@seanmozeik/tripwire 0.6.7 → 0.7.1

package/src/rules/bash-redirect.ts

@@ -1,91 +0,0 @@
-import { type Segment, hasBypass } from '../lib/bash';
-import { type Decision, allow, deny } from '../lib/decision';
-
-// Block writes (via shell redirect, tee, cp, mv) that target sensitive
-// Files. Catches the exfil-via-redirect gap that path-protect can't see
-// Because it only watches Edit/Write tool calls.
-
-const PROTECTED_TARGET_RE: readonly { rule: string; pattern: RegExp; message: string }[] = [
-  {
-    rule: 'redirect-env',
-    pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
-    message:
-      'Refusing to write into a .env file via shell redirect / tee / cp / mv. .env files hold secrets — never overwrite from a tool call.',
-  },
-  {
-    rule: 'redirect-dev-vars',
-    pattern: /(?<prefix>^|\/)\.dev\.vars(?<ext>\.[^/]+)?$/,
-    message: 'Refusing to write into .dev.vars (Cloudflare/Wrangler secrets).',
-  },
-  {
-    rule: 'redirect-ssh',
-    pattern: /(?<prefix>^|\/)\.ssh\//,
-    message: 'Refusing to write into ~/.ssh/ via shell.',
-  },
-  {
-    rule: 'redirect-key',
-    pattern: /\.(?<ext>pem|key|p12|pfx)$/i,
-    message: 'Refusing to overwrite a private-key-shaped file via shell.',
-  },
-  {
-    rule: 'redirect-aws-credentials',
-    pattern: /(?<prefix>^|\/)\.aws\/credentials$/,
-    message: 'Refusing to write into ~/.aws/credentials via shell.',
-  },
-  {
-    rule: 'redirect-netrc',
-    pattern: /(?<prefix>^|\/)\.netrc$/,
-    message: 'Refusing to write into ~/.netrc via shell.',
-  },
-  {
-    rule: 'redirect-block-device',
-    pattern: /^\/dev\/(?<type>sd|disk|nvme|rdisk)/i,
-    message: 'Redirecting into a raw block device wipes the disk. Refuse.',
-  },
-];
-
-const checkPath = (path: string): Decision | null => {
-  for (const p of PROTECTED_TARGET_RE) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
-    }
-  }
-  return null;
-};
-
-const bashRedirect = (segments: readonly Segment[], cmd: string): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-redirect');
-  }
-  for (const seg of segments) {
-    for (const r of seg.redirects) {
-      if (r.op === '>' || r.op === '>>') {
-        const d = checkPath(r.target);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-    if (seg.head === 'tee') {
-      for (const t of seg.args) {
-        const d = checkPath(t);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-    if (seg.head === 'cp' || seg.head === 'mv') {
-      // The destination is the last positional arg.
-      const dst = seg.args.at(-1);
-      if (dst !== undefined) {
-        const d = checkPath(dst);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-  }
-  return allow('bash-redirect');
-};
-
-export { bashRedirect };

package/src/rules/bash-scoped-rm.ts

@@ -1,84 +0,0 @@
-import { type Segment, hasBypass, isSafePathTarget, safeScopesSummary } from '../lib/bash';
-import type { SafePathsConfig } from '../lib/config';
-import { type Decision, allow, deny } from '../lib/decision';
-
-interface Issue {
-  readonly kind: 'rm' | 'find -delete';
-  readonly targets: readonly string[];
-}
-
-const analyzeRm = (seg: Segment, config: SafePathsConfig): readonly string[] => {
-  // `rm -- foo` ends flag parsing. Treat -- as flag-like and stop after it.
-  let endOfFlags = false;
-  const targets: string[] = [];
-  for (const t of seg.tokens.slice(1)) {
-    if (!endOfFlags && t === '--') {
-      endOfFlags = true;
-      continue;
-    }
-    if (!endOfFlags && t.startsWith('-') && t !== '-') {
-      continue;
-    }
-    targets.push(t);
-  }
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  return targets.filter((t) => !isSafePathTarget(t, extraRelative, extraAbsolute));
-};
-
-const analyzeFindDelete = (seg: Segment, config: SafePathsConfig): readonly string[] | null => {
-  if (!seg.tokens.includes('-delete')) {
-    return null;
-  }
-  const paths: string[] = [];
-  for (const t of seg.tokens.slice(1)) {
-    if (t.startsWith('-')) {
-      break;
-    }
-    paths.push(t);
-  }
-  const checked = paths.length === 0 ? ['.'] : paths;
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  return checked.filter((p) => !isSafePathTarget(p, extraRelative, extraAbsolute));
-};
-
-const bashScopedRm = (
-  segments: readonly Segment[],
-  cmd: string,
-  config: SafePathsConfig,
-): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-scoped-rm');
-  }
-  const issues: Issue[] = [];
-  for (const seg of segments) {
-    if (seg.head === 'rm') {
-      const unsafe = analyzeRm(seg, config);
-      if (unsafe.length > 0) {
-        issues.push({ kind: 'rm', targets: unsafe });
-      }
-      continue;
-    }
-    if (seg.head === 'find') {
-      const unsafe = analyzeFindDelete(seg, config);
-      if (unsafe !== null && unsafe.length > 0) {
-        issues.push({ kind: 'find -delete', targets: unsafe });
-      }
-    }
-  }
-  if (issues.length === 0) {
-    return allow('bash-scoped-rm');
-  }
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  const detail = issues
-    .map((i) => `  • ${i.kind} on: ${i.targets.map((t) => JSON.stringify(t)).join(', ')}`)
-    .join('\n');
-  return deny(
-    'destructive-outside-safe-paths',
-    `Destructive deletion outside known-safe scopes is blocked. Use \`trash\` (macOS Trash, recoverable) or \`rip\` (graveyard at /tmp/graveyard-$USER, recoverable until reboot) instead. Real \`rm\` and \`find -delete\` are allowed only inside ephemeral build / cache / state directories:\n${safeScopesSummary(extraRelative, extraAbsolute)}\n\nFlagged targets:\n${detail}\n\nIf raw \`rm\` is genuinely needed, append \` # tripwire-allow: <reason>\` to the command.`,
-  );
-};
-
-export { bashScopedRm };

package/src/rules/bash-tar-explosion.ts

@@ -1,76 +0,0 @@
-import { type Segment, hasBypass } from '../lib/bash';
-import { type Decision, allow, deny } from '../lib/decision';
-
-// Block tar/zip/unzip extractions that would write into / or $HOME
-// (`tar -xf foo.tar.gz -C /` style explosions).
-
-const isExtractFlag = (f: string): boolean =>
-  f === '-x' ||
-  f === '-xf' ||
-  f === '-xzf' ||
-  f === '-xjf' ||
-  f === '-xJf' ||
-  f === '-xvf' ||
-  f === '-xvzf' ||
-  f === '-xvjf' ||
-  f === '--extract' ||
-  /^-[xvzjJtf]+$/.test(f);
-
-const findChangeDir = (seg: Segment): string | null => {
-  for (let i = 0; i < seg.tokens.length; i++) {
-    const t = seg.tokens[i]!;
-    if (t === '-C' || t === '--directory') {
-      return seg.tokens[i + 1] ?? null;
-    }
-    if (t.startsWith('--directory=')) {
-      return t.slice('--directory='.length);
-    }
-  }
-  return null;
-};
-
-const isUnsafeExtractDest = (dest: string): boolean => {
-  return dest === '/' || /^(?<home>~|\$HOME|\$\{HOME\})$/.test(dest);
-};
-
-const bashTarExplosion = (segments: readonly Segment[], cmd: string): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-tar-explosion');
-  }
-  for (const seg of segments) {
-    if (seg.head !== 'tar') {
-      continue;
-    }
-    const extracting = seg.flags.some(isExtractFlag) || seg.tokens.includes('--extract');
-    if (!extracting) {
-      continue;
-    }
-    const dest = findChangeDir(seg);
-    if (dest !== null && isUnsafeExtractDest(dest)) {
-      return deny(
-        'tar-extract-to-root',
-        `tar -x with -C ${dest} can overwrite arbitrary system files. Refuse — extract to a contained directory (e.g. ./tmp/extract) and inspect before moving anything elsewhere.`,
-      );
-    }
-  }
-  // Unzip with -d destination
-  for (const seg of segments) {
-    if (seg.head !== 'unzip') {
-      continue;
-    }
-    for (let i = 0; i < seg.tokens.length; i++) {
-      if (seg.tokens[i] === '-d') {
-        const dest = seg.tokens[i + 1];
-        if (dest !== undefined && isUnsafeExtractDest(dest)) {
-          return deny(
-            'unzip-to-root',
-            `unzip -d ${dest} can overwrite arbitrary system files. Refuse — extract to a contained directory.`,
-          );
-        }
-      }
-    }
-  }
-  return allow('bash-tar-explosion');
-};
-
-export { bashTarExplosion };

package/src/rules/bash-tool-policy.ts

@@ -1,146 +0,0 @@
-import { type Segment, hasBypass } from '../lib/bash';
-import { type Decision, allow, deny, warn } from '../lib/decision';
-
-// Opinionated tooling enforcement. Hard-deny on the package managers and
-// Tools the user has explicitly replaced (npm/pip/patch-package); soft-warn
-// Suggesting modern equivalents (find→fd, grep→rg).
-//
-// Hard-deny rationale (from the user's CLAUDE.md): TypeScript is bun-only,
-// Python is uv-only. Slipping into npm or pip mid-session means the
-// Agent forgot the toolchain and is about to install into the wrong
-// Directory or make a lockfile bun can't read.
-
-interface Policy {
-  readonly rule: string;
-  readonly action: 'deny' | 'warn';
-  readonly message: string;
-  readonly fires: (seg: Segment) => boolean;
-}
-
-const POLICIES: readonly Policy[] = [
-  // ── HARD DENIES: wrong package manager ───────────────────────────────
-  {
-    rule: 'use-bun-not-npm',
-    action: 'deny',
-    message:
-      'Use `bun` instead of `npm`. Translations: `npm install` → `bun install`, `npm install <pkg>` → `bun add <pkg>`, `npm install -D <pkg>` → `bun add -d <pkg>`, `npm run X` → `bun run X` (or `bun X` for bin scripts), `npm test` → `bun test`. If you genuinely need npm (publishing to a registry that requires it, working in a different repo), append ` # tripwire-allow: <reason>` to the command.',
-    fires: (seg) => seg.head === 'npm',
-  },
-  {
-    rule: 'use-bunx-not-npx',
-    action: 'deny',
-    message: 'Use `bunx` instead of `npx`. Same usage shape, faster, no implicit npm cache.',
-    fires: (seg) => seg.head === 'npx',
-  },
-  {
-    rule: 'use-bun-not-pnpm',
-    action: 'deny',
-    message: 'Use `bun` instead of `pnpm`. The user is bun-only across their repos.',
-    fires: (seg) => seg.head === 'pnpm',
-  },
-  {
-    rule: 'use-bun-not-yarn',
-    action: 'deny',
-    message: 'Use `bun` instead of `yarn`. The user is bun-only.',
-    fires: (seg) => seg.head === 'yarn',
-  },
-  {
-    rule: 'use-uv-not-pip',
-    action: 'deny',
-    message:
-      'Use `uv` instead of `pip`. Translations: `pip install <pkg>` → `uv add <pkg>` (project dependency) or `uv pip install <pkg>` (env-only escape hatch). `pip freeze` → `uv pip freeze`. `pip list` → `uv pip list`. The user is uv-only across Python repos.',
-    fires: (seg) => seg.head === 'pip' || seg.head === 'pip3',
-  },
-  {
-    rule: 'use-uv-sync-not-venv',
-    action: 'deny',
-    message:
-      '`python -m venv` creates a bare venv; use `uv sync` instead. uv sync creates the venv AND installs from pyproject.toml + uv.lock in one atomic step. To activate: `source .venv/bin/activate` after.',
-    fires: (seg) =>
-      (seg.head === 'python' || seg.head === 'python3') &&
-      seg.tokens.includes('-m') &&
-      seg.tokens.includes('venv'),
-  },
-  {
-    rule: 'uv-sync-over-uv-venv',
-    action: 'deny',
-    message:
-      'Use `uv sync` instead of `uv venv`. `uv venv` creates an empty venv that you then have to populate; `uv sync` creates the venv AND resolves+installs from pyproject.toml + uv.lock in one step. The only reason to use `uv venv` standalone is when there is no pyproject.toml — and in that case, `uv init` first.',
-    fires: (seg) => seg.head === 'uv' && seg.tokens[1] === 'venv',
-  },
-  {
-    rule: 'use-bun-patch-not-patch-package',
-    action: 'deny',
-    message:
-      'Use `bun patch` instead of `patch-package`. Bun has built-in patch support that integrates with bun.lock; patch-package is npm-era and produces patches in a different format.',
-    fires: (seg) => seg.head === 'patch-package',
-  },
-
-  // ── SOFT WARNS: modern equivalents the user has installed ────────────────
-  {
-    rule: 'consider-fd',
-    action: 'warn',
-    message:
-      'Consider `fd` instead of `find`. Faster, simpler syntax, respects .gitignore by default. Examples: `find . -name "*.ts"` → `fd -e ts`, `find . -type f -name "X"` → `fd -t f X`, `find PATH ...` → `fd ... PATH`. The user has both installed; either works.',
-    fires: (seg) => seg.head === 'find',
-  },
-  {
-    rule: 'consider-rg',
-    action: 'warn',
-    message:
-      'Consider `rg` (ripgrep) instead of `grep`. Faster; recurses by default; respects .gitignore by default (use `-u`/`-uu` to include ignored/hidden files); searches the CWD when no path is given. NOT a clean flag-for-flag swap; some flags differ or are unneeded. Carry over fine: `-i`, `-n`, `-v`, `-l`, `-c`. WATCH OUT: `-r` is NOT recursive in rg, it means `--replace` (rg already recurses), so `rg -rn "PATTERN" dir/` silently parses as `--replace=n` and rewrites every match to the literal "n" while exiting 0. Drop the `-r`: `grep -rn PATTERN .` → `rg -n PATTERN`. And `grep --include`/`--exclude` become `rg -g GLOB`/`-g !GLOB`.',
-    fires: (seg) => seg.head === 'grep' || seg.head === 'egrep' || seg.head === 'fgrep',
-  },
-  {
-    rule: 'rg-r-is-replace',
-    action: 'warn',
-    message:
-      'STOP — your rg output is probably mangled. `-r` in rg means `--replace`, NOT recursive, so any `-r{X}` flag combo silently rewrites every match to the literal string "{X}" and exits 0 with no error. ripgrep is always recursive by default — there is no `-r` for recursion. If you want to search: drop the `-r` entirely (`rg -rn PATTERN` → `rg -n PATTERN`). If you genuinely want text substitution: use `--replace` explicitly.',
-    fires: (seg) => {
-      if (seg.head !== 'rg') {
-        return false;
-      }
-      return seg.flags.some((f) => f.startsWith('-') && !f.startsWith('--') && f.includes('r'));
-    },
-  },
-  {
-    rule: 'consider-btop',
-    action: 'warn',
-    message: 'Consider `btop` instead of `top`. Better UI, more info, modern.',
-    fires: (seg) => seg.head === 'top',
-  },
-  {
-    rule: 'consider-dust',
-    action: 'warn',
-    message: 'Consider `dust` instead of `du -sh`. Sorted, colorful, faster.',
-    fires: (seg) => seg.head === 'du',
-  },
-  {
-    rule: 'consider-duf',
-    action: 'warn',
-    message: 'Consider `duf` instead of `df -h`. Better formatting, more readable.',
-    fires: (seg) => seg.head === 'df',
-  },
-  {
-    rule: 'consider-procs',
-    action: 'warn',
-    message: 'Consider `procs` instead of `ps aux`. Better filtering and output.',
-    fires: (seg) => seg.head === 'ps',
-  },
-];
-
-const bashToolPolicy = (segments: readonly Segment[], cmd: string): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-tool-policy');
-  }
-  for (const seg of segments) {
-    for (const p of POLICIES) {
-      if (p.fires(seg)) {
-        return p.action === 'deny' ? deny(p.rule, p.message) : warn(p.rule, p.message);
-      }
-    }
-  }
-  return allow('bash-tool-policy');
-};
-
-export { bashToolPolicy };

package/src/rules/config-custom.ts

@@ -1,160 +0,0 @@
-// Config-based custom blocking/allowing rules.
-// Uses shell parsing utilities to match command patterns from config.
-
-import { hasBypass, parseCommand, type Segment } from '../lib/bash';
-import type { BlockRule } from '../lib/config';
-import { type Decision, allow, deny, ask } from '../lib/decision';
-
-const BYPASS_HELP = 'If this is intentional, append ` # tripwire-allow: <reason>` to the command.';
-
-const ALIASES: ReadonlyMap<string, string> = new Map([
-  ['add', 'create'],
-  ['new', 'create'],
-  ['edit', 'update'],
-  ['set', 'update'],
-  ['rm', 'delete'],
-  ['del', 'delete'],
-  ['remove', 'delete'],
-]);
-
-const canonical = (token: string): string => ALIASES.get(token) ?? token;
-
-// Strip directory prefix so an absolute or homebrew-style path matches its
-// Basename — `/opt/homebrew/bin/gog` and `gog` are the same command for
-// Policy purposes. shim's typed dispatcher resolves CLIs to absolute paths,
-// So matchers that compare `seg.head` literally would otherwise miss every
-// Rule for those invocations.
-const basename = (token: string): string => {
-  const idx = token.lastIndexOf('/');
-  return idx === -1 ? token : token.slice(idx + 1);
-};
-
-const flagPresent = (tokens: readonly string[], flag: string): boolean =>
-  tokens.some((t) => t === flag || t.startsWith(`${flag}=`));
-
-const flagValue = (tokens: readonly string[], flag: string): string | null => {
-  for (let i = 0; i < tokens.length; i++) {
-    const t = tokens[i]!;
-    if (t === flag) {
-      return tokens[i + 1] ?? '';
-    }
-    if (t.startsWith(`${flag}=`)) {
-      return t.slice(flag.length + 1);
-    }
-  }
-  return null;
-};
-
-const subcommandTokens = (seg: Segment): string[] => {
-  const out: string[] = [];
-  const tokens = seg.tokens.slice(1);
-  for (let i = 0; i < tokens.length; i++) {
-    const t = tokens[i]!;
-    if (t.startsWith('-')) {
-      // Without per-CLI flag metadata, we conservatively treat
-      // `--flag value` / `-f value` as one option pair and `--flag=value`
-      // As one token. This keeps global selectors like `--account X`
-      // Out of the subcommand path, at the cost of not distinguishing
-      // Boolean flags that precede positional args.
-      if (!t.includes('=') && tokens[i + 1] !== undefined && !tokens[i + 1]!.startsWith('-')) {
-        i++;
-      }
-      continue;
-    }
-    out.push(t);
-  }
-  return out;
-};
-
-// Match a pattern against parsed segments using shell parsing.
-// This is more powerful than simple regex because it uses the same
-// Parsing logic as the rest of tripwire.
-const matchPattern = (segments: readonly Segment[], rule: BlockRule): boolean => {
-  const pattern = rule.pattern;
-  const patternSegs = parseCommand(pattern);
-  if (patternSegs.length === 0) {
-    return false;
-  }
-
-  const patternTokens = patternSegs[0]!.tokens;
-  const patternHead = patternTokens[0];
-  if (patternHead === undefined) {
-    return false;
-  }
-  const patternSubcommands = patternTokens.slice(1);
-
-  for (const seg of segments) {
-    if (basename(seg.head) !== basename(patternHead)) {
-      continue;
-    }
-
-    if (patternSubcommands.length > 0) {
-      const actualSubcommands = subcommandTokens(seg);
-      const pathMatches = patternSubcommands.every(
-        (p, i) =>
-          actualSubcommands[i] !== undefined && canonical(actualSubcommands[i]) === canonical(p),
-      );
-      if (!pathMatches) {
-        continue;
-      }
-    }
-
-    if ((rule.requiresFlags ?? []).some((flag) => !flagPresent(seg.tokens, flag))) {
-      continue;
-    }
-
-    const valueChecks = rule.forbidsFlagValues ?? [];
-    const valuesMatch = valueChecks.every((check) => {
-      const value = flagValue(seg.tokens, check.flag);
-      return value !== null && check.values.includes(value);
-    });
-    if (!valuesMatch) {
-      continue;
-    }
-
-    if (
-      patternSubcommands.length === 0 &&
-      rule.requiresFlags === undefined &&
-      rule.forbidsFlagValues === undefined
-    ) {
-      return true;
-    }
-
-    return true;
-  }
-  return false;
-};
-
-export const configCustom = (
-  segments: readonly Segment[],
-  cmd: string,
-  blockedCommands: readonly BlockRule[],
-  allowedCommands: readonly BlockRule[],
-): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('config-custom');
-  }
-
-  // Check allowed first (overrides blocks)
-  for (const allowRule of allowedCommands) {
-    if (matchPattern(segments, allowRule)) {
-      return allow('config-custom');
-    }
-  }
-
-  // Then check blocked
-  for (const blockRule of blockedCommands) {
-    if (matchPattern(segments, blockRule)) {
-      const message = blockRule.message.includes('tripwire-allow')
-        ? blockRule.message
-        : `${blockRule.message} ${BYPASS_HELP}`;
-      return blockRule.action === 'ask'
-        ? ask('config-custom', message)
-        : deny('config-custom', message);
-    }
-  }
-
-  return allow('config-custom');
-};
-
-export { matchPattern };

package/src/rules/lazy-code.ts

@@ -1,95 +0,0 @@
-import { type Decision, allow, warn } from '../lib/decision';
-import { addedLines, readFileOrEmpty } from '../lib/diff';
-import type { EditInput, WriteInput } from '../lib/event';
-
-// Phrases that frequently signal incomplete or deferred work. Some — like
-// "fallback" or "placeholder" — are also legitimate product terms (an auth
-// Fallback flow, an HTML input placeholder). Rather than try to disambiguate
-// Statically, we accept the false-positive rate and keep this as a non-
-// Blocking warn. The advisory is written to make the intent unmistakable
-// So the agent treats real-product uses as no-action and treats actual
-// Stub work as a prompt to finish the job before returning to the user.
-const STUB_RE: readonly RegExp[] = [
-  /\bTODO\s*:/i,
-  /\bFIXME\s*:/i,
-  /\bXXX\s*:/i,
-  /\bHACK\s*:/i,
-  /\bfor now\b/i,
-  /\bnot implemented\b/i,
-  /\bNotImplementedError\b/,
-  /\btemp fix\b/i,
-  /\bfallback\b/i,
-  /\bplaceholder\b/i,
-  /\bbackwards?[ -]?compat(?<ibility>ibility)?\b/i,
-  /\bfor later\b/i,
-  /\blater on\b/i,
-  /\bget back to\b/i,
-  /\bI'?ll fix\b/i,
-  /\bto be implemented\b/i,
-  /\bnot yet (?<state>implemented|done)\b/i,
-  /\bstubbed\b/i,
-];
-
-const CODE_EXT_RE =
-  /\.(?<ext>ts|tsx|js|jsx|mjs|cjs|py|rs|go|rb|java|kt|swift|c|cc|cpp|h|hpp|cs|php|sh|zsh|bash|lua|ex|exs|clj|scala|dart)$/i;
-
-const TEST_PATH_RE =
-  /(?<prefix>^|\/)(?<dir>__tests__|tests?|spec|fixtures?|mocks?|__mocks__|stories)(?<suffix>\/|$)|\.(?<ext>test|spec|fixture|mock|stories)\.[^/]+$/i;
-
-// Comment-syntax-agnostic. Works in `//`, `#`, `--`, `/* */`, `<!-- -->`,
-// `;`, `%`, etc.
-const BYPASS_RE = /tripwire-allow\b/;
-
-const matches = (line: string): boolean => {
-  if (BYPASS_RE.test(line)) {
-    return false;
-  }
-  for (const re of STUB_RE) {
-    if (re.test(line)) {
-      return true;
-    }
-  }
-  return false;
-};
-
-const lazyCode = (input: EditInput | WriteInput): Decision => {
-  const path = input.file_path;
-  if (!CODE_EXT_RE.test(path) || TEST_PATH_RE.test(path)) {
-    return allow('lazy-code');
-  }
-
-  const next = 'content' in input ? input.content : input.new_string;
-  const prev = 'content' in input ? readFileOrEmpty(path) : input.old_string;
-
-  const offenders: string[] = [];
-  for (const line of addedLines(prev, next)) {
-    if (matches(line)) {
-      offenders.push(line.slice(0, 200));
-    }
-  }
-  if (offenders.length === 0) {
-    return allow('lazy-code');
-  }
-
-  const sample = offenders
-    .slice(0, 3)
-    .map((l) => `  • ${l}`)
-    .join('\n');
-  const more = offenders.length > 3 ? `\n  …and ${offenders.length - 3} more` : '';
-
-  return warn(
-    'lazy-code-marker',
-    [
-      `Heads up: line(s) you just added contain words that often signal incomplete or deferred work. The write went through — this is a flag, not a block.`,
-      ``,
-      `Why this exists: AI coding agents have a strong pull toward stubbing things, deferring "for now," and shipping half-built fallbacks instead of finishing the work in the same turn. The point of this warning is to push back on that pull on every iteration. If you stubbed something out for time, finish it this turn rather than leaving deferred work for later.`,
-      ``,
-      `If the marker is genuinely permanent — a real product term ("auth fallback flow", "retry fallback chain", an HTML input placeholder, a public API field literally named "placeholder"), a logging tag, or a comment intentionally left for a human reader — no action needed. To silence the flag on subsequent edits of that line, append \`tripwire-allow: <one-line reason>\` (any comment syntax: \`//\`, \`#\`, \`--\`, etc.).`,
-      ``,
-      `Flagged additions:`,
-      sample + more,
-    ].join('\n'),
-  );
-};
-
-export { lazyCode };