@seanmozeik/tripwire 0.7.0 → 0.7.2

package/src/rules/bash-redirect.ts

@@ -1,91 +0,0 @@
-import { type Segment, hasBypass } from '../lib/bash';
-import { type Decision, allow, deny } from '../lib/decision';
-import { classifyProtectedPath, type ProtectedPathSpec } from './path-protect';
-
-// Block writes (via shell redirect, tee, cp, mv) that target sensitive
-// Files. Catches the exfil-via-redirect gap that path-protect can't see
-// Because it only watches Edit/Write tool calls.
-
-const PROTECTED_TARGET_RE: readonly ProtectedPathSpec[] = [
-  {
-    rule: 'redirect-env',
-    pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
-    message:
-      'Refusing to write into a .env file via shell redirect / tee / cp / mv. .env files hold secrets — never overwrite from a tool call.',
-  },
-  {
-    rule: 'redirect-dev-vars',
-    pattern: /(?<prefix>^|\/)\.dev\.vars(?<ext>\.[^/]+)?$/,
-    message: 'Refusing to write into .dev.vars (Cloudflare/Wrangler secrets).',
-  },
-  {
-    rule: 'redirect-ssh',
-    pattern: /(?<prefix>^|\/)\.ssh\//,
-    message: 'Refusing to write into ~/.ssh/ via shell.',
-  },
-  {
-    rule: 'redirect-key',
-    pattern: /\.(?<ext>pem|key|p12|pfx)$/i,
-    message: 'Refusing to overwrite a private-key-shaped file via shell.',
-  },
-  {
-    rule: 'redirect-aws-credentials',
-    pattern: /(?<prefix>^|\/)\.aws\/credentials$/,
-    message: 'Refusing to write into ~/.aws/credentials via shell.',
-  },
-  {
-    rule: 'redirect-netrc',
-    pattern: /(?<prefix>^|\/)\.netrc$/,
-    message: 'Refusing to write into ~/.netrc via shell.',
-  },
-  {
-    rule: 'redirect-block-device',
-    pattern: /^\/dev\/(?<type>sd|disk|nvme|rdisk)/i,
-    message: 'Redirecting into a raw block device wipes the disk. Refuse.',
-  },
-];
-
-const checkPath = (path: string): Decision | null => {
-  const protection = classifyProtectedPath(path, 'write', PROTECTED_TARGET_RE);
-  if (protection !== null) {
-    return deny(protection.rule, protection.message);
-  }
-  return null;
-};
-
-const bashRedirect = (segments: readonly Segment[], cmd: string): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-redirect');
-  }
-  for (const seg of segments) {
-    for (const r of seg.redirects) {
-      if (r.op === '>' || r.op === '>>') {
-        const d = checkPath(r.target);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-    if (seg.head === 'tee') {
-      for (const t of seg.args) {
-        const d = checkPath(t);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-    if (seg.head === 'cp' || seg.head === 'mv') {
-      // The destination is the last positional arg.
-      const dst = seg.args.at(-1);
-      if (dst !== undefined) {
-        const d = checkPath(dst);
-        if (d !== null) {
-          return d;
-        }
-      }
-    }
-  }
-  return allow('bash-redirect');
-};
-
-export { bashRedirect };

package/src/rules/bash-scoped-rm.ts

@@ -1,84 +0,0 @@
-import { type Segment, hasBypass, isSafePathTarget, safeScopesSummary } from '../lib/bash';
-import type { SafePathsConfig } from '../lib/config';
-import { type Decision, allow, deny } from '../lib/decision';
-
-interface Issue {
-  readonly kind: 'rm' | 'find -delete';
-  readonly targets: readonly string[];
-}
-
-const analyzeRm = (seg: Segment, config: SafePathsConfig): readonly string[] => {
-  // `rm -- foo` ends flag parsing. Treat -- as flag-like and stop after it.
-  let endOfFlags = false;
-  const targets: string[] = [];
-  for (const t of seg.tokens.slice(1)) {
-    if (!endOfFlags && t === '--') {
-      endOfFlags = true;
-      continue;
-    }
-    if (!endOfFlags && t.startsWith('-') && t !== '-') {
-      continue;
-    }
-    targets.push(t);
-  }
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  return targets.filter((t) => !isSafePathTarget(t, extraRelative, extraAbsolute));
-};
-
-const analyzeFindDelete = (seg: Segment, config: SafePathsConfig): readonly string[] | null => {
-  if (!seg.tokens.includes('-delete')) {
-    return null;
-  }
-  const paths: string[] = [];
-  for (const t of seg.tokens.slice(1)) {
-    if (t.startsWith('-')) {
-      break;
-    }
-    paths.push(t);
-  }
-  const checked = paths.length === 0 ? ['.'] : paths;
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  return checked.filter((p) => !isSafePathTarget(p, extraRelative, extraAbsolute));
-};
-
-const bashScopedRm = (
-  segments: readonly Segment[],
-  cmd: string,
-  config: SafePathsConfig,
-): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-scoped-rm');
-  }
-  const issues: Issue[] = [];
-  for (const seg of segments) {
-    if (seg.head === 'rm') {
-      const unsafe = analyzeRm(seg, config);
-      if (unsafe.length > 0) {
-        issues.push({ kind: 'rm', targets: unsafe });
-      }
-      continue;
-    }
-    if (seg.head === 'find') {
-      const unsafe = analyzeFindDelete(seg, config);
-      if (unsafe !== null && unsafe.length > 0) {
-        issues.push({ kind: 'find -delete', targets: unsafe });
-      }
-    }
-  }
-  if (issues.length === 0) {
-    return allow('bash-scoped-rm');
-  }
-  const extraRelative = config.relative ?? [];
-  const extraAbsolute = config.absolute ?? [];
-  const detail = issues
-    .map((i) => `  • ${i.kind} on: ${i.targets.map((t) => JSON.stringify(t)).join(', ')}`)
-    .join('\n');
-  return deny(
-    'destructive-outside-safe-paths',
-    `Destructive deletion outside known-safe scopes is blocked. Use a recoverable deletion tool or limit the target to an ephemeral build, cache, state, or temporary directory:\n${safeScopesSummary(extraRelative, extraAbsolute)}\n\nFlagged targets:\n${detail}\n\nIf raw deletion is genuinely needed, append \` # tripwire-allow: <reason>\` to the command.`,
-  );
-};
-
-export { bashScopedRm };

package/src/rules/bash-tar-explosion.ts

@@ -1,77 +0,0 @@
-import { type Segment, hasBypass } from '../lib/bash';
-import { type Decision, allow, deny } from '../lib/decision';
-
-// Block tar/zip/unzip extractions that would write into / or $HOME
-// (`tar -xf foo.tar.gz -C /` style explosions).
-
-const isExtractFlag = (flag: string): boolean =>
-  flag === '--extract' ||
-  (flag.startsWith('-') && !flag.startsWith('--') && flag.slice(1).includes('x'));
-
-const findChangeDir = (seg: Segment): string | null => {
-  for (let i = 0; i < seg.tokens.length; i += 1) {
-    const t = seg.tokens[i];
-    if (t === undefined) {
-      continue;
-    }
-    if (t === '-C' || t === '--directory') {
-      return seg.tokens[i + 1] ?? null;
-    }
-    if (t.startsWith('--directory=')) {
-      return t.slice('--directory='.length);
-    }
-  }
-  return null;
-};
-
-const isUnsafeExtractDest = (dest: string): boolean => {
-  return dest === '/' || /^(?<home>~|\$HOME|\$\{HOME\})$/.test(dest);
-};
-
-const bashTarExplosion = (segments: readonly Segment[], cmd: string): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('bash-tar-explosion');
-  }
-  for (const seg of segments) {
-    if (seg.head !== 'tar') {
-      continue;
-    }
-    const [, legacyOptionWord] = seg.tokens;
-    const extracting =
-      seg.flags.some(isExtractFlag) ||
-      seg.tokens.includes('--extract') ||
-      (legacyOptionWord !== undefined &&
-        /^[a-zA-Z]+$/.test(legacyOptionWord) &&
-        legacyOptionWord.includes('x'));
-    if (!extracting) {
-      continue;
-    }
-    const dest = findChangeDir(seg);
-    if (dest !== null && isUnsafeExtractDest(dest)) {
-      return deny(
-        'tar-extract-to-root',
-        `tar -x with -C ${dest} can overwrite arbitrary system files. Refuse — extract to a contained directory (e.g. ./tmp/extract) and inspect before moving anything elsewhere.`,
-      );
-    }
-  }
-  // Unzip with -d destination
-  for (const seg of segments) {
-    if (seg.head !== 'unzip') {
-      continue;
-    }
-    for (let i = 0; i < seg.tokens.length; i += 1) {
-      if (seg.tokens[i] === '-d') {
-        const dest = seg.tokens[i + 1];
-        if (dest !== undefined && isUnsafeExtractDest(dest)) {
-          return deny(
-            'unzip-to-root',
-            `unzip -d ${dest} can overwrite arbitrary system files. Refuse — extract to a contained directory.`,
-          );
-        }
-      }
-    }
-  }
-  return allow('bash-tar-explosion');
-};
-
-export { bashTarExplosion };

package/src/rules/config-custom.ts

@@ -1,166 +0,0 @@
-// Config-based custom blocking/allowing rules.
-// Uses shell parsing utilities to match command patterns from config.
-
-import { hasBypass, parseCommand, type Segment } from '../lib/bash';
-import type { BlockRule } from '../lib/config';
-import { type Decision, allow, deny, ask } from '../lib/decision';
-
-const BYPASS_HELP = 'If this is intentional, append ` # tripwire-allow: <reason>` to the command.';
-
-const ALIASES: ReadonlyMap<string, string> = new Map([
-  ['add', 'create'],
-  ['new', 'create'],
-  ['edit', 'update'],
-  ['set', 'update'],
-  ['rm', 'delete'],
-  ['del', 'delete'],
-  ['remove', 'delete'],
-]);
-
-const canonical = (token: string): string => ALIASES.get(token) ?? token;
-
-// Match command policy by executable basename so an absolute path cannot
-// bypass a configured rule.
-const basename = (token: string): string => {
-  const idx = token.lastIndexOf('/');
-  return idx === -1 ? token : token.slice(idx + 1);
-};
-
-const flagPresent = (tokens: readonly string[], flag: string): boolean =>
-  tokens.some((t) => t === flag || t.startsWith(`${flag}=`));
-
-const flagValue = (tokens: readonly string[], flag: string): string | null => {
-  for (let i = 0; i < tokens.length; i += 1) {
-    const t = tokens[i];
-    if (t === undefined) {
-      continue;
-    }
-    if (t === flag) {
-      return tokens[i + 1] ?? '';
-    }
-    if (t.startsWith(`${flag}=`)) {
-      return t.slice(flag.length + 1);
-    }
-  }
-  return null;
-};
-
-const subcommandTokens = (seg: Segment): string[] => {
-  const out: string[] = [];
-  const tokens = seg.tokens.slice(1);
-  for (let i = 0; i < tokens.length; i += 1) {
-    const t = tokens[i];
-    if (t === undefined) {
-      continue;
-    }
-    if (t.startsWith('-')) {
-      // Without per-CLI flag metadata, we conservatively treat
-      // `--flag value` / `-f value` as one option pair and `--flag=value`
-      // As one token. This keeps global selectors like `--account X`
-      // Out of the subcommand path, at the cost of not distinguishing
-      // Boolean flags that precede positional args.
-      const nextToken = tokens[i + 1];
-      if (!t.includes('=') && nextToken !== undefined && !nextToken.startsWith('-')) {
-        i += 1;
-      }
-      continue;
-    }
-    out.push(t);
-  }
-  return out;
-};
-
-// Match a pattern against parsed segments using shell parsing.
-// This is more powerful than simple regex because it uses the same
-// Parsing logic as the rest of tripwire.
-const matchPattern = (segments: readonly Segment[], rule: BlockRule): boolean => {
-  const { pattern } = rule;
-  const patternSegs = parseCommand(pattern);
-  if (patternSegs.length === 0) {
-    return false;
-  }
-
-  const [patternSegment] = patternSegs;
-  if (patternSegment === undefined) {
-    return false;
-  }
-  const [patternHead, ...patternSubcommands] = patternSegment.tokens;
-  if (patternHead === undefined) {
-    return false;
-  }
-
-  for (const seg of segments) {
-    if (basename(seg.head) !== basename(patternHead)) {
-      continue;
-    }
-
-    if (patternSubcommands.length > 0) {
-      const actualSubcommands = subcommandTokens(seg);
-      const pathMatches = patternSubcommands.every(
-        (p, i) =>
-          actualSubcommands[i] !== undefined && canonical(actualSubcommands[i]) === canonical(p),
-      );
-      if (!pathMatches) {
-        continue;
-      }
-    }
-
-    if ((rule.requiresFlags ?? []).some((flag) => !flagPresent(seg.tokens, flag))) {
-      continue;
-    }
-
-    const valueChecks = rule.forbidsFlagValues ?? [];
-    const valuesMatch = valueChecks.every((check) => {
-      const value = flagValue(seg.tokens, check.flag);
-      return value !== null && check.values.includes(value);
-    });
-    if (!valuesMatch) {
-      continue;
-    }
-
-    if (
-      patternSubcommands.length === 0 &&
-      rule.requiresFlags === undefined &&
-      rule.forbidsFlagValues === undefined
-    ) {
-      return true;
-    }
-
-    return true;
-  }
-  return false;
-};
-
-export const configCustom = (
-  segments: readonly Segment[],
-  cmd: string,
-  blockedCommands: readonly BlockRule[],
-  allowedCommands: readonly BlockRule[],
-): Decision => {
-  if (hasBypass(cmd)) {
-    return allow('config-custom');
-  }
-
-  // Check allowed first (overrides blocks)
-  for (const allowRule of allowedCommands) {
-    if (matchPattern(segments, allowRule)) {
-      return allow('config-custom');
-    }
-  }
-
-  // Then check blocked
-  for (const blockRule of blockedCommands) {
-    if (matchPattern(segments, blockRule)) {
-      const message = blockRule.message.includes('tripwire-allow')
-        ? blockRule.message
-        : `${blockRule.message} ${BYPASS_HELP}`;
-      return blockRule.action === 'ask'
-        ? ask('config-custom', message)
-        : deny('config-custom', message);
-    }
-  }
-
-  return allow('config-custom');
-};
-
-export { matchPattern };

package/src/rules/lazy-code.ts

@@ -1,95 +0,0 @@
-import { type Decision, allow, warn } from '../lib/decision';
-import { addedLines, readFileOrEmpty } from '../lib/diff';
-import type { EditInput, WriteInput } from '../lib/event';
-
-// Phrases that frequently signal incomplete or deferred work. Some — like
-// "fallback" or "placeholder" — are also legitimate product terms (an auth
-// Fallback flow, an HTML input placeholder). Rather than try to disambiguate
-// Statically, we accept the false-positive rate and keep this as a non-
-// Blocking warn. The advisory is written to make the intent unmistakable
-// So the agent treats real-product uses as no-action and treats actual
-// Stub work as a prompt to finish the job before returning to the user.
-const STUB_RE: readonly RegExp[] = [
-  /\bTODO\s*:/i,
-  /\bFIXME\s*:/i,
-  /\bXXX\s*:/i,
-  /\bHACK\s*:/i,
-  /\bfor now\b/i,
-  /\bnot implemented\b/i,
-  /\bNotImplementedError\b/,
-  /\btemp fix\b/i,
-  /\bfallback\b/i,
-  /\bplaceholder\b/i,
-  /\bbackwards?[ -]?compat(?<ibility>ibility)?\b/i,
-  /\bfor later\b/i,
-  /\blater on\b/i,
-  /\bget back to\b/i,
-  /\bI'?ll fix\b/i,
-  /\bto be implemented\b/i,
-  /\bnot yet (?<state>implemented|done)\b/i,
-  /\bstubbed\b/i,
-];
-
-const CODE_EXT_RE =
-  /\.(?<ext>ts|tsx|js|jsx|mjs|cjs|py|rs|go|rb|java|kt|swift|c|cc|cpp|h|hpp|cs|php|sh|zsh|bash|lua|ex|exs|clj|scala|dart)$/i;
-
-const TEST_PATH_RE =
-  /(?<prefix>^|\/)(?<dir>__tests__|tests?|spec|fixtures?|mocks?|__mocks__|stories)(?<suffix>\/|$)|\.(?<ext>test|spec|fixture|mock|stories)\.[^/]+$/i;
-
-// Comment-syntax-agnostic. Works in `//`, `#`, `--`, `/* */`, `<!-- -->`,
-// `;`, `%`, etc.
-const BYPASS_RE = /tripwire-allow:[ \t]*\S/;
-
-const matches = (line: string): boolean => {
-  if (BYPASS_RE.test(line)) {
-    return false;
-  }
-  for (const re of STUB_RE) {
-    if (re.test(line)) {
-      return true;
-    }
-  }
-  return false;
-};
-
-const lazyCode = (input: EditInput | WriteInput): Decision => {
-  const path = input.file_path;
-  if (!CODE_EXT_RE.test(path) || TEST_PATH_RE.test(path)) {
-    return allow('lazy-code');
-  }
-
-  const next = 'content' in input ? input.content : input.new_string;
-  const prev = 'content' in input ? readFileOrEmpty(path) : input.old_string;
-
-  const offenders: string[] = [];
-  for (const line of addedLines(prev, next)) {
-    if (matches(line)) {
-      offenders.push(line.slice(0, 200));
-    }
-  }
-  if (offenders.length === 0) {
-    return allow('lazy-code');
-  }
-
-  const sample = offenders
-    .slice(0, 3)
-    .map((l) => `  • ${l}`)
-    .join('\n');
-  const more = offenders.length > 3 ? `\n  …and ${offenders.length - 3} more` : '';
-
-  return warn(
-    'lazy-code-marker',
-    [
-      `Heads up: line(s) you just added contain words that often signal incomplete or deferred work. The write went through — this is a flag, not a block.`,
-      ``,
-      `Why this exists: AI coding agents have a strong pull toward stubbing things, deferring "for now," and shipping half-built fallbacks instead of finishing the work in the same turn. The point of this warning is to push back on that pull on every iteration. If you stubbed something out for time, finish it this turn rather than leaving deferred work for later.`,
-      ``,
-      `If the marker is genuinely permanent — a real product term ("auth fallback flow", "retry fallback chain", an HTML input placeholder, a public API field literally named "placeholder"), a logging tag, or a comment intentionally left for a human reader — no action needed. To silence the flag on subsequent edits of that line, append \`tripwire-allow: <one-line reason>\` (any comment syntax: \`//\`, \`#\`, \`--\`, etc.).`,
-      ``,
-      `Flagged additions:`,
-      sample + more,
-    ].join('\n'),
-  );
-};
-
-export { lazyCode };

package/src/rules/path-protect.ts

@@ -1,131 +0,0 @@
-import { lstatSync, readlinkSync, realpathSync } from 'node:fs';
-import path from 'node:path';
-
-import { type Decision, allow, deny } from '../lib/decision';
-import type { EditInput, WriteInput } from '../lib/event';
-
-interface ProtectedPathSpec {
-  readonly pattern: RegExp;
-  readonly rule: string;
-  readonly message: string;
-}
-
-type PathAccess = 'read' | 'write';
-
-const protections: readonly ProtectedPathSpec[] = [
-  {
-    pattern: /(?<prefix>^|\/)\.env(?<ext>\.[^/]+)?$/,
-    rule: 'env-file',
-    message:
-      '.env files hold secrets that should never be sent to the model. Refuse to write or edit. If an example is needed, create .env.example with redacted placeholders.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.dev\.vars(?<ext>\.[^/]+)?$/,
-    rule: 'dev-vars',
-    message: '.dev.vars holds Cloudflare/Wrangler secrets. Do not modify.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.ssh\//,
-    rule: 'ssh-dir',
-    message: 'Never write into ~/.ssh/. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)(?<key>id_rsa|id_ed25519|id_ecdsa|id_dsa)(?<pub>\.pub)?$/,
-    rule: 'ssh-key',
-    message: 'SSH key file. Refuse.',
-  },
-  {
-    pattern: /\.(?<ext>pem|key|p12|pfx)$/i,
-    rule: 'private-key',
-    message:
-      'Private key file. Refuse to overwrite. If generating a new key, use a different filename and let the user review.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)secrets?\.(?<ext>json|ya?ml|toml|env)$/i,
-    rule: 'secrets-file',
-    message: 'Secrets file. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.aws\/credentials$/,
-    rule: 'aws-credentials',
-    message: 'AWS credentials file. Refuse.',
-  },
-  {
-    pattern: /(?<prefix>^|\/)\.netrc$/,
-    rule: 'netrc',
-    message: '.netrc holds host credentials. Refuse.',
-  },
-];
-
-const resolveExistingPath = (absolutePath: string): string | null => {
-  try {
-    return realpathSync(absolutePath);
-  } catch {
-    return null;
-  }
-};
-
-// A write target may not exist yet. Resolve the deepest existing parent and
-// append the missing suffix. If an existing component is a dangling symlink,
-// follow its link text before continuing so `alias -> .env` cannot hide a new
-// protected target.
-const resolveWritePath = (absolutePath: string, seen: Set<string> = new Set<string>()): string => {
-  if (seen.has(absolutePath)) {
-    return absolutePath;
-  }
-  seen.add(absolutePath);
-
-  const existing = resolveExistingPath(absolutePath);
-  if (existing !== null) {
-    return existing;
-  }
-
-  try {
-    if (lstatSync(absolutePath).isSymbolicLink()) {
-      const target = readlinkSync(absolutePath);
-      return resolveWritePath(path.resolve(path.dirname(absolutePath), target), seen);
-    }
-  } catch {
-    // The target does not exist. Resolve its parent below.
-  }
-
-  const parent = path.dirname(absolutePath);
-  if (parent === absolutePath) {
-    return absolutePath;
-  }
-  return path.join(resolveWritePath(parent, seen), path.basename(absolutePath));
-};
-
-const classifyProtectedPath = (
-  submittedPath: string,
-  access: PathAccess,
-  specs: readonly ProtectedPathSpec[],
-): ProtectedPathSpec | null => {
-  const absolutePath = path.resolve(submittedPath);
-  const resolvedPath =
-    access === 'write' ? resolveWritePath(absolutePath) : resolveExistingPath(absolutePath);
-  const candidates = [submittedPath, absolutePath];
-  if (resolvedPath !== null && !candidates.includes(resolvedPath)) {
-    candidates.push(resolvedPath);
-  }
-
-  for (const candidate of candidates) {
-    for (const spec of specs) {
-      if (spec.pattern.test(candidate)) {
-        return spec;
-      }
-    }
-  }
-  return null;
-};
-
-const pathProtect = (input: EditInput | WriteInput): Decision => {
-  const protection = classifyProtectedPath(input.file_path, 'write', protections);
-  if (protection !== null) {
-    return deny(protection.rule, protection.message);
-  }
-  return allow('path-protect');
-};
-
-export type { PathAccess, ProtectedPathSpec };
-export { classifyProtectedPath, pathProtect };

package/src/rules/post-secret-scrub.ts

@@ -1,49 +0,0 @@
-import type { SecretScannerConfig } from '../lib/config';
-import { type Decision, allow, deny } from '../lib/decision';
-import { extractResponseText } from '../lib/event';
-import { scanAndRedact, type ScannerRunner, type ScanFailureCategory } from '../lib/secrets';
-
-// PostToolUse: scan whatever string content a tool returned (Bash stdout,
-// Read content) for known secret patterns via betterleaks. If anything
-// Fires, block the result (so the original output never reaches the
-// Model) and surface a redacted version in the block reason — that lets
-// The agent see what was returned without leaking the secret itself.
-
-interface PostInput {
-  readonly toolName: string;
-  readonly response: unknown;
-  readonly secretScanner: SecretScannerConfig;
-  readonly scannerRunner?: ScannerRunner;
-}
-
-const scannerFailureMessage = (category: ScanFailureCategory): string =>
-  `Tripwire could not verify this tool output because the configured secret scanner failed ` +
-  `(${category}). The original output was withheld. Install Betterleaks 1.5.0 or later, ` +
-  `check secretScanner.executable and secretScanner.timeoutMs, then run the original tool again.`;
-
-const postSecretScrub = (input: PostInput): Decision => {
-  const text = extractResponseText(input.toolName, input.response);
-  if (text.length === 0) {
-    return allow('post-secret-scrub');
-  }
-  const result = scanAndRedact(text, input.secretScanner, input.scannerRunner);
-  if (!result.ok) {
-    return deny('secret-scanner-failed', scannerFailureMessage(result.category));
-  }
-  if (result.hits.length === 0) {
-    return allow('post-secret-scrub');
-  }
-  const summary = result.hits.map((hit) => `${hit.rule}×${hit.count}`).join(', ');
-  return deny(
-    'secrets-in-output',
-    [
-      `tripwire intercepted ${result.hits.length} secret pattern(s) in this tool's output (${summary}). The original output was withheld so the secret never enters the model context. A redacted form is below — work from this, do not re-run the same command in a way that re-fetches the underlying secret.`,
-      ``,
-      `Redacted output:`,
-      result.redacted.slice(0, 16_000) + (result.redacted.length > 16_000 ? '\n…[truncated]' : ''),
-    ].join('\n'),
-  );
-};
-
-export type { PostInput };
-export { postSecretScrub };