@shield-agent/kya 0.34.0 → 0.35.3

package/dist/guard-lite.d.ts

@@ -0,0 +1,27 @@
+export interface GuardInput {
+    readonly stdinText: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly cwd: string;
+    /** Host id from `--host`: claude (default), codex, cursor, copilot or gemini. Sets the payload reading and the deny shape. */
+    readonly host?: string;
+}
+/** Hosts the guard speaks. Any other id gets the Claude-shaped deny and no ask. */
+export declare const GUARD_HOSTS: readonly ["claude", "codex", "cursor", "copilot", "gemini"];
+export interface GuardResult {
+    readonly exitCode: 0 | 2;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** Evaluate one hook call. Synchronous; never throws. */
+export declare function runGuard(input: GuardInput): GuardResult;
+/** Text for /kya-guard:status. Reads the trail only. Never throws. */
+export declare function guardStatus(env: NodeJS.ProcessEnv, now?: Date): string;
+/**
+ * `--card [--id <id>]`: write the near-miss card (SVG only: this bundle starts no process, so it makes no PNG) and print the caption.
+ * Always exit 0: the slash command shows the text, and its `|| echo` fallback is for a missing node, not for "no card".
+ */
+export declare function guardCard(env: NodeJS.ProcessEnv, id?: string): {
+    readonly exitCode: 0;
+    readonly text: string;
+};
+//# sourceMappingURL=guard-lite.d.ts.map

package/dist/guard-lite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-lite.d.ts","sourceRoot":"","sources":["../src/guard-lite.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8HAA8H;IAC9H,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mFAAmF;AACnF,eAAO,MAAM,WAAW,6DAA8D,CAAC;AAGvF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AA4GD,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAiGvD;AAID,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAgClF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAY9G"}

package/dist/guard-lite.js

@@ -0,0 +1,274 @@
+/**
+ * The kya-guard plugin core (plugins/kya-guard). The lean sibling of `kya hook`: Claude Code PreToolUse in, verdict out,
+ * one row appended to ~/.kya/trail.jsonl. Bundled into plugins/kya-guard/dist/guard.mjs by scripts/build-guard.mjs.
+ *
+ * Same rules, same verdicts and same deny and ask text as src/commands/hook.ts, because it calls the same functions
+ * (evaluateOffline, guardPackMatch, neverListInputMatch). What it leaves out on purpose: the hosted plane, notify and
+ * OTLP, the update check, the IoC scan, usage ping, the dual-hook dedupe markers, the device salt and trail rotation.
+ * It imports no network module and no child process module (test/guard-bundle.test.ts enforces that on the bundle).
+ * Its only write while it guards is one append to the trail file (`--card`, started by the person, also writes one SVG). Any internal error lets the call through and leaves an `error` row.
+ */
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+import { basename } from "node:path";
+import { eventIdOf, formatCard, pickNearMiss, recentNearMiss, ruleLabel, writeCardSvg } from "./card.js";
+import { computeArgsHash } from "./hash.js";
+import { deriveWireChangeFields } from "./diff-preview.js";
+import { GUARD_DEFAULTS, GUARD_SHELL_RULES, guardContextFrom, guardHint, guardPackMatch, readGuardConfig } from "./guard-pack.js";
+import { isNeverCode } from "./never-code.js";
+import { NEVER_LIST_INPUT_RULES, neverListInputMatch } from "./never-list-input.js";
+import { evaluateOffline, matchesNeverList } from "./offline-evaluate.js";
+import { loadProjectPolicy } from "./project-policy.js";
+import { findSampleTool } from "./sample-tools.js";
+import { defaultSessionId, globalTrailPath, hostToProduct, readGlobalTrail } from "./trail.js";
+/** Hosts the guard speaks. Any other id gets the Claude-shaped deny and no ask. */
+export const GUARD_HOSTS = ["claude", "codex", "cursor", "copilot", "gemini"];
+const hostId = (h) => (h ?? "claude").trim().toLowerCase() || "claude";
+const ALLOW = { exitCode: 0, stdout: "", stderr: "" };
+const GUARD_ASK = "GUARD_ASK";
+const str = (v) => (typeof v === "string" && v ? v : undefined);
+/**
+ * Hook envelopes of every host: Claude Code, Codex and Cursor (snake_case), Copilot CLI (camelCase, `toolArgs` can be a
+ * JSON string), Gemini CLI (`BeforeTool`, MCP tools named in `mcp_context`). Same reading as src/commands/hook.ts.
+ * Undefined when the text is not a JSON object with a tool name.
+ */
+function parsePayload(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const p = raw;
+    const event = str(p.hook_event_name) ?? str(p.hookEventName);
+    const mcp = p.mcp_context && typeof p.mcp_context === "object" && !Array.isArray(p.mcp_context) ? p.mcp_context : undefined;
+    const geminiMcp = /^BeforeTool$/i.test(event ?? "") && str(mcp?.server_name) && str(mcp?.tool_name) ? `mcp__${str(mcp?.server_name)}__${str(mcp?.tool_name)}` : undefined;
+    const toolName = geminiMcp ?? str(p.tool_name) ?? str(p.toolName);
+    if (!toolName)
+        return undefined;
+    return { event, sessionId: str(p.session_id) ?? str(p.sessionId), cwd: str(p.cwd), toolName, toolInput: p.tool_input ?? p.toolInput ?? parseToolArgs(p.toolArgs) };
+}
+/** Copilot sends `toolArgs` as a JSON string. A string that does not parse stays a string, so the input rules fail open on it. */
+function parseToolArgs(v) {
+    if (typeof v !== "string")
+        return v;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return v;
+    }
+}
+/** Each host reads its own deny body. Exit 2 blocks on all of them; the body carries the reason the agent sees. */
+function deny(reason, host) {
+    const claude = { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason };
+    const body = host === "gemini" ? { decision: "deny", reason }
+        : host === "cursor" ? { permission: "deny", user_message: reason, agent_message: reason }
+            : host === "copilot" ? { permissionDecision: "deny", permissionDecisionReason: reason, hookSpecificOutput: claude }
+                : { hookSpecificOutput: claude };
+    return { exitCode: 2, stdout: `${JSON.stringify(body)}\n`, stderr: `${reason}\n` };
+}
+function ask(reason) {
+    const body = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: reason } };
+    return { exitCode: 0, stdout: `${JSON.stringify(body)}\n`, stderr: "" };
+}
+/** Same text as hook.ts denyReason. Never carries command text, a path or a matched secret. */
+function denyReason(toolName, reasonCode, ruleId) {
+    if (reasonCode === "NEVER_EVENT" && ruleId) {
+        return `KYA denied ${toolName}: NEVER_EVENT (rule ${ruleId}; never-list rules cannot be overridden)`;
+    }
+    if ((isNeverCode(reasonCode) || reasonCode === GUARD_ASK) && reasonCode !== "NEVER_EVENT" && ruleId) {
+        const hint = guardHint(ruleId);
+        return `KYA denied ${toolName}: ${reasonCode} (${ruleId}).${hint ? ` ${hint}` : ""} Ask the user; see docs/guard-pack.md.`;
+    }
+    return `KYA denied ${toolName}: ${reasonCode}`;
+}
+function askReason(toolName, ruleId) {
+    const hint = ruleId ? guardHint(ruleId) : "";
+    return `KYA asks before ${toolName}: ${GUARD_ASK}${ruleId ? ` (${ruleId})` : ""}.${hint ? ` ${hint}` : ""} See docs/guard-pack.md.`;
+}
+/** The one write: append a JSON line to ~/.kya/trail.jsonl, same shape as appendTrail. No rotation, no salt file, no lock. */
+function record(cwd, ev, env) {
+    const path = globalTrailPath(env);
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, `${JSON.stringify({ ...ev, project: ev.project ?? basename(cwd) })}\n`, "utf8");
+}
+/** Row for a call the guard did not judge. Returns the fail-open result; a failed write is said once on stderr. */
+function failOpen(input, p, summary) {
+    const product = hostToProduct(hostId(input.host));
+    try {
+        record(p?.cwd ?? input.cwd, {
+            ts: new Date().toISOString(),
+            sessionId: p?.sessionId ?? defaultSessionId(input.env),
+            host: "ide",
+            product,
+            toolId: p?.toolName ?? "unknown",
+            verdict: "ALLOW",
+            outcome: "error",
+            reasonCode: "HOOK_ERROR",
+            mode: "offline",
+            summary,
+        }, input.env);
+        return ALLOW;
+    }
+    catch {
+        return { ...ALLOW, stderr: "KYA guard: error recording a failed hook call (the call was let through)\n" };
+    }
+}
+/** Evaluate one hook call. Synchronous; never throws. */
+export function runGuard(input) {
+    const started = Date.now();
+    const host = hostId(input.host);
+    const product = hostToProduct(host);
+    let payload;
+    try {
+        payload = parsePayload(input.stdinText);
+        if (!payload)
+            return failOpen(input, undefined, "unreadable hook payload; the call was let through (fail-open)");
+        // The plugins declare PreToolUse (BeforeTool on Gemini) only; any other event carries no gate decision.
+        if (payload.event && !/^(PreToolUse|pre[_-]tool[_-]use|BeforeTool)$/i.test(payload.event))
+            return ALLOW;
+        const toolName = payload.toolName;
+        const cwd = payload.cwd && isAbsolute(payload.cwd) ? payload.cwd : input.cwd;
+        const guard = guardContextFrom(cwd, input.env);
+        // Same steps as runEvalTool offline: the sample tool decides irreversible and action class.
+        const sample = findSampleTool(toolName);
+        const args = payload.toolInput ?? {};
+        const argsHash = computeArgsHash(args);
+        const response = evaluateOffline({
+            toolId: toolName,
+            action: toolName,
+            argsHash,
+            irreversible: sample?.irreversible ?? false,
+            sessionRisk: "LOW",
+            approvalStatus: "NONE",
+            env: { host: "ide" },
+            ...(sample?.actionClass !== undefined ? { actionClass: sample.actionClass, dataClass: sample.dataClass } : {}),
+        }, "ide", args, loadProjectPolicy(cwd, () => undefined), guard);
+        // Only Claude Code has an ask this guard relies on: on every other host an ask rule is a deny (same as hook.ts askMode).
+        const isAsk = response.reasonCode === GUARD_ASK && host === "claude";
+        const askAsDeny = response.reasonCode === GUARD_ASK && !isAsk;
+        const outcome = isAsk ? "held" : response.verdict === "DENY" || askAsDeny ? "blocked" : "ran";
+        try {
+            // A secret-shaped write is denied because its text is a secret: no preview of that text reaches the trail.
+            const change = response.reasonCode === "NEVER_SECRET_WRITE" ? undefined : deriveWireChangeFields(toolName, args, input.env);
+            record(cwd, {
+                ts: new Date().toISOString(),
+                sessionId: payload.sessionId ?? defaultSessionId(input.env),
+                host: "ide",
+                product,
+                toolId: response.toolId ?? toolName,
+                verdict: response.verdict,
+                outcome,
+                reasonCode: response.reasonCode ?? "",
+                mode: "offline",
+                neverEvent: isNeverCode(response.reasonCode),
+                ...(response.ruleId ? { neverRule: response.ruleId } : {}),
+                argsHash: response.argsHash,
+                latencyMs: Date.now() - started,
+                ...(change ?? {}),
+            }, input.env);
+        }
+        catch {
+            /* the trail never decides the verdict */
+        }
+        if (response.verdict === "DENY" || askAsDeny)
+            return deny(denyReason(toolName, response.reasonCode, response.ruleId), host);
+        if (isAsk)
+            return ask(askReason(toolName, response.ruleId));
+        return ALLOW;
+    }
+    catch {
+        // Same stance as hook.ts: the never-list and the guard pack with its defaults still block when the evaluator broke.
+        try {
+            if (payload?.toolName) {
+                const cwd = payload.cwd && isAbsolute(payload.cwd) ? payload.cwd : input.cwd;
+                const inputHit = neverListInputMatch(payload.toolName, payload.toolInput, undefined, cwd);
+                const hit = inputHit ?? (matchesNeverList(payload.toolName) ? { rule: undefined } : undefined);
+                const guardHit = hit ? undefined : guardPackMatch(payload.toolName, payload.toolInput, guardContextFrom(cwd, input.env), GUARD_DEFAULTS);
+                if (hit || guardHit) {
+                    const code = hit ? "NEVER_EVENT" : guardHit.code;
+                    const rule = hit ? hit.rule : guardHit.rule;
+                    try {
+                        record(cwd, {
+                            ts: new Date().toISOString(),
+                            sessionId: payload.sessionId ?? defaultSessionId(input.env),
+                            host: "ide",
+                            product,
+                            toolId: payload.toolName,
+                            verdict: "DENY",
+                            outcome: "blocked",
+                            reasonCode: code,
+                            mode: "offline",
+                            neverEvent: isNeverCode(code),
+                            ...(rule ? { neverRule: rule } : {}),
+                        }, input.env);
+                    }
+                    catch { /* audit is best effort */ }
+                    return deny(denyReason(payload.toolName, code, rule), host);
+                }
+            }
+        }
+        catch { /* fall through */ }
+        return failOpen(input, payload, "hook error; the call was let through (fail-open)");
+    }
+}
+const DAY_MS = 24 * 3600_000;
+/** Text for /kya-guard:status. Reads the trail only. Never throws. */
+export function guardStatus(env, now = new Date()) {
+    const ctx = guardContextFrom(process.cwd(), env);
+    const { problem } = readGuardConfig(ctx.home);
+    let rows = [];
+    let readable = true;
+    try {
+        rows = readGlobalTrail(env);
+    }
+    catch {
+        readable = false;
+    }
+    const since = now.getTime() - 7 * DAY_MS;
+    const week = rows.filter((e) => Date.parse(e.ts) >= since && e.outcome !== "error");
+    const stopped = week.filter((e) => e.outcome === "blocked");
+    const held = week.filter((e) => e.outcome === "held");
+    const last = [...stopped, ...held]
+        .sort((a, b) => Date.parse(b.ts) - Date.parse(a.ts))
+        .slice(0, 3);
+    const lines = [
+        "KYA Guard status",
+        `Rules loaded: ${NEVER_LIST_INPUT_RULES.length + GUARD_SHELL_RULES.length} (${NEVER_LIST_INPUT_RULES.length} never-list, ${GUARD_SHELL_RULES.length} guard shell), plus the secret-write and exfil checks.`,
+        readable ? `Calls seen in 7 days: ${week.length}` : "Calls seen in 7 days: unknown (the trail could not be read)",
+        `Calls blocked in 7 days: ${stopped.length} (${held.length} more held for you to answer)`,
+        last.length
+            ? `Last ${last.length} stopped: ${last.map((e) => { const r = e.neverRule ?? e.reasonCode; const l = ruleLabel(r); return `${l ? `${l} [${r}]` : r} (${e.ts.slice(0, 16).replace("T", " ")} UTC)`; }).join(", ")}`
+            : "Last stopped: none",
+        // The card is offered here, to the person. Never in the deny text the agent reads.
+        ...(recentNearMiss(week, now) ? ["Make a card to post about the last stop (an image with the rule, the host and the date, nothing private): /kya-guard:share"] : []),
+        ...(problem ? [`Config problem: ${problem}. The defaults are in force.`] : []),
+        "To allow one rule: edit ~/.kya/config.json yourself and add a guardAllow entry (rule id plus an exact path or command). The agent cannot edit that file.",
+        "Full report: npx @shield-agent/kya receipt --open",
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * `--card [--id <id>]`: write the near-miss card (SVG only: this bundle starts no process, so it makes no PNG) and print the caption.
+ * Always exit 0: the slash command shows the text, and its `|| echo` fallback is for a missing node, not for "no card".
+ */
+export function guardCard(env, id) {
+    try {
+        const pick = pickNearMiss(readGlobalTrail(env), id);
+        if (!pick.ok)
+            return { exitCode: 0, text: `${pick.message}\n` };
+        const { svgPath, input } = writeCardSvg(env, pick.event);
+        return {
+            exitCode: 0,
+            text: formatCard({ svgPath, input, id: eventIdOf(pick.event), pngNote: "This plugin makes the SVG only. For a PNG too, run: npx @shield-agent/kya receipt --card" }),
+        };
+    }
+    catch {
+        return { exitCode: 0, text: "KYA Guard could not make the card (the trail or the cards folder could not be read or written). Nothing was sent anywhere.\n" };
+    }
+}
+//# sourceMappingURL=guard-lite.js.map

package/dist/guard-lite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-lite.js","sourceRoot":"","sources":["../src/guard-lite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClI,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAyD,MAAM,YAAY,CAAC;AAUtJ,mFAAmF;AACnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AACvF,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAU,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC;AAgBnG,MAAM,KAAK,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnE,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE7F;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,WAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzJ,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1K,MAAM,QAAQ,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrK,CAAC;AAED,kIAAkI;AAClI,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mHAAmH;AACnH,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACxC,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC;IAC7G,MAAM,IAAI,GACR,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;QAChD,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE;YACzF,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE;gBACnH,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;AACrF,CAAC;AAED,SAAS,GAAG,CAAC,MAAc;IACzB,MAAM,IAAI,GAAG,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,KAAK,EAAE,wBAAwB,EAAE,MAAM,EAAE,EAAE,CAAC;IAClI,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,QAAgB,EAAE,UAAkB,EAAE,MAAe;IACvE,IAAI,UAAU,KAAK,aAAa,IAAI,MAAM,EAAE,CAAC;QAC3C,OAAO,cAAc,QAAQ,uBAAuB,MAAM,0CAA0C,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,SAAS,CAAC,IAAI,UAAU,KAAK,aAAa,IAAI,MAAM,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,cAAc,QAAQ,KAAK,UAAU,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,wCAAwC,CAAC;IAC7H,CAAC;IACD,OAAO,cAAc,QAAQ,KAAK,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,MAA0B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,OAAO,mBAAmB,QAAQ,KAAK,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC;AACtI,CAAC;AAED,8HAA8H;AAC9H,SAAS,MAAM,CAAC,GAAW,EAAE,EAAc,EAAE,GAAsB;IACjE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvG,CAAC;AAED,mHAAmH;AACnH,SAAS,QAAQ,CAAC,KAAiB,EAAE,CAAsB,EAAE,OAAe;IAC1E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC1B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,CAAC,EAAE,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YACtD,IAAI,EAAE,KAAK;YACX,OAAO;YACP,MAAM,EAAE,CAAC,EAAE,QAAQ,IAAI,SAAS;YAChC,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,OAAO;YAChB,UAAU,EAAE,YAAY;YACxB,IAAI,EAAE,SAAS;YACf,OAAO;SACR,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,4EAA4E,EAAE,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAiB,aAAa,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,+DAA+D,CAAC,CAAC;QACjH,wGAAwG;QACxG,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/C,4FAA4F;QAC5F,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,eAAe,CAC9B;YACE,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,KAAK;YAC3C,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YACpB,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/G,EACD,KAAK,EACL,IAAI,EACJ,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,EACvC,KAAK,CACN,CAAC;QAEF,yHAAyH;QACzH,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAC;QACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC;QAC9D,MAAM,OAAO,GAAiB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5G,IAAI,CAAC;YACH,2GAA2G;YAC3G,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,KAAK,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5H,MAAM,CAAC,GAAG,EAAE;gBACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC3D,IAAI,EAAE,KAAK;gBACX,OAAO;gBACP,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ;gBACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO;gBACP,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;gBACrC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAC/B,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;aAClB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5H,IAAI,KAAK;YAAE,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,oHAAoH;QACpH,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC7E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC1F,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;gBACzI,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBACpB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAS,CAAC,IAAI,CAAC;oBAClD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAS,CAAC,IAAI,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,CAAC,GAAG,EAAE;4BACV,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;4BAC3D,IAAI,EAAE,KAAK;4BACX,OAAO;4BACP,MAAM,EAAE,OAAO,CAAC,QAAQ;4BACxB,OAAO,EAAE,MAAM;4BACf,OAAO,EAAE,SAAS;4BAClB,UAAU,EAAE,IAAI;4BAChB,IAAI,EAAE,SAAS;4BACf,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;4BAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACrC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;oBAChB,CAAC;oBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;oBACtC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,kDAAkD,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC;AAE7B,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,GAAsB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAiB,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;SAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACnD,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,MAAM,KAAK,GAAG;QACZ,kBAAkB;QAClB,iBAAiB,sBAAsB,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,KAAK,sBAAsB,CAAC,MAAM,gBAAgB,iBAAiB,CAAC,MAAM,wDAAwD;QAC3M,QAAQ,CAAC,CAAC,CAAC,yBAAyB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,6DAA6D;QACjH,4BAA4B,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,+BAA+B;QACzF,IAAI,CAAC,MAAM;YACT,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAClN,CAAC,CAAC,oBAAoB;QACxB,mFAAmF;QACnF,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,4HAA4H,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,0JAA0J;QAC1J,mDAAmD;KACpD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAsB,EAAE,EAAW;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAChE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0FAA0F,EAAE,CAAC;SACrK,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,8HAA8H,EAAE,CAAC;IAC/J,CAAC;AACH,CAAC"}

package/dist/guard-pack.d.ts

@@ -1,4 +1,5 @@
-export type GuardCode = "NEVER_SHELL" | "NEVER_SECRET_READ" | "NEVER_SECRET_WRITE" | "NEVER_EXFIL";
+/** GUARD_ASK is the second outcome: the human decides (see ASK_RULES). It is not a NEVER_ code, so it is not counted as a block. */
+export type GuardCode = "NEVER_SHELL" | "NEVER_SECRET_READ" | "NEVER_SECRET_WRITE" | "NEVER_EXFIL" | "GUARD_ASK";
 export interface GuardHit {
     readonly rule: string;
     readonly code: GuardCode;
@@ -26,7 +27,9 @@ export interface GuardConfig {
 }
 export declare const GUARD_DEFAULTS: GuardConfig;
 /** Rule ids of the shell family, in match order. Listed in docs/guard-pack.md. */
-export declare const GUARD_SHELL_RULES: readonly ["rm-root-home", "terraform-destroy", "sql-drop", "git-force-push", "git-delete-default-branch", "git-hard-reset-clean", "docker-volumes", "k8s-delete-ns", "cloud-delete", "railway-volume-delete"];
+export declare const GUARD_SHELL_RULES: readonly ["rm-root-home", "terraform-destroy", "sql-drop", "git-force-push", "git-delete-default-branch", "git-hard-reset-clean", "docker-volumes", "k8s-delete-ns", "cloud-delete", "railway-volume-delete", "sql-delete-all", "prisma-migrate-reset", "prisma-accept-data-loss", "supabase-reset-linked", "rm-project-wipe", "rm-git-dir", "mongo-drop-database", "redis-flush", "fly-destroy", "vercel-remove", "gh-repo-delete"];
+/** Rules whose outcome is ask, not deny: routine on a local database or a scratch folder, catastrophic on a remote one. */
+export declare const ASK_RULES: ReadonlySet<string>;
 /** Home for the guard: an absolute `HOME` from the given env, else the OS home. */
 export declare function guardContextFrom(cwd: string, env?: NodeJS.ProcessEnv): GuardContext;
 /**
@@ -55,4 +58,6 @@ export declare function matchesShellNeverList(command: string, ctx: {
 }): string | null;
 /** Actionable text for a deny, from the rule id alone (no command text, no matched secret). */
 export declare function guardHint(rule: string): string;
+/** Human phrase for a guard-pack rule id (the `secret-read-*`, `secret-write-*` and `exfil-*` families included), or undefined. */
+export declare function guardLabel(rule: string): string | undefined;
 //# sourceMappingURL=guard-pack.d.ts.map

package/dist/guard-pack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-pack.d.ts","sourceRoot":"","sources":["../src/guard-pack.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,aAAa,CAAC;AAEnG,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,cAAc,EAAE,WAA4F,CAAC;AAE1H,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,+MAGpB,CAAC;AAMX,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAUhG;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAmCrH;AAwhBD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,YAAY,EACjB,GAAG,GAAE,WAA4B,GAChC,QAAQ,GAAG,SAAS,CA0CtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM7H;AAgBD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C"}
+{"version":3,"file":"guard-pack.d.ts","sourceRoot":"","sources":["../src/guard-pack.ts"],"names":[],"mappings":"AAsBA,oIAAoI;AACpI,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,aAAa,GAAG,WAAW,CAAC;AAEjH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uBAAuB;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;CAC5C;AAED,eAAO,MAAM,cAAc,EAAE,WAA4F,CAAC;AAE1H,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,saAMpB,CAAC;AAEX,2HAA2H;AAC3H,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqG,CAAC;AAMhJ,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,CAUhG;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAmCrH;AA8pBD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,OAAO,EAClB,GAAG,EAAE,YAAY,EACjB,GAAG,GAAE,WAA4B,GAChC,QAAQ,GAAG,SAAS,CAiDtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAM7H;AA4BD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO9C;AA6BD,mIAAmI;AACnI,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO3D"}

package/dist/guard-pack.js

@@ -21,7 +21,12 @@ export const GUARD_DEFAULTS = { shellNeverList: true, secretsGuard: true, exfilG
 export const GUARD_SHELL_RULES = [
     "rm-root-home", "terraform-destroy", "sql-drop", "git-force-push", "git-delete-default-branch", "git-hard-reset-clean",
     "docker-volumes", "k8s-delete-ns", "cloud-delete", "railway-volume-delete",
+    "sql-delete-all", "prisma-migrate-reset", "prisma-accept-data-loss", "supabase-reset-linked", "rm-project-wipe", "rm-git-dir",
+    "mongo-drop-database", "redis-flush", "fly-destroy", "vercel-remove", "gh-repo-delete",
+    // new-rule:ids (pnpm new-rule adds a rule id above this line)
 ];
+/** Rules whose outcome is ask, not deny: routine on a local database or a scratch folder, catastrophic on a remote one. */
+export const ASK_RULES = new Set(["sql-delete-all", "prisma-migrate-reset", "prisma-accept-data-loss", "rm-project-wipe"]);
 // ---------------------------------------------------------------------------------------------
 // Config
 // ---------------------------------------------------------------------------------------------
@@ -353,6 +358,128 @@ const railwayVolumeDelete = (sh) => (hasCommand(sh, (c) => HTTP_CLIENTS.has(c.na
         const { pos } = words(c.args);
         return pos[0] === "volume" && pos[1] === "delete";
     }) ? "" : NO;
+/** Args after `tool`, run directly or through a package runner (`npx prisma ...`, `pnpm exec prisma@5 ...`). */
+const RUNNERS = new Set(["npx", "pnpx", "bunx", "yarn", "pnpm", "npm", "bun"]);
+function toolArgs(c, tool) {
+    if (c.name === tool)
+        return c.args;
+    if (!RUNNERS.has(c.name))
+        return NO;
+    const i = c.args.findIndex((a) => a === tool || a.startsWith(`${tool}@`));
+    return i >= 0 ? c.args.slice(i + 1) : NO;
+}
+/** DELETE FROM <table> with no WHERE before the end of the statement (`;` or the closing quote). */
+const SQL_DELETE = /\bdelete\s+from\s+(?:only\s+)?(?:[\w.]+|\\?"[\w. ]+\\?"|`[^`]+`)([^;"'`]*)/gi;
+const sqlDeleteAll = (sh) => {
+    if (!hasCommand(sh, (c) => DB_CLIENTS.has(c.name)))
+        return NO;
+    for (const m of sh.raw.matchAll(SQL_DELETE))
+        if (!/\bwhere\b/i.test(m[1]))
+            return "";
+    return NO;
+};
+const PRISMA_VALUE_OPTS = new Set(["--schema", "--config"]);
+const prismaWords = (sh) => {
+    const out = [];
+    hasCommand(sh, (c) => {
+        const a = toolArgs(c, "prisma");
+        if (a)
+            out.push(words(a, PRISMA_VALUE_OPTS));
+        return false;
+    });
+    return out;
+};
+const prismaMigrateReset = (sh) => (prismaWords(sh).some((w) => w.pos[0] === "migrate" && w.pos[1] === "reset") ? "" : NO);
+const prismaAcceptDataLoss = (sh) => (prismaWords(sh).some((w) => w.pos[0] === "db" && w.pos[1] === "push" && hasLong(w.flags, "--accept-data-loss")) ? "" : NO);
+const SUPABASE_VALUE_OPTS = new Set(["--workdir", "--db-url", "--password", "-p", "--project-ref", "--version"]);
+const supabaseResetLinked = (sh) => hasCommand(sh, (c) => {
+    const a = toolArgs(c, "supabase");
+    if (!a)
+        return false;
+    const { pos, flags } = words(a, SUPABASE_VALUE_OPTS);
+    return pos[0] === "db" && pos[1] === "reset" && (hasLong(flags, "--linked") || hasLong(flags, "--db-url"));
+}) ? "" : NO;
+/** `rm -r` targets that resolve to the project root (`.`, `./*`, `*`, its absolute path) or to its `.git`. A `cd` elsewhere in the command changes what a relative target means, so those are skipped. */
+function rmProjectTargets(sh, ctx, want) {
+    const root = ctx.projectRoot ?? ctx.cwd;
+    const moved = hasCommand(sh, (c) => (c.name === "cd" || c.name === "pushd") && c.args.some((a) => a !== "." && a !== "./"));
+    const assigned = runtimeVars(sh.raw);
+    const hits = [];
+    hasCommand(sh, (c) => {
+        if (c.name !== "rm")
+            return false;
+        const { pos, flags } = words(c.args);
+        if (!isRecursiveFlags(flags) || (want === "root" && !isForceFlags(flags)))
+            return false;
+        for (const t of pos) {
+            if (t.includes("$(") || t.includes("`") || [...t.matchAll(/\$\{?([A-Za-z_][A-Za-z0-9_]*)/g)].some((m) => assigned.has(m[1])))
+                continue;
+            if (moved && !t.startsWith("/") && !t.startsWith("~") && !t.startsWith("$"))
+                continue;
+            const p = absPath(t, ctx).replace(/\/(\.\*|\*)$/, "");
+            if (want === "root" ? p === root : p === `${root}/.git`)
+                hits.push(p);
+        }
+        return false;
+    });
+    return hits;
+}
+const rmProjectWipe = (sh, ctx) => {
+    const t = rmProjectTargets(sh, ctx, "root");
+    return t.length ? t : NO;
+};
+const rmGitDir = (sh, ctx) => {
+    const t = rmProjectTargets(sh, ctx, "git");
+    return t.length ? t : NO;
+};
+const mongoDropDatabase = (sh) => (hasCommand(sh, named("mongosh", "mongo")) && /\bdropDatabase\s*\(/.test(sh.raw) ? "" : NO);
+/** Every server a redis-cli call selects: all `-h` values and all `-u`/`--uri` URLs, in any order. An unreadable value counts as remote. */
+const redisHosts = (args) => {
+    const out = [];
+    args.forEach((a, i) => {
+        if (a === "-h")
+            out.push(args[i + 1] ?? "");
+        else if (a === "-u" || a === "--uri")
+            out.push(/^unix:\/\//i.test(args[i + 1] ?? "") ? "localhost" : hostOf(args[i + 1] ?? "") ?? "");
+    });
+    return out;
+};
+// Deny unless every host-selecting option is loopback: `-h localhost -h prod` and `-u redis://127.0.0.1 -h prod` are remote.
+const redisFlush = (sh) => hasCommand(sh, (c) => named("redis-cli", "valkey-cli")(c) && /\bflush(?:all|db)\b/i.test(sh.raw) && redisHosts(c.args).some((h) => !LOOPBACK.test(h))) ? "" : NO;
+const FLY_VALUE_OPTS = new Set(["-a", "--app", "-c", "--config", "-t", "--access-token", "-o", "--org", "--region", "-r"]);
+const flyDestroy = (sh) => hasCommand(sh, (c) => {
+    if (!named("fly", "flyctl")(c))
+        return false;
+    const { pos } = words(c.args, FLY_VALUE_OPTS);
+    const group = /^(volumes?|vol|apps?)$/.test(pos[0] ?? "");
+    return pos[0] === "destroy" || (group && /^(destroy|delete)$/.test(pos[1] ?? ""));
+}) ? "" : NO;
+const VERCEL_VALUE_OPTS = new Set(["-t", "--token", "-S", "--scope", "-A", "--local-config", "--global-config", "--cwd", "-d"]);
+const vercelRemove = (sh) => hasCommand(sh, (c) => {
+    const a = toolArgs(c, "vercel") ?? toolArgs(c, "vc");
+    if (!a)
+        return false;
+    const { pos } = words(a, VERCEL_VALUE_OPTS);
+    const rm = (w) => w === "remove" || w === "rm";
+    return rm(pos[0]) || (pos[0] === "project" && rm(pos[1]));
+}) ? "" : NO;
+const ghDeleteMethod = (args) => args.some((a, i) => {
+    const v = a === "-X" || a === "--method" ? args[i + 1] : a.startsWith("--method=") ? a.slice(9) : /^-X./.test(a) ? a.slice(2).replace(/^=/, "") : undefined;
+    return v !== undefined && v.toUpperCase() === "DELETE";
+});
+/** `repos/...` path of a `gh api` endpoint: scheme, host, a GHES `api/v3/` prefix, leading slashes, query and fragment removed. */
+const ghRepoPath = (endpoint) => /^repos\//i.test(endpoint.replace(/^https?:\/\/[^/]+/i, "").replace(/[?#].*$/, "").replace(/^\/+/, "").replace(/^api\/v3\//i, ""));
+const GH_VALUE_OPTS = new Set(["-R", "--repo", "-H", "--header", "--hostname", "-X", "--method", "-f", "-F", "--field", "--raw-field", "--jq", "-q", "-t", "--template", "--input", "--cache", "-p", "--preview"]);
+const ghRepoDelete = (sh) => hasCommand(sh, (c) => {
+    if (c.name !== "gh")
+        return false;
+    const { pos } = words(c.args, GH_VALUE_OPTS);
+    if (pos[0] === "repo")
+        return pos[1] === "delete";
+    // Every operand is checked, so a stray value cannot hide the endpoint.
+    return pos[0] === "api" && ghDeleteMethod(c.args) && pos.slice(1).some(ghRepoPath);
+}) ? "" : NO;
+// new-rule:matchers (pnpm new-rule adds a matcher stub above this line)
 const SHELL_MATCHERS = [
     ["rm-root-home", rmRoot],
     ["terraform-destroy", terraformDestroy],
@@ -364,6 +491,18 @@ const SHELL_MATCHERS = [
     ["k8s-delete-ns", k8sDeleteNs],
     ["cloud-delete", cloudDelete],
     ["railway-volume-delete", railwayVolumeDelete],
+    ["sql-delete-all", sqlDeleteAll],
+    ["prisma-migrate-reset", prismaMigrateReset],
+    ["prisma-accept-data-loss", prismaAcceptDataLoss],
+    ["supabase-reset-linked", supabaseResetLinked],
+    ["rm-project-wipe", rmProjectWipe],
+    ["rm-git-dir", rmGitDir],
+    ["mongo-drop-database", mongoDropDatabase],
+    ["redis-flush", redisFlush],
+    ["fly-destroy", flyDestroy],
+    ["vercel-remove", vercelRemove],
+    ["gh-repo-delete", ghRepoDelete],
+    // new-rule:entries (pnpm new-rule adds an entry above this line)
 ];
 // ---------------------------------------------------------------------------------------------
 // Secrets: reads, writes, exfiltration
@@ -632,8 +771,9 @@ function* shellHits(sh, ctx, cfg) {
             if (t === undefined)
                 continue;
             const targets = typeof t === "string" ? [t] : t;
+            const code = ASK_RULES.has(rule) ? "GUARD_ASK" : "NEVER_SHELL";
             for (const target of targets)
-                yield { rule, code: "NEVER_SHELL", ...(target ? { target } : {}) };
+                yield { rule, code, ...(target ? { target } : {}) };
         }
     }
     if (cfg.secretsGuard) {
@@ -659,12 +799,18 @@ export function guardPackMatch(toolId, toolInput, ctx, cfg = GUARD_DEFAULTS) {
         const f = fieldsOf(toolInput);
         if (!f)
             return NO;
+        // A deny anywhere in the call beats an ask, so `prisma migrate reset && rm -rf ~` is a deny.
+        let ask;
         if (isShellTool(toolId)) {
             for (const cmd of commandStrings(f)) {
                 const sh = parseShell(cmd, ctx.home);
-                for (const hit of shellHits(sh, ctx, cfg))
-                    if (!allowed(hit, cfg, ctx, cmd))
+                for (const hit of shellHits(sh, ctx, cfg)) {
+                    if (allowed(hit, cfg, ctx, cmd))
+                        continue;
+                    if (hit.code !== "GUARD_ASK")
                         return hit;
+                    ask ??= hit;
+                }
             }
         }
         const path = typeof f.file_path === "string" ? f.file_path : typeof f.path === "string" ? f.path : undefined;
@@ -683,7 +829,7 @@ export function guardPackMatch(toolId, toolInput, ctx, cfg = GUARD_DEFAULTS) {
             }
         }
         if (!cfg.secretsGuard)
-            return NO;
+            return ask;
         if (isWriteLike(toolId)) {
             for (const text of writtenStrings(f)) {
                 const kind = secretShape(text);
@@ -705,6 +851,7 @@ export function guardPackMatch(toolId, toolInput, ctx, cfg = GUARD_DEFAULTS) {
                     return hit;
             }
         }
+        return ask;
     }
     catch {
         // Fail open: a parse problem never adds a deny.
@@ -735,6 +882,18 @@ const HINTS = {
     "k8s-delete-ns": "Deleting a namespace or everything in all namespaces needs the user to run it.",
     "cloud-delete": "Cloud deletes are not reversible. Ask the user to run this.",
     "railway-volume-delete": "Volume deletes are not reversible. Ask the user to run this.",
+    "sql-delete-all": "DELETE without WHERE removes every row. Add a WHERE clause, or the user approves it.",
+    "prisma-migrate-reset": "prisma migrate reset drops the database. Check DATABASE_URL points at a local database, or the user approves it.",
+    "prisma-accept-data-loss": "--accept-data-loss can drop columns and tables. Run prisma db push without it, or the user approves it.",
+    "supabase-reset-linked": "supabase db reset on a linked project wipes the remote database. Reset the local stack only, without --linked or --db-url.",
+    "rm-project-wipe": "This removes the whole project folder. Delete the specific folder instead (dist, build, node_modules), or the user approves it.",
+    "rm-git-dir": "Removing .git deletes the project history. Ask the user.",
+    "mongo-drop-database": "dropDatabase deletes a whole database. Ask the user to run it, after a backup.",
+    "redis-flush": "FLUSHALL and FLUSHDB on a remote server delete every key. Ask the user to run it.",
+    "fly-destroy": "Destroying a Fly volume or app is not reversible. Use fly volumes list, or ask the user to run it.",
+    "vercel-remove": "Removing a Vercel project or deployment is not reversible. Ask the user to run it.",
+    "gh-repo-delete": "Deleting a GitHub repository is not reversible. Ask the user to run it.",
+    // new-rule:hints (pnpm new-rule adds a hint above this line)
     "guard-config-write": "Do not edit the KYA guard settings. Ask the user.",
 };
 /** Actionable text for a deny, from the rule id alone (no command text, no matched secret). */
@@ -750,4 +909,43 @@ export function guardHint(rule) {
         return "Do not send environment variables or credential files over the network.";
     return "";
 }
+/** Human phrase per rule, for "My coding agent tried to <label>." (near-miss card, /kya-guard:status). Plain words, no command text. */
+const LABELS = {
+    "rm-root-home": "wipe your home folder",
+    "terraform-destroy": "destroy your infrastructure",
+    "sql-drop": "drop or empty a database table",
+    "git-force-push": "force push over git history",
+    "git-delete-default-branch": "delete the main branch",
+    "git-hard-reset-clean": "throw away all uncommitted work",
+    "docker-volumes": "delete Docker volumes",
+    "k8s-delete-ns": "delete a Kubernetes namespace",
+    "cloud-delete": "delete cloud resources",
+    "railway-volume-delete": "delete a cloud volume",
+    "sql-delete-all": "delete every row in a table",
+    "prisma-migrate-reset": "reset your database",
+    "prisma-accept-data-loss": "push a schema change that can drop data",
+    "supabase-reset-linked": "wipe a linked Supabase database",
+    "rm-project-wipe": "wipe the project folder",
+    "rm-git-dir": "delete the git history of the project",
+    "mongo-drop-database": "drop a MongoDB database",
+    "redis-flush": "flush every key on a Redis server",
+    "fly-destroy": "destroy a Fly app or volume",
+    "vercel-remove": "remove a Vercel project",
+    "gh-repo-delete": "delete a GitHub repository",
+    // new-rule:labels (pnpm new-rule adds a label above this line)
+    "guard-config-write": "edit the KYA guard settings",
+};
+/** Human phrase for a guard-pack rule id (the `secret-read-*`, `secret-write-*` and `exfil-*` families included), or undefined. */
+export function guardLabel(rule) {
+    const fixed = LABELS[rule];
+    if (fixed)
+        return fixed;
+    if (rule.startsWith("secret-read-"))
+        return "read a credentials file";
+    if (rule.startsWith("secret-write-"))
+        return "write a secret into a file";
+    if (rule.startsWith("exfil-"))
+        return "send secrets over the network";
+    return undefined;
+}
 //# sourceMappingURL=guard-pack.js.map