@wrongstack/plugins 0.308.0 → 0.308.2

package/dist/manifest.js

@@ -35,10 +35,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",

package/dist/path-guard.js

@@ -562,14 +562,19 @@ function stripLauncherAtBoundary(command, launcher, valueTaking) {
   }
   return `${command.slice(0, match.index)}${boundary}${after.slice(consumed).replace(/^\s+/, "")}`;
 }
+var XARGS_OPTIONS = String.raw`(?:\s+(?:(?:-[InLsPjeE]|--(?:arg-file|replace|max-args|max-lines|max-chars|max-procs))\s+[^\s]+|-[^\s]+))*`;
+var COMMAND_BOUNDARY = String.raw`(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs${XARGS_OPTIONS}\s+)`;
 function commandRecursivelyDeletes(command) {
   const stripped = stripTransparentLaunchers(maskNonExecutingHeredocBodies(command));
-  if (/(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
+  if (/(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b[^;&|)`]*(?:-delete\b|-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)/i.test(
     stripped
   )) {
     return true;
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(rm|rmdir|del|rd|Remove-Item)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let match = destructive.exec(stripped);
   while (match !== null) {
     const tool = match[1]?.toLowerCase();
@@ -786,6 +791,27 @@ ${remainingCommand}`;
   if (heredoc !== null) maskBody(heredoc.bodyStart, lines.length, heredoc.quoted);
   return lines.join("");
 }
+function stripSubshellClosers(raw) {
+  let result = raw.trimEnd();
+  while (result.endsWith(")")) {
+    if (quoteIsEscaped(result, result.length - 1)) break;
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < result.length - 1; index += 1) {
+      const char = result[index];
+      if (isQuoteBoundary(result, index, quote)) {
+        quote = quote === char ? null : char === "'" ? "'" : '"';
+        continue;
+      }
+      if (quote !== null) continue;
+      if (char === "(" && !quoteIsEscaped(result, index)) depth += 1;
+      else if (char === ")" && !quoteIsEscaped(result, index)) depth -= 1;
+    }
+    if (depth > 0) break;
+    result = result.slice(0, -1).trimEnd();
+  }
+  return result;
+}
 function destructiveTargets(command) {
   return destructiveTargetsAtDepth(command, 0);
 }
@@ -832,20 +858,26 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     targets.push(...destructiveTargetsAtDepth(executableBody, depth + 1));
   }
-  const destructive = /(?:^|[;&|\r\n]\s*|\{\s*|(?<![$(])\(\s*|\bxargs(?:\s+-[^\s]+)*\s+)(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)/gi;
+  const destructive = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(rm|rmdir|del|rd|Remove-Item|unlink|truncate|shred|mv)\s+((?:"[^"]*"|'[^']*'|\\.|\{[^}]*\}|\([^()]*\)|[^;&|\r\n}])+)`,
+    "gi"
+  );
   let m = destructive.exec(normalizedCommand);
   while (m !== null) {
     if (!tokenIsQuoted(m, m[1] ?? "")) targets.push(...shellArgs(m[2] ?? ""));
     m = destructive.exec(normalizedCommand);
   }
-  const copy = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)/gi;
+  const copy = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(cp|install)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let c = copy.exec(normalizedCommand);
   while (c !== null) {
     if (tokenIsQuoted(c, c[1] ?? "")) {
       c = copy.exec(normalizedCommand);
       continue;
     }
-    const tokens = shellTokens(c[2] ?? "");
+    const tokens = shellTokens(stripSubshellClosers(c[2] ?? ""));
     let destination;
     for (let index = 0; index < tokens.length; index += 1) {
       const token = tokens[index];
@@ -862,23 +894,32 @@ function destructiveTargetsAtDepth(command, depth) {
     if (destination) targets.push(destination);
     c = copy.exec(normalizedCommand);
   }
-  const tee = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)/gi;
+  const tee = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(tee)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let t = tee.exec(normalizedCommand);
   while (t !== null) {
     if (!tokenIsQuoted(t, t[1] ?? "")) targets.push(...shellArgs(t[2] ?? ""));
     t = tee.exec(normalizedCommand);
   }
-  const dd = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)/gi;
+  const dd = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(dd)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let d = dd.exec(normalizedCommand);
   while (d !== null) {
     if (!tokenIsQuoted(d, d[1] ?? "")) {
       const outputMatch = /(?:^|\s)of=("[^"]*"|'[^']*'|[^\s]+)/i.exec(d[2] ?? "");
-      const output = outputMatch?.[1]?.replace(/^['"]|['"]$/g, "");
+      const output = outputMatch?.[1] ? stripSubshellClosers(outputMatch[1]).replace(/^['"]|['"]$/g, "") : void 0;
       if (output) targets.push(output);
     }
     d = dd.exec(normalizedCommand);
   }
-  const overwrite = /(?:^|[;&|\r\n]\s*)(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)/gi;
+  const overwrite = new RegExp(
+    String.raw`${COMMAND_BOUNDARY}(?:sudo\s+)?(sed|ln)\s+([^;&|\r\n]+)`,
+    "gi"
+  );
   let o = overwrite.exec(normalizedCommand);
   while (o !== null) {
     const rawArgs = o[2] ?? "";
@@ -896,7 +937,10 @@ function destructiveTargetsAtDepth(command, depth) {
     }
     o = overwrite.exec(normalizedCommand);
   }
-  const xargsPipeline = /\b(?:echo|printf)\s+([^|]+)\|\s*xargs(?:\s+-[^\s]+)*\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b/gi;
+  const xargsPipeline = new RegExp(
+    String.raw`\b(?:echo|printf)\s+([^|]+)\|\s*xargs${XARGS_OPTIONS}\s+(?:sudo\s+)?(?:rm|rmdir|del|unlink|truncate|shred)\b`,
+    "gi"
+  );
   let x = xargsPipeline.exec(normalizedCommand);
   while (x !== null) {
     if (!tokenIsQuoted(x, "xargs")) targets.push(...shellArgs(x[1] ?? ""));
@@ -1013,7 +1057,7 @@ function destructiveTargetsAtDepth(command, depth) {
         targets.push(gitTarget("."));
     }
   }
-  const findDelete = /(?:^|[;&|\r\n]\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:\s|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
+  const findDelete = /(?:^|[;&|\r\n]\s*|\{\s*|\$\(\s*|\(\s*|`\s*)find\b([^;&|)`]*(?:\s-delete(?:[\s;})]|$)|\s-exec(?:dir)?\s+(?:[^\s;&|]+[\\/])?(?:rm|rmdir)\b)[^;&|)`]*)/gi;
   let f = findDelete.exec(normalizedCommand);
   while (f !== null) {
     const tokens = shellTokens(f[1] ?? "");
@@ -1471,10 +1515,19 @@ var plugin = {
       const ti = input.toolInput ?? {};
       const command = typeof ti["command"] === "string" ? ti["command"] : "";
       const commandArgs = Array.isArray(ti["args"]) ? ti["args"].filter((arg) => typeof arg === "string") : [];
-      const commandForInspection = [
-        command,
-        ...commandArgs.map((arg) => /^[\w./:@%+=,-]+$/.test(arg) ? arg : JSON.stringify(arg))
-      ].join(" ");
+      const serializeArgForInspection = (arg) => {
+        if (/^[\w./:@%+=,-]+$/.test(arg)) return arg;
+        const assignment = /^([A-Za-z_]\w*)=(.+)$/.exec(arg);
+        const key = assignment?.[1];
+        const value = assignment?.[2];
+        if (key !== void 0 && value !== void 0) {
+          return `${key}="${value.replaceAll('"', "")}"`;
+        }
+        return JSON.stringify(arg);
+      };
+      const commandForInspection = [command, ...commandArgs.map(serializeArgForInspection)].join(
+        " "
+      );
       if (command && executesShell({
         toolName: input.toolName,
         toolInput: ti,

package/dist/plugin-audit-catalog.js

@@ -245,6 +245,13 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "active",
     canDisable: true
   },
+  {
+    name: "prompt-firewall",
+    risk: "high",
+    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
+    defaultState: "inactive",
+    canDisable: true
+  },
   {
     name: "llm-cache",
     risk: "medium",
@@ -266,13 +273,6 @@ var OFFICIAL_PLUGIN_AUDIT_ENTRIES = [
     defaultState: "inactive",
     canDisable: true
   },
-  {
-    name: "prompt-firewall",
-    risk: "high",
-    summary: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
-    defaultState: "inactive",
-    canDisable: true
-  },
   {
     name: "auto-escalate",
     risk: "medium",

package/dist/prompt-firewall/index.d.ts

@@ -1,43 +1,3 @@
-/**
- * prompt-firewall plugin — inspects and redacts secrets on the provider
- * wire, before context leaves for the LLM API and as it returns.
- *
- * Distinct from `secret-scanner` (which guards the TOOL boundary): this
- * sits on `AgentExtension.wrapProviderRunner`, so it sees the FULL
- * request that is about to be sent to a third-party LLM provider —
- * regardless of how a secret entered the conversation. It scans the
- * outgoing request's system + message text for high-confidence
- * credential patterns and, depending on `mode`:
- *
- *  - `warn`   — logs + counts + emits a `prompt-firewall:leak`
- *    event; the request goes through unchanged
- *  - `redact` (default) — replaces each match with `[REDACTED:<kind>]` in a CLONE
- *    of the request before sending, and also redacts secrets echoed back
- *    in the response
- *  - `block`  — throws before the request is sent (the agent's error
- *    path surfaces it), so the secret never reaches the provider
- *
- * Safety posture: opt-in — loads inert until
- * `config.extensions['prompt-firewall'].enabled = true`. `redact` is the
- * default so secrets are automatically stripped; switch to `warn` only
- * for detection-mode diagnostics without data loss.
- *
- * Config (`config.extensions['prompt-firewall']`):
- *
- * ```jsonc
- * {
- *   "enabled": false,
- *   "mode": "redact",        // "warn" | "redact" | "block"
- *   "scanResponse": true,     // redact secrets echoed back (redact mode)
- *   "allow": []               // regex source strings to exempt (false positives)
- * }
- * ```
- *
- * Tools:
- *  - `prompt_firewall_status` — mode, pattern names, detection counters
- *
- * @public
- */
 import type { Plugin } from '@wrongstack/core/types';
 /**
  * Legacy `kind` names for the shapes this plugin already reported, so the
@@ -50,10 +10,52 @@ export interface Detection {
     kind: string;
     count: number;
 }
+/**
+ * A pattern excluded from a scan pass. `redos-timeout` = the pattern blew
+ * its wall-clock budget on the guarded probe and was skipped (fail-open
+ * with a visible counter — this surface trades blocking for availability;
+ * `secret-scanner` is the fail-closed tool-side gate).
+ */
+export interface ScanSkip {
+    kind: string;
+    reason: 'redos-timeout';
+}
+/**
+ * Mutable deadline shared across one scan pass. `tripped` collects the
+ * kinds that blew the budget mid-pass; the caller merges them into the
+ * visible skip surface (status + counters + warn log).
+ */
+interface ScanDeadline {
+    deadline: number;
+    tripped: Set<string>;
+}
+/**
+ * Hard bound on any single synchronous regex input in a scan pass. The
+ * structural guarantee of #371: even a growth-loop re-measure never hands
+ * a regex the full unbounded leaf.
+ */
+export declare const SCAN_WINDOW_LIMIT: number;
 /** Detect secret matches in text. Returns per-kind counts (no values). */
 export declare function detectSecrets(text: string, allow: RegExp[]): Detection[];
 /** Redact secret matches in text, replacing each with `[REDACTED:<kind>]`. */
-export declare function redactSecrets(text: string, allow: RegExp[]): {
+export declare function redactSecrets(text: string, allow: RegExp[], deadline?: ScanDeadline): {
+    text: string;
+    redactions: number;
+};
+/**
+ * Detect secret matches, skipping patterns that blow the ReDoS budget on
+ * the guarded probe. The skip set is returned so callers can surface it
+ * (status counters / logs) instead of silently trusting the result.
+ */
+export declare function detectSecretsGuarded(text: string, allow: RegExp[]): Promise<{
+    detections: Detection[];
+    skipped: ScanSkip[];
+}>;
+/**
+ * Redact secret matches, skipping the given timed-out patterns (reuse the
+ * set from `detectSecretsGuarded` so a request pays the probe once).
+ */
+export declare function redactSecretsGuarded(text: string, allow: RegExp[], skip: ReadonlySet<string>, deadline?: ScanDeadline): {
     text: string;
     redactions: number;
 };

package/dist/prompt-firewall.js

@@ -1,3 +1,6 @@
+// src/prompt-firewall/index.ts
+import { performance } from "node:perf_hooks";
+
 // src/runtime/credential-patterns.ts
 var CREDENTIAL_PATTERNS = [
   // LLM provider keys
@@ -246,32 +249,161 @@ var PATTERNS = [
   })),
   ...EXTRA_PATTERNS
 ];
-function detectSecrets(text, allow) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const p of PATTERNS) {
-    p.re.lastIndex = 0;
-    let m = p.re.exec(text);
+var PATTERN_BUDGET_MS = 250;
+var GUARD_PROBE_LENGTH = 1e5;
+var GUARD_PROBE_OVERLAP = 4096;
+var SCAN_PASS_BUDGET_MS = 250;
+function createScanDeadline() {
+  return { deadline: performance.now() + SCAN_PASS_BUDGET_MS, tripped: /* @__PURE__ */ new Set() };
+}
+var SCAN_WINDOW_STRIDE = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+var SCAN_WINDOW_TAIL = 65536;
+var SCAN_WINDOW_LIMIT = GUARD_PROBE_LENGTH + SCAN_WINDOW_TAIL;
+var SCAN_MAX_GROWTH = 16;
+function growMatch(re, p, text, absStart, deadline) {
+  let size = GUARD_PROBE_LENGTH;
+  for (let grown = 0; grown < SCAN_MAX_GROWTH; grown++) {
+    if (deadline && performance.now() > deadline.deadline) {
+      deadline.tripped.add(p.kind);
+      return null;
+    }
+    const extEnd = Math.min(text.length, absStart + size);
+    const ext = text.slice(absStart, extEnd);
+    re.lastIndex = 0;
+    const em = re.exec(ext);
+    if (!em || em.index !== 0 || em[0].length === 0) return null;
+    const end = absStart + em[0].length;
+    if (end < extEnd || extEnd === text.length) {
+      return { start: absStart, end, matched: em[0] };
+    }
+    size *= 2;
+  }
+  return null;
+}
+function* execWindowed(p, text, deadline) {
+  const re = new RegExp(p.re.source, p.re.flags);
+  let acceptLo = 0;
+  let highWater = 0;
+  for (let window = 0; acceptLo < text.length; window++) {
+    const sliceStart = window === 0 ? 0 : acceptLo - GUARD_PROBE_OVERLAP;
+    const sliceEnd = Math.min(text.length, sliceStart + SCAN_WINDOW_LIMIT);
+    const slice = text.slice(sliceStart, sliceEnd);
+    const acceptHi = Math.min(acceptLo + SCAN_WINDOW_STRIDE, text.length);
+    re.lastIndex = 0;
+    let m = re.exec(slice);
     while (m !== null) {
+      if (deadline && performance.now() > deadline.deadline) {
+        deadline.tripped.add(p.kind);
+        return;
+      }
       const matched = m[0];
-      if (!allow.some((a) => a.test(matched))) {
-        counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+      if (matched.length === 0) {
+        re.lastIndex += 1;
+        m = re.exec(slice);
+        continue;
       }
-      m = p.re.exec(text);
+      const absStart = sliceStart + m.index;
+      const absEnd = absStart + matched.length;
+      if (absStart >= acceptLo && absStart < acceptHi) {
+        let final = { start: absStart, end: absEnd, matched };
+        if (absEnd === sliceEnd && sliceEnd < text.length) {
+          final = growMatch(re, p, text, absStart, deadline) ?? final;
+          re.lastIndex = m.index + final.matched.length;
+        }
+        if (final.start >= highWater) {
+          highWater = Math.max(highWater, final.end);
+          yield final;
+        }
+      }
+      m = re.exec(slice);
+    }
+    acceptLo += SCAN_WINDOW_STRIDE;
+  }
+}
+function countMatches(p, text, allow, counts, deadline) {
+  if (deadline && performance.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return;
+  }
+  for (const m of execWindowed(p, text, deadline)) {
+    if (!allow.some((a) => a.test(m.matched))) {
+      counts.set(p.kind, (counts.get(p.kind) ?? 0) + 1);
+    }
+  }
+}
+function replacePattern(p, text, allow, redactions, deadline) {
+  if (deadline && performance.now() > deadline.deadline) {
+    deadline.tripped.add(p.kind);
+    return text;
+  }
+  let out = "";
+  let copied = 0;
+  for (const m of execWindowed(p, text, deadline)) {
+    out += text.slice(copied, m.start);
+    if (allow.some((a) => a.test(m.matched))) {
+      out += m.matched;
+    } else {
+      redactions.n += 1;
+      out += `[REDACTED:${p.kind}]`;
     }
+    copied = m.end;
   }
+  return out + text.slice(copied);
+}
+function detectSecrets(text, allow) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS) countMatches(p, text, allow, counts);
   return [...counts.entries()].map(([kind, count]) => ({ kind, count }));
 }
-function redactSecrets(text, allow) {
+function redactSecrets(text, allow, deadline) {
+  const redactions = { n: 0 };
   let out = text;
-  let redactions = 0;
-  for (const p of PATTERNS) {
-    out = out.replace(new RegExp(p.re.source, p.re.flags), (match) => {
-      if (allow.some((a) => a.test(match))) return match;
-      redactions += 1;
-      return `[REDACTED:${p.kind}]`;
+  for (const p of PATTERNS) out = replacePattern(p, out, allow, redactions, deadline);
+  return { text: out, redactions: redactions.n };
+}
+var DISTINCT_PATTERN_KINDS = new Set(PATTERNS.map((p) => p.kind)).size;
+async function probeTimedOutPatterns(text) {
+  const timedOut = /* @__PURE__ */ new Set();
+  if (text.length === 0) return timedOut;
+  const probeWindow = (offset) => {
+    const window = text.slice(offset, offset + GUARD_PROBE_LENGTH);
+    const combined = new RegExp(PATTERNS.map((p) => `(${p.re.source})`).join("|"), "gi");
+    return withReDoSGuard(combined, window, PATTERN_BUDGET_MS).then(async (combinedResult) => {
+      if (!combinedResult.timedOut) return;
+      for (const p of PATTERNS) {
+        if (timedOut.has(p.kind)) continue;
+        const result = await withReDoSGuard(p.re, window, PATTERN_BUDGET_MS);
+        if (result.timedOut) timedOut.add(p.kind);
+      }
     });
+  };
+  const stride = GUARD_PROBE_LENGTH - GUARD_PROBE_OVERLAP;
+  for (let offset = 0; offset < text.length; offset += stride) {
+    if (timedOut.size >= DISTINCT_PATTERN_KINDS) break;
+    await probeWindow(offset);
+  }
+  return timedOut;
+}
+async function detectSecretsGuarded(text, allow) {
+  const timedOut = await probeTimedOutPatterns(text);
+  const deadline = createScanDeadline();
+  const counts = /* @__PURE__ */ new Map();
+  for (const p of PATTERNS) {
+    if (!timedOut.has(p.kind)) countMatches(p, text, allow, counts, deadline);
+  }
+  const allSkipped = /* @__PURE__ */ new Set([...timedOut, ...deadline.tripped]);
+  return {
+    detections: [...counts.entries()].map(([kind, count]) => ({ kind, count })),
+    skipped: [...allSkipped].sort().map((kind) => ({ kind, reason: "redos-timeout" }))
+  };
+}
+function redactSecretsGuarded(text, allow, skip, deadline) {
+  const redactions = { n: 0 };
+  let out = text;
+  for (const p of PATTERNS) {
+    if (!skip.has(p.kind)) out = replacePattern(p, out, allow, redactions, deadline);
   }
-  return { text: out, redactions };
+  return { text: out, redactions: redactions.n };
 }
 function collectText(request) {
   const parts = [];
@@ -285,17 +417,27 @@ function collectText(request) {
   walk(request["messages"]);
   return parts.join("\n");
 }
-function redactDeep(value, allow, counter) {
+var RESPONSE_SCAN_BUDGET = 1e6;
+function redactDeep(value, allow, counter, skip, budget, deadline) {
   if (typeof value === "string") {
-    const { text, redactions } = redactSecrets(value, allow);
+    if (budget) {
+      if (value.length > budget.remaining) {
+        budget.remaining = 0;
+        budget.truncated = true;
+        return value;
+      }
+      budget.remaining -= value.length;
+    }
+    const { text, redactions } = skip ? redactSecretsGuarded(value, allow, skip, deadline) : redactSecrets(value, allow, deadline);
     counter.n += redactions;
     return text;
   }
-  if (Array.isArray(value)) return value.map((v) => redactDeep(v, allow, counter));
+  if (Array.isArray(value))
+    return value.map((v) => redactDeep(v, allow, counter, skip, budget, deadline));
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = redactDeep(v, allow, counter);
+      out[k] = redactDeep(v, allow, counter, skip, budget, deadline);
     }
     return out;
   }
@@ -331,16 +473,33 @@ var state = {
   responseRedactions: 0,
   blocked: 0,
   timeoutCount: 0,
+  skippedPatterns: [],
+  responseTruncated: false,
   byKind: /* @__PURE__ */ new Map(),
   lastDetection: null,
   extensionUnregister: null
 };
+function surfaceScanTrips(api, tripped) {
+  for (const kind of tripped) {
+    if (!state.skippedPatterns.includes(kind)) state.skippedPatterns.push(kind);
+  }
+  state.timeoutCount += 1;
+  api.metrics.counter("redos_skips", 1);
+  api.log.warn("prompt-firewall: scan-pass budget exceeded \u2014 patterns skipped mid-pass (issue #370)", {
+    skipped: [...tripped]
+  });
+}
 var plugin = {
   name: "prompt-firewall",
   version: "0.1.0",
   description: "Scans the provider wire for credential leaks before context reaches the LLM API (wrapProviderRunner); redact/warn/block. Opt-in; redact by default.",
   apiVersion: "^0.1.10",
   capabilities: { tools: true },
+  // Wrap-stack contract (issue #362): ExtensionRegistry composes wrappers
+  // first-registered = outermost. The manifest lists this plugin before
+  // llm-cache, and llm-cache declares this plugin in optionalDeps, so the
+  // firewall is the outer wrap: every request is scanned/redacted before
+  // llm-cache can fingerprint or cache it.
   defaultConfig: { enabled: false, mode: "redact", scanResponse: true, allow: [] },
   configSchema: {
     type: "object",
@@ -376,6 +535,8 @@ var plugin = {
     state.responseRedactions = 0;
     state.blocked = 0;
     state.timeoutCount = 0;
+    state.skippedPatterns = [];
+    state.responseTruncated = false;
     state.byKind.clear();
     state.lastDetection = null;
     if (state.extensionUnregister) {
@@ -399,15 +560,16 @@ var plugin = {
           const req = request ?? {};
           state.invocations += 1;
           const requestText = collectText(req);
-          for (const extra of EXTRA_PATTERNS) {
-            const guarded = await withReDoSGuard(extra.re, requestText, 250, {
-              onTimeout: () => {
-                state.timeoutCount += 1;
-              }
+          const { detections, skipped } = await detectSecretsGuarded(requestText, cfg.allow);
+          state.skippedPatterns = skipped.map((s) => s.kind);
+          if (skipped.length > 0) {
+            state.timeoutCount += 1;
+            api.log.warn("prompt-firewall: ReDoS budget exceeded, patterns skipped", {
+              skipped: state.skippedPatterns
             });
-            if (guarded.timedOut) break;
+            api.metrics.counter("redos_skips", 1);
           }
-          const detections = detectSecrets(requestText, cfg.allow);
+          const skipSet = new Set(state.skippedPatterns);
           if (detections.length > 0) {
             state.requestsWithSecrets += 1;
             for (const d of detections) {
@@ -426,27 +588,39 @@ var plugin = {
             }
             if (cfg.mode === "redact") {
               const counter = { n: 0 };
-              const redactedReq = redactDeep(req, cfg.allow, counter);
+              const deadline = createScanDeadline();
+              const redactedReq = redactDeep(req, cfg.allow, counter, skipSet, void 0, deadline);
               state.requestRedactions += counter.n;
               api.metrics.counter("request_redactions", counter.n);
+              if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
               const response2 = await inner(_ctx, redactedReq);
-              return cfg.scanResponse ? redactResponse(response2, cfg.allow) : response2;
+              return cfg.scanResponse ? redactResponse(response2, cfg.allow, skipSet) : response2;
             }
           }
           const response = await inner(_ctx, request);
           if (cfg.mode === "redact" && cfg.scanResponse) {
-            return redactResponse(response, cfg.allow);
+            return redactResponse(response, cfg.allow, skipSet);
           }
           return response;
         }
       });
     }
-    function redactResponse(response, allow) {
+    function redactResponse(response, allow, skip) {
       if (!response || typeof response !== "object") return response;
       const counter = { n: 0 };
       const content = response.content;
       if (content === void 0) return response;
-      const redacted = redactDeep(content, allow, counter);
+      const budget = { remaining: RESPONSE_SCAN_BUDGET, truncated: false };
+      const deadline = createScanDeadline();
+      const redacted = redactDeep(content, allow, counter, skip, budget, deadline);
+      if (deadline.tripped.size > 0) surfaceScanTrips(api, deadline.tripped);
+      if (budget.truncated) {
+        state.responseTruncated = true;
+        api.log.warn(
+          "prompt-firewall: response scan budget exhausted \u2014 part of the response was returned unredacted"
+        );
+        api.metrics.counter("response_scan_truncated", 1);
+      }
       if (counter.n > 0) {
         state.responseRedactions += counter.n;
         api.metrics.counter("response_redactions", counter.n);
@@ -472,6 +646,8 @@ var plugin = {
           mode: cfg.mode,
           scanResponse: cfg.scanResponse,
           patterns: PATTERNS.map((p) => p.kind),
+          skippedPatterns: state.skippedPatterns,
+          responseTruncated: state.responseTruncated,
           counters: {
             invocations: state.invocations,
             requestsWithSecrets: state.requestsWithSecrets,
@@ -505,13 +681,17 @@ var plugin = {
       requestsWithSecrets: state.requestsWithSecrets,
       requestRedactions: state.requestRedactions,
       responseRedactions: state.responseRedactions,
-      blocked: state.blocked
+      blocked: state.blocked,
+      timeoutCount: state.timeoutCount
     };
     state.invocations = 0;
     state.requestsWithSecrets = 0;
     state.requestRedactions = 0;
     state.responseRedactions = 0;
     state.blocked = 0;
+    state.timeoutCount = 0;
+    state.skippedPatterns = [];
+    state.responseTruncated = false;
     state.byKind.clear();
     state.lastDetection = null;
     api.log.info("prompt-firewall: teardown complete", { final });
@@ -533,8 +713,11 @@ var plugin = {
 var prompt_firewall_default = plugin;
 export {
   KIND_ALIASES,
+  SCAN_WINDOW_LIMIT,
   prompt_firewall_default as default,
   detectSecrets,
+  detectSecretsGuarded,
   readConfig,
-  redactSecrets
+  redactSecrets,
+  redactSecretsGuarded
 };

package/dist/spec-linker.js

@@ -55,10 +55,10 @@ var OFFICIAL_PLUGIN_NAMES = [
   "notify-hub",
   "changelog-writer",
   "injection-shield",
+  "prompt-firewall",
   "llm-cache",
   "model-router",
   "pr-drafter",
-  "prompt-firewall",
   "auto-escalate",
   "test-coverage-gate",
   "type-gate",