@seanmozeik/tripwire 0.6.7 → 0.7.0

package/src/rules/bash-git.ts

@@ -2,39 +2,13 @@ import { type Segment, collectHeredocBodies, hasBypass, unwrapStaticString } fro
 import type { GitConfig } from '../lib/config';
 import { type Decision, allow, ask, deny, warn } from '../lib/decision';
 
-// Smart git policy. Replaces blanket git handling with intent-based decisions:
-//
-//   - Read-only ops (status, log, diff, show, blame, fetch, etc.) — silent allow.
-//   - Working-tree-destroying ops (reset --hard, clean -fd, checkout .,
-//     Restore <path>) — deny with concrete safer alternative.
-//   - History-rewriting ops (rebase -i, filter-branch, filter-repo,
-//     Commit --amend, gc --prune=now, reflog expire, update-ref) — deny.
-//   - Branch destruction (branch -D, branch -d on protected, push --delete,
-//     Push :branch) — deny.
-//   - Direct push to protected branches (main / master / develop /
-//     Production / release) — deny, route to PR.
-//   - Force push (--force / -f / --force-with-lease) — deny everywhere.
-//   - Commits — allow ONLY with Conventional Commits format on the first
-//     `-m` value. Auto-stage (-a / --all / -am) — ask. Editor mode (no -m
-//     And no -F) — deny (would hang the agent).
-//   - Rebase / cherry-pick / merge — ask (creates conflicts).
-//   - Config — allow read; deny write to --global / --system; deny local
-//     Write (the user's identity / workflow).
-//
-// `git -C <dir>`, `git --git-dir=<path>`, `git --work-tree=<path>`,
-// `git -c key=value` are stripped before subcommand dispatch — `git -C ../foo
-// Reset --hard` is handled the same as `git reset --hard`.
-
-const DEFAULT_PROTECTED_BRANCHES: readonly string[] = [
-  'main',
-  'master',
-  'develop',
-  'production',
-  'release',
-];
+// Git policy separates read operations from destructive worktree, history,
+// Branch, push, commit, and configuration changes. Global Git options are
+// Removed before subcommand dispatch so `git -C repo reset --hard` receives
+// The same decision as `git reset --hard`.
 
 const getProtectedBranches = (config: GitConfig): readonly string[] =>
-  config.protectedBranches ?? DEFAULT_PROTECTED_BRANCHES;
+  config.protectedBranches ?? [];
 
 // Conventional Commits 1.0.0 — type(scope)?(!)?: description
 const CONVENTIONAL_RE =
@@ -78,13 +52,16 @@ const parseGit = (seg: Segment): GitInvocation | null => {
   const toks = seg.tokens.slice(1);
   let i = 0;
   while (i < toks.length) {
-    const t = toks[i]!;
+    const t = toks[i];
+    if (t === undefined) {
+      break;
+    }
     if (PRE_SUB_FLAG_TAKES_VALUE.has(t)) {
       i += 2;
       continue;
     }
     if (PRE_SUB_FLAG_NO_VALUE.has(t)) {
-      i++;
+      i += 1;
       continue;
     }
     if (
@@ -94,12 +71,12 @@ const parseGit = (seg: Segment): GitInvocation | null => {
       t.startsWith('--super-prefix=') ||
       t.startsWith('--exec-path=')
     ) {
-      i++;
+      i += 1;
       continue;
     }
     if (t.startsWith('-')) {
       // Unknown pre-subcommand flag; assume no value, advance.
-      i++;
+      i += 1;
       continue;
     }
     return { subcommand: t, subArgs: toks.slice(i + 1) };
@@ -111,8 +88,11 @@ const messageOf = (
   subArgs: readonly string[],
   heredocBodies?: ReadonlyMap<string, string>,
 ): string | null => {
-  for (let i = 0; i < subArgs.length; i++) {
-    const t = subArgs[i]!;
+  for (let i = 0; i < subArgs.length; i += 1) {
+    const t = subArgs[i];
+    if (t === undefined) {
+      break;
+    }
     if (t === '-m' || t === '--message') {
       const raw = subArgs[i + 1];
       return raw === undefined ? null : unwrapStaticString(raw, heredocBodies);
@@ -147,8 +127,10 @@ const positionalOf = (subArgs: readonly string[]): string[] =>
 
 const flagsOf = (subArgs: readonly string[]): string[] => subArgs.filter((a) => a.startsWith('-'));
 
-const has = (subArgs: readonly string[], ...needles: readonly string[]): boolean =>
-  needles.some((n) => subArgs.includes(n));
+const has = (subArgs: readonly string[], ...needles: readonly string[]): boolean => {
+  const argumentSet = new Set(subArgs);
+  return needles.some((needle) => argumentSet.has(needle));
+};
 
 interface HandlerCtx {
   readonly subcommand: string;
@@ -218,7 +200,12 @@ const handleCheckout: Handler = ({ subArgs, positional }) => {
       '`git checkout -- <path>` discards uncommitted working-tree changes. Refuse — use `git stash push <path>` to preserve, or `git diff <path>` to inspect first.',
     );
   }
-  if (positional.length === 1 && (positional[0] === '.' || positional[0]!.startsWith('./'))) {
+  const [target] = positional;
+  if (
+    target !== undefined &&
+    positional.length === 1 &&
+    (target === '.' || target.startsWith('./'))
+  ) {
     return deny(
       'git-checkout-discard-all',
       '`git checkout .` discards ALL uncommitted working-tree changes. Refuse — `git stash` to preserve, or `git diff` to inspect first.',
@@ -279,7 +266,7 @@ const handleRebase: Handler = ({ subArgs, positional, config }) => {
       '`git rebase -i` rewrites history interactively. Refuse — too easy to lose commits in the agent loop. If this is genuinely required, do it manually outside the agent.',
     );
   }
-  const onto = positional[0];
+  const [onto] = positional;
   const branches = getProtectedBranches(config);
   if (onto !== undefined && branches.includes(onto)) {
     return ask(
@@ -326,7 +313,7 @@ const handleCommit: Handler = ({ subArgs, config, heredocBodies }) => {
       '`git commit` without `-m "..."` opens an editor and hangs the agent. Use `git commit -m "<conventional message>"`.',
     );
   }
-  if (msg !== null && config.enforceConventionalCommits !== false && !CONVENTIONAL_RE.test(msg)) {
+  if (msg !== null && config.enforceConventionalCommits === true && !CONVENTIONAL_RE.test(msg)) {
     return deny(
       'git-commit-non-conventional',
       [
@@ -384,8 +371,8 @@ const handleBranch: Handler = ({ subArgs, flags, positional, config }) => {
   );
   if (deleteFlag !== undefined) {
     const targets = positional;
-    const branches = getProtectedBranches(config);
-    const hit = targets.find((t) => branches.includes(t));
+    const branches = new Set(getProtectedBranches(config));
+    const hit = targets.find((target) => branches.has(target));
     if (hit !== undefined) {
       return deny('git-branch-delete-protected', `Refusing to delete protected branch \`${hit}\`.`);
     }
@@ -435,7 +422,7 @@ const handleGc: Handler = ({ flags }) => {
 };
 
 const handleRemote: Handler = ({ subArgs }) => {
-  const sub = subArgs[0];
+  const [sub] = subArgs;
   if (sub === 'add' || sub === 'remove' || sub === 'rm' || sub === 'set-url' || sub === 'rename') {
     return ask(
       'git-remote-mutate',

package/src/rules/bash-network-install.ts

@@ -10,9 +10,12 @@ const SHELL_HEADS: ReadonlySet<string> = new Set(['bash', 'sh', 'zsh', 'fish']);
 const isFetchPipedToShell = (segments: readonly Segment[]): boolean => {
   // Shell-quote splits a pipeline `curl X | bash` into two segments. We
   // Detect the pattern by looking for adjacent fetch-then-shell heads.
-  for (let i = 0; i < segments.length - 1; i++) {
-    const a = segments[i]!;
-    const b = segments[i + 1]!;
+  for (let i = 0; i < segments.length - 1; i += 1) {
+    const a = segments[i];
+    const b = segments[i + 1];
+    if (a === undefined || b === undefined) {
+      continue;
+    }
     if (FETCH_HEADS.has(a.head) && SHELL_HEADS.has(b.head)) {
       return true;
     }

package/src/rules/bash-redirect.ts

@@ -1,11 +1,12 @@
 import { type Segment, hasBypass } from '../lib/bash';
 import { type Decision, allow, deny } from '../lib/decision';
+import { classifyProtectedPath, type ProtectedPathSpec } from './path-protect';
 
 // Block writes (via shell redirect, tee, cp, mv) that target sensitive
 // Files. Catches the exfil-via-redirect gap that path-protect can't see
 // Because it only watches Edit/Write tool calls.
 
-const PROTECTED_TARGET_RE: readonly { rule: string; pattern: RegExp; message: string }[] = [
+const PROTECTED_TARGET_RE: readonly ProtectedPathSpec[] = [
   {
     rule: 'redirect-env',
     pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
@@ -45,10 +46,9 @@ const PROTECTED_TARGET_RE: readonly { rule: string; pattern: RegExp; message: st
 ];
 
 const checkPath = (path: string): Decision | null => {
-  for (const p of PROTECTED_TARGET_RE) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
-    }
+  const protection = classifyProtectedPath(path, 'write', PROTECTED_TARGET_RE);
+  if (protection !== null) {
+    return deny(protection.rule, protection.message);
   }
   return null;
 };

package/src/rules/bash-scoped-rm.ts

@@ -77,7 +77,7 @@ const bashScopedRm = (
     .join('\n');
   return deny(
     'destructive-outside-safe-paths',
-    `Destructive deletion outside known-safe scopes is blocked. Use \`trash\` (macOS Trash, recoverable) or \`rip\` (graveyard at /tmp/graveyard-$USER, recoverable until reboot) instead. Real \`rm\` and \`find -delete\` are allowed only inside ephemeral build / cache / state directories:\n${safeScopesSummary(extraRelative, extraAbsolute)}\n\nFlagged targets:\n${detail}\n\nIf raw \`rm\` is genuinely needed, append \` # tripwire-allow: <reason>\` to the command.`,
+    `Destructive deletion outside known-safe scopes is blocked. Use a recoverable deletion tool or limit the target to an ephemeral build, cache, state, or temporary directory:\n${safeScopesSummary(extraRelative, extraAbsolute)}\n\nFlagged targets:\n${detail}\n\nIf raw deletion is genuinely needed, append \` # tripwire-allow: <reason>\` to the command.`,
   );
 };
 

package/src/rules/bash-tar-explosion.ts

@@ -4,21 +4,16 @@ import { type Decision, allow, deny } from '../lib/decision';
 // Block tar/zip/unzip extractions that would write into / or $HOME
 // (`tar -xf foo.tar.gz -C /` style explosions).
 
-const isExtractFlag = (f: string): boolean =>
-  f === '-x' ||
-  f === '-xf' ||
-  f === '-xzf' ||
-  f === '-xjf' ||
-  f === '-xJf' ||
-  f === '-xvf' ||
-  f === '-xvzf' ||
-  f === '-xvjf' ||
-  f === '--extract' ||
-  /^-[xvzjJtf]+$/.test(f);
+const isExtractFlag = (flag: string): boolean =>
+  flag === '--extract' ||
+  (flag.startsWith('-') && !flag.startsWith('--') && flag.slice(1).includes('x'));
 
 const findChangeDir = (seg: Segment): string | null => {
-  for (let i = 0; i < seg.tokens.length; i++) {
-    const t = seg.tokens[i]!;
+  for (let i = 0; i < seg.tokens.length; i += 1) {
+    const t = seg.tokens[i];
+    if (t === undefined) {
+      continue;
+    }
     if (t === '-C' || t === '--directory') {
       return seg.tokens[i + 1] ?? null;
     }
@@ -41,7 +36,13 @@ const bashTarExplosion = (segments: readonly Segment[], cmd: string): Decision =
     if (seg.head !== 'tar') {
       continue;
     }
-    const extracting = seg.flags.some(isExtractFlag) || seg.tokens.includes('--extract');
+    const [, legacyOptionWord] = seg.tokens;
+    const extracting =
+      seg.flags.some(isExtractFlag) ||
+      seg.tokens.includes('--extract') ||
+      (legacyOptionWord !== undefined &&
+        /^[a-zA-Z]+$/.test(legacyOptionWord) &&
+        legacyOptionWord.includes('x'));
     if (!extracting) {
       continue;
     }
@@ -58,7 +59,7 @@ const bashTarExplosion = (segments: readonly Segment[], cmd: string): Decision =
     if (seg.head !== 'unzip') {
       continue;
     }
-    for (let i = 0; i < seg.tokens.length; i++) {
+    for (let i = 0; i < seg.tokens.length; i += 1) {
       if (seg.tokens[i] === '-d') {
         const dest = seg.tokens[i + 1];
         if (dest !== undefined && isUnsafeExtractDest(dest)) {

package/src/rules/config-custom.ts

@@ -19,11 +19,8 @@ const ALIASES: ReadonlyMap<string, string> = new Map([
 
 const canonical = (token: string): string => ALIASES.get(token) ?? token;
 
-// Strip directory prefix so an absolute or homebrew-style path matches its
-// Basename — `/opt/homebrew/bin/gog` and `gog` are the same command for
-// Policy purposes. shim's typed dispatcher resolves CLIs to absolute paths,
-// So matchers that compare `seg.head` literally would otherwise miss every
-// Rule for those invocations.
+// Match command policy by executable basename so an absolute path cannot
+// bypass a configured rule.
 const basename = (token: string): string => {
   const idx = token.lastIndexOf('/');
   return idx === -1 ? token : token.slice(idx + 1);
@@ -33,8 +30,11 @@ const flagPresent = (tokens: readonly string[], flag: string): boolean =>
   tokens.some((t) => t === flag || t.startsWith(`${flag}=`));
 
 const flagValue = (tokens: readonly string[], flag: string): string | null => {
-  for (let i = 0; i < tokens.length; i++) {
-    const t = tokens[i]!;
+  for (let i = 0; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t === undefined) {
+      continue;
+    }
     if (t === flag) {
       return tokens[i + 1] ?? '';
     }
@@ -48,16 +48,20 @@ const flagValue = (tokens: readonly string[], flag: string): string | null => {
 const subcommandTokens = (seg: Segment): string[] => {
   const out: string[] = [];
   const tokens = seg.tokens.slice(1);
-  for (let i = 0; i < tokens.length; i++) {
-    const t = tokens[i]!;
+  for (let i = 0; i < tokens.length; i += 1) {
+    const t = tokens[i];
+    if (t === undefined) {
+      continue;
+    }
     if (t.startsWith('-')) {
       // Without per-CLI flag metadata, we conservatively treat
       // `--flag value` / `-f value` as one option pair and `--flag=value`
       // As one token. This keeps global selectors like `--account X`
       // Out of the subcommand path, at the cost of not distinguishing
       // Boolean flags that precede positional args.
-      if (!t.includes('=') && tokens[i + 1] !== undefined && !tokens[i + 1]!.startsWith('-')) {
-        i++;
+      const nextToken = tokens[i + 1];
+      if (!t.includes('=') && nextToken !== undefined && !nextToken.startsWith('-')) {
+        i += 1;
       }
       continue;
     }
@@ -70,18 +74,20 @@ const subcommandTokens = (seg: Segment): string[] => {
 // This is more powerful than simple regex because it uses the same
 // Parsing logic as the rest of tripwire.
 const matchPattern = (segments: readonly Segment[], rule: BlockRule): boolean => {
-  const pattern = rule.pattern;
+  const { pattern } = rule;
   const patternSegs = parseCommand(pattern);
   if (patternSegs.length === 0) {
     return false;
   }
 
-  const patternTokens = patternSegs[0]!.tokens;
-  const patternHead = patternTokens[0];
+  const [patternSegment] = patternSegs;
+  if (patternSegment === undefined) {
+    return false;
+  }
+  const [patternHead, ...patternSubcommands] = patternSegment.tokens;
   if (patternHead === undefined) {
     return false;
   }
-  const patternSubcommands = patternTokens.slice(1);
 
   for (const seg of segments) {
     if (basename(seg.head) !== basename(patternHead)) {

package/src/rules/lazy-code.ts

@@ -38,7 +38,7 @@ const TEST_PATH_RE =
 
 // Comment-syntax-agnostic. Works in `//`, `#`, `--`, `/* */`, `<!-- -->`,
 // `;`, `%`, etc.
-const BYPASS_RE = /tripwire-allow\b/;
+const BYPASS_RE = /tripwire-allow:[ \t]*\S/;
 
 const matches = (line: string): boolean => {
   if (BYPASS_RE.test(line)) {

package/src/rules/path-protect.ts

@@ -1,16 +1,18 @@
-// oxlint-disable-next-line unicorn/import-style
-import { resolve } from 'node:path';
+import { lstatSync, readlinkSync, realpathSync } from 'node:fs';
+import path from 'node:path';
 
 import { type Decision, allow, deny } from '../lib/decision';
 import type { EditInput, WriteInput } from '../lib/event';
 
-interface Spec {
+interface ProtectedPathSpec {
   readonly pattern: RegExp;
   readonly rule: string;
   readonly message: string;
 }
 
-const protections: readonly Spec[] = [
+type PathAccess = 'read' | 'write';
+
+const protections: readonly ProtectedPathSpec[] = [
   {
     pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
     rule: 'env-file',
@@ -55,14 +57,75 @@ const protections: readonly Spec[] = [
   },
 ];
 
-const pathProtect = (input: EditInput | WriteInput): Decision => {
-  const path = resolve(input.file_path);
-  for (const p of protections) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
+const resolveExistingPath = (absolutePath: string): string | null => {
+  try {
+    return realpathSync(absolutePath);
+  } catch {
+    return null;
+  }
+};
+
+// A write target may not exist yet. Resolve the deepest existing parent and
+// append the missing suffix. If an existing component is a dangling symlink,
+// follow its link text before continuing so `alias -> .env` cannot hide a new
+// protected target.
+const resolveWritePath = (absolutePath: string, seen: Set<string> = new Set<string>()): string => {
+  if (seen.has(absolutePath)) {
+    return absolutePath;
+  }
+  seen.add(absolutePath);
+
+  const existing = resolveExistingPath(absolutePath);
+  if (existing !== null) {
+    return existing;
+  }
+
+  try {
+    if (lstatSync(absolutePath).isSymbolicLink()) {
+      const target = readlinkSync(absolutePath);
+      return resolveWritePath(path.resolve(path.dirname(absolutePath), target), seen);
     }
+  } catch {
+    // The target does not exist. Resolve its parent below.
+  }
+
+  const parent = path.dirname(absolutePath);
+  if (parent === absolutePath) {
+    return absolutePath;
+  }
+  return path.join(resolveWritePath(parent, seen), path.basename(absolutePath));
+};
+
+const classifyProtectedPath = (
+  submittedPath: string,
+  access: PathAccess,
+  specs: readonly ProtectedPathSpec[],
+): ProtectedPathSpec | null => {
+  const absolutePath = path.resolve(submittedPath);
+  const resolvedPath =
+    access === 'write' ? resolveWritePath(absolutePath) : resolveExistingPath(absolutePath);
+  const candidates = [submittedPath, absolutePath];
+  if (resolvedPath !== null && !candidates.includes(resolvedPath)) {
+    candidates.push(resolvedPath);
+  }
+
+  for (const candidate of candidates) {
+    for (const spec of specs) {
+      if (spec.pattern.test(candidate)) {
+        return spec;
+      }
+    }
+  }
+  return null;
+};
+
+const pathProtect = (input: EditInput | WriteInput): Decision => {
+  const protection = classifyProtectedPath(input.file_path, 'write', protections);
+  if (protection !== null) {
+    return deny(protection.rule, protection.message);
   }
   return allow('path-protect');
 };
 
-export { pathProtect };
+export type { PathAccess, ProtectedPathSpec };
+export { classifyProtectedPath, pathProtect };

package/src/rules/post-secret-scrub.ts

@@ -1,6 +1,7 @@
+import type { SecretScannerConfig } from '../lib/config';
 import { type Decision, allow, deny } from '../lib/decision';
 import { extractResponseText } from '../lib/event';
-import { scanAndRedact } from '../lib/secrets';
+import { scanAndRedact, type ScannerRunner, type ScanFailureCategory } from '../lib/secrets';
 
 // PostToolUse: scan whatever string content a tool returned (Bash stdout,
 // Read content) for known secret patterns via betterleaks. If anything
@@ -11,25 +12,35 @@ import { scanAndRedact } from '../lib/secrets';
 interface PostInput {
   readonly toolName: string;
   readonly response: unknown;
+  readonly secretScanner: SecretScannerConfig;
+  readonly scannerRunner?: ScannerRunner;
 }
 
+const scannerFailureMessage = (category: ScanFailureCategory): string =>
+  `Tripwire could not verify this tool output because the configured secret scanner failed ` +
+  `(${category}). The original output was withheld. Install Betterleaks 1.5.0 or later, ` +
+  `check secretScanner.executable and secretScanner.timeoutMs, then run the original tool again.`;
+
 const postSecretScrub = (input: PostInput): Decision => {
   const text = extractResponseText(input.toolName, input.response);
   if (text.length === 0) {
     return allow('post-secret-scrub');
   }
-  const { hits, redacted } = scanAndRedact(text);
-  if (hits.length === 0) {
+  const result = scanAndRedact(text, input.secretScanner, input.scannerRunner);
+  if (!result.ok) {
+    return deny('secret-scanner-failed', scannerFailureMessage(result.category));
+  }
+  if (result.hits.length === 0) {
     return allow('post-secret-scrub');
   }
-  const summary = hits.map((h) => `${h.rule}×${h.count}`).join(', ');
+  const summary = result.hits.map((hit) => `${hit.rule}×${hit.count}`).join(', ');
   return deny(
     'secrets-in-output',
     [
-      `tripwire intercepted ${hits.length} secret pattern(s) in this tool's output (${summary}). The original output was withheld so the secret never enters the model context. A redacted form is below — work from this, do not re-run the same command in a way that re-fetches the underlying secret.`,
+      `tripwire intercepted ${result.hits.length} secret pattern(s) in this tool's output (${summary}). The original output was withheld so the secret never enters the model context. A redacted form is below — work from this, do not re-run the same command in a way that re-fetches the underlying secret.`,
       ``,
       `Redacted output:`,
-      redacted.slice(0, 16_000) + (redacted.length > 16_000 ? '\n…[truncated]' : ''),
+      result.redacted.slice(0, 16_000) + (result.redacted.length > 16_000 ? '\n…[truncated]' : ''),
     ].join('\n'),
   );
 };

package/src/rules/read-protect.ts

@@ -1,16 +1,8 @@
-// oxlint-disable-next-line unicorn/import-style
-import { resolve } from 'node:path';
-
 import { type Decision, allow, deny } from '../lib/decision';
 import type { ReadInput } from '../lib/event';
+import { classifyProtectedPath, type ProtectedPathSpec } from './path-protect';
 
-interface Spec {
-  readonly rule: string;
-  readonly pattern: RegExp;
-  readonly message: string;
-}
-
-const PROTECTIONS: readonly Spec[] = [
+const PROTECTIONS: readonly ProtectedPathSpec[] = [
   {
     rule: 'read-env',
     pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
@@ -55,11 +47,9 @@ const PROTECTIONS: readonly Spec[] = [
 ];
 
 const readProtect = (input: ReadInput): Decision => {
-  const path = resolve(input.file_path);
-  for (const p of PROTECTIONS) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
-    }
+  const protection = classifyProtectedPath(input.file_path, 'read', PROTECTIONS);
+  if (protection !== null) {
+    return deny(protection.rule, protection.message);
   }
   return allow('read-protect');
 };

package/src/rules/tool-policy.ts

@@ -0,0 +1,54 @@
+import { type Segment, hasBypass } from '../lib/bash';
+import type { ToolPolicy } from '../lib/config';
+import { type Decision, allow, deny, warn } from '../lib/decision';
+
+const hasShortFlag = (flags: readonly string[], expected: string): boolean =>
+  flags.some(
+    (flag) => flag.startsWith('-') && !flag.startsWith('--') && flag.slice(1).includes(expected),
+  );
+
+const matches = (segment: Segment, policy: ToolPolicy): boolean => {
+  if (!policy.executables.includes(segment.head)) {
+    return false;
+  }
+
+  const commandArguments = segment.tokens.slice(1);
+  const commandArgumentSet = new Set(commandArguments);
+  if (
+    !(policy.match?.argumentsIncludeAll ?? []).every((argument) => commandArgumentSet.has(argument))
+  ) {
+    return false;
+  }
+  if (
+    !(policy.match?.argumentsStartWith ?? []).every(
+      (argument, index) => commandArguments[index] === argument,
+    )
+  ) {
+    return false;
+  }
+  return (policy.match?.shortFlagsIncludeAll ?? []).every((flag) =>
+    hasShortFlag(segment.flags, flag),
+  );
+};
+
+const toolPolicy = (
+  segments: readonly Segment[],
+  command: string,
+  policies: readonly ToolPolicy[],
+): Decision => {
+  if (hasBypass(command)) {
+    return allow('tool-policy');
+  }
+  for (const segment of segments) {
+    for (const policy of policies) {
+      if (matches(segment, policy)) {
+        return policy.action === 'deny'
+          ? deny(policy.rule, policy.message)
+          : warn(policy.rule, policy.message);
+      }
+    }
+  }
+  return allow('tool-policy');
+};
+
+export { toolPolicy };

package/dist/tripwire-cli.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env bun
-// @bun @bytecode @bun-cjs
-(function(exports, require, module, __filename, __dirname) {var S=require("path"),U=require("@effect/platform-bun"),C=globalThis.Bun,Q=require("effect"),q=require("effect/unstable/cli");var W={name:"@seanmozeik/tripwire",version:"0.6.7",description:"Opinionated hooks dispatcher for AI coding agents with configurable safety rules",license:"MIT",bin:{tripwire:"./dist/tripwire-cli.js","tripwire-hook":"./dist/tripwire.js"},files:["dist","package.json","src","README.md"],type:"module",exports:{".":"./src/index.ts"},publishConfig:{access:"public"},scripts:{build:"bun scripts/build.ts",prepublishOnly:"bun run build",check:"bun run format && bun run lint:fix && bun run typecheck",format:"oxfmt --write .",lint:"oxlint --tsconfig tsconfig.oxlint.json .","lint:fix":"oxlint --format agent --tsconfig tsconfig.oxlint.json --fix .",prepare:"bunx effect-tsgo patch",test:"bun test",typecheck:"tsc --noEmit"},dependencies:{"shell-quote":"^1.8.4"},devDependencies:{"@effect/platform-bun":"^4.0.0-beta.102","@effect/tsgo":"^0.24.3","@types/bun":"^1.3.14","@types/shell-quote":"^1.7.5",effect:"^4.0.0-beta.102",oxfmt:"^0.53.0",oxlint:"1.68.0","oxlint-tsgolint":"^0.23.0",typescript:"^7.0.2"},peerDependencies:{"@effect/platform-bun":"^4.0.0-beta.102",effect:"^4.0.0-beta.102"},engines:{bun:">=1.0"}};var N=require("os"),z=globalThis.Bun,X="tripwire-hook",$=(b)=>{if(!b)return[[{hooks:[{type:"command",command:X}]}],!1];let w=!1,x=b.map((L)=>({hooks:L.hooks.map((D)=>{if(D.command===X||D.command.endsWith("/tripwire-hook")){if(D.command!==X)return w=!0,{...D,command:X};return D}return D})}));if(x.some((L)=>L.hooks.some((D)=>D.command===X)))return[x,!w];return[[...x,{hooks:[{type:"command",command:X}]}],!1]},v=async()=>{let b=`${N.homedir()}/.claude/settings.json`,w=z.file(b);try{let x=await w.text(),y=JSON.parse(x);y.hooks??={};let[G,L]=$(y.hooks.PreToolUse),[D,j]=$(y.hooks.PostToolUse);if(y.hooks.PreToolUse=G,y.hooks.PostToolUse=D,L&&j)return{success:!0,message:`Already configured: ${b}`};return await w.write(`${JSON.stringify(y,null,2)}
-`),{success:!0,message:`Updated ${b}`}}catch(x){let y=x instanceof Error?x.message:String(x);if(y.includes("No such file"))return{success:!1,message:`Config file not found: ${b}`};return{success:!1,message:`Failed to update Claude config: ${y}`}}},J=async()=>{let b=`${N.homedir()}/.pi/agent/settings.json`,w=z.file(b);try{let x=await w.text(),y=JSON.parse(x);y.hooks??={};let[G,L]=$(y.hooks.PreToolUse),[D,j]=$(y.hooks.PostToolUse);if(y.hooks.PreToolUse=G,y.hooks.PostToolUse=D,L&&j)return{success:!0,message:`Already configured: ${b}`};return await w.write(`${JSON.stringify(y,null,2)}
-`),{success:!0,message:`Updated ${b}`}}catch(x){let y=x instanceof Error?x.message:String(x);if(y.includes("No such file"))return{success:!1,message:`Config file not found: ${b}`};return{success:!1,message:`Failed to update pi config: ${y}`}}},K=async()=>{let b=`${N.homedir()}/.codex/config.toml`,w=`${N.homedir()}/.codex/hooks.json`,x=z.file(w),y=z.file(b),G=!1,L=!1;try{let D=await x.text(),j=JSON.parse(D);j.hooks??={};let[Y,V]=$(j.hooks.PreToolUse),[B,A]=$(j.hooks.PostToolUse);if(j.hooks.PreToolUse=Y,j.hooks.PostToolUse=B,!V||!A)G=!0;let Z=(R)=>{return R?.map((E)=>({hooks:E.hooks.map((M)=>{if(M.command===X&&M.timeout===void 0)return{...M,timeout:10};return M})}))??[]};if(j.hooks.PreToolUse=Z(j.hooks.PreToolUse),j.hooks.PostToolUse=Z(j.hooks.PostToolUse),G)await x.write(`${JSON.stringify(j,null,2)}
-`)}catch(D){let j=D instanceof Error?D.message:String(D);if(j.includes("No such file"))return{success:!1,message:`Config file not found: ${w}`};return{success:!1,message:`Failed to update Codex hooks.json: ${j}`}}try{let j=await y.text();if(j.includes("hooks = true"));else if(L=!0,j.includes("[features]")){let Y=j.indexOf("[features]"),V=j.indexOf(`
-[`,Y+1);if(V===-1)j+=`
-hooks = true`;else j=`${j.slice(0,V)}
-hooks = true${j.slice(V)}`}else j+=`
-[features]
-hooks = true`;if(L)await y.write(j)}catch(D){let j=D instanceof Error?D.message:String(D);if(j.includes("No such file"))return{success:!1,message:`Config file not found: ${b}`};return{success:!1,message:`Failed to update Codex config.toml: ${j}`}}if(!G&&!L)return{success:!0,message:`Already configured: ${b} and ${w}`};return{success:!0,message:`Updated ${b} and ${w}`}},_=async()=>{return[{target:"claude",...await v()},{target:"codex",...await K()},{target:"pi",...await J()}]};var O=()=>{return/\/bun(?<ext>\.exe)?$/.test(process.argv[0]??"")?process.argv[1]:process.argv[0]},u=async()=>{let b=O(),w=S.dirname(b),x=`${w}/tripwire-hook`;try{return await C.file(x).text(),x}catch{return`${w}/tripwire.js`}},T=(b,w,x,y)=>{if(b==="Bash")return{command:w??""};if(b==="Read")return{file_path:x??""};if(b==="Write")return{file_path:x??"",content:y??""};if(b==="Edit"||b==="MultiEdit")return{file_path:x??"",old_string:"",new_string:y??""};return},I=(b)=>{let{tool:w,post:x,command:y,path:G,stdout:L,stderr:D,content:j}=b,V={hook_event_name:x?"PostToolUse":"PreToolUse",tool_name:w,cwd:process.cwd(),session_id:"tripwire-cli-test",tool_input:T(w,y,G,j)};if(x)V.tool_response=w==="Bash"?{stdout:L??"",stderr:D??""}:{content:j??""};return V},F=(b)=>Q.Effect.gen(function*(){let{command:w,content:x,path:y,post:G,stderr:L,stdout:D,tool:j}=b,Y=I({tool:j,post:G,command:w,path:y,stdout:D,stderr:L,content:x}),V=yield*Q.Effect.promise(()=>u()),B=Bun.spawnSync([V],{stdin:new TextEncoder().encode(JSON.stringify(Y)),timeout:1e4,stdout:"pipe",stderr:"pipe"});if(B.exitCode!==0){let Z=new TextDecoder().decode(B.stderr);console.error(`error: ${Z}`),process.exit(1)}let A=new TextDecoder().decode(B.stdout);try{let Z=JSON.parse(A);console.log(JSON.stringify(Z,null,2))}catch{console.log(A)}}),P=q.Command.make("test",{command:q.Argument.string("command").pipe(q.Argument.optional,q.Argument.withDescription("Command to test (for Bash tool)")),content:q.Flag.string("content").pipe(q.Flag.optional,q.Flag.withDescription("Content for Write/Edit tools")),path:q.Flag.string("path").pipe(q.Flag.optional,q.Flag.withDescription("File path for Read/Write/Edit tools")),post:q.Flag.boolean("post").pipe(q.Flag.withDescription("Test PostToolUse instead of PreToolUse")),stderr:q.Flag.string("stderr").pipe(q.Flag.optional,q.Flag.withDescription("Stderr for PostToolUse Bash")),stdout:q.Flag.string("stdout").pipe(q.Flag.optional,q.Flag.withDescription("Stdout for PostToolUse Bash")),tool:q.Flag.string("tool").pipe(q.Flag.withDefault("Bash"),q.Flag.withDescription("Tool name (Bash, Read, Write, Edit, MultiEdit)"))},({command:b,content:w,path:x,post:y,stderr:G,stdout:L,tool:D})=>F({command:Q.Option.getOrUndefined(b),content:Q.Option.getOrUndefined(w),path:Q.Option.getOrUndefined(x),post:y,stderr:Q.Option.getOrUndefined(G),stdout:Q.Option.getOrUndefined(L),tool:D})).pipe(q.Command.withDescription("Test a synthetic hook event")),p=(b)=>Q.Effect.gen(function*(){if(!["claude","codex","pi","all"].includes(b))console.error(`error: unknown target "${b}"`),console.error("Valid targets: claude, codex, pi, all"),process.exit(1);let w;switch(b){case"claude":{w=[{target:"claude",result:yield*Q.Effect.promise(()=>v())}];break}case"codex":{w=[{target:"codex",result:yield*Q.Effect.promise(()=>K())}];break}case"pi":{w=[{target:"pi",result:yield*Q.Effect.promise(()=>J())}];break}case"all":{w=(yield*Q.Effect.promise(()=>_())).map((G)=>({target:G.target,result:G}));break}default:{w=[];break}}let x=!1;for(let{target:y,result:G}of w)if(G.success){let L=G.message.startsWith("Already configured")?"\u2299":"\u2713";console.log(`${L} [${y}] ${G.message}`)}else console.error(`\u2717 [${y}] ${G.message}`),x=!0;if(x)process.exit(1)}),c=q.Command.make("install",{target:q.Argument.string("target").pipe(q.Argument.withDescription("Target agent (claude, codex, pi, or all)"))},({target:b})=>p(b)).pipe(q.Command.withDescription("Install tripwire hooks for AI agents")),k=q.Command.make("tripwire").pipe(q.Command.withDescription("Opinionated hooks dispatcher for AI coding agents"),q.Command.withSubcommands([P,c])),f=q.Command.run(k,{version:W.version}),h=async()=>{try{await Q.Effect.runPromise(f.pipe(Q.Effect.provide(U.BunServices.layer)))}catch(b){let w=b instanceof Error?b.message:String(b);console.error(w),process.exitCode=1}};h();})