@te-river/opencode-team-mode 1.5.0 → 1.5.1

package/README.md

@@ -55,73 +55,40 @@ Instead of one agent trying to do everything, you get:
 
 ### Install TeamMode
 
-**Option A — One-line installer (recommended):**
+**Option A — One-line installer:**
 
 macOS / Linux (bash):
 ```bash
-curl -fsSL "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh" | bash
+curl -fsSL https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
 ```
 
 Windows (PowerShell):
 ```powershell
-irm "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1" | iex
+irm https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
 ```
 
-If gh-proxy is unavailable, try jsdelivr or GitHub raw:
-```bash
-# macOS / Linux — jsdelivr
-curl -fsSL "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.sh" | bash
-
-# Windows — jsdelivr
-irm "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.ps1" | iex
-
-# macOS / Linux — GitHub raw
-curl -fsSL https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
-
-# Windows — GitHub raw
-irm https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
-```
-
-These scripts install the npm package and automatically register the plugin in your `opencode.jsonc`.
-
-**Option B — Manual npm install:**
-
-```bash
-# 1. Install the plugin package
-npm install -g @te-river/opencode-team-mode
-
-# 2. Add the plugin to your opencode.jsonc
-#    (see "Configuration" below)
-```
-
-**Option C — Local dev install (from this repo):**
-
-```bash
-git clone https://github.com/Te-River/Opencode-TeamMode.git
-cd Opencode-TeamMode
-npm install
-npm run build
-npm link
-```
-
----
+**Option B — Manual config:**
 
-## ⚙️ Configuration
-
-After installing, add the plugin to your `opencode.jsonc`:
+Add the plugin to your `opencode.jsonc`:
 
 ```jsonc
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
 
-That's it. The plugin automatically injects all team agents and commands when OpenCode starts. **No need to manually copy agent files or command definitions.**
+OpenCode will automatically install the plugin on startup.
+
+> **Tip:** After modifying `opencode.json`, **restart OpenCode Desktop** for changes to take effect.
+
+---
+
+## ⚙️ Configuration
 
-> 💡 **Tip:** After modifying `opencode.json`, **restart OpenCode Desktop** for changes to take effect.
+The plugin automatically injects all team agents and commands when OpenCode starts. **No need to manually copy agent files or command definitions.**
 
 > ⚠️ **Model choice matters.** Every judgment in the workflow — triage,
 > decomposition, dispatch briefs, synthesis, review-loop verdicts — flows
@@ -139,7 +106,7 @@ To enable TeamMode in every project, add the plugin to your global config:
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
@@ -251,6 +218,45 @@ In **OpenCode Desktop**, you get additional UX benefits:
 
 ---
 
+## 🧯 Context governance (tm_* + R6) — new in v1.5.1
+
+> ⚠️ Requires `@te-river/opencode-team-mode@1.5.1` or later (released
+> 2026-09-08). If your config pins `@latest`, OpenCode upgrades on next start.
+
+**JIT layer-2 tools (`tm_read` / `tm_grep` / `tm_bash` / `tm_fetch`).**
+Large tool outputs are context cost's main driver: every step re-sends the
+whole window. The tm_* tools run the built-in capability under governance
+first: results above `TM_OFFLOAD_THRESHOLD` tokens never enter the window —
+they are written to a local run store and replaced by a handle with a
+content-aware preview (JSON keys / CSV header+shape / log ERROR×N stats /
+code signatures / binary metadata, hard-capped at 80 tokens). When the agent
+actually needs the payload it pages through it with `tm_fetch`, using an
+HMAC-signed, run-scoped, expiring handle. `tm_bash` only allows read-only
+commands (allowlist), and failures come back as structured errors instead of
+raw dumps.
+
+**R6 environment protection.** With TeamMode active, env-var reads by the
+model are blocked at the tool layer: env dump commands (`printenv`,
+`Get-ChildItem env:`, …), `$env:` / `$VAR` / `${VAR}` expansions, and env
+files (`.env`, shell rc files). The model sees a structured refusal and can
+ask the human instead; tm_* wrappers route through the same checks (no
+backdoor via the wrappers). Audit lines record only tool name + pattern
+category — never command text, paths, variable names or values.
+
+| Env var | Default | Purpose |
+|---|---|---|
+| `TM_ENV_PROTECT` | `strict` | R6 mode: `strict` / `standard` / `off` |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | extra block patterns (regex list) |
+| `TM_OFFLOAD_THRESHOLD` | `2000` | offload threshold (tokens, chars/4 estimate) |
+| `TM_PREVIEW_MAX_TOKENS` | `80` | preview hard cap |
+| `TM_FETCH_MAX_LINES` | `2000` | tm_fetch page cap |
+| `TM_BLACKBOARD_DIR` | `.blackboard/` | offloaded payload store |
+| `TM_TRAJECTORY_DIR` | `.trajectory/` | append-only tool-call ledger |
+| `TM_BLACKBOARD_TTL` | `7` | store retention (days) |
+| `TM_BASH_READONLY_ALLOWED` | built-in table | tm_bash allowlist |
+
+---
+
 ## 🏗️ Architecture
 
 ```
@@ -258,14 +264,17 @@ opencode-team-mode/
 ├── package.json          ← npm package definition
 ├── tsconfig.json         ← TypeScript config
 ├── src/
-│   ├── index.ts          ← Plugin entry (server() + config hook, id: "team-mode")
+│   ├── index.ts          ← Plugin entry (server(): config + R6 tool.execute.before + tool segment)
 │   ├── agents.ts         ← Agent definitions (prompts, modes, colors)
 │   ├── commands.ts       ← Command definitions (templates, agent bindings)
 │   ├── blackboard.ts     ← Shared blackboard + TTL auto-cleanup sweeper
+│   ├── envprotect.ts     ← R6 env-var read protection (pattern engine + hook)
+│   ├── tm/               ← JIT layer-2 tools (tm_read / tm_grep / tm_bash / tm_fetch)
 │   └── types.ts          ← Loader-contract type definitions (1.18.x)
 ├── scripts/
 │   ├── install.sh        ← One-click installer (bash)
 │   └── install.ps1       ← One-click installer (PowerShell)
+├── pt07/                 ← PT-07 baseline suite (seeded A/B token measurement)
 ├── LICENSE               ← Apache 2.0
 ├── README.md             ← English documentation
 └── README.zh-CN.md       ← Chinese documentation
@@ -274,8 +283,8 @@ opencode-team-mode/
 ### How it works
 
 1. OpenCode Desktop starts and loads `opencode.json(c)`.
-2. It sees `"@te-river/opencode-team-mode@1.4.9"` in the `plugin` array and loads the npm package.
-3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config.
+2. It sees `"@te-river/opencode-team-mode@latest"` in the `plugin` array and loads the npm package.
+3. The loader calls the plugin's `server(input, options)`, which registers a `config` hook; the hook injects 6 agents and 6 commands into the merged config. The same call installs the R6 `tool.execute.before` guard and registers the governed `tm_*` tools (see [Context governance](#-context-governance-tm--r6--new-in-v151) below).
 4. The plugin's `id: "team-mode"` is displayed as the plugin name in the Desktop UI.
 5. Agents and commands are immediately available in the Desktop UI — no file copying needed. User-defined agents with the same name always win (the plugin never clobbers them).
 
@@ -381,7 +390,7 @@ Default is **5 days**. To choose your own, use the tuple plugin form in
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "ttlDays": 7 }]
+    ["@te-river/opencode-team-mode@latest", { "ttlDays": 7 }]
   ]
 }
 ```
@@ -405,7 +414,7 @@ team**):
 ```jsonc
 {
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "defaultAgent": false }]
+    ["@te-river/opencode-team-mode@latest", { "defaultAgent": false }]
   ]
 }
 ```

package/README.zh-CN.md

@@ -55,73 +55,40 @@ TeamMode 将 OpenCode 桌面版从一个单 Agent 编码助手，升级为**一
 
 ### 安装 TeamMode
 
-**方式 A — 一键安装脚本（推荐）：**
+**方式 A — 一键安装脚本：**
 
 macOS / Linux（bash）：
 ```bash
-curl -fsSL "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh" | bash
+curl -fsSL https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
 ```
 
 Windows（PowerShell）：
 ```powershell
-irm "https://gh-proxy.com/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1" | iex
+irm https://ghproxy.net/https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
 ```
 
-如果 gh-proxy 不可用，尝试 jsdelivr 或 GitHub 原始地址：
-```bash
-# macOS / Linux — jsdelivr
-curl -fsSL "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.sh" | bash
-
-# Windows — jsdelivr
-irm "https://cdn.jsdelivr.net/gh/Te-River/Opencode-TeamMode@main/scripts/install.ps1" | iex
-
-# macOS / Linux — GitHub 原始地址
-curl -fsSL https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.sh | bash
-
-# Windows — GitHub 原始地址
-irm https://raw.githubusercontent.com/Te-River/Opencode-TeamMode/main/scripts/install.ps1 | iex
-```
-
-脚本会自动安装 npm 包，并将插件注册到你的 `opencode.jsonc` 中。
-
-**方式 B — 手动 npm 安装：**
-
-```bash
-# 1. 安装插件包
-npm install -g @te-river/opencode-team-mode
-
-# 2. 将插件添加到 opencode.jsonc
-#    （见下方"配置"章节）
-```
-
-**方式 C — 本地开发安装（从本仓库）：**
-
-```bash
-git clone https://github.com/Te-River/Opencode-TeamMode.git
-cd Opencode-TeamMode
-npm install
-npm run build
-npm link
-```
-
----
-
-## ⚙️ 配置
+**方式 B — 手动配置：**
 
-安装后，将插件添加到你的 `opencode.jsonc`：
+在你的 `opencode.jsonc` 中添加插件：
 
 ```jsonc
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
 
-就这么简单。插件会在 OpenCode 启动时自动注入所有团队 Agent 和命令，**无需手动复制任何 Agent 文件或命令定义**。
+OpenCode 启动时会自动安装插件。
+
+> **提示：** 修改 `opencode.json` 后，**重启 OpenCode Desktop** 使配置生效。
+
+---
+
+## ⚙️ 配置
 
-> 💡 **提示：** 修改 `opencode.json` 后，请**重启 OpenCode 桌面版**使更改生效。
+插件会在 OpenCode 启动时自动注入所有团队 Agent 和命令，**无需手动复制任何 Agent 文件或命令定义**。
 
 > ⚠️ **模型选择很重要。** 工作流里的每一个判断——分诊、拆解、派单、
 > 整合、审查/测试闭环裁决——都经过 **Team Lead**。这个位置上放弱模型，
@@ -137,7 +104,7 @@ npm link
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    "@te-river/opencode-team-mode@1.4.9"
+    "@te-river/opencode-team-mode@latest"
   ]
 }
 ```
@@ -246,6 +213,41 @@ team   完成。
 
 ---
 
+## 🧯 上下文治理（tm_* + R6）—— v1.5.1 起提供
+
+> ⚠️ 需 `@te-river/opencode-team-mode@1.5.1` 或更新（2026-09-08 发布）。
+> 配置里钉 `@latest` 的用户，下次启动自动升级。
+
+**JIT 层 2 工具（`tm_read` / `tm_grep` / `tm_bash` / `tm_fetch`）。**
+大体积工具输出是上下文成本的主要来源：智能体每走一步都要重发整个窗口。
+tm_* 工具先用受治理的管线执行内置能力：超过 `TM_OFFLOAD_THRESHOLD`
+token 的结果**不进窗口**——全量写入本地 run 存储，模型只拿一张句柄
+“提货单”，附内容感知预览（JSON 键结构 / CSV 表头+形状 / 日志
+ERROR×N 统计 / 代码签名清单 / 二进制元信息，硬上限 80 token）。
+确实需要全文时，用 HMAC 签名、限本 run、带有效期的句柄经 `tm_fetch`
+分段取回。`tm_bash` 仅放行只读命令白名单，失败以结构化错误返回。
+
+**R6 环境变量保护。** TeamMode 激活时，模型读取环境变量的行为在工具层
+被拦截：env 导出命令（`printenv`、`Get-ChildItem env:` 等）、
+`$env:` / `$VAR` / `${VAR}` 展开、环境文件（`.env`、shell rc 文件）。
+模型收到结构化拒绝提示，需要变量值时向人类申请；tm_* 包装工具同样
+过这套检查（不给包装层留后门）。审计日志只记工具名+模式类别——
+绝不记录命令文本、路径、变量名或值。
+
+| 环境变量 | 默认 | 作用 |
+|---|---|---|
+| `TM_ENV_PROTECT` | `strict` | R6 模式：`strict` / `standard` / `off` |
+| `TM_ENV_PROTECT_EXTRA_DENY` | — | 追加拦截正则（分号分隔） |
+| `TM_OFFLOAD_THRESHOLD` | `2000` | 卸载阈值（token，chars/4 估算） |
+| `TM_PREVIEW_MAX_TOKENS` | `80` | 预览硬上限 |
+| `TM_FETCH_MAX_LINES` | `2000` | tm_fetch 单段上限 |
+| `TM_BLACKBOARD_DIR` | `.blackboard/` | 卸载载荷存储 |
+| `TM_TRAJECTORY_DIR` | `.trajectory/` | 只追加工具调用账本 |
+| `TM_BLACKBOARD_TTL` | `7` | 存储保留天数 |
+| `TM_BASH_READONLY_ALLOWED` | 内置表 | tm_bash 只读白名单 |
+
+---
+
 ## 🏗️ 架构
 
 ```
@@ -253,14 +255,17 @@ opencode-team-mode/
 ├── package.json          ← npm 包定义
 ├── tsconfig.json         ← TypeScript 配置
 ├── src/
-│   ├── index.ts          ← 插件入口（server() + config hook，id: "team-mode"）
+│   ├── index.ts          ← 插件入口（server()：config + R6 tool.execute.before 钩子 + tool 段）
 │   ├── agents.ts         ← Agent 定义（prompts、模式、颜色）
 │   ├── commands.ts       ← 命令定义（模板、Agent 绑定）
 │   ├── blackboard.ts     ← 共享黑板 + TTL 自动清理清扫器
+│   ├── envprotect.ts     ← R6 环境变量读取保护（模式引擎 + 钩子）
+│   ├── tm/               ← JIT 层 2 工具（tm_read / tm_grep / tm_bash / tm_fetch）
 │   └── types.ts          ← 加载器契约类型定义（1.18.x）
 ├── scripts/
 │   ├── install.sh        ← 一键安装脚本（bash）
 │   └── install.ps1       ← 一键安装脚本（PowerShell）
+├── pt07/                 ← PT-07 基线任务集（种子化 A/B token 测量）
 ├── LICENSE               ← Apache 2.0
 └── README.md             ← 英文文档
     README.zh-CN.md       ← 中文文档
@@ -269,8 +274,8 @@ opencode-team-mode/
 ### 工作原理
 
 1. OpenCode 桌面版启动，加载 `opencode.json(c)`
-2. 检测到 `plugin` 数组中的 `"@te-river/opencode-team-mode@1.4.9"`，加载 npm 包
-3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令
+2. 检测到 `plugin` 数组中的 `"@te-river/opencode-team-mode@latest"`，加载 npm 包
+3. 加载器调用插件的 `server(input, options)`，注册 `config` hook；hook 向合并后的配置注入 6 个 Agent 和 6 个命令。同一次调用还会安装 R6 的 `tool.execute.before` 防护，并注册受治理的 `tm_*` 工具（见下文“上下文治理”）
 4. 插件的 `id: "team-mode"` 作为插件名显示在桌面版 UI
 5. Agent 和命令立即在桌面版 UI 中可用 —— 无需复制任何文件；同名 Agent 以用户自定义优先（插件绝不覆盖）
 
@@ -353,7 +358,7 @@ Team Lead 不再删除任务目录 —— 跑完的黑板原地留给你回看
 {
   "$schema": "https://opencode.ai/config.json",
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "ttlDays": 7 }]
+    ["@te-river/opencode-team-mode@latest", { "ttlDays": 7 }]
   ]
 }
 ```
@@ -372,7 +377,7 @@ TeamMode 默认**把 Team 设为你的默认代理**——新会话直接由团
 ```jsonc
 {
   "plugin": [
-    ["@te-river/opencode-team-mode@1.4.9", { "defaultAgent": false }]
+    ["@te-river/opencode-team-mode@latest", { "defaultAgent": false }]
   ]
 }
 ```

package/dist/envprotect.d.ts

@@ -0,0 +1,123 @@
+/**
+ * R6 — code-level environment-variable read protection for Team mode.
+ *
+ * HUMAN-approved feature: in Team mode, EVERY path the model can use to
+ * read environment variables / env files is intercepted in code, before
+ * the tool runs, independent of prompt compliance. This hook throws inside
+ * `tool.execute.before`, which opencode (verified live on 1.18.29) turns
+ * into a failed tool call whose error text is returned to the model — so
+ * the block is hard, not advisory.
+ *
+ * Surfaces covered (bash + PowerShell dialects, matched against the bash
+ * tool's `args.command`, and against path-class args of the read / grep /
+ * glob / list tools):
+ *   1. explicit env commands: `env` — a dump whenever no outside command
+ *      word follows: flags/assignments only (`env -0`, `env -u HOME`,
+ *      `env FOO=bar`) or a command word that is itself `env`/`printenv`
+ *      (`env printenv`); a real launcher (`env node app.js`, `env -i node
+ *      app.js`) passes — `printenv`, bare `set` (sh context only —
+ *      PowerShell `Set-*` cmdlets are never matched), `declare -p` and
+ *      its dump synonyms `typeset -p` / `export -p` / `local -p` (flags
+ *      may be split: `declare -x -p FOO`), and the PowerShell `env:`
+ *      drive via Get-ChildItem / gci / dir / ls / Get-Item / gi /
+ *      Get-Content / gc / cat / type (flags and optional quotes allowed
+ *      between cmdlet and drive: `Get-Content 'env:HOME'`).  The same
+ *      statement heads are caught behind statement noise: subshells and
+ *      groups (`(env)`, `{ env; }`), escaped commands (`\env`), the `time`
+ *      keyword prefix, and command substitution (`$(printenv)`, backticks).
+ *   2. `$env:` / `${env:...}` expansion (PowerShell);
+ *   3. strict mode only: `${VAR}` and `$ALLCAPS_VAR` expansion;
+ *   4. env-file paths: `.env`, `.env.*`, `*.env`, `.bashrc`,
+ *      `.bash_profile`, `.profile`, `.zshrc`, `.zprofile`, `.zshenv`
+ *      (checked-in template copies like `.env.example` are exempt, and
+ *      code identifiers like `process.env` are not files).
+ *
+ * TeamMode's own tm_* tools (tm_read / tm_grep / tm_bash) are aliased onto
+ * read/grep/bash in `inspectToolCall`, so this interception covers them
+ * identically — the plugin tools can never serve as an R6 bypass.
+ *
+ * Known limitation (accepted, documented): interpreter execution paths —
+ * `bash -c "env"`, `node -e 'process.env'`, `python -c "import os; ..."` —
+ * are NOT intercepted; the pattern surface stops at the command line
+ * itself.  One decode pass covers URL-encoded names (`/%2Eenv`); a double
+ * encoding (`/%252Eenv`) and a quoted dump head behind `env`
+ * (`env 'printenv'`) stay ahead of the matcher by design.
+ *
+ * Configuration (read by the PLUGIN at startup — this is program-level
+ * configuration of the tool itself, the same category as the ttlDays
+ * option below; it is NOT what R6 defends against, which is the MODEL
+ * reading environment variables through tool calls at runtime):
+ *   - `TM_ENV_PROTECT`       = "strict" (default) | "standard" | "off";
+ *     unknown values fail closed into strict.
+ *   - `TM_ENV_PROTECT_EXTRA_DENY` = semicolon-separated user regexes,
+ *     applied to every scanned string in any non-off mode.
+ *
+ * Audit red line (HUMAN privacy constraint): every interception is logged
+ * via `client.app.log()` (level "warn", service "team-mode-env-protect")
+ * recording ONLY the tool name and the pattern category. Command text,
+ * paths, variable names and values are NEVER logged — the audit trail must
+ * answer "what class of read was blocked", and must not become a place
+ * where secrets accumulate.
+ */
+/** Audit log service identifier (also the query key for "what was blocked"). */
+export declare const ENV_PROTECT_SERVICE = "team-mode-env-protect";
+/**
+ * Fixed structured message returned to the model on every block.  The
+ * category is appended as a machine-readable suffix; tests pin both.
+ */
+export declare const ENV_PROTECT_MESSAGE = "TeamMode R6 env protection: \u73AF\u5883\u53D8\u91CF\u8BFB\u53D6\u5DF2\u88AB\u62E6\u622A\u3002\u9700\u8981\u53D8\u91CF\u503C\u8BF7\u5411 HUMAN \u7533\u8BF7\u3002";
+/** Pattern categories surfaced in the block message and the audit log. */
+export declare const CATEGORY_BASH_ENV_COMMAND = "bash-env-command";
+export declare const CATEGORY_BASH_ENV_EXPANSION = "bash-env-expansion";
+export declare const CATEGORY_ENV_FILE_PATH = "env-file-path";
+export declare const CATEGORY_EXTRA_DENY = "extra-deny";
+export type EnvProtectMode = "strict" | "standard" | "off";
+/**
+ * Resolve the protection mode.  Only exact "standard" / "off" switch those
+ * modes on; everything else (unset, typos, wrong case) fails CLOSED into
+ * strict — a mistyped opt-out must never disable the red line.
+ */
+export declare function resolveEnvProtectMode(raw: unknown): EnvProtectMode;
+/**
+ * Parse `TM_ENV_PROTECT_EXTRA_DENY` (semicolon-separated regex bodies).
+ * Invalid regexes are skipped rather than crashing plugin startup; the
+ * remaining rules still apply.  Empty/absent input yields no extra rules.
+ */
+export declare function parseExtraDeny(raw: unknown): RegExp[];
+/** The block error handed back to the model (fixed text + category tag). */
+export declare function envProtectError(category: string): Error;
+/**
+ * True when the value points at an env file.  Matches on the BASENAME with
+ * both separators handled; URL query/fragment tails are cut first so
+ * `https://x/.env?raw=1` matches the same basename as a plain path, and
+ * asterisks are stripped so glob patterns like "*.env" or a recursive deep
+ * form of ".env.local" are caught by the same matcher as real paths.
+ * (Note: glob spellings are written without backticks here — a double-star
+ * + slash inside JSDoc would close the comment block early.)
+ */
+export declare function isEnvFilePath(raw: string): boolean;
+/**
+ * Classify a bash/PowerShell command string.  Returns the pattern category
+ * when the command must be blocked, null when it may pass.  `off` is
+ * handled by the caller; user extra-deny rules take precedence.
+ */
+export declare function classifyBashCommand(command: string, mode: EnvProtectMode, extra?: RegExp[]): string | null;
+/**
+ * Classify the path-class arguments of a file tool.  Returns the pattern
+ * category when the call must be blocked, null when it may pass.
+ */
+export declare function classifyPathFields(args: Record<string, unknown> | undefined, mode: EnvProtectMode, extra?: RegExp[]): string | null;
+/**
+ * Top routing: tool name + tool args -> category to block, or null to pass.
+ * `off` always passes (the hook stays installed but is a no-op).
+ */
+export declare function inspectToolCall(tool: string, args: Record<string, unknown> | undefined, mode: EnvProtectMode, extra?: RegExp[]): string | null;
+/**
+ * Build the `tool.execute.before` hook.  The hook is installed in every
+ * mode; with mode "off" it returns immediately and everything passes.
+ * When a block triggers, the audit entry is written first, then the fixed
+ * structured error is thrown so opencode surfaces it to the model as the
+ * failed tool result.
+ */
+export declare function createEnvProtectHook(client: unknown, mode: EnvProtectMode, extra?: RegExp[]): (input: unknown, output: unknown) => Promise<void>;
+//# sourceMappingURL=envprotect.d.ts.map

package/dist/envprotect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envprotect.d.ts","sourceRoot":"","sources":["../src/envprotect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sKAC4B,CAAA;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAC3D,eAAO,MAAM,2BAA2B,uBAAuB,CAAA;AAC/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AACrD,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAIlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAarD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAEvD;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiClD;AAiJD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,MAAM,GAAG,IAAI,CAgCf;AAYD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,MAAM,GAAG,IAAI,CAWf;AAoBD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,MAAM,GAAG,IAAI,CAYf;AA0CD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAUpD"}