLICY_ARG_KEYS = {
-  Bash: "command",
-  Edit: "file_path",
-  Write: "file_path"
-};
-var extractPolicyArg = (toolName, toolInput) => {
-  const key = POLICY_ARG_KEYS[toolName];
-  if (!key) return void 0;
-  const value = toolInput[key];
-  return typeof value === "string" ? value : void 0;
-};
-var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
-  "ls",
-  "pwd",
-  "cd",
-  "cat",
-  "head",
-  "tail",
-  "wc",
-  "echo",
-  "printf",
-  "which",
-  "type",
-  "whoami",
-  "id",
-  "uname",
-  "arch",
-  "printenv",
-  "locale",
-  "tty",
-  "dirname",
-  "basename",
-  "realpath",
-  "readlink",
-  "stat",
-  "cut",
-  "nl",
-  "tr",
-  "comm",
-  "diff",
-  "cmp",
-  "grep",
-  "egrep",
-  "fgrep",
-  "jq",
-  "cksum",
-  "md5sum",
-  "sha1sum",
-  "sha256sum",
-  "du",
-  "df",
-  "ps",
-  "true"
-]);
-var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "status",
-  "log",
-  "diff",
-  "show",
-  "rev-parse",
-  "describe",
-  "blame",
-  "shortlog",
-  "ls-files",
-  "ls-tree",
-  "cat-file",
-  "whatchanged",
-  "rev-list",
-  "name-rev",
-  "for-each-ref",
-  "var",
-  "count-objects"
-]);
-var GIT_WRITE_FLAGS = (token) => token === "--output" || token.startsWith("--output=");
-var UNSAFE_SHELL_CHARS = /[;&|<>(){}`\\\n\r]/;
-var basenameOf = (token) => {
-  const slash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
-  return slash === -1 ? token : token.slice(slash + 1);
-};
-var tokenizeShellCommand = (command) => {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  let started = false;
-  for (const ch of command) {
-    if (quote) {
-      if (ch === quote) quote = null;
-      else current += ch;
-      started = true;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      started = true;
-      continue;
-    }
-    if (ch === " " || ch === "	") {
-      if (started) {
-        tokens.push(current);
-        current = "";
-        started = false;
-      }
-      continue;
-    }
-    current += ch;
-    started = true;
-  }
-  if (quote) return null;
-  if (started) tokens.push(current);
-  return tokens;
-};
-var isSafeReadOnlyCommand = (command) => {
-  const trimmed = command.trim();
-  if (!trimmed || trimmed.length > 2e3) return false;
-  if (UNSAFE_SHELL_CHARS.test(trimmed)) return false;
-  const tokens = tokenizeShellCommand(trimmed);
-  if (!tokens || tokens.length === 0) return false;
-  const first = tokens[0];
-  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first) || first.includes("$")) return false;
-  const exe = basenameOf(first);
-  if (exe === "git") {
-    const sub = tokens[1];
-    if (!sub || sub.startsWith("-")) return false;
-    if (!SAFE_GIT_SUBCOMMANDS.has(sub)) return false;
-    return !tokens.some(GIT_WRITE_FLAGS);
-  }
-  return SAFE_SHELL_COMMANDS.has(exe);
-};
-var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
-var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
-var ACTION_BODY_MAX = 4e3;
-var DECISION_LINE_MAX = 500;
-var SECRET_REDACTION_RULES = [
-  { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
-  { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: "[redacted]" },
-  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[redacted]" },
-  { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
-  { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
-  { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
-  { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
-  { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" },
-  {
-    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi,
-    replacement: "$1[redacted]"
-  }
-];
-var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
-var redactSecrets = (text) => SECRET_REDACTION_RULES.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
-var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
-
-export {
-  isApprovalMode,
-  HOOK_BUDGETS,
-  hookWaitDeadline,
-  hookWaitClamped,
-  effectiveWaitSeconds,
-  matchRankWeight,
-  matchToolPattern,
-  extractPolicyArg,
-  isSafeReadOnlyCommand,
-  isValidApiKey,
-  ACTION_BODY_MAX,
-  DECISION_LINE_MAX,
-  redactSecrets,
-  redactSecretsDeep
-};