actoviq-agent-sdk 0.4.21 → 0.4.22

package/dist/src/extensions/builtInExtensions.js

@@ -0,0 +1,218 @@
+/**
+ * Built-in extension framework (Hadamard-owned): a fixed catalog of
+ * settings-toggleable extensions, state resolution from
+ * `~/.hadamard/settings.json` (`extensions.<id>`) with SDK overrides, a
+ * validated settings patcher, and a mutable toggle holder captured by runtime
+ * contributions so `/extensions` toggling takes effect without rebuilding the
+ * tool-policy pipeline.
+ *
+ * @module src/extensions/builtInExtensions
+ */
+import { resolveHadamardSettingsStore, persistHadamardSettingsStore } from '../config/hadamardSettingsStore.js';
+import { isRecord } from '../runtime/helpers.js';
+/**
+ * Fixed catalog. `security`/`filterOutput` are runtime tool-policy extensions
+ * (opt-in, hard-deny/redact semantics); `costTracker`/`usageBar`/`notifications`
+ * are default-on session/UI extensions wired into the TUI and GUI.
+ */
+export const BUILT_IN_EXTENSIONS = [
+    {
+        id: 'security',
+        title: 'Security Guard',
+        description: 'Denies catastrophic shell commands and writes to protected paths before the permission stage.',
+        defaultEnabled: false,
+        kind: 'policy',
+        configurableKeys: ['protectedPaths', 'extraDangerousPatterns'],
+    },
+    {
+        id: 'filterOutput',
+        title: 'Output Filter',
+        description: 'Redacts secrets and credentials from tool results before they reach the model.',
+        defaultEnabled: false,
+        kind: 'policy',
+        configurableKeys: ['extraPatterns', 'maxChars'],
+    },
+    {
+        id: 'costTracker',
+        title: 'Cost Tracker',
+        description: 'Tracks per-session token usage and cost.',
+        defaultEnabled: true,
+        kind: 'session',
+        configurableKeys: [],
+    },
+    {
+        id: 'usageBar',
+        title: 'Usage Bar',
+        description: 'Shows live context/token usage in interactive surfaces.',
+        defaultEnabled: true,
+        kind: 'ui',
+        configurableKeys: [],
+    },
+    {
+        id: 'notifications',
+        title: 'Notifications',
+        description: 'Surfaces run and background-task notifications.',
+        defaultEnabled: true,
+        kind: 'ui',
+        configurableKeys: ['bell', 'osc'],
+    },
+];
+export function getBuiltInExtensionDefinition(id) {
+    return BUILT_IN_EXTENSIONS.find((definition) => definition.id === id);
+}
+const STRING_ARRAY_KEYS = new Set(['protectedPaths', 'extraDangerousPatterns', 'extraPatterns']);
+const BOOLEAN_KEYS = new Set(['bell', 'osc']);
+function isValidConfigValue(key, value) {
+    if (STRING_ARRAY_KEYS.has(key)) {
+        return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+    }
+    if (BOOLEAN_KEYS.has(key)) {
+        return typeof value === 'boolean';
+    }
+    if (key === 'maxChars') {
+        return typeof value === 'number' && Number.isFinite(value) && value >= 0;
+    }
+    return false;
+}
+/**
+ * Resolve the effective state of every built-in extension from raw settings
+ * (`extensions.<id>` entries) plus SDK overrides. Unknown ids are ignored;
+ * invalid shapes fall back to catalog defaults; SDK overrides win and accept a
+ * boolean shorthand or `{ enabled, ...config }`.
+ */
+export function resolveBuiltInExtensionStates(settingsRaw, overrides) {
+    const stored = isRecord(settingsRaw) && isRecord(settingsRaw.extensions) ? settingsRaw.extensions : {};
+    return BUILT_IN_EXTENSIONS.map((definition) => {
+        let enabled = definition.defaultEnabled;
+        let config = {};
+        const storedEntry = stored[definition.id];
+        if (isRecord(storedEntry)) {
+            if (typeof storedEntry.enabled === 'boolean')
+                enabled = storedEntry.enabled;
+            config = pickValidConfig(definition, storedEntry);
+        }
+        const override = overrides?.[definition.id];
+        if (typeof override === 'boolean') {
+            enabled = override;
+        }
+        else if (isRecord(override)) {
+            if (typeof override.enabled === 'boolean')
+                enabled = override.enabled;
+            config = { ...config, ...pickValidConfig(definition, override) };
+        }
+        return { id: definition.id, enabled, config };
+    });
+}
+function pickValidConfig(definition, source) {
+    const config = {};
+    for (const key of definition.configurableKeys) {
+        const value = source[key];
+        if (value !== undefined && isValidConfigValue(key, value)) {
+            config[key] = Array.isArray(value) ? [...value] : value;
+        }
+    }
+    return config;
+}
+/**
+ * Validated patch of the persisted `extensions.<id>` subtree: unknown stored
+ * keys are preserved, invalid patch values throw (mirroring
+ * patchManagedPluginSettings strictness). Persists the full settings store.
+ */
+export async function patchBuiltInExtensionSettings(homeDir, id, patch) {
+    const definition = getBuiltInExtensionDefinition(id);
+    if (!definition) {
+        throw new Error(`Unknown built-in extension: ${id}`);
+    }
+    const validated = {};
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined)
+            continue;
+        if (key === 'enabled') {
+            if (typeof value !== 'boolean') {
+                throw new Error(`extensions.${id}.enabled must be a boolean.`);
+            }
+            validated.enabled = value;
+            continue;
+        }
+        if (!definition.configurableKeys.includes(key)) {
+            throw new Error(`Unknown config key for built-in extension '${id}': ${key}`);
+        }
+        if (!isValidConfigValue(key, value)) {
+            const expected = STRING_ARRAY_KEYS.has(key)
+                ? 'a string array'
+                : BOOLEAN_KEYS.has(key)
+                    ? 'a boolean'
+                    : 'a number >= 0';
+            throw new Error(`extensions.${id}.${key} must be ${expected}.`);
+        }
+        validated[key] = Array.isArray(value) ? [...new Set(value)] : value;
+    }
+    const store = await resolveHadamardSettingsStore({ homeDir });
+    const raw = store.raw;
+    const extensions = isRecord(raw.extensions) ? { ...raw.extensions } : {};
+    const existing = isRecord(extensions[id]) ? extensions[id] : {};
+    extensions[id] = { ...existing, ...validated };
+    raw.extensions = extensions;
+    await persistHadamardSettingsStore(store.configPath, raw);
+}
+export function createBuiltInExtensionsApi(toggles, homeDir) {
+    return {
+        list: () => toggles.snapshot(),
+        isEnabled: (id) => toggles.isEnabled(id),
+        getConfig: (id) => toggles.getConfig(id),
+        setEnabled: async (id, enabled) => {
+            const previous = toggles.isEnabled(id);
+            toggles.setEnabled(id, enabled);
+            try {
+                await patchBuiltInExtensionSettings(homeDir, id, { enabled });
+            }
+            catch (error) {
+                toggles.setEnabled(id, previous);
+                throw error;
+            }
+        },
+    };
+}
+/**
+ * Mutable per-client holder resolved once at create(); contributions capture
+ * it so toggling an extension later takes effect on the next run without
+ * rebuilding the pipeline.
+ */
+export class BuiltInExtensionToggles {
+    states = new Map();
+    constructor(states) {
+        for (const state of states) {
+            this.states.set(state.id, { enabled: state.enabled, config: { ...state.config } });
+        }
+    }
+    isEnabled(id) {
+        const state = this.states.get(id);
+        if (state)
+            return state.enabled;
+        return getBuiltInExtensionDefinition(id)?.defaultEnabled ?? false;
+    }
+    getConfig(id) {
+        return (this.states.get(id)?.config ?? {});
+    }
+    setEnabled(id, enabled) {
+        const state = this.states.get(id);
+        if (!state) {
+            if (!getBuiltInExtensionDefinition(id))
+                throw new Error(`Unknown built-in extension: ${id}`);
+            this.states.set(id, { enabled, config: {} });
+            return;
+        }
+        state.enabled = enabled;
+    }
+    snapshot() {
+        return BUILT_IN_EXTENSIONS.map((definition) => {
+            const state = this.states.get(definition.id);
+            return {
+                id: definition.id,
+                enabled: state?.enabled ?? definition.defaultEnabled,
+                config: { ...(state?.config ?? {}) },
+            };
+        });
+    }
+}
+//# sourceMappingURL=builtInExtensions.js.map

package/dist/src/extensions/builtInExtensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtInExtensions.js","sourceRoot":"","sources":["../../../src/extensions/builtInExtensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAChH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAoBjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0C;IACxE;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,+FAA+F;QAC5G,cAAc,EAAE,KAAK;QACrB,IAAI,EAAE,QAAQ;QACd,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;KAC/D;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,gFAAgF;QAC7F,cAAc,EAAE,KAAK;QACrB,IAAI,EAAE,QAAQ;QACd,gBAAgB,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KAChD;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,0CAA0C;QACvD,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE,SAAS;QACf,gBAAgB,EAAE,EAAE;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,yDAAyD;QACtE,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,EAAE;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,iDAAiD;QAC9D,cAAc,EAAE,IAAI;QACpB,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;KAClC;CACO,CAAC;AAEX,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC,CAAC;AACjG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9C,SAAS,kBAAkB,CAAC,GAAW,EAAE,KAAc;IACrD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;IACpC,CAAC;IACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAuD,EACvD,SAAuF;IAEvF,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC5C,IAAI,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;QACxC,IAAI,MAAM,GAA4B,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;YAC5E,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACtE,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,UAAsC,EACtC,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAe,EACf,EAAU,EACV,KAAsD;IAEtD,MAAM,UAAU,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;YACjE,CAAC;YACD,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBACrB,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,eAAe,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,GAAG,YAAY,QAAQ,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC;IAC/C,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,MAAM,4BAA4B,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAUD,MAAM,UAAU,0BAA0B,CACxC,OAAgC,EAChC,OAAe;IAEf,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;QAC9B,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,6BAA6B,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IACjB,MAAM,GAAG,IAAI,GAAG,EAAiE,CAAC;IAEnG,YAAY,MAAwC;QAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,SAAS,CAAC,EAAU;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,6BAA6B,CAAC,EAAE,CAAC,EAAE,cAAc,IAAI,KAAK,CAAC;IACpE,CAAC;IAED,SAAS,CAA8B,EAAU;QAC/C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,EAAE,CAAM,CAAC;IAClD,CAAC;IAED,UAAU,CAAC,EAAU,EAAE,OAAgB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,QAAQ;QACN,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,UAAU,CAAC,cAAc;gBACpD,MAAM,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE;aACrC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/src/extensions/filterOutputPolicy.d.ts

@@ -0,0 +1,21 @@
+import type { HadamardRuntimeContribution } from '../contrib/contributionHost.js';
+import { type ToolPostPolicyListener } from '../runtime/toolPolicyPipeline.js';
+import type { BuiltInExtensionToggles } from './builtInExtensions.js';
+/**
+ * Redact known secret shapes from `text`. `extraPatterns` are user regex
+ * strings (compiled with `g`; invalid ones skipped) whose whole match is
+ * replaced with `[REDACTED:custom]`.
+ */
+export declare function redactSensitiveText(text: string, extraPatterns?: readonly string[]): string;
+/** Hard-truncate to `maxChars` (when > 0), marking the cut. */
+export declare function truncateText(text: string, maxChars: number): string;
+export interface FilterOutputExtensionConfig {
+    extraPatterns?: string[];
+    /** 0 (default) disables truncation; the upstream spill listener still artifacts huge outputs. */
+    maxChars?: number;
+}
+/** Post-listener: redacts and truncates accepted results (success and error). No-op when disabled. */
+export declare function createFilterOutputPostListener(toggles: BuiltInExtensionToggles): ToolPostPolicyListener;
+/** Contribution: attaches the filter-output post-listener to the tool-policy listener registry. */
+export declare function createFilterOutputPolicyContribution(toggles: BuiltInExtensionToggles): HadamardRuntimeContribution;
+//# sourceMappingURL=filterOutputPolicy.d.ts.map

package/dist/src/extensions/filterOutputPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterOutputPolicy.d.ts","sourceRoot":"","sources":["../../../src/extensions/filterOutputPolicy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA4B,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC5G,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAgDtE;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA0B3F;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,uBAAuB,GAAG,sBAAsB,CAgBvG;AAED,mGAAmG;AACnG,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,uBAAuB,GAAG,2BAA2B,CAWlH"}

package/dist/src/extensions/filterOutputPolicy.js

@@ -0,0 +1,121 @@
+import { toolPolicyListenerRegistryKey, } from '../runtime/toolPolicyPipeline.js';
+const REDACTION_RULES = [
+    // PEM private keys (multi-line; runs first so inner assignments are consumed).
+    {
+        label: 'private-key',
+        pattern: /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    { label: 'aws-access-key', pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { label: 'github-token', pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}\b/g },
+    { label: 'github-token', pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/g },
+    // OpenAI/Anthropic-style API keys (sk-ant-... included).
+    { label: 'api-key', pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    // Bearer tokens: keep the scheme, redact the token.
+    { label: 'bearer-token', pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{20,}/g, keepPrefix: true },
+    // Generic secret assignments: keep `key=` prefix, redact the value.
+    {
+        label: 'secret',
+        pattern: /\b(password|passwd|pwd|api[_-]?key|apikey|secret|access[_-]?token|auth[_-]?token)\b(\s*[:=]\s*['"]?)([^\s'"]{8,})/gi,
+        keepPrefix: true,
+        labelFromMatch: true,
+    },
+];
+function compileExtraPatterns(extraPatterns) {
+    const compiled = [];
+    for (const source of extraPatterns ?? []) {
+        if (typeof source !== 'string' || !source)
+            continue;
+        try {
+            compiled.push(new RegExp(source, 'g'));
+        }
+        catch {
+            // Invalid user regex: skip rather than break tool results.
+        }
+    }
+    return compiled;
+}
+/**
+ * Redact known secret shapes from `text`. `extraPatterns` are user regex
+ * strings (compiled with `g`; invalid ones skipped) whose whole match is
+ * replaced with `[REDACTED:custom]`.
+ */
+export function redactSensitiveText(text, extraPatterns) {
+    let redacted = text;
+    for (const rule of REDACTION_RULES) {
+        redacted = redacted.replace(rule.pattern, (...args) => {
+            const match = args[0];
+            const groups = args.slice(1, -2);
+            if (rule.labelFromMatch) {
+                const key = groups[0] ?? 'secret';
+                const separator = groups[1] ?? '';
+                const value = groups[2] ?? '';
+                if (value.startsWith('[REDACTED:'))
+                    return match;
+                return `${key}${separator}[REDACTED:${key.toLowerCase()}]`;
+            }
+            if (rule.keepPrefix) {
+                const prefix = groups[0] ?? '';
+                const value = match.slice(prefix.length);
+                if (value.startsWith('[REDACTED:'))
+                    return match;
+                return `${prefix}[REDACTED:${rule.label}]`;
+            }
+            return `[REDACTED:${rule.label}]`;
+        });
+    }
+    for (const pattern of compileExtraPatterns(extraPatterns)) {
+        redacted = redacted.replace(pattern, '[REDACTED:custom]');
+    }
+    return redacted;
+}
+/** Hard-truncate to `maxChars` (when > 0), marking the cut. */
+export function truncateText(text, maxChars) {
+    if (!Number.isFinite(maxChars) || maxChars <= 0 || text.length <= maxChars)
+        return text;
+    return `${text.slice(0, maxChars)}\n… [truncated by filter-output extension]`;
+}
+function transformContent(content, transform) {
+    if (typeof content === 'string')
+        return transform(content);
+    if (Array.isArray(content)) {
+        return content.map((block) => block && typeof block === 'object' && block.type === 'text' && typeof block.text === 'string'
+            ? { ...block, text: transform(block.text) }
+            : block);
+    }
+    return content;
+}
+/** Post-listener: redacts and truncates accepted results (success and error). No-op when disabled. */
+export function createFilterOutputPostListener(toggles) {
+    return async (_call, _execution, next) => {
+        if (!toggles.isEnabled('filterOutput'))
+            return next();
+        const config = toggles.getConfig('filterOutput');
+        const maxChars = typeof config.maxChars === 'number' ? config.maxChars : 0;
+        const transform = (text) => truncateText(redactSensitiveText(text, config.extraPatterns), maxChars);
+        const inner = await next();
+        if (inner.kind !== 'accept')
+            return inner;
+        return {
+            kind: 'accept',
+            ...(inner.content !== undefined ? { content: transformContent(inner.content, transform) } : {}),
+            ...(inner.additionalContexts !== undefined
+                ? { additionalContexts: inner.additionalContexts.map((entry) => ({ ...entry, text: transform(entry.text) })) }
+                : {}),
+        };
+    };
+}
+/** Contribution: attaches the filter-output post-listener to the tool-policy listener registry. */
+export function createFilterOutputPolicyContribution(toggles) {
+    return {
+        id: 'hadamard.ext.filter-output',
+        apply(ctx) {
+            const registry = ctx.services.get(toolPolicyListenerRegistryKey);
+            if (!registry)
+                return;
+            const listener = createFilterOutputPostListener(toggles);
+            registry.addPost(listener);
+            return () => { registry.removePost(listener); };
+        },
+    };
+}
+//# sourceMappingURL=filterOutputPolicy.js.map

package/dist/src/extensions/filterOutputPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterOutputPolicy.js","sourceRoot":"","sources":["../../../src/extensions/filterOutputPolicy.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,6BAA6B,GAE9B,MAAM,kCAAkC,CAAC;AAY1C,MAAM,eAAe,GAA6B;IAChD,+EAA+E;IAC/E;QACE,KAAK,EAAE,aAAa;QACpB,OAAO,EACL,2IAA2I;KAC9I;IACD,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE;IACtE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACnF,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACvE,yDAAyD;IACzD,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC3D,oDAAoD;IACpD,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7F,oEAAoE;IACpE;QACE,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,qHAAqH;QACvH,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,SAAS,oBAAoB,CAAC,aAAiC;IAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM;YAAE,SAAS;QACpD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAiC;IACjF,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAA8B,CAAC;YAC9D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;gBAClC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjD,OAAO,GAAG,GAAG,GAAG,SAAS,aAAa,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC;YAC7D,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjD,OAAO,GAAG,MAAM,aAAa,IAAI,CAAC,KAAK,GAAG,CAAC;YAC7C,CAAC;YACD,OAAO,aAAa,IAAI,CAAC,KAAK,GAAG,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,4CAA4C,CAAC;AAChF,CAAC;AAQD,SAAS,gBAAgB,CACvB,OAAwC,EACxC,SAAmC;IAEnC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;YACnH,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,CAAE,KAA0B,CAAC,IAAI,CAAC,EAAE;YACjE,CAAC,CAAC,KAAK,CACV,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,8BAA8B,CAAC,OAAgC;IAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAA8B,cAAc,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpH,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,oCAAoC,CAAC,OAAgC;IACnF,OAAO;QACL,EAAE,EAAE,4BAA4B;QAChC,KAAK,CAAC,GAA6B;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACzD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/extensions/securityPolicy.d.ts

@@ -0,0 +1,27 @@
+import type { HadamardRuntimeContribution } from '../contrib/contributionHost.js';
+import { type ToolPrePolicyListener } from '../runtime/toolPolicyPipeline.js';
+import type { BuiltInExtensionToggles } from './builtInExtensions.js';
+/** Default protected paths; extend via settings `extensions.security.protectedPaths`. */
+export declare const DEFAULT_PROTECTED_PATHS: readonly string[];
+/**
+ * Return a human-readable violation when the command matches the hard-deny
+ * list, else null. `extraPatterns` are user regex strings (compiled
+ * case-insensitive; invalid ones are skipped).
+ */
+export declare function findDangerousCommandViolation(command: string, extraPatterns?: readonly string[]): string | null;
+/**
+ * Return a human-readable violation when `candidatePath` (relative or
+ * absolute, resolved against `workDir`) hits one of `protectedPaths`, else
+ * null. Entries ending in `/` are directory prefixes; `*`/`?` act as globs
+ * matched against the relative path and the basename.
+ */
+export declare function findProtectedPathViolation(candidatePath: string, workDir: string, protectedPaths: readonly string[]): string | null;
+export interface SecurityExtensionConfig {
+    protectedPaths?: string[];
+    extraDangerousPatterns?: string[];
+}
+/** Pre-listener: dangerous shell commands and protected-path writes. No-op when disabled. */
+export declare function createSecurityPreListener(toggles: BuiltInExtensionToggles): ToolPrePolicyListener;
+/** Contribution: attaches the security pre-listener to the tool-policy listener registry. */
+export declare function createSecurityPolicyContribution(toggles: BuiltInExtensionToggles): HadamardRuntimeContribution;
+//# sourceMappingURL=securityPolicy.d.ts.map

package/dist/src/extensions/securityPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityPolicy.d.ts","sourceRoot":"","sources":["../../../src/extensions/securityPolicy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA4B,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE5G,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAiD,CAAC;AAgFvG;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAiB/G;AAmCD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,MAAM,GAAG,IAAI,CAYf;AAiBD,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC;AASD,6FAA6F;AAC7F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,uBAAuB,GAAG,qBAAqB,CAgCjG;AAED,6FAA6F;AAC7F,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,uBAAuB,GAAG,2BAA2B,CAW9G"}

package/dist/src/extensions/securityPolicy.js

@@ -0,0 +1,238 @@
+/**
+ * Security Guard built-in extension (Hadamard-owned, pi-agent style): an
+ * opt-in PRE tool-policy listener that hard-denies catastrophic shell
+ * commands and writes to protected paths before the permission stage. Because
+ * the pipeline pre-stage is monotonic, this listener can only tighten, never
+ * widen, existing behavior.
+ *
+ * @module src/extensions/securityPolicy
+ */
+import path from 'node:path';
+import { isRecord } from '../runtime/helpers.js';
+import { toolPolicyListenerRegistryKey, } from '../runtime/toolPolicyPipeline.js';
+/** Default protected paths; extend via settings `extensions.security.protectedPaths`. */
+export const DEFAULT_PROTECTED_PATHS = ['.env', '.env.*', '.git/', 'node_modules/'];
+/** Input fields carrying a file path on mutating tools (Write/Edit/NotebookEdit/MultiEdit). */
+const FILE_PATH_FIELDS = ['file_path', 'filePath', 'notebook_path', 'path'];
+/**
+ * Catastrophic-command patterns. `git clean -fdx` / `git reset --hard` are
+ * deliberately NOT here: they are common recovery operations owned by the
+ * permission-rule machinery, not by this hard-deny list.
+ */
+const DANGEROUS_COMMAND_PATTERNS = [
+    // mkfs.* formats a filesystem.
+    { pattern: /\bmkfs(?:\.[a-z0-9]+)?\b/i, label: 'filesystem format (mkfs)' },
+    // dd writing to a block device.
+    { pattern: /\bdd\b[^;&|]*\bof=\/dev\//i, label: 'dd writing to a device' },
+    // Classic fork bomb: :(){ :|:& };:
+    { pattern: /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, label: 'fork bomb' },
+    // OS shutdown/reboot (not followed by a script-ish suffix like shutdown.sh).
+    { pattern: /\b(?:shutdown|reboot|halt|poweroff)\b(?![\w.-])/i, label: 'system power command' },
+    // Windows system-drive destruction.
+    { pattern: /\bformat\s+(?:\/[a-z]+\s+)*[a-z]:/i, label: 'drive format' },
+    { pattern: /\bdiskpart\b/i, label: 'disk partitioning (diskpart)' },
+    { pattern: /\bbcdedit\b/i, label: 'boot configuration edit (bcdedit)' },
+    { pattern: /\b(?:del|erase|rd|rmdir)\s+(?:\/[a-z]+\s+)*[a-z]:\\(?:\s|$)/i, label: 'system-drive recursive delete' },
+    // Shell redirection overwriting a block device.
+    { pattern: />{1,2}\s*\/dev\/(?:sd[a-z]|hd[a-z]|nvme\d+n\d+|xvd[a-z])\b/, label: 'write to block device' },
+];
+/** `rm` targets that are unambiguously catastrophic when combined with -rf. */
+function isCatastrophicRmTarget(target) {
+    const stripped = target.replace(/["']/g, '');
+    if (stripped === '*' || stripped === '/*')
+        return true;
+    const normalized = stripped.replace(/[/\\]+$/, '') || '/';
+    return (normalized === '/' ||
+        normalized === '~' ||
+        normalized.startsWith('~/') ||
+        normalized === '$HOME' ||
+        normalized === '${HOME}' ||
+        normalized.startsWith('$HOME/') ||
+        normalized.startsWith('${HOME}/'));
+}
+/** Tokenize each `rm ...` segment; deny only recursive+force against root/home/wildcard targets. */
+function findRmRfViolation(command) {
+    const segments = command.match(/\brm\b[^;&|()]*/g) ?? [];
+    for (const segment of segments) {
+        const tokens = segment.split(/\s+/).filter(Boolean).slice(1);
+        let recursive = false;
+        let force = false;
+        const targets = [];
+        for (const token of tokens) {
+            if (token === '--')
+                continue;
+            if (token.startsWith('-')) {
+                if (token === '--recursive')
+                    recursive = true;
+                else if (token === '--force')
+                    force = true;
+                else if (/^-[a-zA-Z]+$/.test(token)) {
+                    if (/r/i.test(token))
+                        recursive = true;
+                    if (/f/i.test(token))
+                        force = true;
+                }
+                continue;
+            }
+            targets.push(token);
+        }
+        if (!recursive || !force)
+            continue;
+        for (const target of targets) {
+            if (isCatastrophicRmTarget(target)) {
+                return `recursive forced delete of '${target}'`;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Return a human-readable violation when the command matches the hard-deny
+ * list, else null. `extraPatterns` are user regex strings (compiled
+ * case-insensitive; invalid ones are skipped).
+ */
+export function findDangerousCommandViolation(command, extraPatterns) {
+    const rmViolation = findRmRfViolation(command);
+    if (rmViolation)
+        return rmViolation;
+    for (const { pattern, label } of DANGEROUS_COMMAND_PATTERNS) {
+        if (pattern.test(command))
+            return label;
+    }
+    for (const source of extraPatterns ?? []) {
+        if (typeof source !== 'string' || !source)
+            continue;
+        let pattern;
+        try {
+            pattern = new RegExp(source, 'i');
+        }
+        catch {
+            continue;
+        }
+        if (pattern.test(command))
+            return `custom dangerous pattern /${source}/i`;
+    }
+    return null;
+}
+function toPosix(value) {
+    return value.split(path.sep).join('/');
+}
+function globToRegExp(glob) {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.');
+    return new RegExp(`^${escaped}$`, 'i');
+}
+function matchesProtectedEntry(candidateAbs, workDir, entry) {
+    const isDirectory = entry.endsWith('/');
+    const cleanEntry = isDirectory ? entry.slice(0, -1) : entry;
+    if (!cleanEntry)
+        return false;
+    const candidatePosix = toPosix(path.resolve(candidateAbs));
+    if (path.isAbsolute(cleanEntry) || /^[a-z]:/i.test(cleanEntry)) {
+        const entryAbs = toPosix(path.resolve(cleanEntry));
+        return isDirectory
+            ? candidatePosix === entryAbs || candidatePosix.startsWith(`${entryAbs}/`)
+            : candidatePosix === entryAbs;
+    }
+    const relative = toPosix(path.relative(workDir, candidateAbs));
+    if (/[*?]/.test(cleanEntry)) {
+        const pattern = globToRegExp(cleanEntry);
+        return pattern.test(relative) || pattern.test(path.basename(candidateAbs));
+    }
+    if (isDirectory) {
+        // Directory prefix: any matching path segment (covers nested .git/, node_modules/).
+        if (relative === cleanEntry || relative.startsWith(`${cleanEntry}/`))
+            return true;
+        return relative.split('/').includes(cleanEntry);
+    }
+    return relative === cleanEntry || path.basename(candidateAbs) === cleanEntry;
+}
+/**
+ * Return a human-readable violation when `candidatePath` (relative or
+ * absolute, resolved against `workDir`) hits one of `protectedPaths`, else
+ * null. Entries ending in `/` are directory prefixes; `*`/`?` act as globs
+ * matched against the relative path and the basename.
+ */
+export function findProtectedPathViolation(candidatePath, workDir, protectedPaths) {
+    const trimmed = candidatePath.trim().replace(/["']+$/, '').replace(/^["']+/, '');
+    if (!trimmed)
+        return null;
+    const resolved = path.isAbsolute(trimmed) || /^[a-z]:/i.test(trimmed)
+        ? path.resolve(trimmed)
+        : path.resolve(workDir, trimmed);
+    for (const entry of protectedPaths) {
+        if (typeof entry === 'string' && entry.trim() && matchesProtectedEntry(resolved, path.resolve(workDir), entry.trim())) {
+            return `protected path '${entry.trim()}'`;
+        }
+    }
+    return null;
+}
+/** Best-effort scan for `>`/`>>` redirections into protected paths. */
+function findProtectedRedirectionViolation(command, workDir, protectedPaths) {
+    const matches = command.match(/>{1,2}\s*[^\s;&|]+/g) ?? [];
+    for (const match of matches) {
+        const target = match.replace(/>{1,2}\s*/, '');
+        const violation = findProtectedPathViolation(target, workDir, protectedPaths);
+        if (violation)
+            return `shell redirection into ${violation}`;
+    }
+    return null;
+}
+function deny(state, detail) {
+    state.behavior = 'deny';
+    state.reason =
+        `[security extension] Blocked ${detail}. ` +
+            'Disable via /extensions security off or settings extensions.security.enabled=false.';
+}
+/** Pre-listener: dangerous shell commands and protected-path writes. No-op when disabled. */
+export function createSecurityPreListener(toggles) {
+    return async (call, state) => {
+        if (state.behavior === 'deny')
+            return;
+        if (!toggles.isEnabled('security'))
+            return;
+        const config = toggles.getConfig('security');
+        const protectedPaths = [...DEFAULT_PROTECTED_PATHS, ...(config.protectedPaths ?? [])];
+        const input = isRecord(call.input) ? call.input : {};
+        // Any tool whose input carries a shell command string (Bash, PowerShell, ...).
+        if (typeof input.command === 'string') {
+            const commandViolation = findDangerousCommandViolation(input.command, config.extraDangerousPatterns);
+            if (commandViolation) {
+                deny(state, `dangerous shell command: ${commandViolation}`);
+                return;
+            }
+            const redirectionViolation = findProtectedRedirectionViolation(input.command, call.workDir, protectedPaths);
+            if (redirectionViolation) {
+                deny(state, redirectionViolation);
+                return;
+            }
+        }
+        // File-path inputs on mutating tools; read-only tools (Read, Grep) pass.
+        if (call.adapter.isReadOnly?.(call.input) === true)
+            return;
+        for (const field of FILE_PATH_FIELDS) {
+            const value = input[field];
+            if (typeof value !== 'string' || !value.trim())
+                continue;
+            const pathViolation = findProtectedPathViolation(value, call.workDir, protectedPaths);
+            if (pathViolation) {
+                deny(state, `write to ${pathViolation}`);
+                return;
+            }
+        }
+    };
+}
+/** Contribution: attaches the security pre-listener to the tool-policy listener registry. */
+export function createSecurityPolicyContribution(toggles) {
+    return {
+        id: 'hadamard.ext.security',
+        apply(ctx) {
+            const registry = ctx.services.get(toolPolicyListenerRegistryKey);
+            if (!registry)
+                return;
+            const listener = createSecurityPreListener(toggles);
+            registry.addPre(listener);
+            return () => { registry.removePre(listener); };
+        },
+    };
+}
+//# sourceMappingURL=securityPolicy.js.map