@seanmozeik/tripwire 0.6.7 → 0.7.1

package/src/lib/config.ts

@@ -1,127 +0,0 @@
-// Config system using Effect Schema for validation and Effect for safe loading.
-// Config file: ~/.config/tripwire/config.json
-// Falls back to defaults if file doesn't exist or is invalid.
-
-import { accessSync, constants, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-
-import { Cause, Effect, Schema } from 'effect';
-
-const BlockRuleSchema = Schema.Struct({
-  pattern: Schema.String,
-  message: Schema.String,
-  action: Schema.optional(Schema.Union([Schema.Literal('deny'), Schema.Literal('ask')])),
-  requiresFlags: Schema.optional(Schema.Array(Schema.String)),
-  forbidsFlagValues: Schema.optional(
-    Schema.Array(Schema.Struct({ flag: Schema.String, values: Schema.Array(Schema.String) })),
-  ),
-});
-
-const GitConfigSchema = Schema.Struct({
-  protectedBranches: Schema.optional(Schema.Array(Schema.String)),
-  enforceConventionalCommits: Schema.optional(Schema.Boolean),
-});
-
-const SafePathsConfigSchema = Schema.Struct({
-  relative: Schema.optional(Schema.Array(Schema.String)),
-  absolute: Schema.optional(Schema.Array(Schema.String)),
-});
-
-const ConfigSchema = Schema.Struct({
-  git: Schema.optional(GitConfigSchema),
-  safePaths: Schema.optional(SafePathsConfigSchema),
-  blockedCommands: Schema.optional(Schema.Array(BlockRuleSchema)),
-  allowedCommands: Schema.optional(Schema.Array(BlockRuleSchema)),
-});
-
-const CONFIG_PATH = `${homedir()}/.config/tripwire/config.json`;
-
-const configExists = (path: string): Effect.Effect<boolean> =>
-  Effect.sync(() => {
-    try {
-      accessSync(path, constants.R_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-
-const readConfigFile = (path: string): Effect.Effect<string, Error> =>
-  Effect.try({ try: () => readFileSync(path, 'utf8'), catch: (error) => error as Error });
-
-const parseConfigJson = (raw: string): Effect.Effect<unknown, Error> =>
-  Effect.try({ try: () => JSON.parse(raw) as unknown, catch: (error) => error as Error });
-
-// `onExcessProperty: 'error'` rejects unknown keys (the default 'ignore' would
-// Silently strip them — a typo'd `blockedComands` would vanish unnoticed, the
-// Same silent-policy-drop class this whole change exists to kill). A stray key
-// Now fails loud, e.g. the `rtk` block that triggered MTA-137.
-const decodeConfig = (unknown: unknown): Effect.Effect<Config, Error> =>
-  Schema.decodeUnknownEffect(ConfigSchema)(unknown, { onExcessProperty: 'error' });
-
-const getDefaultConfig = (): Config => ({
-  git: {
-    protectedBranches: ['main', 'master', 'develop', 'production', 'release'],
-    enforceConventionalCommits: true,
-  },
-  safePaths: {},
-  blockedCommands: [],
-  allowedCommands: [],
-});
-
-const mergeWithDefaults = (partial: Config): Config => ({
-  git: partial.git ?? getDefaultConfig().git,
-  safePaths: partial.safePaths ?? getDefaultConfig().safePaths,
-  blockedCommands: partial.blockedCommands ?? getDefaultConfig().blockedCommands,
-  allowedCommands: partial.allowedCommands ?? getDefaultConfig().allowedCommands,
-});
-
-// A present-but-broken config (bad JSON, schema decode failure, timeout) must
-// Never be papered over with defaults — that silently drops all custom safety
-// Policy. `loadConfigResult` reports the failure as data so callers can fail
-// Closed loudly (see `loadConfig` and the dispatcher). A *missing* file is the
-// One legitimate defaults case.
-type ConfigLoad =
-  | { readonly ok: true; readonly config: Config }
-  | { readonly ok: false; readonly error: string };
-
-export const loadConfigResult = (path: string = CONFIG_PATH): Effect.Effect<ConfigLoad> =>
-  Effect.gen(function* () {
-    const exists = yield* configExists(path);
-    if (!exists) {
-      const result: ConfigLoad = { ok: true, config: getDefaultConfig() };
-      return result;
-    }
-
-    const raw = yield* readConfigFile(path);
-    const parsed = yield* parseConfigJson(raw);
-    const config = yield* decodeConfig(parsed);
-    const result: ConfigLoad = { ok: true, config: mergeWithDefaults(config) };
-    return result;
-  }).pipe(
-    Effect.timeout(1000),
-    Effect.catchCause((cause) => {
-      const result: ConfigLoad = { ok: false, error: Cause.pretty(cause) };
-      return Effect.succeed(result);
-    }),
-  );
-
-// Loud loader for library consumers (e.g. the shim daemon) that expect a
-// `Config`. A broken config dies rather than silently defaulting, so the
-// Consumer fails closed visibly until the file is fixed.
-export const loadConfig = (path: string = CONFIG_PATH): Effect.Effect<Config> =>
-  loadConfigResult(path).pipe(
-    Effect.flatMap((result) =>
-      result.ok
-        ? Effect.succeed(result.config)
-        : Effect.die(new Error(`[tripwire] config load failed (${path}): ${result.error}`)),
-    ),
-  );
-
-export type BlockRule = typeof BlockRuleSchema.Type;
-export type GitConfig = typeof GitConfigSchema.Type;
-export type SafePathsConfig = typeof SafePathsConfigSchema.Type;
-export type Config = typeof ConfigSchema.Type;
-
-export type { ConfigLoad };
-export { CONFIG_PATH, ConfigSchema, getDefaultConfig, mergeWithDefaults };

package/src/lib/decision.ts

@@ -1,36 +0,0 @@
-// Decisions are ordered by restrictiveness:
-//   Allow — let the tool call proceed silently
-//   Warn  — let the tool call proceed but inject a system message so the
-//           Agent sees the advisory in its next turn
-//   Ask   — Claude Code prompts the user before letting the call proceed
-//   Deny  — block the tool call (PreToolUse) or refuse to surface its
-//           Output to the model (PostToolUse)
-//
-type DecisionKind = 'allow' | 'warn' | 'ask' | 'deny';
-
-interface Decision {
-  readonly kind: DecisionKind;
-  readonly rule: string;
-  readonly message: string;
-}
-
-const order: Record<DecisionKind, number> = { allow: 0, warn: 1, ask: 2, deny: 3 };
-
-const allow = (rule: string): Decision => ({ kind: 'allow', rule, message: '' });
-const warn = (rule: string, message: string): Decision => ({ kind: 'warn', rule, message });
-const ask = (rule: string, message: string): Decision => ({ kind: 'ask', rule, message });
-const deny = (rule: string, message: string): Decision => ({ kind: 'deny', rule, message });
-
-// Merge picks the most restrictive kind.
-const merge = (decisions: readonly Decision[]): Decision => {
-  let best: Decision = allow('none');
-  for (const d of decisions) {
-    if (order[d.kind] > order[best.kind]) {
-      best = d;
-    }
-  }
-  return best;
-};
-
-export type { Decision, DecisionKind };
-export { allow, ask, deny, merge, warn };

package/src/lib/diff.ts

@@ -1,26 +0,0 @@
-import { readFileSync } from 'node:fs';
-
-// Lines present in `next` but not in `prev`, compared trimmed.
-// Whitespace-only differences are ignored — we want semantic additions.
-const addedLines = (prev: string, next: string): string[] => {
-  const prevSet = new Set(
-    prev
-      .split('\n')
-      .map((l) => l.trim())
-      .filter((l) => l.length > 0),
-  );
-  return next
-    .split('\n')
-    .filter((l) => l.trim().length > 0)
-    .filter((l) => !prevSet.has(l.trim()));
-};
-
-const readFileOrEmpty = (path: string): string => {
-  try {
-    return readFileSync(path, 'utf8');
-  } catch {
-    return '';
-  }
-};
-
-export { addedLines, readFileOrEmpty };

package/src/lib/event.ts

@@ -1,106 +0,0 @@
-import { Schema } from 'effect';
-
-const HookEvent = Schema.Struct({
-  hook_event_name: Schema.String,
-  tool_name: Schema.optional(Schema.String),
-  tool_input: Schema.optional(Schema.Unknown),
-  tool_response: Schema.optional(Schema.Unknown),
-  cwd: Schema.optional(Schema.String),
-  session_id: Schema.optional(Schema.String),
-  // Codex extension: present on every PreToolUse / PostToolUse event.
-  turn_id: Schema.optional(Schema.String),
-  tool_use_id: Schema.optional(Schema.String),
-});
-type HookEventType = typeof HookEvent.Type;
-
-interface BashInput {
-  readonly command: string;
-}
-
-interface EditInput {
-  readonly file_path: string;
-  readonly old_string: string;
-  readonly new_string: string;
-}
-
-interface WriteInput {
-  readonly file_path: string;
-  readonly content: string;
-}
-
-interface ReadInput {
-  readonly file_path: string;
-}
-
-// PostToolUse `tool_response` shape varies by tool. Bash returns
-// Stdout/stderr/interrupted; Read returns content; others vary. We extract
-// Any string-ish payload we can find for scanning purposes.
-interface BashResponse {
-  readonly stdout?: string;
-  readonly stderr?: string;
-  readonly interrupted?: boolean;
-}
-
-interface ReadResponse {
-  readonly content?: string;
-  readonly file?: { readonly content?: string };
-}
-
-const isBashInput = (x: unknown): x is BashInput =>
-  typeof x === 'object' && x !== null && typeof (x as BashInput).command === 'string';
-
-const isEditInput = (x: unknown): x is EditInput =>
-  typeof x === 'object' &&
-  x !== null &&
-  typeof (x as EditInput).file_path === 'string' &&
-  typeof (x as EditInput).old_string === 'string' &&
-  typeof (x as EditInput).new_string === 'string';
-
-const isWriteInput = (x: unknown): x is WriteInput =>
-  typeof x === 'object' &&
-  x !== null &&
-  typeof (x as WriteInput).file_path === 'string' &&
-  typeof (x as WriteInput).content === 'string';
-
-const isReadInput = (x: unknown): x is ReadInput =>
-  typeof x === 'object' && x !== null && typeof (x as ReadInput).file_path === 'string';
-
-// Extract any string payload from a tool_response we can scan for secrets.
-// Returns concatenated stdout/stderr for Bash, content for Read, or '' if
-// Nothing is recognizable.
-const extractResponseText = (toolName: string, response: unknown): string => {
-  if (typeof response !== 'object' || response === null) {
-    return '';
-  }
-  if (toolName === 'Bash') {
-    const r = response as BashResponse;
-    return [r.stdout ?? '', r.stderr ?? ''].filter((s) => s.length > 0).join('\n');
-  }
-  if (toolName === 'Read') {
-    const r = response as ReadResponse;
-    return r.content ?? r.file?.content ?? '';
-  }
-  // Best-effort fallback: stringify and let the scanner do its thing.
-  if (typeof (response as { content?: string }).content === 'string') {
-    return (response as { content?: string }).content ?? '';
-  }
-  return '';
-};
-
-export type {
-  BashInput,
-  BashResponse,
-  EditInput,
-  HookEventType as HookEvent,
-  ReadInput,
-  ReadResponse,
-  WriteInput,
-};
-export {
-  HookEvent as HookEventSchema,
-  extractResponseText,
-  isBashInput,
-  isEditInput,
-  isReadInput,
-  isWriteInput,
-};

package/src/lib/install.ts

@@ -1,238 +0,0 @@
-// Config installation module for tripwire hooks.
-// Parses and upserts hook configurations for Claude Code, Codex, and pi-guardrails.
-
-import { homedir } from 'node:os';
-
-import { file } from 'bun';
-
-interface ClaudeConfig {
-  hooks?: {
-    PreToolUse?: { hooks: { type: string; command: string }[] }[];
-    PostToolUse?: { hooks: { type: string; command: string }[] }[];
-  };
-}
-
-interface PiConfig {
-  hooks?: {
-    PreToolUse?: { hooks: { type: string; command: string }[] }[];
-    PostToolUse?: { hooks: { type: string; command: string }[] }[];
-  };
-}
-
-interface CodexHooksConfig {
-  hooks?: {
-    PreToolUse?: { hooks: { type: string; command: string; timeout?: number }[] }[];
-    PostToolUse?: { hooks: { type: string; command: string; timeout?: number }[] }[];
-  };
-}
-
-const TRIPWIRE_HOOK = 'tripwire-hook';
-
-const addHookIfMissing = (
-  hooks: { hooks: { type: string; command: string; timeout?: number }[] }[] | undefined,
-): [{ hooks: { type: string; command: string; timeout?: number }[] }[], boolean] => {
-  if (!hooks) {
-    const newHooks: { hooks: { type: string; command: string; timeout?: number }[] }[] = [
-      { hooks: [{ type: 'command', command: TRIPWIRE_HOOK }] },
-    ];
-    return [newHooks, false];
-  }
-
-  let needsNormalization = false;
-
-  const normalizedHooks = hooks.map((h) => ({
-    hooks: h.hooks.map((hook) => {
-      if (hook.command === TRIPWIRE_HOOK || hook.command.endsWith('/tripwire-hook')) {
-        if (hook.command !== TRIPWIRE_HOOK) {
-          needsNormalization = true;
-          return { ...hook, command: TRIPWIRE_HOOK };
-        }
-        return hook;
-      }
-      return hook;
-    }),
-  }));
-
-  const hasTripwire = normalizedHooks.some((h) =>
-    h.hooks.some((hook) => hook.command === TRIPWIRE_HOOK),
-  );
-
-  if (hasTripwire) {
-    return [normalizedHooks, !needsNormalization];
-  }
-
-  const newHooks: { hooks: { type: string; command: string; timeout?: number }[] }[] = [
-    ...normalizedHooks,
-    { hooks: [{ type: 'command', command: TRIPWIRE_HOOK }] },
-  ];
-  return [newHooks, false];
-};
-
-export const installClaude = async (): Promise<{ success: boolean; message: string }> => {
-  const configPath = `${homedir()}/.claude/settings.json`;
-  const configFile = file(configPath);
-
-  try {
-    const raw = await configFile.text();
-    const config = JSON.parse(raw) as ClaudeConfig;
-
-    config.hooks ??= {};
-    const [preToolUse, preSkipped] = addHookIfMissing(config.hooks.PreToolUse);
-    const [postToolUse, postSkipped] = addHookIfMissing(config.hooks.PostToolUse);
-
-    config.hooks.PreToolUse = preToolUse;
-    config.hooks.PostToolUse = postToolUse;
-
-    if (preSkipped && postSkipped) {
-      return { success: true, message: `Already configured: ${configPath}` };
-    }
-
-    await configFile.write(`${JSON.stringify(config, null, 2)}\n`);
-
-    return { success: true, message: `Updated ${configPath}` };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes('No such file')) {
-      return { success: false, message: `Config file not found: ${configPath}` };
-    }
-    return { success: false, message: `Failed to update Claude config: ${message}` };
-  }
-};
-
-export const installPi = async (): Promise<{ success: boolean; message: string }> => {
-  const configPath = `${homedir()}/.pi/agent/settings.json`;
-  const configFile = file(configPath);
-
-  try {
-    const raw = await configFile.text();
-    const config = JSON.parse(raw) as PiConfig;
-
-    config.hooks ??= {};
-    const [preToolUse, preSkipped] = addHookIfMissing(config.hooks.PreToolUse);
-    const [postToolUse, postSkipped] = addHookIfMissing(config.hooks.PostToolUse);
-
-    config.hooks.PreToolUse = preToolUse;
-    config.hooks.PostToolUse = postToolUse;
-
-    if (preSkipped && postSkipped) {
-      return { success: true, message: `Already configured: ${configPath}` };
-    }
-
-    await configFile.write(`${JSON.stringify(config, null, 2)}\n`);
-
-    return { success: true, message: `Updated ${configPath}` };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes('No such file')) {
-      return { success: false, message: `Config file not found: ${configPath}` };
-    }
-    return { success: false, message: `Failed to update pi config: ${message}` };
-  }
-};
-
-export const installCodex = async (): Promise<{ success: boolean; message: string }> => {
-  const configTomlPath = `${homedir()}/.codex/config.toml`;
-  const hooksJsonPath = `${homedir()}/.codex/hooks.json`;
-  const hooksJsonFile = file(hooksJsonPath);
-  const configTomlFile = file(configTomlPath);
-
-  let hooksUpdated = false;
-  let tomlUpdated = false;
-
-  // First, update hooks.json
-  try {
-    const raw = await hooksJsonFile.text();
-    const config = JSON.parse(raw) as CodexHooksConfig;
-
-    config.hooks ??= {};
-    const [preToolUse, preSkipped] = addHookIfMissing(config.hooks.PreToolUse);
-    const [postToolUse, postSkipped] = addHookIfMissing(config.hooks.PostToolUse);
-
-    config.hooks.PreToolUse = preToolUse;
-    config.hooks.PostToolUse = postToolUse;
-
-    if (!preSkipped || !postSkipped) {
-      hooksUpdated = true;
-    }
-
-    // Add timeout to tripwire-hook if not present
-    const addTimeout = (
-      hooks: { hooks: { type: string; command: string; timeout?: number }[] }[] | undefined,
-    ): { hooks: { type: string; command: string; timeout?: number }[] }[] => {
-      return (
-        hooks?.map((h) => ({
-          hooks: h.hooks.map((hook) => {
-            if (hook.command === TRIPWIRE_HOOK && hook.timeout === undefined) {
-              return { ...hook, timeout: 10 };
-            }
-            return hook;
-          }),
-        })) ?? []
-      );
-    };
-
-    config.hooks.PreToolUse = addTimeout(config.hooks.PreToolUse);
-    config.hooks.PostToolUse = addTimeout(config.hooks.PostToolUse);
-
-    if (hooksUpdated) {
-      await hooksJsonFile.write(`${JSON.stringify(config, null, 2)}\n`);
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes('No such file')) {
-      return { success: false, message: `Config file not found: ${hooksJsonPath}` };
-    }
-    return { success: false, message: `Failed to update Codex hooks.json: ${message}` };
-  }
-
-  // Then, update config.toml to enable hooks
-  try {
-    const raw = await configTomlFile.text();
-    let toml = raw;
-
-    // Enable hooks in [features] section
-    if (toml.includes('hooks = true')) {
-      // Already enabled, nothing to do
-    } else {
-      tomlUpdated = true;
-      if (toml.includes('[features]')) {
-        // Find [features] section and add hooks = true
-        const featuresIndex = toml.indexOf('[features]');
-        const nextSectionIndex = toml.indexOf('\n[', featuresIndex + 1);
-        if (nextSectionIndex === -1) {
-          toml += '\nhooks = true';
-        } else {
-          toml = `${toml.slice(0, nextSectionIndex)}\nhooks = true${toml.slice(nextSectionIndex)}`;
-        }
-      } else {
-        toml += '\n[features]\nhooks = true';
-      }
-    }
-
-    if (tomlUpdated) {
-      await configTomlFile.write(toml);
-    }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes('No such file')) {
-      return { success: false, message: `Config file not found: ${configTomlPath}` };
-    }
-    return { success: false, message: `Failed to update Codex config.toml: ${message}` };
-  }
-
-  if (!hooksUpdated && !tomlUpdated) {
-    return { success: true, message: `Already configured: ${configTomlPath} and ${hooksJsonPath}` };
-  }
-
-  return { success: true, message: `Updated ${configTomlPath} and ${hooksJsonPath}` };
-};
-
-export const installAll = async (): Promise<
-  { target: string; success: boolean; message: string }[]
-> => {
-  return [
-    { target: 'claude', ...(await installClaude()) },
-    { target: 'codex', ...(await installCodex()) },
-    { target: 'pi', ...(await installPi()) },
-  ];
-};

package/src/lib/log.ts

@@ -1,24 +0,0 @@
-import { appendFileSync, mkdirSync } from 'node:fs';
-import { homedir } from 'node:os';
-// oxlint-disable-next-line unicorn/import-style
-import { dirname } from 'node:path';
-
-const LOG_PATH = `${homedir()}/.claude/tripwire.log`;
-
-try {
-  mkdirSync(dirname(LOG_PATH), { recursive: true });
-} catch {
-  // Directory creation failure is non-fatal — logging is best-effort.
-}
-
-const logError = (rule: string, err: unknown): void => {
-  const stamp = new Date().toISOString();
-  const msg = err instanceof Error ? (err.stack ?? err.message) : String(err);
-  try {
-    appendFileSync(LOG_PATH, `[${stamp}] [${rule}] ${msg}\n`);
-  } catch {
-    // Never block the agent on a logging failure.
-  }
-};
-
-export { logError };

package/src/lib/secrets.ts

@@ -1,121 +0,0 @@
-// Secret scanning via the `betterleaks` binary (Zach Rice's gitleaks
-// Successor, MIT). We spawn it once per PostToolUse, write the tool
-// Output to a temp file, scan the file, parse JSON findings, redact
-// Matches in-place, and delete the temp file.
-//
-// Why subprocess vs. inline regex: betterleaks ships the curated
-// 100+-rule pack the gitleaks ecosystem has tuned over years (AWS, GH,
-// Stripe, OpenAI, Anthropic, mongo URLs, JWTs, private keys, plus ~70
-// Long-tail vendors). We get all of it for one fork+exec, ~250–300ms.
-//
-// Why a temp file vs. `--pipe`: betterleaks `--pipe` *adds* stdin to its
-// Scan but does not replace the directory walk, so it scans the cwd as
-// Well. Writing to a tempfile in /tmp and using `--source <file>` is
-// Scoped, deterministic, and only ~5ms slower.
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-// oxlint-disable-next-line unicorn/import-style
-import { join } from 'node:path';
-
-interface BetterleaksFinding {
-  readonly RuleID: string;
-  readonly Description: string;
-  readonly StartLine: number;
-  readonly EndLine: number;
-  readonly Secret: string;
-  readonly Match: string;
-}
-
-interface ScanResult {
-  readonly hits: readonly { readonly rule: string; readonly count: number }[];
-  readonly redacted: string;
-}
-
-const BETTERLEAKS_BIN = '/opt/homebrew/bin/betterleaks';
-
-const summarizeHits = (
-  findings: readonly BetterleaksFinding[],
-): readonly { rule: string; count: number }[] => {
-  const counts = new Map<string, number>();
-  for (const f of findings) {
-    counts.set(f.RuleID, (counts.get(f.RuleID) ?? 0) + 1);
-  }
-  return [...counts.entries()].map(([rule, count]) => ({ rule, count }));
-};
-
-const escapeRegExp = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-
-// Replace every found secret in the original input with a tagged redaction.
-const redactWith = (input: string, findings: readonly BetterleaksFinding[]): string => {
-  let out = input;
-  // Sort by length descending so shorter matches that are substrings of
-  // Longer ones don't fire first and break the longer match.
-  const sorted = [...findings].toSorted((a, b) => b.Secret.length - a.Secret.length);
-  for (const f of sorted) {
-    if (f.Secret === '') {
-      continue;
-    }
-    out = out.replaceAll(f.Secret, `[REDACTED:${f.RuleID}]`);
-  }
-  return out;
-};
-
-const scanAndRedact = (input: string, timeoutMs = 5000): ScanResult => {
-  if (input.length === 0) {
-    return { hits: [], redacted: input };
-  }
-  const dir = mkdtempSync(join(tmpdir(), 'tripwire-scan-'));
-  const inPath = join(dir, 'input');
-  const reportPath = join(dir, 'report.json');
-  try {
-    writeFileSync(inPath, input);
-    const result = spawnSync(
-      BETTERLEAKS_BIN,
-      [
-        'detect',
-        '--no-git',
-        '--no-banner',
-        '--no-color',
-        '--report-format',
-        'json',
-        '--report-path',
-        reportPath,
-        '--source',
-        inPath,
-        '--exit-code',
-        '0',
-        '--log-level',
-        'error',
-      ],
-      { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 64 * 1024 * 1024 },
-    );
-    if (result.error !== undefined) {
-      return { hits: [], redacted: input };
-    }
-    let findings: BetterleaksFinding[];
-    try {
-      const raw = readFileSync(reportPath, 'utf8');
-      const parsed = JSON.parse(raw || '[]') as unknown;
-      findings = Array.isArray(parsed) ? (parsed as BetterleaksFinding[]) : [];
-    } catch {
-      return { hits: [], redacted: input };
-    }
-    if (findings.length === 0) {
-      return { hits: [], redacted: input };
-    }
-    return { hits: summarizeHits(findings), redacted: redactWith(input, findings) };
-  } finally {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      // Best-effort cleanup.
-    }
-  }
-};
-
-// `escapeRegExp` is exported so tests / callers can build patterns over the
-// Redacted output without re-implementing escaping.
-export type { BetterleaksFinding, ScanResult };
-export { escapeRegExp, scanAndRedact };