@te-river/opencode-team-mode 1.5.5 → 1.5.6

package/dist/envprotect/gate-predicates.js

@@ -0,0 +1,174 @@
+/**
+ * Unified approval gate — deferral predicates.  The byte-exact vs loose glob
+ * split: LOOSE (case-insensitive, trimmed) identifies dialogs for the gate;
+ * BYTE-EXACT governs deferral, so a command is only passed through when the
+ * host dialog is GUARANTEED to fire.  Split out of the former monolithic
+ * envprotect.ts; behavior unchanged.
+ */
+import { R2_DANGER_BASH_ASK_PATTERNS, R6_ENV_BASH_ASK_PATTERNS } from "./patterns.js";
+import { commandToken, isEnvDumpStatement } from "./bash-classify.js";
+import { splitShellSegments } from "../shell-text.js";
+// local alias for the shared segmentation (call sites below)
+const splitSegments = splitShellSegments;
+// ---------- approval-gate deferral predicates ----------
+/** Compile `*` into `.*`, escape every other regex metacharacter, anchor. */
+function globToRegex(pattern, flags) {
+    let out = "";
+    for (const ch of pattern) {
+        if (ch === "*")
+            out += ".*";
+        else if (".+?^${}()|[]\\".includes(ch))
+            out += "\\" + ch;
+        else
+            out += ch;
+    }
+    return new RegExp("^" + out + "$", flags);
+}
+/**
+ * Two spellings of the same glob grammar:
+ *  - LOOSE (case-insensitive, trimmed) — dialog IDENTIFICATION only
+ *    (categorizePermission): over-matching here can merely arm a timer for a
+ *    dialog the host already opened, never let a command run;
+ *  - EXACT (byte-for-byte, no trim) — the DEFERRAL side: a command is only
+ *    passed through to the dialog when it reproduces the injected config
+ *    pattern head exactly, so ANY host matcher at least as greedy as ours
+ *    must pop the dialog.  Case/trim leniency on this side would defer forms
+ *    like `GET-CONTENT ENV:PATH` that a byte-exact host grammar never pops
+ *    — a SILENT env read with no popup.  If the host turns out to be
+ *    case-insensitive, exact costs nothing but a few extra hard throws
+ *    (fail-closed direction).
+ */
+const GLOB_CACHE = new Map();
+function glob(pattern, flags) {
+    const key = flags + pattern;
+    let re = GLOB_CACHE.get(key);
+    if (!re) {
+        re = globToRegex(pattern, flags);
+        GLOB_CACHE.set(key, re);
+    }
+    return re;
+}
+/** True when `text` matches ANY of the given ask globs (LOOSE, host-style). */
+export function commandMatchesAnyAskPattern(text, patterns) {
+    const t = String(text ?? "").trim();
+    if (!t)
+        return false;
+    for (const p of patterns)
+        if (glob(p, "i").test(t))
+            return true;
+    return false;
+}
+/** Byte-exact deferral-side match (see the GLOB_CACHE note above). */
+function commandMatchesAnyAskPatternExact(text, patterns) {
+    if (!text)
+        return false;
+    for (const p of patterns)
+        if (glob(p, "").test(text))
+            return true;
+    return false;
+}
+/**
+ * True when a built-in-bash command is an environment read in a form the
+ * host is configured to ASK about (and therefore the dialog governs it).
+ * The hook then lets it proceed WITHOUT throwing, so a human approval is
+ * meaningful.  Kept deliberately narrower than classifyBashCommand: every
+ * form it accepts is a head-anchored single statement that matches one of
+ * R6_ENV_BASH_ASK BYTE-EXACTLY (so the dialog WILL fire under any host
+ * grammar at least as greedy as ours — no case/trim leniency, see
+ * commandMatchesAnyAskPatternExact), and every hazard that breaks that
+ * alignment (compound statements, substitutions, `${…}`, `$ALLCAPS`,
+ * assignment prefixes, `time`/subshell/escaped heads, user extra-deny, path
+ * heads like `/usr/bin/env`, `cmd /c …`, and the PowerShell env-drive forms
+ * with intervening flags or quotes that the globs miss) returns false → the
+ * classifier keeps hard-throwing.  tm_* channels are hard-blocked separately
+ * (the dialog never opens for them).
+ */
+export function isAskGatedEnvCommand(command, mode, extra = []) {
+    const text = String(command ?? "");
+    if (!text.trim())
+        return false;
+    for (const r of extra)
+        if (r.test(text))
+            return false;
+    // command substitution runs its own line — the outer pattern never matches
+    if (/\$\(|`|<\(|>\(/.test(text))
+        return false;
+    // ${VAR} brace expansion is wildcard-inexpressible
+    if (/\$\{[^}]*\}/.test(text))
+        return false;
+    const segs = splitSegments(text).map((s) => s.trim()).filter(Boolean);
+    if (segs.length !== 1)
+        return false;
+    const seg = segs[0];
+    // byte-exact head: a VAR=value prefix, stray leading whitespace or any
+    // case deviation from the injected pattern fails here and stays hard
+    if (!commandMatchesAnyAskPatternExact(text, R6_ENV_BASH_ASK_PATTERNS))
+        return false;
+    const { token, rest } = commandToken(seg);
+    // classic dump head: printenv / env / set / declare|typeset|export|local -p
+    if (isEnvDumpStatement(token, rest))
+        return true;
+    // PowerShell env: drive read with no flags between the cmdlet and the
+    // drive, spellings byte-identical to the config globs (see the doc above)
+    if (/^(?:Get-ChildItem|gci|dir|ls|Get-Item|gi|Get-Content|gc|cat|type)\s+env:/.test(seg)) {
+        return true;
+    }
+    // leading `$env:` drive form (matches the `$env:*` config glob)
+    if (text.startsWith("$env:"))
+        return true;
+    return false;
+}
+/**
+ * Coarse category for a host permission-event payload, used ONLY to gate the
+ * timer, to register the deferral session, and to tag the audit (never the
+ * pattern text itself).  Returns null for anything that is not one of OUR
+ * injected bash asks, so the gate leaves other tools' dialogs (edit,
+ * webfetch, host-native rules) alone.
+ *
+ * Real 1.18.29 `permission.asked` props carry NO `type` field: the tool name
+ * rides in `permission` and the concrete command segments in `patterns[]`
+ * (plus `metadata.command` with the raw line).  Inference order, defensive
+ * across builds:
+ *   1. explicit tool field (`type` || `permission`) — non-bash is a hard no;
+ *   2. absent tool field → bash evidence = `metadata.command` present, or a
+ *      candidate that is COMMAND-SHAPED (contains whitespace: our command
+ *      globs all need an embedded space except bare keys, and bare-key
+ *      patterns like a file named `set` cannot prove bash without the
+ *      command metadata beside them).
+ * Matching here is the LOOSE glob (case-insensitive): over-matching can only
+ * arm a timer for a dialog the host already opened, never run a command —
+ * the deferral side keeps the byte-exact matcher (isAskGatedEnvCommand).
+ */
+export function categorizePermission(props) {
+    if (!props)
+        return null;
+    const type = String(props.type ?? props.permission ?? "").trim().toLowerCase();
+    if (type && type !== "bash")
+        return null;
+    const raw = props.patterns ?? props.pattern;
+    const list = raw == null ? [] : Array.isArray(raw) ? raw.map(String) : [String(raw)];
+    const metaCmd = typeof props.metadata?.command === "string" ? props.metadata.command : "";
+    const title = typeof props.title === "string" ? props.title : "";
+    const candidates = [...list];
+    if (metaCmd)
+        candidates.push(metaCmd);
+    if (title)
+        candidates.push(title);
+    if (!candidates.length)
+        return null;
+    if (!type) {
+        // no tool field at all (live 1.18.29 asked): bash evidence = the bash
+        // tool's own metadata.command, or a command-shaped candidate (contains
+        // whitespace — every multi-word ask glob needs one; single bare words
+        // like a path named `set` prove nothing without metadata beside them)
+        if (!metaCmd && !candidates.some((c) => /\s/.test(c)))
+            return null;
+    }
+    const hits = (patterns) => candidates.some((p) => patterns.includes(p) || commandMatchesAnyAskPattern(p, patterns));
+    if (hits(R6_ENV_BASH_ASK_PATTERNS))
+        return "env";
+    if (hits(R2_DANGER_BASH_ASK_PATTERNS))
+        return "danger";
+    return null;
+}
+//# sourceMappingURL=gate-predicates.js.map

package/dist/envprotect/gate-predicates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-predicates.js","sourceRoot":"","sources":["../../src/envprotect/gate-predicates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,6DAA6D;AAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAA;AAExC,0DAA0D;AAE1D,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAe,EAAE,KAAe;IACnD,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,GAAG;YAAE,GAAG,IAAI,IAAI,CAAA;aACtB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;;YACnD,GAAG,IAAI,EAAE,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;AAC5C,SAAS,IAAI,CAAC,OAAe,EAAE,KAAe;IAC5C,MAAM,GAAG,GAAG,KAAK,GAAG,OAAO,CAAA;IAC3B,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAAC,IAAa,EAAE,QAA2B;IACpF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IAC/D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sEAAsE;AACtE,SAAS,gCAAgC,CACvC,IAAY,EACZ,QAA2B;IAE3B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;IACjE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,IAAoB,EACpB,QAAkB,EAAE;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;IACrD,2EAA2E;IAC3E,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7C,mDAAmD;IACnD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACnB,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAAC,gCAAgC,CAAC,IAAI,EAAE,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAA;IACnF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IACzC,4EAA4E;IAC5E,IAAI,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,0EAA0E,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,gEAAgE;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAOjB;IAClB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9E,IAAI,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAA;IAC3C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACpF,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IACzF,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;IAC5B,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,QAA2B,EAAE,EAAE,CAC3C,UAAU,CAAC,IAAI,CACb,CAAC,CAAC,EAAE,EAAE,CACH,QAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,EAAE,QAAQ,CAAC,CAC1F,CAAA;IACH,IAAI,IAAI,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,IAAI,IAAI,CAAC,2BAA2B,CAAC;QAAE,OAAO,QAAQ,CAAA;IACtD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/envprotect/hook.d.ts

@@ -0,0 +1,45 @@
+/**
+ * R6 — the `tool.execute.before` hook: file-tool path classification,
+ * tool-call level routing (tm_* aliasing = anti-backdoor), and the hook
+ * factory with the privacy-red-line audit.  Split out of the former
+ * monolithic envprotect.ts; behavior unchanged.
+ */
+import { type EnvProtectMode } from "./patterns.js";
+/**
+ * Classify the path-class arguments of a file tool.  Returns the pattern
+ * category when the call must be blocked, null when it may pass.
+ */
+export declare function classifyPathFields(args: Record<string, unknown> | undefined, mode: EnvProtectMode, extra?: RegExp[]): string | null;
+/**
+ * Top routing: tool name + tool args -> category to block, or null to pass.
+ * `off` always passes (the hook stays installed but is a no-op).
+ */
+export declare function inspectToolCall(tool: string, args: Record<string, unknown> | undefined, mode: EnvProtectMode, extra?: RegExp[]): string | null;
+/**
+ * Build the `tool.execute.before` hook.  The hook is installed in every
+ * mode; with mode "off" it returns immediately and everything passes.
+ * When a block triggers, the audit entry is written first, then the fixed
+ * structured error is thrown so opencode surfaces it to the model as the
+ * failed tool result.
+ *
+ * `options.deferToApproval` (the unified approval gate) — called with the
+ * tool call's `input.sessionID`; when it reports `true`, a built-in-bash
+ * environment read in an EXACT ask-glob form is passed through WITHOUT
+ * throwing, because the official confirmation dialog is the live gate for
+ * it (approve → runs, reject or timeout → the host blocks it).  The signal
+ * is SESSION-SCOPED on purpose: the gate registers only sessions carrying
+ * our injected bash ask set (exec-role chat.message, or an R6-env-classified
+ * `permission.asked`), so a stock build/plan session — where no dialog would
+ * ever open for `printenv` — keeps the hard throw instead of slipping the
+ * read through a global arm flag.  Reaching the deferral point at all
+ * additionally requires the command to match the config globs byte-exactly,
+ * so the dialog is GUARANTEED to fire wherever deferral happens.  A failed
+ * auto-reject flips the gate back to `false` everywhere, restoring the hard
+ * throw (fail-closed).  tm_* channels are never deferred (no dialog opens
+ * for them).
+ */
+export declare function createEnvProtectHook(client: unknown, mode: EnvProtectMode, extra?: RegExp[], options?: {
+    deferToApproval?: (sessionID?: string) => boolean;
+    envApproved?: (sessionID?: string) => boolean;
+}): (input: unknown, output: unknown) => Promise<void>;
+//# sourceMappingURL=hook.d.ts.map

package/dist/envprotect/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/envprotect/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AAetB;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,MAAM,GAAG,IAAI,CAWf;AAoBD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,GACnB,MAAM,GAAG,IAAI,CAYf;AA0CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,cAAc,EACpB,KAAK,GAAE,MAAM,EAAO,EACpB,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;CAAO,GACjH,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAgCpD"}

package/dist/envprotect/hook.js

@@ -0,0 +1,158 @@
+/**
+ * R6 — the `tool.execute.before` hook: file-tool path classification,
+ * tool-call level routing (tm_* aliasing = anti-backdoor), and the hook
+ * factory with the privacy-red-line audit.  Split out of the former
+ * monolithic envprotect.ts; behavior unchanged.
+ */
+import { CATEGORY_ENV_FILE_PATH, CATEGORY_EXTRA_DENY, ENV_PROTECT_SERVICE, envProtectError, } from "./patterns.js";
+import { classifyBashCommand } from "./bash-classify.js";
+import { isEnvFilePath } from "./path-classify.js";
+import { isAskGatedEnvCommand } from "./gate-predicates.js";
+// ---------- file-tool path classification ----------
+/**
+ * Path-class argument keys scanned defensively across read / grep / glob /
+ * list (read uses `filePath`; the others historically use `path`, and
+ * `pattern` / `include` select files for glob / grep).  Keys outside this
+ * set (descriptions, notes) are never scanned.
+ */
+const PATH_LIKE_KEYS = /^(filepath|path|file|dir|directory|pattern|include)$/i;
+/**
+ * Classify the path-class arguments of a file tool.  Returns the pattern
+ * category when the call must be blocked, null when it may pass.
+ */
+export function classifyPathFields(args, mode, extra = []) {
+    if (!args || typeof args !== "object")
+        return null;
+    for (const [key, value] of Object.entries(args)) {
+        if (typeof value !== "string" || !value)
+            continue;
+        if (!PATH_LIKE_KEYS.test(key))
+            continue;
+        for (const rule of extra) {
+            if (rule.test(value))
+                return CATEGORY_EXTRA_DENY;
+        }
+        if (isEnvFilePath(value))
+            return CATEGORY_ENV_FILE_PATH;
+    }
+    return null;
+}
+// ---------- tool-call level routing ----------
+/** File tools whose path-class arguments are scanned for env files. */
+const PATH_SCAN_TOOLS = new Set(["read", "grep", "glob", "list"]);
+/**
+ * TeamMode's own tm_* tools alias onto the built-in surface so the SAME
+ * interception applies to them (anti-backdoor: tm_read/tm_grep/tm_bash must
+ * never become an R6 bypass by virtue of a different tool name).  The tools
+ * ALSO re-check with the same matchers inside their own pipelines — this
+ * hook-level alias is the outer defense layer.
+ */
+const TM_TOOL_ALIASES = {
+    tm_read: "read",
+    tm_grep: "grep",
+    tm_bash: "bash",
+};
+/**
+ * Top routing: tool name + tool args -> category to block, or null to pass.
+ * `off` always passes (the hook stays installed but is a no-op).
+ */
+export function inspectToolCall(tool, args, mode, extra = []) {
+    if (mode === "off")
+        return null;
+    const rawName = String(tool ?? "").trim().toLowerCase();
+    const name = TM_TOOL_ALIASES[rawName] ?? rawName;
+    if (name === "bash") {
+        const command = args?.command;
+        return classifyBashCommand(String(command ?? ""), mode, extra);
+    }
+    if (PATH_SCAN_TOOLS.has(name)) {
+        return classifyPathFields(args, mode, extra);
+    }
+    return null;
+}
+/**
+ * Best-effort audit of one interception.  Records ONLY the tool name and
+ * the pattern category (privacy red line: never command text, paths,
+ * variable names or values); the message embeds the service id itself so
+ * file-backed log sinks that drop the `service` field stay greppable.  A
+ * failing audit endpoint must never turn a block into a pass-through, so
+ * every failure is swallowed after the call attempt.
+ */
+async function auditInterception(client, tool, category) {
+    try {
+        // Call the method THROUGH the app object.  Destructuring `app.log`
+        // first would drop the SDK's `this` binding, so every real call died
+        // inside the SDK and was silently swallowed here — zero audit entries.
+        const app = client?.app;
+        if (!app || typeof app.log !== "function")
+            return;
+        await app.log({
+            body: {
+                level: "warn",
+                service: ENV_PROTECT_SERVICE,
+                message: `${ENV_PROTECT_SERVICE} :: ${tool} :: ${category}`,
+            },
+        });
+    }
+    catch {
+        /* audit is best-effort; the block below still takes effect */
+    }
+}
+/**
+ * Build the `tool.execute.before` hook.  The hook is installed in every
+ * mode; with mode "off" it returns immediately and everything passes.
+ * When a block triggers, the audit entry is written first, then the fixed
+ * structured error is thrown so opencode surfaces it to the model as the
+ * failed tool result.
+ *
+ * `options.deferToApproval` (the unified approval gate) — called with the
+ * tool call's `input.sessionID`; when it reports `true`, a built-in-bash
+ * environment read in an EXACT ask-glob form is passed through WITHOUT
+ * throwing, because the official confirmation dialog is the live gate for
+ * it (approve → runs, reject or timeout → the host blocks it).  The signal
+ * is SESSION-SCOPED on purpose: the gate registers only sessions carrying
+ * our injected bash ask set (exec-role chat.message, or an R6-env-classified
+ * `permission.asked`), so a stock build/plan session — where no dialog would
+ * ever open for `printenv` — keeps the hard throw instead of slipping the
+ * read through a global arm flag.  Reaching the deferral point at all
+ * additionally requires the command to match the config globs byte-exactly,
+ * so the dialog is GUARANTEED to fire wherever deferral happens.  A failed
+ * auto-reject flips the gate back to `false` everywhere, restoring the hard
+ * throw (fail-closed).  tm_* channels are never deferred (no dialog opens
+ * for them).
+ */
+export function createEnvProtectHook(client, mode, extra = [], options = {}) {
+    return async (input, output) => {
+        if (mode === "off")
+            return;
+        const tool = String(input?.tool ?? "");
+        const rawSid = input?.sessionID;
+        const sessionID = typeof rawSid === "string" && rawSid.trim() !== "" ? rawSid.trim() : undefined;
+        const args = output?.args;
+        const category = inspectToolCall(tool, args, mode, extra);
+        if (!category)
+            return;
+        // Session-wide env approval ("always" on first env ask) — pass silently;
+        // the "always" event itself was already audited by the approval gate.
+        // The blanket NEVER covers env-FILE reads (CATEGORY_ENV_FILE_PATH):
+        // files on disk (.env, shell rc family) never open a dialog of their
+        // own (they are not in the ask-pattern set), so no "always" verdict can
+        // have consented to them — they keep hard-throwing even in an
+        // env-approved session.
+        if (sessionID &&
+            options.envApproved?.(sessionID) &&
+            category !== CATEGORY_ENV_FILE_PATH) {
+            return;
+        }
+        // Defer ONLY the built-in bash tool (never its tm_bash alias), ONLY in a
+        // registered session, for the exact forms the config escalates to `ask`.
+        if (tool.trim().toLowerCase() === "bash" && sessionID && options.deferToApproval?.(sessionID)) {
+            const command = args?.command;
+            if (isAskGatedEnvCommand(String(command ?? ""), mode, extra))
+                return;
+        }
+        await auditInterception(client, tool, category);
+        throw envProtectError(category);
+    };
+}
+//# sourceMappingURL=hook.js.map

package/dist/envprotect/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/envprotect/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAEhB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,sDAAsD;AAEtD;;;;;GAKG;AACH,MAAM,cAAc,GAAG,uDAAuD,CAAA;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyC,EACzC,IAAoB,EACpB,QAAkB,EAAE;IAEpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,SAAQ;QACjD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,mBAAmB,CAAA;QAClD,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,sBAAsB,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gDAAgD;AAEhD,uEAAuE;AACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,eAAe,GAA2B;IAC9C,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,IAAyC,EACzC,IAAoB,EACpB,QAAkB,EAAE;IAEpB,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAA;IAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAI,IAA0C,EAAE,OAAO,CAAA;QACpE,OAAO,mBAAmB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAWD;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,MAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC;QACH,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,GAAG,GAAI,MAAyC,EAAE,GAAG,CAAA;QAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU;YAAE,OAAM;QACjD,MAAM,GAAG,CAAC,GAAG,CAAC;YACZ,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,GAAG,mBAAmB,OAAO,IAAI,OAAO,QAAQ,EAAE;aAC5D;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,IAAoB,EACpB,QAAkB,EAAE,EACpB,UAAgH,EAAE;IAElH,OAAO,KAAK,EAAE,KAAc,EAAE,MAAe,EAAiB,EAAE;QAC9D,IAAI,IAAI,KAAK,KAAK;YAAE,OAAM;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAE,KAAmC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACrE,MAAM,MAAM,GAAI,KAAwC,EAAE,SAAS,CAAA;QACnE,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAChG,MAAM,IAAI,GAAI,MAAoD,EAAE,IAAI,CAAA;QACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAM;QACrB,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,8DAA8D;QAC9D,wBAAwB;QACxB,IACE,SAAS;YACT,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC;YAChC,QAAQ,KAAK,sBAAsB,EACnC,CAAC;YACD,OAAM;QACR,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,MAAM,OAAO,GAAI,IAA0C,EAAE,OAAO,CAAA;YACpE,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;gBAAE,OAAM;QACtE,CAAC;QACD,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC/C,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC,CAAA;AACH,CAAC"}

package/dist/envprotect/path-classify.d.ts

@@ -0,0 +1,16 @@
+/**
+ * R6 — env-file path matching (.env family, shell rc files) for both path
+ * arguments and bash tokens.  Split out of the former monolithic
+ * envprotect.ts; behavior unchanged.
+ */
+/**
+ * True when the value points at an env file.  Matches on the BASENAME with
+ * both separators handled; URL query/fragment tails are cut first so
+ * `https://x/.env?raw=1` matches the same basename as a plain path, and
+ * asterisks are stripped so glob patterns like "*.env" or a recursive deep
+ * form of ".env.local" are caught by the same matcher as real paths.
+ * (Note: glob spellings are written without backticks here — a double-star
+ * + slash inside JSDoc would close the comment block early.)
+ */
+export declare function isEnvFilePath(raw: string): boolean;
+//# sourceMappingURL=path-classify.d.ts.map

package/dist/envprotect/path-classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-classify.d.ts","sourceRoot":"","sources":["../../src/envprotect/path-classify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiClD"}

package/dist/envprotect/path-classify.js

@@ -0,0 +1,72 @@
+/**
+ * R6 — env-file path matching (.env family, shell rc files) for both path
+ * arguments and bash tokens.  Split out of the former monolithic
+ * envprotect.ts; behavior unchanged.
+ */
+// ---------- env-file path matching ----------
+/** Shell/rc basenames whose content is effectively an env dump. */
+const ENV_FILE_BASENAMES = new Set([
+    ".bashrc",
+    ".bash_profile",
+    ".profile",
+    ".zshrc",
+    ".zprofile",
+    ".zshenv",
+]);
+/** Checked-in template suffixes — documentation copies, not real secrets. */
+const ENV_TEMPLATE_SUFFIX = /\.(?:example|sample|template|dist)$/;
+/**
+ * Code identifiers that merely end in ".env" and name an object, not a
+ * file (`process.env`, `import.meta.env`, ...).  The escaped form is
+ * listed too because a grep pattern like `process\.env` survives
+ * tokenization with its backslash.
+ */
+const ENV_IDENTIFIER = /^(?:process|deno|bun|os|import\.meta)\.env$/i;
+/**
+ * True when the value points at an env file.  Matches on the BASENAME with
+ * both separators handled; URL query/fragment tails are cut first so
+ * `https://x/.env?raw=1` matches the same basename as a plain path, and
+ * asterisks are stripped so glob patterns like "*.env" or a recursive deep
+ * form of ".env.local" are caught by the same matcher as real paths.
+ * (Note: glob spellings are written without backticks here — a double-star
+ * + slash inside JSDoc would close the comment block early.)
+ */
+export function isEnvFilePath(raw) {
+    const value = String(raw ?? "")
+        // one percent-decode pass FIRST, so URL-encoded names like
+        // `https://x/%2Eenv` land on the same basename as the plain path
+        // (single pass only: `%252E` decodes to `%2E` and stays encoded)
+        .replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+        .replace(/[?#].*$/, "")
+        .replace(/\*/g, "")
+        .trim();
+    if (!value)
+        return false;
+    // A code identifier like `process.env` is not a file path, however it is
+    // segmented.  The unescaped form matters because a grep pattern spelled
+    // `process\.env` would otherwise split at the backslash into path +
+    // basename `.env` and slip past the identifier check below.
+    if (ENV_IDENTIFIER.test(value) || ENV_IDENTIFIER.test(value.replace(/\\/g, ""))) {
+        return false;
+    }
+    const segments = value.split(/[\\/]/);
+    const base = (segments[segments.length - 1] || "").toLowerCase();
+    if (!base)
+        return false;
+    if (base === ".env")
+        return true;
+    if (base.startsWith(".env.")) {
+        // `.env.example` and friends are safe checked-in documentation
+        if (ENV_TEMPLATE_SUFFIX.test(base))
+            return false;
+        return true;
+    }
+    if (base.endsWith(".env")) {
+        if (ENV_IDENTIFIER.test(base) || ENV_IDENTIFIER.test(base.replace(/\\/g, ""))) {
+            return false;
+        }
+        return true;
+    }
+    return ENV_FILE_BASENAMES.has(base);
+}
+//# sourceMappingURL=path-classify.js.map

package/dist/envprotect/path-classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-classify.js","sourceRoot":"","sources":["../../src/envprotect/path-classify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+CAA+C;AAE/C,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,SAAS;IACT,eAAe;IACf,UAAU;IACV,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC,CAAA;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,qCAAqC,CAAA;AAEjE;;;;;GAKG;AACH,MAAM,cAAc,GAAG,8CAA8C,CAAA;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;SAChE,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,IAAI,EAAE,CAAA;IACT,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,+DAA+D;QAC/D,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACrC,CAAC"}

package/dist/envprotect/patterns.d.ts

@@ -0,0 +1,77 @@
+/**
+ * R6/R2 — environment-protection constants, the host-native `ask` pattern
+ * sets (Layer 1 of the unified approval gate), and the mode/config parsing.
+ * Split out of the former monolithic envprotect.ts; behavior unchanged.
+ *
+ * These are the shapes a wildcard CAN express (head-anchored globs).  The
+ * plugin NEVER self-allows; an unanswered dialog is auto-REJECTED by the
+ * approval timer (see approval-gate.ts).
+ */
+/** Audit log service identifier (also the query key for "what was blocked"). */
+export declare const ENV_PROTECT_SERVICE = "team-mode-env-protect";
+/**
+ * Fixed structured message returned to the model on every block.  The
+ * category is appended as a machine-readable suffix; tests pin both.
+ */
+export declare const ENV_PROTECT_MESSAGE = "TeamMode R6 env protection: \u73AF\u5883\u53D8\u91CF\u8BFB\u53D6\u5DF2\u88AB\u62E6\u622A\u3002\u9700\u8981\u53D8\u91CF\u503C\u8BF7\u5411 HUMAN \u7533\u8BF7\u3002";
+/** Pattern categories surfaced in the block message and the audit log. */
+export declare const CATEGORY_BASH_ENV_COMMAND = "bash-env-command";
+export declare const CATEGORY_BASH_ENV_EXPANSION = "bash-env-expansion";
+export declare const CATEGORY_ENV_FILE_PATH = "env-file-path";
+export declare const CATEGORY_EXTRA_DENY = "extra-deny";
+/**
+ * Two faces are routed to the OpenCode official confirmation dialog by
+ * declaring them `ask` in each agent's bash permission object.  The host
+ * pops a dialog for any command matching one of these patterns and SUSPENDS
+ * it: a human reply ("once"/"always") runs the command, a "reject" or NO
+ * REPLY is handled by the approval timer (Layer 2, see approval-gate.ts)
+ * which auto-REJECTS after TM_ASK_TIMEOUT_MIN.  The plugin NEVER self-allows.
+ *
+ * These are the shapes a wildcard CAN express (head-anchored globs, matching
+ * the probe-verified grammar: `printenv*`, `rm *`, `Get-ChildItem env:*`).
+ * Wildcards CANNOT express (embedded `${VAR}` / `$ALLCAPS` / `$env:` inside
+ * another command, command substitution `$(printenv)`, subshell/escaped/
+ * `time`-prefixed heads, `VAR=… env` assignment prefixes, split `declare -xp`,
+ * env-file paths at arbitrary positions) stay the classifier's HARD THROW —
+ * that is the `isAskGatedEnvCommand` boundary, kept in lockstep with the
+ * classifier so a form we stop throwing on is exactly a form the dialog shows.
+ */
+/** R6 env face — the wildcard-expressible environment-variable reads. */
+export declare const R6_ENV_BASH_ASK: Readonly<Record<string, "ask">>;
+/** R2 danger face — destructive / publishing / network / install / process /
+ *  privilege commands.  Independent of TM_ENV_PROTECT (R2 is its own red
+ *  line); the built-in bash tool stays `allow` for everything else, so the
+ *  normal verification stack (npm test, tsc, git status/diff) never pops. */
+export declare const R2_DANGER_BASH_ASK: Readonly<Record<string, "ask">>;
+/** Ordered key lists (frozen) — single source for the matcher + the gate. */
+export declare const R6_ENV_BASH_ASK_PATTERNS: readonly string[];
+export declare const R2_DANGER_BASH_ASK_PATTERNS: readonly string[];
+/**
+ * The bash permission object injected into the four execution-role agents
+ * (team / implementer / reviewer / tester).  Default stays `allow`
+ * (`"*": "allow"`, preserving the T2.1 matrix semantics — bash is granted,
+ * not removed); only the listed shapes escalate to the host dialog.  The R6
+ * env face is dropped when `mode === "off"` (the R6 kill switch) AND when
+ * `envFace` is false — index.ts passes false while the approval gate cannot
+ * arm: the R6 hook then hard-throws every env read BEFORE its dialog could
+ * ever satisfy it, so injecting the env asks would only create dead popups
+ * a human can answer yet never make runnable.  The R2 face is always
+ * present (its dialog is the whole gate — no code-level throw is involved).
+ */
+export declare function bashAskPatterns(mode: EnvProtectMode, envFace?: boolean): Record<string, string>;
+export type EnvProtectMode = "strict" | "standard" | "off";
+/**
+ * Resolve the protection mode.  Only exact "standard" / "off" switch those
+ * modes on; everything else (unset, typos, wrong case) fails CLOSED into
+ * strict — a mistyped opt-out must never disable the red line.
+ */
+export declare function resolveEnvProtectMode(raw: unknown): EnvProtectMode;
+/**
+ * Parse `TM_ENV_PROTECT_EXTRA_DENY` (semicolon-separated regex bodies).
+ * Invalid regexes are skipped rather than crashing plugin startup; the
+ * remaining rules still apply.  Empty/absent input yields no extra rules.
+ */
+export declare function parseExtraDeny(raw: unknown): RegExp[];
+/** The block error handed back to the model (fixed text + category tag). */
+export declare function envProtectError(category: string): Error;
+//# sourceMappingURL=patterns.d.ts.map

package/dist/envprotect/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/envprotect/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,sKAC4B,CAAA;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAC3D,eAAO,MAAM,2BAA2B,uBAAuB,CAAA;AAC/D,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AACrD,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAK/C;;;;;;;;;;;;;;;;GAgBG;AAEH,yEAAyE;AACzE,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAyB1D,CAAA;AAEF;;;6EAG6E;AAC7E,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CA6C7D,CAAA;AAEF,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAErD,CAAA;AACD,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAExD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,UAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5F;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAA;AAE1D;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAIlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAarD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAEvD"}