@wrongstack/plugins 0.307.1 → 0.308.0

package/dist/lint-gate.js

@@ -221,9 +221,10 @@ async function detectLinter(requested, cwd) {
 }
 async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-"));
+    const tmpFile = join(tmpDir, `input${ext}`);
     await writeFile(tmpFile, content, "utf-8");
     const fullArgs = [...linter.args, tmpFile];
     const result = await runCommand(linter.cmd, fullArgs, timeoutMs, cwd, signal);
@@ -234,14 +235,15 @@ async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return null;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-fix-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-fix-"));
+    const tmpFile = join(tmpDir, `input${ext}`);
     await writeFile(tmpFile, content, "utf-8");
     const fixArgs = linter.name === "biome" ? [linter.args[0], "check", "--write", tmpFile] : [linter.args[0], "--fix", tmpFile];
     await runCommand(linter.cmd, fixArgs, timeoutMs, cwd, signal);
@@ -251,7 +253,7 @@ async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return content;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 function parseLinterOutput(stdout, linterName) {
@@ -505,9 +507,9 @@ ${summary}${truncated}`
       name: "lint-gate",
       stage: "mutate",
       timeoutMs: Math.max(1e3, cfg.timeoutMs + 1e3),
-      // Formatter/linter availability must not create approval or denial
-      // loops in YOLO mode. Explicit lint findings still block in block mode.
-      failurePolicy: "open"
+      // Fail closed: a linter crash or timeout must not let unlinted
+      // content through in block mode (issue #363).
+      failurePolicy: "closed"
     });
     api.tools.register({
       name: "lint_gate_status",
@@ -579,5 +581,6 @@ ${summary}${truncated}`
 };
 var lint_gate_default = plugin;
 export {
-  lint_gate_default as default
+  lint_gate_default as default,
+  resolveLocalLinter
 };

package/dist/path-guard/glob.d.ts

@@ -2,6 +2,20 @@ export interface WriteTarget {
     path: string;
     kind: 'file' | 'scope' | 'deletion-scope';
 }
+/** Default wall-clock budget per glob match (ms). Must clear worker spin-up (~20ms). */
+export declare const GLOB_REDOS_BUDGET_MS = 250;
+export interface GuardedMatchOptions {
+    /** Invoked when a match times out — wired to the plugin's redosTimeouts counter. */
+    onTimeout?: (info: {
+        regex: RegExp;
+        input: string;
+        budgetMs: number;
+        elapsedMs: number;
+    }) => void;
+    /** Per-regex wall-clock budget. Default GLOB_REDOS_BUDGET_MS. */
+    budgetMs?: number;
+}
+export declare function matchesAnyGuarded(path: string, patterns: RegExp[], options?: GuardedMatchOptions): Promise<boolean>;
 /**
  * Compile a glob pattern to a RegExp. Supports `**` (any depth),
  * `*` (within one segment), and `?` (single char). Matching is done
@@ -27,6 +41,15 @@ export declare function staticPrefix(pattern: string): string;
 export declare function hasPartialSegmentWildcard(pattern: string): boolean;
 export declare function globWitness(pattern: string): string;
 export declare function scopesMayOverlap(left: string, right: string): boolean;
+export declare function targetIntersectsScope(target: WriteTarget, patternTexts: string[]): boolean;
 export declare function targetIntersectsPatterns(target: WriteTarget, patternTexts: string[], patterns: RegExp[]): boolean;
+/**
+ * ReDoS-guarded variant of `targetIntersectsPatterns` (issue #365 / audit
+ * T-02): the direct path match runs through `matchesAnyGuarded` (worker
+ * watchdog, fail-closed on timeout); scope-overlap logic stays synchronous
+ * because it matches against constructed candidate paths, not the raw
+ * hostile input.
+ */
+export declare function targetIntersectsPatternsGuarded(target: WriteTarget, patternTexts: string[], patterns: RegExp[], options?: GuardedMatchOptions): Promise<boolean>;
 export declare function targetFullyAllowed(target: WriteTarget, allowTexts: string[], allowRes: RegExp[]): boolean;
 //# sourceMappingURL=glob.d.ts.map

package/dist/path-guard/index.d.ts

@@ -7,6 +7,8 @@
 import type { Plugin } from '@wrongstack/core/types';
 export { compilePathGlob } from './glob.js';
 export { destructiveTargets } from './shell-targets.js';
+/** True when `path` is a project-local symlink whose real target escaped. */
+export declare function isSymlinkEscape(path: string, cwd?: string): boolean;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/path-guard.js

@@ -1,4 +1,104 @@
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const workerSource = buildWorkerSource(re.source, input, re.flags);
+  const worker = new Worker(workerSource, {
+    eval: true,
+    name: `redos-guard:${re.source.slice(0, 32)}`
+  });
+  return new Promise((resolve3) => {
+    let settled = false;
+    const onMessage = (msg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      if (!msg.ok) {
+        resolve3({ timedOut: true, match: null });
+        return;
+      }
+      resolve3({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      resolve3({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      resolve3({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.on("message", onMessage);
+    worker.on("error", onError);
+  });
+}
+function buildWorkerSource(source, input, flags) {
+  const S = JSON.stringify(source);
+  const I = JSON.stringify(input);
+  const F = JSON.stringify(flags);
+  return `
+const { parentPort } = require('node:worker_threads');
+const source = ${S};
+const input = ${I};
+const flags = ${F};
+try {
+  const re = new RegExp(source, flags);
+  const match = re.exec(input);
+  // parentPort.postMessage, NOT bare postMessage: with eval:true
+  // workers this Node version does not expose the bare postMessage
+  // global \u2014 the worker throws ReferenceError at startup and the
+  // host misreads it as a timeout (positive-path regression).
+  parentPort.postMessage({ ok: true, match });
+} catch (err) {
+  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
+}
+`;
+}
+
 // src/path-guard/glob.ts
+var GLOB_REDOS_BUDGET_MS = 250;
+function mergeGuardedRegex(patterns) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const p of patterns) {
+    for (const f of p.flags) {
+      if (f !== "g" && f !== "y") flags.add(f);
+    }
+  }
+  const uniqueFlags = [...flags].join("");
+  return new RegExp(patterns.map((p) => p.source).join("|"), uniqueFlags);
+}
+async function matchesAnyGuarded(path, patterns, options = {}) {
+  const normalized = normalizePath(path);
+  if (patterns.length === 0) return false;
+  const result = await withReDoSGuard(
+    mergeGuardedRegex(patterns),
+    normalized,
+    options.budgetMs ?? GLOB_REDOS_BUDGET_MS,
+    options.onTimeout ? { onTimeout: options.onTimeout } : {}
+  );
+  if (result.timedOut) return true;
+  return result.match !== null;
+}
 function compilePathGlob(pattern) {
   const normalized = pattern.replace(/\\/g, "/");
   let source = "";
@@ -89,8 +189,8 @@ function isRootPathScope(path) {
 function isDirectoryAmbiguousPath(path) {
   const normalized = normalizePath(path).replace(/\/$/, "");
   if (isRootPathScope(normalized)) return true;
-  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
-  return path.endsWith("/") || basename.length > 0 && !basename.includes(".");
+  const basename2 = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return path.endsWith("/") || basename2.length > 0 && !basename2.includes(".");
 }
 function hasConfiguredProtectedDescendant(path, patterns) {
   const normalized = normalizePath(path).replace(/\/$/, "").toLowerCase();
@@ -133,8 +233,7 @@ function scopesMayOverlap(left, right) {
   }
   return hasPartialSegmentWildcard(left) && rightPrefix.startsWith(leftPrefix) || hasPartialSegmentWildcard(right) && leftPrefix.startsWith(rightPrefix);
 }
-function targetIntersectsPatterns(target, patternTexts, patterns) {
-  if (matchesAny(target.path, patterns)) return true;
+function targetIntersectsScope(target, patternTexts) {
   if (target.kind === "file") return false;
   const normalized = normalizePath(target.path).replace(/\/$/, "");
   if (!isUnresolvedPathScope(normalized)) {
@@ -146,6 +245,14 @@ function targetIntersectsPatterns(target, patternTexts, patterns) {
   }
   return patternTexts.some((pattern) => scopesMayOverlap(normalized, normalizePath(pattern)));
 }
+function targetIntersectsPatterns(target, patternTexts, patterns) {
+  if (matchesAny(target.path, patterns)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
+async function targetIntersectsPatternsGuarded(target, patternTexts, patterns, options = {}) {
+  if (await matchesAnyGuarded(target.path, patterns, options)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
 function targetFullyAllowed(target, allowTexts, allowRes) {
   if (target.kind === "file") return matchesAny(target.path, allowRes);
   const normalized = normalizePath(target.path).replace(/\/$/, "");
@@ -462,7 +569,7 @@ function commandRecursivelyDeletes(command) {
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -475,6 +582,8 @@ function commandRecursivelyDeletes(command) {
       if (token === "--") break;
       if (tool === "rm") {
         if (token === "--recursive" || /^-[^-]*[rR]/.test(token)) recursive = true;
+      } else if (tool === "remove-item") {
+        if (/^-Recurse$/i.test(token) || /^-r$/i.test(token)) recursive = true;
       } else if (/^\/[a-z]*s[a-z]*$/i.test(token)) {
         recursive = true;
       }
@@ -723,7 +832,7 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
@@ -1211,8 +1320,52 @@ function operationLabel(toolName) {
 }
 
 // src/path-guard/index.ts
+import { realpathSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function withinProject(p) {
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
+}
+
+// src/path-guard/index.ts
+function isSymlinkEscape(path, cwd) {
+  if (!withinProject(path)) return false;
+  try {
+    const abs = resolve2(cwd ?? process.cwd(), path);
+    const real = realpathSync(abs);
+    return !withinProject(real);
+  } catch {
+    return false;
+  }
+}
 function createState() {
-  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
+  return {
+    invocations: 0,
+    blocks: 0,
+    warns: 0,
+    redosTimeouts: 0,
+    lastBlock: null,
+    hookUnregister: null
+  };
 }
 var states = /* @__PURE__ */ new WeakMap();
 var latestState = createState();
@@ -1307,7 +1460,11 @@ var plugin = {
         additionalContext: `path-guard (warn mode): ${subject} and this ${operation} would modify it. Double-check this is intentional.`
       };
     };
-    const hook = (input) => {
+    const bumpRedos = () => {
+      state.redosTimeouts += 1;
+      api.metrics.counter("redos_timeouts");
+    };
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state.invocations += 1;
       const toolName = input.toolName ?? "";
@@ -1328,21 +1485,27 @@ var plugin = {
         const effectiveCwd = effectiveToolCwd(ti["cwd"], input.cwd);
         const recursivelyDeletes = commandRecursivelyDeletes(commandForInspection);
         const deletesImplicitScope = commandDeletesImplicitScope(commandForInspection);
-        for (const path of shellTargets) {
-          const target = {
-            path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
-            kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
-          };
-          if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-          const protectedShellTarget = targetIntersectsPatterns(target, cfg.protect, protectRes) || matchesAny(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes);
-          if (protectedShellTarget) {
-            return verdict(
-              target.path,
-              toolName,
-              "destructive shell command",
-              target.kind !== "file"
-            );
-          }
+        const shellHits = await Promise.all(
+          shellTargets.map(async (path) => {
+            const target = {
+              path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
+              kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
+            };
+            if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+            const protectedShellTarget = await targetIntersectsPatternsGuarded(target, cfg.protect, protectRes, { onTimeout: bumpRedos }) || await matchesAnyGuarded(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes, {
+              onTimeout: bumpRedos
+            });
+            return protectedShellTarget ? target : null;
+          })
+        );
+        const firstProtected = shellHits.find((t) => t !== null);
+        if (firstProtected) {
+          return verdict(
+            firstProtected.path,
+            toolName,
+            "destructive shell command",
+            firstProtected.kind !== "file"
+          );
         }
         const writes = writesToDisk({ ...input, toolInput: ti });
         const hasStructuredTarget = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some((field) => ti[field] !== void 0) || typeof ti["patch"] === "string";
@@ -1353,11 +1516,21 @@ var plugin = {
       }
       if (!writesToDisk({ ...input, toolInput: ti }) || isReadOnlyInvocation(toolName, ti)) return;
       const targets = pathsFromToolInput(ti, toolName, input.cwd);
-      for (const target of targets) {
-        if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-        if (targetIntersectsPatterns(target, cfg.protect, protectRes)) {
-          return verdict(target.path, toolName, operationLabel(toolName), target.kind !== "file");
-        }
+      const writeHits = await Promise.all(
+        targets.map(async (target) => {
+          if (target.kind === "file" && isSymlinkEscape(target.path, input.cwd)) return target;
+          if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+          return targetIntersectsPatterns(target, cfg.protect, protectRes) ? target : null;
+        })
+      );
+      const firstProtectedWrite = writeHits.find((t) => t !== null);
+      if (firstProtectedWrite) {
+        return verdict(
+          firstProtectedWrite.path,
+          toolName,
+          operationLabel(toolName),
+          firstProtectedWrite.kind !== "file"
+        );
       }
       return;
     };
@@ -1384,7 +1557,8 @@ var plugin = {
           counters: {
             invocations: state.invocations,
             blocks: state.blocks,
-            warns: state.warns
+            warns: state.warns,
+            redosTimeouts: state.redosTimeouts
           },
           lastBlock: state.lastBlock
         };
@@ -1407,10 +1581,16 @@ var plugin = {
       }
       state.hookUnregister = null;
     }
-    const final = { invocations: state.invocations, blocks: state.blocks, warns: state.warns };
+    const final = {
+      invocations: state.invocations,
+      blocks: state.blocks,
+      warns: state.warns,
+      redosTimeouts: state.redosTimeouts
+    };
     state.invocations = 0;
     state.blocks = 0;
     state.warns = 0;
+    state.redosTimeouts = 0;
     state.lastBlock = null;
     states.delete(api);
     api.log.info("path-guard: teardown complete", { final });
@@ -1423,7 +1603,8 @@ var plugin = {
       counters: {
         invocations: state.invocations,
         blocks: state.blocks,
-        warns: state.warns
+        warns: state.warns,
+        redosTimeouts: state.redosTimeouts
       }
     };
   }
@@ -1432,5 +1613,6 @@ var path_guard_default = plugin;
 export {
   compilePathGlob,
   path_guard_default as default,
-  destructiveTargets
+  destructiveTargets,
+  isSymlinkEscape
 };

package/dist/prompt-firewall/index.d.ts

@@ -39,6 +39,13 @@
  * @public
  */
 import type { Plugin } from '@wrongstack/core/types';
+/**
+ * Legacy `kind` names for the shapes this plugin already reported, so the
+ * canonical `type` ids from the shared table keep their existing spelling
+ * in logs, metrics and the status tool. Anything not listed here is
+ * reported under its canonical id.
+ */
+export declare const KIND_ALIASES: Readonly<Record<string, string>>;
 export interface Detection {
     kind: string;
     count: number;

package/dist/prompt-firewall.js

@@ -130,6 +130,83 @@ function cloneCredentialPatterns() {
   }));
 }
 
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const workerSource = buildWorkerSource(re.source, input, re.flags);
+  const worker = new Worker(workerSource, {
+    eval: true,
+    name: `redos-guard:${re.source.slice(0, 32)}`
+  });
+  return new Promise((resolve) => {
+    let settled = false;
+    const onMessage = (msg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      if (!msg.ok) {
+        resolve({ timedOut: true, match: null });
+        return;
+      }
+      resolve({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      resolve({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      resolve({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.on("message", onMessage);
+    worker.on("error", onError);
+  });
+}
+function buildWorkerSource(source, input, flags) {
+  const S = JSON.stringify(source);
+  const I = JSON.stringify(input);
+  const F = JSON.stringify(flags);
+  return `
+const { parentPort } = require('node:worker_threads');
+const source = ${S};
+const input = ${I};
+const flags = ${F};
+try {
+  const re = new RegExp(source, flags);
+  const match = re.exec(input);
+  // parentPort.postMessage, NOT bare postMessage: with eval:true
+  // workers this Node version does not expose the bare postMessage
+  // global \u2014 the worker throws ReferenceError at startup and the
+  // host misreads it as a timeout (positive-path regression).
+  parentPort.postMessage({ ok: true, match });
+} catch (err) {
+  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
+}
+`;
+}
+
 // src/prompt-firewall/index.ts
 var KIND_ALIASES = {
   aws_access_key: "aws-access-key",
@@ -253,6 +330,7 @@ var state = {
   requestRedactions: 0,
   responseRedactions: 0,
   blocked: 0,
+  timeoutCount: 0,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
@@ -297,6 +375,7 @@ var plugin = {
     state.requestRedactions = 0;
     state.responseRedactions = 0;
     state.blocked = 0;
+    state.timeoutCount = 0;
     state.byKind.clear();
     state.lastDetection = null;
     if (state.extensionUnregister) {
@@ -319,7 +398,16 @@ var plugin = {
         async wrapProviderRunner(_ctx, request, inner) {
           const req = request ?? {};
           state.invocations += 1;
-          const detections = detectSecrets(collectText(req), cfg.allow);
+          const requestText = collectText(req);
+          for (const extra of EXTRA_PATTERNS) {
+            const guarded = await withReDoSGuard(extra.re, requestText, 250, {
+              onTimeout: () => {
+                state.timeoutCount += 1;
+              }
+            });
+            if (guarded.timedOut) break;
+          }
+          const detections = detectSecrets(requestText, cfg.allow);
           if (detections.length > 0) {
             state.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -389,7 +477,8 @@ var plugin = {
             requestsWithSecrets: state.requestsWithSecrets,
             requestRedactions: state.requestRedactions,
             responseRedactions: state.responseRedactions,
-            blocked: state.blocked
+            blocked: state.blocked,
+            timeoutCount: state.timeoutCount
           },
           byKind: Object.fromEntries(state.byKind),
           lastDetection: state.lastDetection
@@ -443,6 +532,7 @@ var plugin = {
 };
 var prompt_firewall_default = plugin;
 export {
+  KIND_ALIASES,
   prompt_firewall_default as default,
   detectSecrets,
   readConfig,

package/dist/runtime/h1-state.d.ts

@@ -0,0 +1,62 @@
+/**
+ * H1 idempotent state — single-slot plugin state with a registry of
+ * releasable handles that survives `setup()` reload cycles.
+ *
+ * The "H1 audit pattern" (per SAGE memory T-03) is documented across
+ * the plugin suite: a plugin's module-scope `state` object holds
+ * counters plus a `hookUnregister` (or `extensionUnregister`) slot;
+ * on reload, the slot MUST be released before a new one is stored.
+ * Every plugin implements this inline with subtle variations:
+ *
+ *   - some use `releaseHandle(state.hookUnregister)` (`accessibility-auditor`)
+ *   - some use `try { state.hookUnregister(); } catch {}` (`config-validator`)
+ *   - some use a single inline `if (state.hookUnregister) { … }` block
+ *
+ * The drift cost: in 4 plugins the prior handle was leaked on reload
+ * because the inline `if` check raced with the new registration.
+ * This helper centralises the contract.
+ *
+ * Contract:
+ *   `createH1State<T>(initial)` returns
+ *     {
+ *       state:    T,                    // the user's mutable state
+ *       register: (key, unregister) => void,
+ *       release:  (key) => void,
+ *       releaseAll: () => void,
+ *     }
+ *
+ * - `register(key, unregister)` releases any prior handle at `key`
+ *   before storing the new one.
+ * - `release(key)` is a no-op if no handle is registered.
+ * - `releaseAll()` releases every registered handle and clears the map.
+ * - A throwing unregister function is swallowed (best-effort), matching
+ *   the existing `releaseHandle` semantics at `runtime/handles.ts`.
+ *
+ * The state object itself is NOT reset by `releaseAll` — counter
+ * reset is the plugin's responsibility (it knows the semantics of its
+ * counters). This helper owns the handle lifecycle only.
+ */
+export type Unregister = () => void;
+export interface H1State<T> {
+    /** The plugin's mutable state. Owned by the caller; never reset by this helper. */
+    state: T;
+    /**
+     * Register an unregister function under `key`. Any prior handle at
+     * `key` is released first. Throwing unregister functions are
+     * swallowed.
+     */
+    register: (key: string, unregister: Unregister | null | undefined) => void;
+    /**
+     * Release the handle at `key` (if any). Idempotent. Throwing
+     * unregister functions are swallowed.
+     */
+    release: (key: string) => void;
+    /** Release every registered handle. Idempotent. */
+    releaseAll: () => void;
+    /** Number of currently registered handles. Observability for health()/status tools. */
+    size: () => number;
+    /** List the registered keys. Order is insertion order; useful for diagnostics. */
+    keys: () => string[];
+}
+export declare function createH1State<T>(initial: T): H1State<T>;
+//# sourceMappingURL=h1-state.d.ts.map

package/dist/runtime/index.d.ts

@@ -32,6 +32,9 @@ export { parseLlmJsonObject, runOptionalPluginCouncil, runOptionalPluginLlm, str
 export { BoundedMap, BoundedSet, type BoundedMapOptions } from './bounded-map.js';
 export { UNSERIALIZABLE, safeJsonStringify } from './safe-json.js';
 export { releaseHandle, releaseHandles, type Unregister } from './handles.js';
+export { withReDoSGuard, guardedMatcher, type ReDoSResult, type ReDoSOptions, } from './redos-guard.js';
+export { safePath, isInsideProject, type SafePathOptions, } from './sandbox.js';
+export { createH1State, type H1State, } from './h1-state.js';
 export { clearLocalBinCache, findOnPath, resolveExecInvocation, resolveFirstNodeBin, resolveNodeBin, resolveWin32Command, type ExecInvocation, type ResolvedNodeBin, } from './local-bin.js';
 export type LanguageId = 'typescript' | 'javascript' | 'python' | 'go' | 'rust' | 'shell' | 'ruby' | 'java' | 'kotlin' | 'dotnet' | 'generic';
 export type PackageManagerId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'pip' | 'poetry' | 'go' | 'cargo' | 'gem' | 'maven' | 'gradle' | 'dotnet' | 'none';