@wrongstack/plugins 0.306.3 → 0.307.0

package/dist/index.js

@@ -9343,7 +9343,7 @@ var DEFAULT_ARTIFACT_PATTERNS = Object.freeze([
   "*.env.*"
 ]);
 function toForwardSlashes(p) {
-  return sep3 === "/" ? p : p.split(sep3).join("/");
+  return p.split(sep3).join("/").replaceAll("\\", "/");
 }
 function globToSource(glob) {
   return glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]");
@@ -13544,6 +13544,19 @@ var plugin38 = {
       }
     }
     state35.eventUnsubscribers = [];
+    if (api.tools?.unregister) {
+      try {
+        api.tools.unregister("notify_send");
+        api.tools.unregister("notify_hub_status");
+      } catch {
+      }
+    }
+    if (api.notifier?.unregisterChannel) {
+      try {
+        api.notifier.unregisterChannel("webhook");
+      } catch {
+      }
+    }
     const channelCounters = state35.channel?.counters();
     state35.channel = null;
     state35.lastDelivery = null;
@@ -13565,40 +13578,7 @@ var plugin38 = {
 };
 var notify_hub_default = plugin38;
 
-// src/path-guard/index.ts
-function createState() {
-  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
-}
-var states = /* @__PURE__ */ new WeakMap();
-var latestState = createState();
-var DEFAULT_PROTECT = [
-  "pnpm-lock.yaml",
-  "package-lock.json",
-  "yarn.lock",
-  "bun.lockb",
-  "Cargo.lock",
-  "poetry.lock",
-  ".env",
-  ".env.*",
-  ".git/**",
-  "**/migrations/**"
-];
-var DEFAULTS33 = {
-  enabled: true,
-  mode: "block",
-  protect: DEFAULT_PROTECT,
-  allow: []
-};
-function readConfig34(raw) {
-  if (!raw || typeof raw !== "object") return { ...DEFAULTS33, protect: [...DEFAULT_PROTECT] };
-  const r = raw;
-  return {
-    enabled: r["enabled"] !== false,
-    mode: r["mode"] === "warn" ? "warn" : "block",
-    protect: Array.isArray(r["protect"]) ? r["protect"].filter((p) => typeof p === "string" && p.length > 0) : [...DEFAULT_PROTECT],
-    allow: Array.isArray(r["allow"]) ? r["allow"].filter((p) => typeof p === "string" && p.length > 0) : []
-  };
-}
+// src/path-guard/glob.ts
 function compilePathGlob(pattern) {
   const normalized = pattern.replace(/\\/g, "/");
   let source = "";
@@ -13764,244 +13744,8 @@ function targetFullyAllowed(target, allowTexts, allowRes) {
     return allowNormalized.endsWith("/**") && allowRe?.test(`${normalized}/.path-guard-probe`);
   });
 }
-var WRITE_CAPABILITIES = /* @__PURE__ */ new Set(["fs.write", "fs.write.outside-project"]);
-var DISK_MUTATING_CAPABILITIES = /* @__PURE__ */ new Set(["package.install"]);
-var SHELL_CAPABILITIES = /* @__PURE__ */ new Set(["shell.arbitrary", "shell.restricted", "shell.exec"]);
-var LEGACY_SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell", "exec"]);
-var LEGACY_WRITE_TOOLS = /* @__PURE__ */ new Set([
-  "write",
-  "edit",
-  "patch",
-  "scaffold",
-  "format",
-  "replace",
-  "design",
-  "install"
-]);
-function writesToDisk(input) {
-  const capabilities = input.toolCapabilities;
-  const capabilitiesUndeclared = !capabilities || capabilities.length === 0;
-  const hasWriteCap = capabilities?.some((capability) => WRITE_CAPABILITIES.has(capability)) ?? false;
-  const hasDiskMutatingCap = capabilities?.some((capability) => DISK_MUTATING_CAPABILITIES.has(capability)) ?? false;
-  const hasCommandString = typeof input.toolInput?.["command"] === "string";
-  if (hasCommandString && executesShell(input) && !hasWriteCap && !hasDiskMutatingCap && !(capabilitiesUndeclared && LEGACY_WRITE_TOOLS.has(input.toolName ?? "")))
-    return false;
-  if (!capabilitiesUndeclared) {
-    if (hasWriteCap || hasDiskMutatingCap) return true;
-    if (capabilities.includes("mcp.proxy")) {
-      const segmentedName = (input.toolName ?? "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9]+/gi, "_").toLowerCase();
-      const filesystemWriter = /(?:^|_)filesystem(?:_|$)/.test(segmentedName) && /(?:^|_)(?:add|append|copy|create|delete|edit|mkdir|move|remove|rename|write)(?:_|$)/.test(
-        segmentedName
-      );
-      const toolInput = input.toolInput ?? {};
-      const hasKnownPath = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some(
-        (field) => toolInput[field] !== void 0
-      );
-      if (filesystemWriter && hasKnownPath) return true;
-    }
-    return false;
-  }
-  if (input.toolMutating !== void 0) return input.toolMutating;
-  return LEGACY_WRITE_TOOLS.has(input.toolName ?? "");
-}
-function executesShell(input) {
-  const toolName = input.toolName ?? "";
-  if (LEGACY_SHELL_TOOLS.has(toolName)) return true;
-  if (toolName === "git") return false;
-  const segmentedName = toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
-  const isCommandStringRunner = /(?:^|[_.-])(?:command|exec|execute|shell|terminal)(?:$|[_.-])/i.test(segmentedName);
-  const hasShellCapability = input.toolCapabilities?.some((capability) => SHELL_CAPABILITIES.has(capability)) ?? false;
-  const hasCommandString = typeof input.toolInput?.["command"] === "string";
-  return isCommandStringRunner && hasShellCapability || hasCommandString && input.toolMutating === true;
-}
-var PATH_FIELDS = [
-  "path",
-  "file_path",
-  "filePath",
-  "target",
-  "target_path",
-  "targetPath",
-  "destination",
-  "dest",
-  "output_path",
-  "outputPath",
-  "out",
-  "file"
-];
-var PATH_LIST_FIELDS = ["files", "paths"];
-var SOURCE_PATH_FIELDS = [
-  "source",
-  "from",
-  "src",
-  "input_path",
-  "inputPath",
-  "old_path",
-  "oldPath"
-];
-var MOVE_TOOL_NAME = /(?:^|[_.-])(move|rename)(?:$|[_.-])/i;
-var DIRECTORY_DELETE_TOOL_NAME = /(?:^|[_.-])(?:rmdir|(?:delete|remove)[_.-](?:dir|directory))(?:$|[_.-])/i;
-function segmentedToolName(toolName) {
-  return toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
-}
-function isMoveToolName(toolName) {
-  return MOVE_TOOL_NAME.test(segmentedToolName(toolName));
-}
-function isDirectoryDeleteToolName(toolName) {
-  return DIRECTORY_DELETE_TOOL_NAME.test(segmentedToolName(toolName));
-}
-function cleanPatchPath(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed || trimmed === "/dev/null") return null;
-  const quoted = /^"([^"]+)"(?:\s|$)/.exec(trimmed)?.[1];
-  const withoutTimestamp = quoted ?? trimmed.replace(/(?:\t|\s+)\d{4}-\d{2}-\d{2}(?:\s.*)?$/, "").trim();
-  if (!withoutTimestamp || withoutTimestamp === "/dev/null") return null;
-  return withoutTimestamp.replace(/^[ab]\//, "");
-}
-function pathsFromPatch(patch) {
-  const paths = [];
-  const lines = patch.split(/\r?\n/);
-  for (let index = 0; index + 2 < lines.length; index += 1) {
-    const oldHeader = lines[index];
-    const newHeader = lines[index + 1];
-    const hunkHeader = lines[index + 2];
-    if (!oldHeader?.startsWith("--- ") || !newHeader?.startsWith("+++ ")) continue;
-    if (!hunkHeader?.startsWith("@@ ")) continue;
-    const oldPath = cleanPatchPath(oldHeader.slice(4));
-    const newPath = cleanPatchPath(newHeader.slice(4));
-    if (oldPath) paths.push(oldPath);
-    if (newPath) paths.push(newPath);
-  }
-  return paths;
-}
-function appendTarget(targets, value, kind, base) {
-  if (typeof value !== "string" || value.length === 0) return;
-  targets.push({
-    path: resolveTargetPath(value, base),
-    kind
-  });
-}
-function appendTargetList(targets, value, directoryCapable, base) {
-  const appendPath = (path) => {
-    targets.push({
-      path: resolveTargetPath(path, base),
-      kind: isUnresolvedPathScope(path) || isRootPathScope(path) || directoryCapable && isDirectoryAmbiguousPath(path) ? "scope" : "file"
-    });
-  };
-  if (typeof value === "string") {
-    const paths = value.split(",").map((item) => item.trim()).filter((path) => path.length > 0);
-    for (const path of paths) appendPath(path);
-    return;
-  }
-  if (!Array.isArray(value)) return;
-  for (const item of value) {
-    if (typeof item !== "string") continue;
-    const path = item.trim();
-    if (path.length > 0) appendPath(path);
-  }
-}
-function isReadOnlyInvocation(toolName, toolInput) {
-  if (toolName === "git") {
-    const command = toolInput["command"];
-    if (command === "status" || command === "log" || command === "diff" || command === "fetch" || command === "commit" || command === "branch" || command === "push") {
-      return true;
-    }
-    return command === "worktree" && toolInput["worktreeAction"] === "list";
-  }
-  if (toolName === "design") {
-    const action = toolInput["action"] ?? "list";
-    return action === "list" || action === "foundations" || action === "verify";
-  }
-  if (toolName === "format") return toolInput["check"] === true;
-  if (toolName === "patch" || toolName === "scaffold") return toolInput["dry_run"] === true;
-  if (toolName === "replace") return toolInput["dry_run"] !== false;
-  return false;
-}
-function pathsFromToolInput(toolInput, toolName, invocationCwd) {
-  const targets = [];
-  const effectiveCwd = effectiveToolCwd(toolInput["cwd"], invocationCwd);
-  const directoryDelete = isDirectoryDeleteToolName(toolName);
-  for (const field of PATH_FIELDS) {
-    const value = toolInput[field];
-    appendTarget(
-      targets,
-      value,
-      directoryDelete ? "deletion-scope" : typeof value === "string" && isUnresolvedPathScope(value) ? "scope" : "file",
-      effectiveCwd
-    );
-  }
-  const directoryCapableLists = toolName === "format" || toolName === "replace";
-  for (const field of PATH_LIST_FIELDS) {
-    appendTargetList(
-      targets,
-      toolInput[field],
-      directoryCapableLists && field === "files",
-      effectiveCwd
-    );
-  }
-  if (toolName === "install") {
-    appendTarget(targets, effectiveCwd ?? invocationCwd ?? ".", "scope");
-  }
-  if (toolName === "git") {
-    const command = toolInput["command"];
-    if (command === "worktree" && (toolInput["worktreeAction"] === "add" || toolInput["worktreeAction"] === "remove")) {
-      appendTarget(targets, toolInput["worktreePath"] ?? toolInput["worktree_path"], "file");
-    }
-  }
-  if (toolName === "scaffold") {
-    const cwdValue = toolInput["cwd"];
-    const cwd = typeof cwdValue === "string" && cwdValue.length > 0 ? cwdValue : invocationCwd ?? ".";
-    const base = normalizePath2(cwd).replace(/\/$/, "");
-    const name = typeof toolInput["name"] === "string" ? toolInput["name"] : "";
-    const template = toolInput["template"];
-    const filesByTemplate = {
-      "npm-package": ["package.json", "tsconfig.json", "src/index.ts", "src/index.test.ts"],
-      "cli-tool": ["package.json", "src/index.ts"],
-      "react-component": name ? [`${name}.tsx`, `${name}.test.tsx`] : []
-    };
-    for (const file of typeof template === "string" ? filesByTemplate[template] ?? [] : []) {
-      targets.push({ path: `${base}/${file}`, kind: "file" });
-    }
-    targets.push({ path: base, kind: "scope" });
-  }
-  if (isMoveToolName(toolName)) {
-    for (const field of SOURCE_PATH_FIELDS) {
-      appendTarget(targets, toolInput[field], "deletion-scope", effectiveCwd);
-    }
-  }
-  const patch = toolInput["patch"];
-  if (typeof patch === "string") {
-    const patchTargets = pathsFromPatch(patch);
-    const directory = toolInput["directory"];
-    const baseValue = typeof directory === "string" && directory.length > 0 ? directory : invocationCwd;
-    if (baseValue) {
-      const base = normalizePath2(baseValue).replace(/\/$/, "");
-      targets.push(
-        ...patchTargets.map((target) => ({ path: `${base}/${target}`, kind: "file" }))
-      );
-    } else {
-      targets.push(...patchTargets.map((path) => ({ path, kind: "file" })));
-    }
-  }
-  if (targets.length === 0) {
-    const cwd = effectiveCwd ?? ".";
-    targets.push({ path: normalizePath2(cwd).replace(/\/$/, "") || ".", kind: "scope" });
-  }
-  const seen = /* @__PURE__ */ new Set();
-  return targets.map((target) => ({
-    ...target,
-    path: relativeToInvocationCwd(target.path, invocationCwd)
-  })).filter((target) => {
-    const key = `${target.kind}:${target.path}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}
-function operationLabel(toolName) {
-  if (toolName === "write") return "write";
-  if (toolName === "edit") return "edit";
-  return `write via "${toolName}"`;
-}
+
+// src/path-guard/shell-targets.ts
 var VALUE_TAKING_GIT_OPTIONS = /* @__PURE__ */ new Set([
   "-C",
   "-c",
@@ -14165,21 +13909,6 @@ function unwrapEnvSplitStringAtBoundary(command) {
   }
   return command;
 }
-function stripTransparentLaunchers(command) {
-  let stripped = command;
-  let previous;
-  do {
-    previous = stripped;
-    let beforeUnwrap;
-    do {
-      beforeUnwrap = stripped;
-      stripped = unwrapEnvSplitStringAtBoundary(stripped);
-    } while (stripped !== beforeUnwrap);
-    stripped = stripLauncherAtBoundary(stripped, "env", ENV_VALUE_TAKING);
-    stripped = stripLauncherAtBoundary(stripped, "sudo", SUDO_VALUE_TAKING);
-  } while (stripped !== previous);
-  return stripped;
-}
 var SUDO_VALUE_TAKING = /* @__PURE__ */ new Set([
   "-u",
   "-g",
@@ -14221,6 +13950,21 @@ var ENV_FLAG_OPTIONS = /* @__PURE__ */ new Set([
   "--help",
   "--version"
 ]);
+function stripTransparentLaunchers(command) {
+  let stripped = command;
+  let previous;
+  do {
+    previous = stripped;
+    let beforeUnwrap;
+    do {
+      beforeUnwrap = stripped;
+      stripped = unwrapEnvSplitStringAtBoundary(stripped);
+    } while (stripped !== beforeUnwrap);
+    stripped = stripLauncherAtBoundary(stripped, "env", ENV_VALUE_TAKING);
+    stripped = stripLauncherAtBoundary(stripped, "sudo", SUDO_VALUE_TAKING);
+  } while (stripped !== previous);
+  return stripped;
+}
 function firstUnquotedShellSeparator(raw, start, end) {
   let quote = null;
   for (let index = start; index < end; index += 1) {
@@ -14357,9 +14101,7 @@ function executableCommandSubstitutions(command) {
     }
     const commandSubstitution = char === "$" && command[index + 1] === "(";
     const processSubstitution = (char === ">" || char === "<") && command[index + 1] === "(";
-    if (!commandSubstitution && !processSubstitution || // Arithmetic expansion evaluates an expression; it does not execute its
-    // contents as a shell command substitution.
-    commandSubstitution && command[index + 2] === "(")
+    if (!commandSubstitution && !processSubstitution || commandSubstitution && command[index + 2] === "(")
       continue;
     let depth = 1;
     let innerQuote = null;
@@ -14742,70 +14484,345 @@ function destructiveTargetsAtDepth(command, depth) {
         targets.push(gitTarget("."));
     }
   }
-  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
-  let f = findDelete.exec(normalizedCommand);
-  while (f !== null) {
-    const tokens = shellTokens(f[1] ?? "");
-    const expressionIndex = tokens.findIndex(
-      (token) => token.startsWith("-") || token === "!" || token === "("
+  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  let f = findDelete.exec(normalizedCommand);
+  while (f !== null) {
+    const tokens = shellTokens(f[1] ?? "");
+    const expressionIndex = tokens.findIndex(
+      (token) => token.startsWith("-") || token === "!" || token === "("
+    );
+    const roots = (expressionIndex === -1 ? tokens : tokens.slice(0, expressionIndex)).filter(
+      (token) => token.length > 0
+    );
+    targets.push(...roots.length > 0 ? roots : ["."]);
+    f = findDelete.exec(normalizedCommand);
+  }
+  const shellWrapper = /\b(?:ba|z|k)?sh\s+-c\s+(['"])(.*?)\1/gi;
+  let w = shellWrapper.exec(normalizedCommand);
+  while (w !== null) {
+    if (w[2] && !tokenIsQuoted(w, w[0].split(/\s/)[0] ?? "")) {
+      targets.push(...destructiveTargetsAtDepth(w[2], depth + 1));
+    }
+    w = shellWrapper.exec(normalizedCommand);
+  }
+  let quote = null;
+  for (let index = 0; index < normalizedCommand.length; index += 1) {
+    const char = normalizedCommand[index];
+    if (char === "\n") {
+      quote = null;
+      continue;
+    }
+    if (isQuoteBoundary(normalizedCommand, index, quote)) {
+      quote = quote === char ? null : char === "'" ? "'" : '"';
+      continue;
+    }
+    if (quote !== null || char !== ">") continue;
+    const redirectsBothStreams = normalizedCommand[index + 1] === "&";
+    const overridesNoclobber = normalizedCommand[index + 1] === "|";
+    if (redirectsBothStreams || overridesNoclobber || normalizedCommand[index + 1] === ">") {
+      index += 1;
+    }
+    while (normalizedCommand[index + 1] === " " || normalizedCommand[index + 1] === "	") {
+      index += 1;
+    }
+    const targetQuote = normalizedCommand[index + 1];
+    let end = index + 1;
+    let target;
+    if (targetQuote === "'" || targetQuote === '"') {
+      end = normalizedCommand.indexOf(targetQuote, index + 2);
+      if (end === -1) continue;
+      target = normalizedCommand.slice(index + 2, end);
+    } else {
+      while (end < normalizedCommand.length && !/[\s;&|>()]/.test(normalizedCommand[end] ?? "")) {
+        end += 1;
+      }
+      target = normalizedCommand.slice(index + 1, end);
+    }
+    if (target && !(redirectsBothStreams && (/^\d+$/.test(target) || target === "-"))) {
+      targets.push(target);
+    }
+    index = end;
+  }
+  return [
+    ...new Set(
+      targets.map((target) => target.replace(/^['"]|['"]$/g, "")).filter((target) => target !== "/dev/null" && target.toLowerCase() !== "nul")
+    )
+  ];
+}
+
+// src/path-guard/tool-targets.ts
+var WRITE_CAPABILITIES = /* @__PURE__ */ new Set(["fs.write", "fs.write.outside-project"]);
+var DISK_MUTATING_CAPABILITIES = /* @__PURE__ */ new Set(["package.install"]);
+var SHELL_CAPABILITIES = /* @__PURE__ */ new Set(["shell.arbitrary", "shell.restricted", "shell.exec"]);
+var LEGACY_SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell", "exec"]);
+var LEGACY_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "write",
+  "edit",
+  "patch",
+  "scaffold",
+  "format",
+  "replace",
+  "design",
+  "install"
+]);
+var PATH_FIELDS = [
+  "path",
+  "file_path",
+  "filePath",
+  "target",
+  "target_path",
+  "targetPath",
+  "destination",
+  "dest",
+  "output_path",
+  "outputPath",
+  "out",
+  "file"
+];
+var PATH_LIST_FIELDS = ["files", "paths"];
+var SOURCE_PATH_FIELDS = [
+  "source",
+  "from",
+  "src",
+  "input_path",
+  "inputPath",
+  "old_path",
+  "oldPath"
+];
+var MOVE_TOOL_NAME = /(?:^|[_.-])(move|rename)(?:$|[_.-])/i;
+var DIRECTORY_DELETE_TOOL_NAME = /(?:^|[_.-])(?:rmdir|(?:delete|remove)[_.-](?:dir|directory))(?:$|[_.-])/i;
+function segmentedToolName(toolName) {
+  return toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+}
+function isMoveToolName(toolName) {
+  return MOVE_TOOL_NAME.test(segmentedToolName(toolName));
+}
+function isDirectoryDeleteToolName(toolName) {
+  return DIRECTORY_DELETE_TOOL_NAME.test(segmentedToolName(toolName));
+}
+function cleanPatchPath(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed === "/dev/null") return null;
+  const quoted = /^"([^"]+)"(?:\s|$)/.exec(trimmed)?.[1];
+  const withoutTimestamp = quoted ?? trimmed.replace(/(?:\t|\s+)\d{4}-\d{2}-\d{2}(?:\s.*)?$/, "").trim();
+  if (!withoutTimestamp || withoutTimestamp === "/dev/null") return null;
+  return withoutTimestamp.replace(/^[ab]\//, "");
+}
+function pathsFromPatch(patch) {
+  const paths = [];
+  const lines = patch.split(/\r?\n/);
+  for (let index = 0; index + 2 < lines.length; index += 1) {
+    const oldHeader = lines[index];
+    const newHeader = lines[index + 1];
+    const hunkHeader = lines[index + 2];
+    if (!oldHeader?.startsWith("--- ") || !newHeader?.startsWith("+++ ")) continue;
+    if (!hunkHeader?.startsWith("@@ ")) continue;
+    const oldPath = cleanPatchPath(oldHeader.slice(4));
+    const newPath = cleanPatchPath(newHeader.slice(4));
+    if (oldPath) paths.push(oldPath);
+    if (newPath) paths.push(newPath);
+  }
+  return paths;
+}
+function appendTarget(targets, value, kind, base) {
+  if (typeof value !== "string" || value.length === 0) return;
+  targets.push({
+    path: resolveTargetPath(value, base),
+    kind
+  });
+}
+function appendTargetList(targets, value, directoryCapable, base) {
+  const appendPath = (path) => {
+    targets.push({
+      path: resolveTargetPath(path, base),
+      kind: isUnresolvedPathScope(path) || isRootPathScope(path) || directoryCapable && isDirectoryAmbiguousPath(path) ? "scope" : "file"
+    });
+  };
+  if (typeof value === "string") {
+    const paths = value.split(",").map((item) => item.trim()).filter((path) => path.length > 0);
+    for (const path of paths) appendPath(path);
+    return;
+  }
+  if (!Array.isArray(value)) return;
+  for (const item of value) {
+    if (typeof item !== "string") continue;
+    const path = item.trim();
+    if (path.length > 0) appendPath(path);
+  }
+}
+function isReadOnlyInvocation(toolName, toolInput) {
+  if (toolName === "git") {
+    const command = toolInput["command"];
+    if (command === "status" || command === "log" || command === "diff" || command === "fetch" || command === "commit" || command === "branch" || command === "push") {
+      return true;
+    }
+    return command === "worktree" && toolInput["worktreeAction"] === "list";
+  }
+  if (toolName === "design") {
+    const action = toolInput["action"] ?? "list";
+    return action === "list" || action === "foundations" || action === "verify";
+  }
+  if (toolName === "format") return toolInput["check"] === true;
+  if (toolName === "patch" || toolName === "scaffold") return toolInput["dry_run"] === true;
+  if (toolName === "replace") return toolInput["dry_run"] !== false;
+  return false;
+}
+function writesToDisk(input) {
+  const capabilities = input.toolCapabilities;
+  const capabilitiesUndeclared = !capabilities || capabilities.length === 0;
+  const hasWriteCap = capabilities?.some((capability) => WRITE_CAPABILITIES.has(capability)) ?? false;
+  const hasDiskMutatingCap = capabilities?.some((capability) => DISK_MUTATING_CAPABILITIES.has(capability)) ?? false;
+  const hasCommandString = typeof input.toolInput?.["command"] === "string";
+  if (hasCommandString && executesShell(input) && !hasWriteCap && !hasDiskMutatingCap && !(capabilitiesUndeclared && LEGACY_WRITE_TOOLS.has(input.toolName ?? "")))
+    return false;
+  if (!capabilitiesUndeclared) {
+    if (hasWriteCap || hasDiskMutatingCap) return true;
+    if (capabilities.includes("mcp.proxy")) {
+      const segmentedName = (input.toolName ?? "").replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^a-z0-9]+/gi, "_").toLowerCase();
+      const filesystemWriter = /(?:^|_)filesystem(?:_|$)/.test(segmentedName) && /(?:^|_)(?:add|append|copy|create|delete|edit|mkdir|move|remove|rename|write)(?:_|$)/.test(
+        segmentedName
+      );
+      const toolInput = input.toolInput ?? {};
+      const hasKnownPath = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some(
+        (field) => toolInput[field] !== void 0
+      );
+      if (filesystemWriter && hasKnownPath) return true;
+    }
+    return false;
+  }
+  if (input.toolMutating !== void 0) return input.toolMutating;
+  return LEGACY_WRITE_TOOLS.has(input.toolName ?? "");
+}
+function executesShell(input) {
+  const toolName = input.toolName ?? "";
+  if (LEGACY_SHELL_TOOLS.has(toolName)) return true;
+  if (toolName === "git") return false;
+  const segmentedName = toolName.replace(/([a-z0-9])([A-Z])/g, "$1_$2");
+  const isCommandStringRunner = /(?:^|[_.-])(?:command|exec|execute|shell|terminal)(?:$|[_.-])/i.test(segmentedName);
+  const hasShellCapability = input.toolCapabilities?.some((capability) => SHELL_CAPABILITIES.has(capability)) ?? false;
+  const hasCommandString = typeof input.toolInput?.["command"] === "string";
+  return isCommandStringRunner && hasShellCapability || hasCommandString && input.toolMutating === true;
+}
+function pathsFromToolInput(toolInput, toolName, invocationCwd) {
+  const targets = [];
+  const effectiveCwd = effectiveToolCwd(toolInput["cwd"], invocationCwd);
+  const directoryDelete = isDirectoryDeleteToolName(toolName);
+  for (const field of PATH_FIELDS) {
+    const value = toolInput[field];
+    appendTarget(
+      targets,
+      value,
+      directoryDelete ? "deletion-scope" : typeof value === "string" && isUnresolvedPathScope(value) ? "scope" : "file",
+      effectiveCwd
     );
-    const roots = (expressionIndex === -1 ? tokens : tokens.slice(0, expressionIndex)).filter(
-      (token) => token.length > 0
+  }
+  const directoryCapableLists = toolName === "format" || toolName === "replace";
+  for (const field of PATH_LIST_FIELDS) {
+    appendTargetList(
+      targets,
+      toolInput[field],
+      directoryCapableLists && field === "files",
+      effectiveCwd
     );
-    targets.push(...roots.length > 0 ? roots : ["."]);
-    f = findDelete.exec(normalizedCommand);
   }
-  const shellWrapper = /\b(?:ba|z|k)?sh\s+-c\s+(['"])(.*?)\1/gi;
-  let w = shellWrapper.exec(normalizedCommand);
-  while (w !== null) {
-    if (w[2] && !tokenIsQuoted(w, w[0].split(/\s/)[0] ?? "")) {
-      targets.push(...destructiveTargetsAtDepth(w[2], depth + 1));
-    }
-    w = shellWrapper.exec(normalizedCommand);
+  if (toolName === "install") {
+    appendTarget(targets, effectiveCwd ?? invocationCwd ?? ".", "scope");
   }
-  let quote = null;
-  for (let index = 0; index < normalizedCommand.length; index += 1) {
-    const char = normalizedCommand[index];
-    if (char === "\n") {
-      quote = null;
-      continue;
-    }
-    if (isQuoteBoundary(normalizedCommand, index, quote)) {
-      quote = quote === char ? null : char === "'" ? "'" : '"';
-      continue;
+  if (toolName === "git") {
+    const command = toolInput["command"];
+    if (command === "worktree" && (toolInput["worktreeAction"] === "add" || toolInput["worktreeAction"] === "remove")) {
+      appendTarget(targets, toolInput["worktreePath"] ?? toolInput["worktree_path"], "file");
     }
-    if (quote !== null || char !== ">") continue;
-    const redirectsBothStreams = normalizedCommand[index + 1] === "&";
-    const overridesNoclobber = normalizedCommand[index + 1] === "|";
-    if (redirectsBothStreams || overridesNoclobber || normalizedCommand[index + 1] === ">") {
-      index += 1;
+  }
+  if (toolName === "scaffold") {
+    const cwdValue = toolInput["cwd"];
+    const cwd = typeof cwdValue === "string" && cwdValue.length > 0 ? cwdValue : invocationCwd ?? ".";
+    const base = normalizePath2(cwd).replace(/\/$/, "");
+    const name = typeof toolInput["name"] === "string" ? toolInput["name"] : "";
+    const template = toolInput["template"];
+    const filesByTemplate = {
+      "npm-package": ["package.json", "tsconfig.json", "src/index.ts", "src/index.test.ts"],
+      "cli-tool": ["package.json", "src/index.ts"],
+      "react-component": name ? [`${name}.tsx`, `${name}.test.tsx`] : []
+    };
+    for (const file of typeof template === "string" ? filesByTemplate[template] ?? [] : []) {
+      targets.push({ path: `${base}/${file}`, kind: "file" });
     }
-    while (normalizedCommand[index + 1] === " " || normalizedCommand[index + 1] === "	") {
-      index += 1;
+    targets.push({ path: base, kind: "scope" });
+  }
+  if (isMoveToolName(toolName)) {
+    for (const field of SOURCE_PATH_FIELDS) {
+      appendTarget(targets, toolInput[field], "deletion-scope", effectiveCwd);
     }
-    const targetQuote = normalizedCommand[index + 1];
-    let end = index + 1;
-    let target;
-    if (targetQuote === "'" || targetQuote === '"') {
-      end = normalizedCommand.indexOf(targetQuote, index + 2);
-      if (end === -1) continue;
-      target = normalizedCommand.slice(index + 2, end);
+  }
+  const patch = toolInput["patch"];
+  if (typeof patch === "string") {
+    const patchTargets = pathsFromPatch(patch);
+    const directory = toolInput["directory"];
+    const baseValue = typeof directory === "string" && directory.length > 0 ? directory : invocationCwd;
+    if (baseValue) {
+      const base = normalizePath2(baseValue).replace(/\/$/, "");
+      targets.push(
+        ...patchTargets.map((target) => ({ path: `${base}/${target}`, kind: "file" }))
+      );
     } else {
-      while (end < normalizedCommand.length && !/[\s;&|>()]/.test(normalizedCommand[end] ?? "")) {
-        end += 1;
-      }
-      target = normalizedCommand.slice(index + 1, end);
-    }
-    if (target && !(redirectsBothStreams && (/^\d+$/.test(target) || target === "-"))) {
-      targets.push(target);
+      targets.push(...patchTargets.map((path) => ({ path, kind: "file" })));
     }
-    index = end;
   }
-  return [
-    ...new Set(
-      targets.map((target) => target.replace(/^['"]|['"]$/g, "")).filter((target) => target !== "/dev/null" && target.toLowerCase() !== "nul")
-    )
-  ];
+  if (targets.length === 0) {
+    const cwd = effectiveCwd ?? ".";
+    targets.push({ path: normalizePath2(cwd).replace(/\/$/, "") || ".", kind: "scope" });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return targets.map((target) => ({
+    ...target,
+    path: relativeToInvocationCwd(target.path, invocationCwd)
+  })).filter((target) => {
+    const key = `${target.kind}:${target.path}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function operationLabel(toolName) {
+  if (toolName === "write") return "write";
+  if (toolName === "edit") return "edit";
+  return `write via "${toolName}"`;
+}
+
+// src/path-guard/index.ts
+function createState() {
+  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
+}
+var states = /* @__PURE__ */ new WeakMap();
+var latestState = createState();
+var DEFAULT_PROTECT = [
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  "bun.lockb",
+  "Cargo.lock",
+  "poetry.lock",
+  ".env",
+  ".env.*",
+  ".git/**",
+  "**/migrations/**"
+];
+var DEFAULTS33 = {
+  enabled: true,
+  mode: "block",
+  protect: DEFAULT_PROTECT,
+  allow: []
+};
+function readConfig34(raw) {
+  if (!raw || typeof raw !== "object") return { ...DEFAULTS33, protect: [...DEFAULT_PROTECT] };
+  const r = raw;
+  return {
+    enabled: r["enabled"] !== false,
+    mode: r["mode"] === "warn" ? "warn" : "block",
+    protect: Array.isArray(r["protect"]) ? r["protect"].filter((p) => typeof p === "string" && p.length > 0) : [...DEFAULT_PROTECT],
+    allow: Array.isArray(r["allow"]) ? r["allow"].filter((p) => typeof p === "string" && p.length > 0) : []
+  };
 }
 var plugin39 = {
   name: "path-guard",
@@ -16033,7 +16050,29 @@ var CREDENTIAL_PATTERNS = [
     regex: /postgres(?:ql)?:\/\/(?:[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+|[^&\s?"'`#]{1,2048}\?(?:(?!(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=)[^&\s#"'`]{1,256}&){0,32}(?:p|%70)(?:a|%61)(?:s|%73)(?:s|%73)(?:w|%77)(?:o|%6[fF])(?:r|%72)(?:d|%64)=[^&\s#"'`]{1,4096})/g
   },
   { type: "mysql_uri", regex: /mysql:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
-  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g }
+  { type: "redis_uri", regex: /redis:\/\/[^\s:/@"'`]*:[^\s/@"'`]+@[^\s"'`]+/g },
+  {
+    // Credentials serialised as JSON, keyed rather than prefixed. Every other
+    // entry in this table recognises a credential by its SHAPE (`ghp_`, `sk-`,
+    // `eyJ`), which means a key with no distinctive prefix — Azure, a
+    // self-hosted gateway, an Anthropic/Codex OAuth token — was invisible to
+    // both surfaces. `prompt-firewall` guards the outgoing provider request, so
+    // this is what stops a JSON-shaped tool result carrying such a value to a
+    // third party.
+    //
+    // The key is matched in a LOOKBEHIND, so the reported match is the secret
+    // itself and the pattern keeps zero capturing groups — `secret-scanner`
+    // maps a combined-regex group index back to the pattern that fired, and an
+    // inner group would shift that mapping (see the style note above, enforced
+    // by credential-pattern-parity.test.ts).
+    //
+    // Mirrors `json_credential_key` in
+    // `@wrongstack/core` → `src/security/secret-scrubber.ts`. Keep the two key
+    // lists in step; the core side additionally preserves the key name when it
+    // rewrites, which is why it is written with capture groups instead.
+    type: "json_credential_key",
+    regex: /(?<="[A-Za-z0-9_]{0,64}(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s{0,8}:\s{0,8}")[^"\\]{8,512}(?=")/gi
+  }
 ];
 function cloneCredentialPatterns() {
   return CREDENTIAL_PATTERNS.map((p) => ({