@seanmozeik/tripwire 0.6.7 → 0.7.1

package/src/rules/path-protect.ts

@@ -1,68 +0,0 @@
-// oxlint-disable-next-line unicorn/import-style
-import { resolve } from 'node:path';
-
-import { type Decision, allow, deny } from '../lib/decision';
-import type { EditInput, WriteInput } from '../lib/event';
-
-interface Spec {
-  readonly pattern: RegExp;
-  readonly rule: string;
-  readonly message: string;
-}
-
-const protections: readonly Spec[] = [
-  {
-    pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
-    rule: 'env-file',
-    message:
-      '.env files hold secrets that should never be sent to the model. Refuse to write or edit. If an example is needed, create .env.example with redacted placeholders.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.dev\.vars(?<ext>\.[^/]+)?$/,
-    rule: 'dev-vars',
-    message: '.dev.vars holds Cloudflare/Wrangler secrets. Do not modify.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.ssh\//,
-    rule: 'ssh-dir',
-    message: 'Never write into ~/.ssh/. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)(?<key>id_rsa|id_ed25519|id_ecdsa|id_dsa)(?<pub>\.pub)?$/,
-    rule: 'ssh-key',
-    message: 'SSH key file. Refuse.',
-  },
-  {
-    pattern: /\.(?<ext>pem|key|p12|pfx)$/i,
-    rule: 'private-key',
-    message:
-      'Private key file. Refuse to overwrite. If generating a new key, use a different filename and let the user review.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)secrets?\.(?<ext>json|ya?ml|toml|env)$/i,
-    rule: 'secrets-file',
-    message: 'Secrets file. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.aws\/credentials$/,
-    rule: 'aws-credentials',
-    message: 'AWS credentials file. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.netrc$/,
-    rule: 'netrc',
-    message: '.netrc holds host credentials. Refuse.',
-  },
-];
-
-const pathProtect = (input: EditInput | WriteInput): Decision => {
-  const path = resolve(input.file_path);
-  for (const p of protections) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
-    }
-  }
-  return allow('path-protect');
-};
-
-export { pathProtect };

package/src/rules/post-secret-scrub.ts

@@ -1,38 +0,0 @@
-import { type Decision, allow, deny } from '../lib/decision';
-import { extractResponseText } from '../lib/event';
-import { scanAndRedact } from '../lib/secrets';
-
-// PostToolUse: scan whatever string content a tool returned (Bash stdout,
-// Read content) for known secret patterns via betterleaks. If anything
-// Fires, block the result (so the original output never reaches the
-// Model) and surface a redacted version in the block reason — that lets
-// The agent see what was returned without leaking the secret itself.
-
-interface PostInput {
-  readonly toolName: string;
-  readonly response: unknown;
-}
-
-const postSecretScrub = (input: PostInput): Decision => {
-  const text = extractResponseText(input.toolName, input.response);
-  if (text.length === 0) {
-    return allow('post-secret-scrub');
-  }
-  const { hits, redacted } = scanAndRedact(text);
-  if (hits.length === 0) {
-    return allow('post-secret-scrub');
-  }
-  const summary = hits.map((h) => `${h.rule}×${h.count}`).join(', ');
-  return deny(
-    'secrets-in-output',
-    [
-      `tripwire intercepted ${hits.length} secret pattern(s) in this tool's output (${summary}). The original output was withheld so the secret never enters the model context. A redacted form is below — work from this, do not re-run the same command in a way that re-fetches the underlying secret.`,
-      ``,
-      `Redacted output:`,
-      redacted.slice(0, 16_000) + (redacted.length > 16_000 ? '\n…[truncated]' : ''),
-    ].join('\n'),
-  );
-};
-
-export type { PostInput };
-export { postSecretScrub };

package/src/rules/read-protect.ts

@@ -1,67 +0,0 @@
-// oxlint-disable-next-line unicorn/import-style
-import { resolve } from 'node:path';
-
-import { type Decision, allow, deny } from '../lib/decision';
-import type { ReadInput } from '../lib/event';
-
-interface Spec {
-  readonly rule: string;
-  readonly pattern: RegExp;
-  readonly message: string;
-}
-
-const PROTECTIONS: readonly Spec[] = [
-  {
-    rule: 'read-env',
-    pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
-    message:
-      '.env files hold secrets that should never enter the model context. Refuse to read. If the goal is documenting required env vars, look at .env.example or describe the schema from memory.',
-  },
-  {
-    rule: 'read-dev-vars',
-    pattern: /(?<prefix>^|\/)\.dev\.vars(?<ext>\.[^/]+)?$/,
-    message: 'Refuse to read .dev.vars (Cloudflare/Wrangler secrets).',
-  },
-  {
-    rule: 'read-ssh',
-    pattern: /(?<prefix>^|\/)\.ssh\//,
-    message: 'Refuse to read files inside ~/.ssh/.',
-  },
-  {
-    rule: 'read-ssh-key',
-    pattern: /(?<prefix>^|\/)(?<key>id_rsa|id_ed25519|id_ecdsa|id_dsa)$/,
-    message: 'Refuse to read SSH private key files.',
-  },
-  {
-    rule: 'read-private-key',
-    pattern: /\.(?<ext>pem|key|p12|pfx)$/i,
-    message: 'Refuse to read private-key-shaped files.',
-  },
-  {
-    rule: 'read-aws-credentials',
-    pattern: /(?<prefix>^|\/)\.aws\/credentials$/,
-    message: 'Refuse to read ~/.aws/credentials.',
-  },
-  {
-    rule: 'read-netrc',
-    pattern: /(?<prefix>^|\/)\.netrc$/,
-    message: 'Refuse to read ~/.netrc (host credentials).',
-  },
-  {
-    rule: 'read-secrets-file',
-    pattern: /(?<prefix>^|\/)secrets?\.(?<ext>json|ya?ml|toml|env)$/i,
-    message: 'Refuse to read a file named secrets.{json,yaml,toml,env}.',
-  },
-];
-
-const readProtect = (input: ReadInput): Decision => {
-  const path = resolve(input.file_path);
-  for (const p of PROTECTIONS) {
-    if (p.pattern.test(path)) {
-      return deny(p.rule, p.message);
-    }
-  }
-  return allow('read-protect');
-};
-
-export { readProtect };