@pushary/agent-hooks 0.49.1 → 0.51.0

package/dist/chunk-CJBVT33U.js

@@ -0,0 +1,595 @@
+// ../contracts/src/index.ts
+var APPROVAL_MODES = ["push_only", "terminal_only", "push_first", "notify_only"];
+var isApprovalMode = (value) => typeof value === "string" && APPROVAL_MODES.includes(value);
+var HOOK_BUDGETS = {
+  claude: { budgetSeconds: 120, guardSeconds: 10 },
+  codex: { budgetSeconds: 180, guardSeconds: 10 },
+  gemini: { budgetSeconds: 180, guardSeconds: 10 },
+  // The Cursor gate is a dependency-free .mjs that cannot import this module; it
+  // mirrors these as MAX_BLOCK_MS (45s) inside its 60s failClosed budget.
+  cursor: { budgetSeconds: 60, guardSeconds: 15 }
+};
+var hookMaxWaitSeconds = (agent) => Math.max(HOOK_BUDGETS[agent].budgetSeconds - HOOK_BUDGETS[agent].guardSeconds, 1);
+var hookWaitDeadline = (startMs, policyWaitSeconds, agent, nowMs) => {
+  const maxWait = hookMaxWaitSeconds(agent);
+  return Math.min(
+    nowMs + Math.min(Math.max(policyWaitSeconds, 0), maxWait) * 1e3,
+    startMs + maxWait * 1e3
+  );
+};
+var hookWaitClamped = (startMs, policyWaitSeconds, agent, nowMs) => startMs + hookMaxWaitSeconds(agent) * 1e3 < nowMs + Math.max(policyWaitSeconds, 0) * 1e3;
+var effectiveWaitSeconds = (timeoutAction, policySeconds, agent) => timeoutAction === "wait" ? hookMaxWaitSeconds(agent) : policySeconds;
+var MATCH_RANKS = ["none", "tool", "prefix", "exact"];
+var matchRankWeight = (rank) => MATCH_RANKS.indexOf(rank);
+var matchToolPattern = (pattern, toolName, arg) => {
+  const open = pattern.indexOf("(");
+  if (open === -1 || !pattern.endsWith(")")) {
+    return pattern === toolName ? "tool" : "none";
+  }
+  if (pattern.slice(0, open) !== toolName || arg === void 0) return "none";
+  const inner = pattern.slice(open + 1, -1);
+  if (inner.endsWith(":*")) {
+    return arg.startsWith(inner.slice(0, -2)) ? "prefix" : "none";
+  }
+  return arg === inner ? "exact" : "none";
+};
+var POLICY_ARG_KEYS = {
+  Bash: "command",
+  Edit: "file_path",
+  Write: "file_path"
+};
+var extractPolicyArg = (toolName, toolInput) => {
+  const key = POLICY_ARG_KEYS[toolName];
+  if (!key) return void 0;
+  const value = toolInput[key];
+  return typeof value === "string" ? value : void 0;
+};
+var SAFE_SHELL_COMMANDS = /* @__PURE__ */ new Set([
+  "ls",
+  "pwd",
+  "cd",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "echo",
+  "printf",
+  "which",
+  "type",
+  "whoami",
+  "id",
+  "uname",
+  "arch",
+  "printenv",
+  "locale",
+  "tty",
+  "dirname",
+  "basename",
+  "realpath",
+  "readlink",
+  "stat",
+  "cut",
+  "nl",
+  "tr",
+  "comm",
+  "diff",
+  "cmp",
+  "grep",
+  "egrep",
+  "fgrep",
+  "jq",
+  "cksum",
+  "md5sum",
+  "sha1sum",
+  "sha256sum",
+  "du",
+  "df",
+  "ps",
+  "true"
+]);
+var SAFE_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "rev-parse",
+  "describe",
+  "blame",
+  "shortlog",
+  "ls-files",
+  "ls-tree",
+  "cat-file",
+  "whatchanged",
+  "rev-list",
+  "name-rev",
+  "for-each-ref",
+  "var",
+  "count-objects"
+]);
+var GIT_WRITE_FLAGS = (token) => token === "--output" || token.startsWith("--output=");
+var DANGEROUS_FIND_ACTIONS = /* @__PURE__ */ new Set([
+  "-exec",
+  "-execdir",
+  "-ok",
+  "-okdir",
+  "-delete",
+  "-fprintf",
+  "-fprint",
+  "-fprint0",
+  "-fls"
+]);
+var SAFE_FIND_TOKENS = /* @__PURE__ */ new Set([
+  "-name",
+  "-iname",
+  "-path",
+  "-ipath",
+  "-wholename",
+  "-iwholename",
+  "-lname",
+  "-ilname",
+  "-regex",
+  "-iregex",
+  "-type",
+  "-xtype",
+  "-maxdepth",
+  "-mindepth",
+  "-depth",
+  "-mount",
+  "-xdev",
+  "-size",
+  "-empty",
+  "-perm",
+  "-readable",
+  "-writable",
+  "-executable",
+  "-mtime",
+  "-mmin",
+  "-atime",
+  "-amin",
+  "-ctime",
+  "-cmin",
+  "-newer",
+  "-newermt",
+  "-anewer",
+  "-cnewer",
+  "-user",
+  "-uid",
+  "-group",
+  "-gid",
+  "-nouser",
+  "-nogroup",
+  "-samefile",
+  "-inum",
+  "-links",
+  "-print",
+  "-print0",
+  "-printf",
+  "-ls",
+  "-quit",
+  "-prune",
+  "-follow",
+  "-noleaf",
+  "-ignore_readdir_race",
+  "-noignore_readdir_race",
+  "-true",
+  "-false",
+  "-not",
+  "-and",
+  "-or",
+  "-o",
+  "-a",
+  "-P",
+  "-L",
+  "-H",
+  "-D",
+  "-O"
+]);
+var SAFE_REDIRECTION = /\s*(?:[0-9]*>&[0-9-]+|(?:[0-9]*|&)>>?\s*\/dev\/null)/g;
+var basenameOf = (token) => {
+  const slash = Math.max(token.lastIndexOf("/"), token.lastIndexOf("\\"));
+  return slash === -1 ? token : token.slice(slash + 1);
+};
+var TRUSTED_EXE_PREFIXES = [
+  "/bin/",
+  "/sbin/",
+  "/usr/bin/",
+  "/usr/sbin/",
+  "/usr/local/bin/",
+  "/opt/homebrew/bin/"
+];
+var isTrustedExecutable = (first) => {
+  if (!first.includes("/")) return true;
+  if (first.includes("..")) return false;
+  return TRUSTED_EXE_PREFIXES.some((prefix) => first.startsWith(prefix));
+};
+var tokenizeShellCommand = (command) => {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let started = false;
+  for (const ch of command) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else current += ch;
+      started = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      if (started) {
+        tokens.push(current);
+        current = "";
+        started = false;
+      }
+      continue;
+    }
+    current += ch;
+    started = true;
+  }
+  if (quote) return null;
+  if (started) tokens.push(current);
+  return tokens;
+};
+var isSafeSimpleCommand = (segment) => {
+  const tokens = tokenizeShellCommand(segment.trim());
+  if (!tokens || tokens.length === 0) return false;
+  const first = tokens[0];
+  if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first) || first.includes("$")) return false;
+  if (!isTrustedExecutable(first)) return false;
+  const exe = basenameOf(first);
+  if (exe === "git") {
+    const sub = tokens[1];
+    if (!sub || sub.startsWith("-")) return false;
+    if (!SAFE_GIT_SUBCOMMANDS.has(sub)) return false;
+    return !tokens.some(GIT_WRITE_FLAGS);
+  }
+  if (exe === "find") {
+    for (let i = 1; i < tokens.length; i += 1) {
+      const t = tokens[i];
+      if (t === "(" || t === ")" || t === "!" || t === "\\(" || t === "\\)" || t === "\\!") continue;
+      if (t.startsWith("-") && (DANGEROUS_FIND_ACTIONS.has(t) || !SAFE_FIND_TOKENS.has(t))) return false;
+    }
+    return true;
+  }
+  return SAFE_SHELL_COMMANDS.has(exe);
+};
+var isSafeReadOnlyCommand = (command) => {
+  const trimmed = command.trim();
+  if (!trimmed || trimmed.length > 2e3) return false;
+  if (/[`\n\r{}]/.test(trimmed)) return false;
+  if (/;|\|\|/.test(trimmed)) return false;
+  if (/\\(?![()!])/.test(trimmed)) return false;
+  if (/(?<!\\)[()]/.test(trimmed)) return false;
+  const noRedir = trimmed.replace(SAFE_REDIRECTION, " ");
+  if (/[<>]/.test(noRedir)) return false;
+  if (noRedir.replace(/&&/g, "  ").includes("&")) return false;
+  for (const andPart of noRedir.split("&&")) {
+    if (!andPart.trim()) return false;
+    for (const segment of andPart.split("|")) {
+      if (!isSafeSimpleCommand(segment)) return false;
+    }
+  }
+  return true;
+};
+var API_KEY_PATTERN = /^pk_[a-f0-9]+\.[a-f0-9]+$/;
+var isValidApiKey = (value) => API_KEY_PATTERN.test(value);
+var ACTION_BODY_MAX = 4e3;
+var DECISION_LINE_MAX = 500;
+var APPROVAL_FATIGUE_FLAG_PATTERNS = [
+  /\brm\s+-[a-z]*r/i,
+  /\brmdir\b/i,
+  /git\s+push[^\n]*(--force|--force-with-lease|\s-f\b)/i,
+  /git\s+reset\s+--hard/i,
+  /git\s+clean\s+-[a-z]*f/i,
+  /\bdrop\s+(table|database|schema)\b/i,
+  /\bdelete\s+from\b/i,
+  /\btruncate\b/i,
+  /\b(deploy|publish|release)\b/i,
+  /\bnpm\s+publish\b/i,
+  /\bsudo\b/i,
+  /chmod\s+-?R?\s*777/i,
+  /\bkubectl\s+delete\b/i,
+  /\bterraform\s+(apply|destroy)\b/i,
+  /\bdocker\s+system\s+prune\b/i
+];
+var DELTA_STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "to",
+  "of",
+  "for",
+  "and",
+  "is",
+  "in",
+  "on",
+  "with"
+]);
+var HIGH_CONSEQUENCE_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /secrets?/i,
+  /credentials?/i,
+  /(^|[\\/])deploy/i,
+  /\.github[\\/]workflows/i,
+  /package\.json/i
+];
+var isCommandTool = (toolName) => {
+  const name = (toolName ?? "").toLowerCase();
+  return name === "bash" || name === "shell" || name === "run_shell_command" || name === "apply_patch" || name.includes("command");
+};
+var normalizeTarget = (toolName, toolTarget, actionBody) => {
+  const command = isCommandTool(toolName);
+  const target = toolTarget ?? "";
+  const body = actionBody ?? "";
+  const commandText = command ? body.length > 0 ? body : target : `${target}
+${body}`;
+  const path = command ? "" : target;
+  const scanText = command ? commandText : `${path}
+${body}`;
+  const highConsequence = HIGH_CONSEQUENCE_PATTERNS.some((re) => re.test(scanText));
+  return { isCommand: command, commandText, path, highConsequence };
+};
+var isDestructive = (toolName, commandText) => {
+  const haystack = `${toolName ?? ""}
+${commandText}`;
+  return APPROVAL_FATIGUE_FLAG_PATTERNS.some((re) => re.test(haystack));
+};
+var addAlnumTokens = (source, set) => {
+  for (const raw of source.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw) set.add(raw);
+  }
+};
+var tokenize = (text) => {
+  const set = /* @__PURE__ */ new Set();
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw && !DELTA_STOPWORDS.has(raw)) set.add(raw);
+  }
+  return set;
+};
+var targetTokenSet = (target) => {
+  const set = /* @__PURE__ */ new Set();
+  if (target.isCommand) {
+    const parts = target.commandText.trim().split(/\s+/).filter(Boolean);
+    if (parts[0]) addAlnumTokens(basenameOf(parts[0]), set);
+    if (parts[1]) addAlnumTokens(basenameOf(parts[1]), set);
+  } else {
+    addAlnumTokens(target.path, set);
+  }
+  return set;
+};
+var intersectionSize = (a, b) => {
+  const [small, large] = a.size <= b.size ? [a, b] : [b, a];
+  let count = 0;
+  for (const token of small) if (large.has(token)) count += 1;
+  return count;
+};
+var computeDeltaSignal = (input) => {
+  const target = normalizeTarget(input.toolName, input.toolTarget, input.actionBody);
+  const destructive = isDestructive(input.toolName, target.commandText);
+  if (!input.intent || input.intent.trim().length === 0) {
+    return { deltaSignal: "unclear", deltaScore: 0, remoteApprove: !destructive };
+  }
+  const intentTokens = tokenize(input.intent);
+  const targetTokens = targetTokenSet(target);
+  const overlap = intersectionSize(intentTokens, targetTokens);
+  const zeroOverlap = overlap === 0 && targetTokens.size > 0;
+  if (zeroOverlap && (destructive || target.highConsequence)) {
+    return { deltaSignal: "mismatch", deltaScore: 1, remoteApprove: false };
+  }
+  if (zeroOverlap) {
+    return { deltaSignal: "unclear", deltaScore: 0.5, remoteApprove: true };
+  }
+  return { deltaSignal: "match", deltaScore: 0, remoteApprove: !destructive };
+};
+var SECRET_REDACTION_RULES = [
+  { pattern: /-----BEGIN[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z0-9 ]*PRIVATE KEY-----/g, replacement: "[redacted key]" },
+  { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b[spr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bwhsec_[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bglpat-[A-Za-z0-9_-]{20,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAIza[A-Za-z0-9_-]{35}\b/g, replacement: "[redacted]" },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[redacted]" },
+  { pattern: /\bnpm_[A-Za-z0-9]{36}\b/g, replacement: "[redacted]" },
+  { pattern: /\bxai-[A-Za-z0-9]{16,}\b/g, replacement: "[redacted]" },
+  { pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, replacement: "[redacted]" },
+  { pattern: /\bbearer\s+[A-Za-z0-9._~+/=-]+/gi, replacement: "bearer [redacted]" },
+  { pattern: /\bauthorization:\s*\S+/gi, replacement: "authorization: [redacted]" },
+  {
+    pattern: /((?:secret|token|password|passwd|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi,
+    replacement: "$1[redacted]"
+  }
+];
+var HIGH_ENTROPY_RULE = { pattern: /[A-Za-z0-9+/]{40,}={0,2}/g, replacement: "[redacted]" };
+var redactSecrets = (text) => SECRET_REDACTION_RULES.reduce((acc, rule) => acc.replace(rule.pattern, rule.replacement), text);
+var redactSecretsDeep = (text) => redactSecrets(text).replace(HIGH_ENTROPY_RULE.pattern, HIGH_ENTROPY_RULE.replacement);
+var classifyDecisionRisk = (toolName, toolTarget) => {
+  const parts = [toolName, toolTarget ?? ""];
+  const matchesAny = (patterns) => parts.some((part) => patterns.some((re) => re.test(part)));
+  if (matchesAny(APPROVAL_FATIGUE_FLAG_PATTERNS)) return "destructive";
+  if (matchesAny(HIGH_CONSEQUENCE_PATTERNS)) return "elevated";
+  return "standard";
+};
+var POLICY_CAPABILITIES = ["read", "edit", "shell", "network", "destructive"];
+var CAPABILITY_PATTERNS = {
+  read: ["Read", "Grep", "Glob", "LS", "NotebookRead"],
+  edit: ["Edit", "Write"],
+  shell: ["Bash"],
+  network: [
+    "WebFetch",
+    "Bash(curl:*)",
+    "Bash(wget:*)",
+    "Bash(nc:*)",
+    "Bash(ssh:*)",
+    "Bash(scp:*)",
+    "Bash(npm install:*)",
+    "Bash(npm i:*)",
+    "Bash(pnpm add:*)",
+    "Bash(yarn add:*)",
+    "Bash(bun add:*)",
+    "Bash(pip install:*)",
+    "Bash(brew install:*)",
+    "Bash(apt:*)",
+    "Bash(apt-get:*)"
+  ],
+  destructive: [
+    "Bash(rm:*)",
+    "Bash(rmdir:*)",
+    "Bash(sudo:*)",
+    "Bash(git push:*)",
+    "Bash(git reset --hard:*)",
+    "Bash(git clean:*)",
+    "Bash(npm publish:*)",
+    "Bash(kubectl delete:*)",
+    "Bash(terraform apply:*)",
+    "Bash(terraform destroy:*)",
+    "Bash(docker system prune:*)",
+    "Bash(dropdb:*)",
+    "Bash(mkfs:*)"
+  ]
+};
+var DECISION_EPISODE_SCHEMA_VERSION = 1;
+var DECISION_FEATURE_EXTRACTOR = `pushary-hooks/schema-${DECISION_EPISODE_SCHEMA_VERSION}`;
+var EPISODE_CAPABILITIES = [...POLICY_CAPABILITIES, "other"];
+var NETWORK_COMMAND_PATTERNS = [
+  /\bcurl\b/i,
+  /\bwget\b/i,
+  /\bnc\b/i,
+  /\bssh\b/i,
+  /\bscp\b/i,
+  /\b(?:npm|pnpm|yarn|bun)\s+(?:install|i|add)\b/i,
+  /\bpip\s+install\b/i,
+  /\bbrew\s+install\b/i,
+  /\bapt(?:-get)?\s+(?:install|update|upgrade)\b/i
+];
+var SECRET_TARGET_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /secrets?/i,
+  /credentials?/i,
+  /private[_-]?key/i,
+  /\.pem$/i
+];
+var READ_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.read);
+var EDIT_TOOL_NAMES = new Set(CAPABILITY_PATTERNS.edit);
+var deriveEpisodeCapability = (toolName, commandText) => {
+  if (READ_TOOL_NAMES.has(toolName)) return "read";
+  if (EDIT_TOOL_NAMES.has(toolName)) return "edit";
+  if (toolName === "WebFetch" || toolName === "WebSearch") return "network";
+  if (isCommandTool(toolName)) {
+    if (isDestructive(toolName, commandText)) return "destructive";
+    if (NETWORK_COMMAND_PATTERNS.some((re) => re.test(commandText))) return "network";
+    return "shell";
+  }
+  if (isDestructive(toolName, commandText)) return "destructive";
+  return "other";
+};
+var deriveTargetClass = (path) => {
+  const p = path.toLowerCase();
+  if (!p) return "other";
+  if (SECRET_TARGET_PATTERNS.some((re) => re.test(p))) return "secret";
+  if (/(^|[\\/])(?:tests?|__tests__|spec)([\\/]|$)|\.(?:test|spec)\.[a-z0-9]+$/i.test(p)) return "test";
+  if (/\.(?:md|mdx|txt|rst)$|(^|[\\/])docs?([\\/]|$)/i.test(p)) return "docs";
+  if (/(^|[\\/])(?:package\.json|tsconfig[^\\/]*\.json|\.[a-z]+rc)$|\.(?:json|ya?ml|toml|ini|conf|cfg)$/i.test(p)) return "config";
+  if (/\.(?:ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|rb|php|c|cc|cpp|h|hpp|cs|swift|kt|scala|sh)$/i.test(p)) return "source";
+  return "other";
+};
+var bucketArgCount = (n) => n <= 0 ? "none" : n <= 3 ? "few" : "many";
+var bucketLength = (n) => n < 40 ? "short" : n < 200 ? "medium" : "long";
+var deriveArgShape = (isCommand, commandText, path) => {
+  const text = isCommand ? commandText : path;
+  const tokenCount = isCommand ? text.trim().split(/\s+/).filter(Boolean).length : 0;
+  return {
+    hasPipe: isCommand && /(?<!\|)\|(?!\|)/.test(text),
+    hasRedirect: isCommand && /(?<![0-9])[<>]/.test(text),
+    hasChain: isCommand && /&&|\|\||;/.test(text),
+    hasSudo: /\bsudo\b/i.test(text),
+    hasGlob: isCommand && /[*?]/.test(text),
+    hasSubshell: isCommand && /\$\(|`/.test(text),
+    touchesSecretPath: SECRET_TARGET_PATTERNS.some((re) => re.test(text)),
+    // The command word itself is not an argument, so subtract one.
+    argCountBucket: bucketArgCount(isCommand ? Math.max(0, tokenCount - 1) : 0),
+    lengthBucket: bucketLength(text.length)
+  };
+};
+var deriveReversibility = (capability, riskClass) => {
+  if (capability === "read") return "none";
+  if (capability === "destructive" || riskClass === "destructive") return "irreversible";
+  return "reversible";
+};
+var deriveBlastRadius = (capability, riskClass, targetClass) => {
+  if (capability === "read") return "low";
+  if (capability === "destructive" || riskClass === "destructive" || targetClass === "secret") return "high";
+  if (capability === "network" || capability === "shell" || riskClass === "elevated" || targetClass === "config") return "medium";
+  return "low";
+};
+var deriveLabelTier = (origin, decision) => {
+  if (origin === "autopilot") return "none";
+  if (origin === "human" && (decision === "approve" || decision === "deny")) return "bronze";
+  return "bronze";
+};
+var buildDecisionEpisodeFeatures = (input) => {
+  const isCommand = isCommandTool(input.toolName);
+  const raw = input.commandOrPath ?? input.toolTarget ?? "";
+  const commandText = isCommand ? raw : "";
+  const path = isCommand ? "" : raw;
+  const capability = deriveEpisodeCapability(input.toolName, commandText);
+  const riskClass = classifyDecisionRisk(input.toolName, input.toolTarget ?? raw);
+  const targetClass = isCommand ? SECRET_TARGET_PATTERNS.some((re) => re.test(commandText)) ? "secret" : "other" : deriveTargetClass(path);
+  const argShape = deriveArgShape(isCommand, commandText, path);
+  const { deltaSignal } = computeDeltaSignal({
+    intent: input.intent,
+    toolName: input.toolName,
+    toolTarget: input.toolTarget,
+    actionBody: input.commandOrPath
+  });
+  return {
+    schemaVersion: DECISION_EPISODE_SCHEMA_VERSION,
+    extractorVersion: DECISION_FEATURE_EXTRACTOR,
+    capability,
+    toolFamily: input.toolName.trim().slice(0, 40),
+    riskClass,
+    targetClass,
+    argShape,
+    reversibility: deriveReversibility(capability, riskClass),
+    blastRadius: deriveBlastRadius(capability, riskClass, targetClass),
+    deltaSignal,
+    preset: input.preset,
+    // A policy artifact (usually canonical like `Bash(rm:*)`), but a user could
+    // author a custom pattern, so scrub secrets defensively before it is stored.
+    matchedPattern: input.matchedPattern ? redactSecretsDeep(input.matchedPattern).slice(0, 120) : void 0,
+    policyMode: input.policyMode,
+    requestedGate: input.requestedGate,
+    timeoutSeconds: input.timeoutSeconds,
+    timeoutAction: input.timeoutAction,
+    decision: input.decision,
+    origin: input.origin,
+    latencyMs: input.latencyMs,
+    labelTier: deriveLabelTier(input.origin, input.decision),
+    agentType: input.agentType
+  };
+};
+
+export {
+  isApprovalMode,
+  HOOK_BUDGETS,
+  hookWaitDeadline,
+  hookWaitClamped,
+  effectiveWaitSeconds,
+  matchRankWeight,
+  matchToolPattern,
+  extractPolicyArg,
+  isSafeReadOnlyCommand,
+  isValidApiKey,
+  ACTION_BODY_MAX,
+  DECISION_LINE_MAX,
+  redactSecrets,
+  redactSecretsDeep,
+  classifyDecisionRisk,
+  buildDecisionEpisodeFeatures
+};

package/dist/{chunk-7EW3USQF.js → chunk-K74PMS6N.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-Z5PL3K7C.js";
+} from "./chunk-CJBVT33U.js";
 
 // src/claude-config.ts
 import { join } from "path";

package/dist/{chunk-R5AJNXZS.js → chunk-LRGSMQH2.js}

@@ -1,6 +1,6 @@
 import {
   isSafeReadOnlyCommand
-} from "./chunk-Z5PL3K7C.js";
+} from "./chunk-CJBVT33U.js";
 
 // src/ledger.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "fs";

package/dist/{chunk-SVVEC4QV.js → chunk-ORKNGSJI.js}

@@ -1,6 +1,6 @@
 import {
   HOOK_BUDGETS
-} from "./chunk-Z5PL3K7C.js";
+} from "./chunk-CJBVT33U.js";
 
 // src/codex-config.ts
 import { createHash } from "crypto";