@wrongstack/plugins 0.307.1 → 0.308.1

package/dist/lint-gate.js

@@ -221,9 +221,10 @@ async function detectLinter(requested, cwd) {
 }
 async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-"));
+    const tmpFile = join(tmpDir, `input${ext}`);
     await writeFile(tmpFile, content, "utf-8");
     const fullArgs = [...linter.args, tmpFile];
     const result = await runCommand(linter.cmd, fullArgs, timeoutMs, cwd, signal);
@@ -234,14 +235,15 @@ async function lintContent(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return null;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
   const ext = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")) : ".ts";
-  const tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-fix-"));
-  const tmpFile = join(tmpDir, `input${ext}`);
+  let tmpDir;
   try {
+    tmpDir = await mkdtemp(join(tmpdir(), "lint-gate-fix-"));
+    const tmpFile = join(tmpDir, `input${ext}`);
     await writeFile(tmpFile, content, "utf-8");
     const fixArgs = linter.name === "biome" ? [linter.args[0], "check", "--write", tmpFile] : [linter.args[0], "--fix", tmpFile];
     await runCommand(linter.cmd, fixArgs, timeoutMs, cwd, signal);
@@ -251,7 +253,7 @@ async function lintAndFix(content, filePath, linter, timeoutMs, cwd, signal) {
     if (signal.aborted) throw signal.reason;
     return content;
   } finally {
-    await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
+    if (tmpDir) await rm(tmpDir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 function parseLinterOutput(stdout, linterName) {
@@ -505,9 +507,9 @@ ${summary}${truncated}`
       name: "lint-gate",
       stage: "mutate",
       timeoutMs: Math.max(1e3, cfg.timeoutMs + 1e3),
-      // Formatter/linter availability must not create approval or denial
-      // loops in YOLO mode. Explicit lint findings still block in block mode.
-      failurePolicy: "open"
+      // Fail closed: a linter crash or timeout must not let unlinted
+      // content through in block mode (issue #363).
+      failurePolicy: "closed"
     });
     api.tools.register({
       name: "lint_gate_status",
@@ -579,5 +581,6 @@ ${summary}${truncated}`
 };
 var lint_gate_default = plugin;
 export {
-  lint_gate_default as default
+  lint_gate_default as default,
+  resolveLocalLinter
 };

package/dist/llm-cache.js

@@ -82,6 +82,12 @@ var plugin = {
   description: "Caches identical provider requests and short-circuits the provider call on a hit (wrapProviderRunner). Opt-in; deterministic-only by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost, and both dependsOn and optionalDeps load
+  // dependencies first. Declaring prompt-firewall here guarantees the
+  // firewall wraps OUTSIDE this cache even if the manifest order changes —
+  // otherwise a cache hit short-circuits `inner` and bypasses redaction.
+  optionalDeps: ["prompt-firewall"],
   defaultConfig: { ...DEFAULTS },
   configSchema: {
     type: "object",

package/dist/manifest.js

@@ -35,10 +35,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/dist/path-guard/glob.d.ts

@@ -2,6 +2,20 @@ export interface WriteTarget {
     path: string;
     kind: 'file' | 'scope' | 'deletion-scope';
 }
+/** Default wall-clock budget per glob match (ms). Must clear worker spin-up (~20ms). */
+export declare const GLOB_REDOS_BUDGET_MS = 250;
+export interface GuardedMatchOptions {
+    /** Invoked when a match times out — wired to the plugin's redosTimeouts counter. */
+    onTimeout?: (info: {
+        regex: RegExp;
+        input: string;
+        budgetMs: number;
+        elapsedMs: number;
+    }) => void;
+    /** Per-regex wall-clock budget. Default GLOB_REDOS_BUDGET_MS. */
+    budgetMs?: number;
+}
+export declare function matchesAnyGuarded(path: string, patterns: RegExp[], options?: GuardedMatchOptions): Promise<boolean>;
 /**
  * Compile a glob pattern to a RegExp. Supports `**` (any depth),
  * `*` (within one segment), and `?` (single char). Matching is done
@@ -27,6 +41,15 @@ export declare function staticPrefix(pattern: string): string;
 export declare function hasPartialSegmentWildcard(pattern: string): boolean;
 export declare function globWitness(pattern: string): string;
 export declare function scopesMayOverlap(left: string, right: string): boolean;
+export declare function targetIntersectsScope(target: WriteTarget, patternTexts: string[]): boolean;
 export declare function targetIntersectsPatterns(target: WriteTarget, patternTexts: string[], patterns: RegExp[]): boolean;
+/**
+ * ReDoS-guarded variant of `targetIntersectsPatterns` (issue #365 / audit
+ * T-02): the direct path match runs through `matchesAnyGuarded` (worker
+ * watchdog, fail-closed on timeout); scope-overlap logic stays synchronous
+ * because it matches against constructed candidate paths, not the raw
+ * hostile input.
+ */
+export declare function targetIntersectsPatternsGuarded(target: WriteTarget, patternTexts: string[], patterns: RegExp[], options?: GuardedMatchOptions): Promise<boolean>;
 export declare function targetFullyAllowed(target: WriteTarget, allowTexts: string[], allowRes: RegExp[]): boolean;
 //# sourceMappingURL=glob.d.ts.map

package/dist/path-guard/index.d.ts

@@ -7,6 +7,8 @@
 import type { Plugin } from '@wrongstack/core/types';
 export { compilePathGlob } from './glob.js';
 export { destructiveTargets } from './shell-targets.js';
+/** True when `path` is a project-local symlink whose real target escaped. */
+export declare function isSymlinkEscape(path: string, cwd?: string): boolean;
 declare const plugin: Plugin;
 export default plugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/path-guard.js

@@ -1,4 +1,104 @@
+// src/runtime/redos-guard.ts
+import { Worker } from "node:worker_threads";
+function withReDoSGuard(re, input, budgetMs = 50, options = {}) {
+  const opts = { budgetMs, ...options };
+  const start = Date.now();
+  const workerSource = buildWorkerSource(re.source, input, re.flags);
+  const worker = new Worker(workerSource, {
+    eval: true,
+    name: `redos-guard:${re.source.slice(0, 32)}`
+  });
+  return new Promise((resolve3) => {
+    let settled = false;
+    const onMessage = (msg) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      if (!msg.ok) {
+        resolve3({ timedOut: true, match: null });
+        return;
+      }
+      resolve3({ timedOut: false, match: msg.match });
+    };
+    const onError = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      worker.terminate().catch(() => {
+      });
+      resolve3({ timedOut: true, match: null });
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      const elapsedMs = Date.now() - start;
+      worker.terminate().catch(() => {
+      });
+      try {
+        opts.onTimeout?.({
+          regex: re,
+          input,
+          budgetMs: opts.budgetMs,
+          elapsedMs
+        });
+      } catch {
+      }
+      resolve3({ timedOut: true, match: null });
+    }, opts.budgetMs);
+    timer.unref?.();
+    worker.on("message", onMessage);
+    worker.on("error", onError);
+  });
+}
+function buildWorkerSource(source, input, flags) {
+  const S = JSON.stringify(source);
+  const I = JSON.stringify(input);
+  const F = JSON.stringify(flags);
+  return `
+const { parentPort } = require('node:worker_threads');
+const source = ${S};
+const input = ${I};
+const flags = ${F};
+try {
+  const re = new RegExp(source, flags);
+  const match = re.exec(input);
+  // parentPort.postMessage, NOT bare postMessage: with eval:true
+  // workers this Node version does not expose the bare postMessage
+  // global \u2014 the worker throws ReferenceError at startup and the
+  // host misreads it as a timeout (positive-path regression).
+  parentPort.postMessage({ ok: true, match });
+} catch (err) {
+  parentPort.postMessage({ ok: false, error: err && err.message ? err.message : String(err) });
+}
+`;
+}
+
 // src/path-guard/glob.ts
+var GLOB_REDOS_BUDGET_MS = 250;
+function mergeGuardedRegex(patterns) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const p of patterns) {
+    for (const f of p.flags) {
+      if (f !== "g" && f !== "y") flags.add(f);
+    }
+  }
+  const uniqueFlags = [...flags].join("");
+  return new RegExp(patterns.map((p) => p.source).join("|"), uniqueFlags);
+}
+async function matchesAnyGuarded(path, patterns, options = {}) {
+  const normalized = normalizePath(path);
+  if (patterns.length === 0) return false;
+  const result = await withReDoSGuard(
+    mergeGuardedRegex(patterns),
+    normalized,
+    options.budgetMs ?? GLOB_REDOS_BUDGET_MS,
+    options.onTimeout ? { onTimeout: options.onTimeout } : {}
+  );
+  if (result.timedOut) return true;
+  return result.match !== null;
+}
 function compilePathGlob(pattern) {
   const normalized = pattern.replace(/\\/g, "/");
   let source = "";
@@ -89,8 +189,8 @@ function isRootPathScope(path) {
 function isDirectoryAmbiguousPath(path) {
   const normalized = normalizePath(path).replace(/\/$/, "");
   if (isRootPathScope(normalized)) return true;
-  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
-  return path.endsWith("/") || basename.length > 0 && !basename.includes(".");
+  const basename2 = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return path.endsWith("/") || basename2.length > 0 && !basename2.includes(".");
 }
 function hasConfiguredProtectedDescendant(path, patterns) {
   const normalized = normalizePath(path).replace(/\/$/, "").toLowerCase();
@@ -133,8 +233,7 @@ function scopesMayOverlap(left, right) {
   }
   return hasPartialSegmentWildcard(left) && rightPrefix.startsWith(leftPrefix) || hasPartialSegmentWildcard(right) && leftPrefix.startsWith(rightPrefix);
 }
-function targetIntersectsPatterns(target, patternTexts, patterns) {
-  if (matchesAny(target.path, patterns)) return true;
+function targetIntersectsScope(target, patternTexts) {
   if (target.kind === "file") return false;
   const normalized = normalizePath(target.path).replace(/\/$/, "");
   if (!isUnresolvedPathScope(normalized)) {
@@ -146,6 +245,14 @@ function targetIntersectsPatterns(target, patternTexts, patterns) {
   }
   return patternTexts.some((pattern) => scopesMayOverlap(normalized, normalizePath(pattern)));
 }
+function targetIntersectsPatterns(target, patternTexts, patterns) {
+  if (matchesAny(target.path, patterns)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
+async function targetIntersectsPatternsGuarded(target, patternTexts, patterns, options = {}) {
+  if (await matchesAnyGuarded(target.path, patterns, options)) return true;
+  return targetIntersectsScope(target, patternTexts);
+}
 function targetFullyAllowed(target, allowTexts, allowRes) {
   if (target.kind === "file") return matchesAny(target.path, allowRes);
   const normalized = normalizePath(target.path).replace(/\/$/, "");
@@ -462,7 +569,7 @@ function commandRecursivelyDeletes(command) {
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -475,6 +582,8 @@ function commandRecursivelyDeletes(command) {
       if (token === "--") break;
       if (tool === "rm") {
         if (token === "--recursive" || /^-[^-]*[rR]/.test(token)) recursive = true;
+      } else if (tool === "remove-item") {
+        if (/^-Recurse$/i.test(token) || /^-r$/i.test(token)) recursive = true;
       } else if (/^\/[a-z]*s[a-z]*$/i.test(token)) {
         recursive = true;
       }
@@ -723,7 +832,7 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
@@ -1211,8 +1320,52 @@ function operationLabel(toolName) {
 }
 
 // src/path-guard/index.ts
+import { realpathSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// src/runtime/index.ts
+import { basename, extname, isAbsolute, relative, resolve } from "node:path";
+
+// src/runtime/local-bin.ts
+import { buildWin32CmdShimInvocation, resolveWin32Command } from "@wrongstack/tools/win32";
+
+// src/runtime/index.ts
+var MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+function hasLeadingDash(arg) {
+  return arg.length > 0 && arg.startsWith("-");
+}
+function withinProjectPath(projectRoot, candidate) {
+  if (candidate.length === 0 || candidate.length > 4096) return false;
+  if (hasLeadingDash(candidate)) return false;
+  const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(projectRoot, candidate);
+  const rel = relative(projectRoot, resolved);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function withinProject(p) {
+  const cwd = process.cwd();
+  return withinProjectPath(cwd, p) || relative(cwd, p) === ".";
+}
+
+// src/path-guard/index.ts
+function isSymlinkEscape(path, cwd) {
+  if (!withinProject(path)) return false;
+  try {
+    const abs = resolve2(cwd ?? process.cwd(), path);
+    const real = realpathSync(abs);
+    return !withinProject(real);
+  } catch {
+    return false;
+  }
+}
 function createState() {
-  return { invocations: 0, blocks: 0, warns: 0, lastBlock: null, hookUnregister: null };
+  return {
+    invocations: 0,
+    blocks: 0,
+    warns: 0,
+    redosTimeouts: 0,
+    lastBlock: null,
+    hookUnregister: null
+  };
 }
 var states = /* @__PURE__ */ new WeakMap();
 var latestState = createState();
@@ -1307,7 +1460,11 @@ var plugin = {
         additionalContext: `path-guard (warn mode): ${subject} and this ${operation} would modify it. Double-check this is intentional.`
       };
     };
-    const hook = (input) => {
+    const bumpRedos = () => {
+      state.redosTimeouts += 1;
+      api.metrics.counter("redos_timeouts");
+    };
+    const hook = async (input) => {
       if (!cfg.enabled) return;
       state.invocations += 1;
       const toolName = input.toolName ?? "";
@@ -1328,21 +1485,27 @@ var plugin = {
         const effectiveCwd = effectiveToolCwd(ti["cwd"], input.cwd);
         const recursivelyDeletes = commandRecursivelyDeletes(commandForInspection);
         const deletesImplicitScope = commandDeletesImplicitScope(commandForInspection);
-        for (const path of shellTargets) {
-          const target = {
-            path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
-            kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
-          };
-          if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-          const protectedShellTarget = targetIntersectsPatterns(target, cfg.protect, protectRes) || matchesAny(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes);
-          if (protectedShellTarget) {
-            return verdict(
-              target.path,
-              toolName,
-              "destructive shell command",
-              target.kind !== "file"
-            );
-          }
+        const shellHits = await Promise.all(
+          shellTargets.map(async (path) => {
+            const target = {
+              path: relativeToInvocationCwd(resolveTargetPath(path, effectiveCwd), input.cwd),
+              kind: isRootPathScope(path) && deletesImplicitScope || isUnresolvedPathScope(path) || recursivelyDeletes && (isDirectoryAmbiguousPath(path) || hasConfiguredProtectedDescendant(path, cfg.protect)) ? "deletion-scope" : "file"
+            };
+            if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+            const protectedShellTarget = await targetIntersectsPatternsGuarded(target, cfg.protect, protectRes, { onTimeout: bumpRedos }) || await matchesAnyGuarded(`${target.path.replace(/\/$/, "")}/.path-guard-probe`, protectRes, {
+              onTimeout: bumpRedos
+            });
+            return protectedShellTarget ? target : null;
+          })
+        );
+        const firstProtected = shellHits.find((t) => t !== null);
+        if (firstProtected) {
+          return verdict(
+            firstProtected.path,
+            toolName,
+            "destructive shell command",
+            firstProtected.kind !== "file"
+          );
         }
         const writes = writesToDisk({ ...input, toolInput: ti });
         const hasStructuredTarget = [...PATH_FIELDS, ...PATH_LIST_FIELDS].some((field) => ti[field] !== void 0) || typeof ti["patch"] === "string";
@@ -1353,11 +1516,21 @@ var plugin = {
       }
       if (!writesToDisk({ ...input, toolInput: ti }) || isReadOnlyInvocation(toolName, ti)) return;
       const targets = pathsFromToolInput(ti, toolName, input.cwd);
-      for (const target of targets) {
-        if (targetFullyAllowed(target, cfg.allow, allowRes)) continue;
-        if (targetIntersectsPatterns(target, cfg.protect, protectRes)) {
-          return verdict(target.path, toolName, operationLabel(toolName), target.kind !== "file");
-        }
+      const writeHits = await Promise.all(
+        targets.map(async (target) => {
+          if (target.kind === "file" && isSymlinkEscape(target.path, input.cwd)) return target;
+          if (targetFullyAllowed(target, cfg.allow, allowRes)) return null;
+          return targetIntersectsPatterns(target, cfg.protect, protectRes) ? target : null;
+        })
+      );
+      const firstProtectedWrite = writeHits.find((t) => t !== null);
+      if (firstProtectedWrite) {
+        return verdict(
+          firstProtectedWrite.path,
+          toolName,
+          operationLabel(toolName),
+          firstProtectedWrite.kind !== "file"
+        );
       }
       return;
     };
@@ -1384,7 +1557,8 @@ var plugin = {
           counters: {
             invocations: state.invocations,
             blocks: state.blocks,
-            warns: state.warns
+            warns: state.warns,
+            redosTimeouts: state.redosTimeouts
           },
           lastBlock: state.lastBlock
         };
@@ -1407,10 +1581,16 @@ var plugin = {
       }
       state.hookUnregister = null;
     }
-    const final = { invocations: state.invocations, blocks: state.blocks, warns: state.warns };
+    const final = {
+      invocations: state.invocations,
+      blocks: state.blocks,
+      warns: state.warns,
+      redosTimeouts: state.redosTimeouts
+    };
     state.invocations = 0;
     state.blocks = 0;
     state.warns = 0;
+    state.redosTimeouts = 0;
     state.lastBlock = null;
     states.delete(api);
     api.log.info("path-guard: teardown complete", { final });
@@ -1423,7 +1603,8 @@ var plugin = {
       counters: {
         invocations: state.invocations,
         blocks: state.blocks,
-        warns: state.warns
+        warns: state.warns,
+        redosTimeouts: state.redosTimeouts
       }
     };
   }
@@ -1432,5 +1613,6 @@ var path_guard_default = plugin;
 export {
   compilePathGlob,
   path_guard_default as default,
-  destructiveTargets
+  destructiveTargets,
+  isSymlinkEscape
 };

package/dist/plugin-audit-catalog.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/prompt-firewall/index.d.ts

@@ -1,52 +1,61 @@
+import type { Plugin } from '@wrongstack/core/types';
 /**
- * prompt-firewall plugin — inspects and redacts secrets on the provider
- * wire, before context leaves for the LLM API and as it returns.
- *
- * Distinct from `secret-scanner` (which guards the TOOL boundary): this
- * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
- * request that is about to be sent to a third-party LLM provider —
- * regardless of how a secret entered the conversation. It scans the
- * outgoing request's system + message text for high-confidence
- * credential patterns and, depending on `mode`:
- *
- *  - `warn`   — logs + counts + emits a `prompt-firewall:leak`
- *    event; the request goes through unchanged
- *  - `redact` (default) — replaces each match with `[REDACTED:<kind>]` in a CLONE
- *    of the request before sending, and also redacts secrets echoed back
- *    in the response
- *  - `block`  — throws before the request is sent (the agent's error
- *    path surfaces it), so the secret never reaches the provider
- *
- * Safety posture: opt-in — loads inert until
- * `config.extensions['prompt-firewall'].enabled = true`. `redact` is the
- * default so secrets are automatically stripped; switch to `warn` only
- * for detection-mode diagnostics without data loss.
- *
- * Config (`config.extensions['prompt-firewall']`):
- *
- * ```jsonc
- * {
- *   "enabled": false,
- *   "mode": "redact",        // "warn" | "redact" | "block"
- *   "scanResponse": true,     // redact secrets echoed back (redact mode)
- *   "allow": []               // regex source strings to exempt (false positives)
- * }
- * ```
- *
- * Tools:
- *  - `prompt_firewall_status` — mode, pattern names, detection counters
- *
- * @public
+ * Legacy `kind` names for the shapes this plugin already reported, so the
+ * canonical `type` ids from the shared table keep their existing spelling
+ * in logs, metrics and the status tool. Anything not listed here is
+ * reported under its canonical id.
  */
-import type { Plugin } from '@wrongstack/core/types';
+export declare const KIND_ALIASES: Readonly<Record<string, string>>;
 export interface Detection {
     kind: string;
     count: number;
 }
+/**
+ * A pattern excluded from a scan pass. `redos-timeout` = the pattern blew
+ * its wall-clock budget on the guarded probe and was skipped (fail-open
+ * with a visible counter — this surface trades blocking for availability;
+ * `secret-scanner` is the fail-closed tool-side gate).
+ */
+export interface ScanSkip {
+    kind: string;
+    reason: 'redos-timeout';
+}
+/**
+ * Mutable deadline shared across one scan pass. `tripped` collects the
+ * kinds that blew the budget mid-pass; the caller merges them into the
+ * visible skip surface (status + counters + warn log).
+ */
+interface ScanDeadline {
+    deadline: number;
+    tripped: Set<string>;
+}
+/**
+ * Hard bound on any single synchronous regex input in a scan pass. The
+ * structural guarantee of #371: even a growth-loop re-measure never hands
+ * a regex the full unbounded leaf.
+ */
+export declare const SCAN_WINDOW_LIMIT: number;
 /** Detect secret matches in text. Returns per-kind counts (no values). */
 export declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
 /** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
-export declare function redactSecrets(text: string, allow: RegExp[]): {
+export declare function redactSecrets(text: string, allow: RegExp[], deadline?: ScanDeadline): {
+    text: string;
+    redactions: number;
+};
+/**
+ * Detect secret matches, skipping patterns that blow the ReDoS budget on
+ * the guarded probe. The skip set is returned so callers can surface it
+ * (status counters / logs) instead of silently trusting the result.
+ */
+export declare function detectSecretsGuarded(text: string, allow: RegExp[]): Promise<{
+    detections: Detection[];
+    skipped: ScanSkip[];
+}>;
+/**
+ * Redact secret matches, skipping the given timed-out patterns (reuse the
+ * set from `detectSecretsGuarded` so a request pays the probe once).
+ */
+export declare function redactSecretsGuarded(text: string, allow: RegExp[], skip: ReadonlySet<string>, deadline?: ScanDeadline): {
     text: string;
     redactions: number;
 };