claude-warden 1.1.0 → 1.1.4

package/README.md

@@ -15,7 +15,7 @@ Warden hooks into Claude Code's `PreToolUse` event and **parses every shell comm
 This AST-based approach enables:
 
 - **Pipe and chain decomposition**: `cat file | grep pattern | wc -l` is parsed into three commands, each evaluated separately. All safe → auto-allow. One dangerous → deny the whole pipeline.
-- **Argument-aware rules**: `git status` → allow, `git push --force` → prompt. `rm temp.txt` → allow, `rm -rf /` → deny. The evaluator matches against argument patterns, not just command names.
+- **Argument-aware rules**: `git status` → allow, `git push --force` → prompt. `rm temp.txt` → allow, `rm -rf /` → prompt. The evaluator matches against argument patterns, not just command names.
 - **Recursive evaluation of remote commands**: `ssh devserver 'cat /etc/hosts'` → Warden extracts the remote command, parses it through the same pipeline, and allows it. `ssh devserver 'sudo rm -rf /'` → denied. Same for `docker exec`, `kubectl exec`, and `sprite exec`.
 - **Shell wrapper unwrapping**: `sh -c "npm run build && npm test"` → the inner command is extracted and recursively parsed/evaluated, not treated as an opaque string.
 - **Env prefix handling**: `NODE_ENV=production npm run build` → correctly evaluates `npm run build`, ignoring the env prefix.
@@ -32,7 +32,7 @@ The result: **100+ common dev commands auto-approved**, dangerous commands auto-
 | `cat file \| grep pattern \| wc -l` | Prompted | Auto-allowed (3 safe commands) |
 | `npm run build && npm test` | Prompted | Auto-allowed |
 | `git push --force origin main` | Prompted | Prompted (force push is risky) |
-| `sudo rm -rf /` | Prompted | Auto-denied |
+| `sudo rm -rf /` | Prompted | Auto-denied (sudo is blocked) |
 | `ssh devserver cat /etc/hosts` | Prompted | Auto-allowed (trusted host + safe cmd) |
 | `ssh devserver sudo rm -rf /` | Prompted | Auto-denied (trusted host + dangerous cmd) |
 
@@ -147,7 +147,7 @@ File readers (`cat`, `head`, `tail`, `less`), search tools (`grep`, `rg`, `find`
 ### Conditional rules
 Commands like `node`, `npx`, `docker`, `ssh`, `git push --force`, `rm`, `chmod` have argument-aware rules. For example:
 - `git` is allowed but `git push --force` triggers a prompt
-- `rm temp.txt` is allowed but `rm -rf /` is denied
+- `rm temp.txt` is allowed but `rm -rf /` is prompted
 - `chmod 644 file` prompts but `chmod -R 777 /var` is denied
 
 ### Trusted remote targets

package/dist/index.cjs

@@ -18888,6 +18888,11 @@ var DEFAULT_CONFIG = {
       "fnm",
       "rbenv",
       "pyenv",
+      // Terminal
+      "stty",
+      "tput",
+      "reset",
+      "clear",
       // Misc safe
       "cd",
       "pushd",
@@ -18931,6 +18936,36 @@ var DEFAULT_CONFIG = {
       "launchctl"
     ],
     rules: [
+      // --- CLI tools ---
+      {
+        command: "claude",
+        default: "ask",
+        argPatterns: [
+          { match: { anyArgMatches: ["^--(version|help)$", "^-[vh]$"] }, decision: "allow", description: "Version/help flags" }
+        ]
+      },
+      // --- Shell interpreters ---
+      {
+        command: "bash",
+        default: "ask",
+        argPatterns: [
+          { match: { anyArgMatches: ["^--(version|help)$"] }, decision: "allow", description: "Version/help flags" }
+        ]
+      },
+      {
+        command: "sh",
+        default: "ask",
+        argPatterns: [
+          { match: { anyArgMatches: ["^--(version|help)$"] }, decision: "allow", description: "Version/help flags" }
+        ]
+      },
+      {
+        command: "zsh",
+        default: "ask",
+        argPatterns: [
+          { match: { anyArgMatches: ["^--(version|help)$"] }, decision: "allow", description: "Version/help flags" }
+        ]
+      },
       // --- Node.js ecosystem ---
       {
         command: "node",
@@ -19075,7 +19110,7 @@ var DEFAULT_CONFIG = {
         command: "rm",
         default: "ask",
         argPatterns: [
-          { match: { argsMatch: ["-[^\\s]*r[^\\s]*f|-[^\\s]*f[^\\s]*r"] }, decision: "deny", reason: "Recursive force delete (rm -rf)" },
+          { match: { argsMatch: ["-[^\\s]*r[^\\s]*f|-[^\\s]*f[^\\s]*r"] }, decision: "ask", reason: "Recursive force delete (rm -rf)" },
           { match: { argsMatch: ["-[^\\s]*r"] }, decision: "ask", reason: "Recursive delete" },
           { match: { argCount: { max: 3 }, not: false }, decision: "allow", description: "Deleting a small number of non-recursive files" }
         ]
@@ -19230,9 +19265,12 @@ function generateAllowSnippet(details) {
   return lines.join("\n");
 }
 function formatSystemMessage(decision, rawCommand, details) {
-  const header = decision === "deny" ? "[warden] Command blocked" : "[warden] Command flagged for review";
-  const lines = [header, ""];
   const relevant = details.filter((d) => d.decision !== "allow");
+  if (decision === "ask") {
+    const parts = relevant.map((d) => `\`${d.command}\`: ${d.reason}`);
+    return `[warden] ${parts.join(" | ")} \u2014 To auto-allow, see /warden-allow`;
+  }
+  const lines = ["[warden] Command blocked", ""];
   if (relevant.length > 0) {
     for (const d of relevant) {
       lines.push(`- \`${d.command}\`: ${d.reason}`);
@@ -19291,14 +19329,26 @@ async function main() {
   }
   if (result.decision === "deny") {
     const msg2 = formatSystemMessage("deny", command, result.details);
-    const output2 = { systemMessage: msg2 };
+    const output2 = {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: msg2
+      }
+    };
     process.stdout.write(JSON.stringify(output2));
     process.stderr.write(`[warden] Blocked: ${result.reason}
 `);
     process.exit(2);
   }
   const msg = formatSystemMessage("ask", command, result.details);
-  const output = { systemMessage: msg };
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "ask",
+      permissionDecisionReason: msg
+    }
+  };
   process.stdout.write(JSON.stringify(output));
   process.exit(0);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-warden",
-  "version": "1.1.0",
+  "version": "1.1.4",
   "description": "Smart command safety filter for Claude Code — auto-approves safe commands, blocks dangerous ones",
   "type": "module",
   "main": "dist/index.cjs",
@@ -28,15 +28,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "eval": "node dist/index.cjs",
-    "prepublishOnly": "pnpm run build && pnpm run test"
-  },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "bash-parser": "^0.5.0",
@@ -44,5 +35,13 @@
     "typescript": "^5.4.0",
     "vitest": "^1.6.0",
     "yaml": "^2.4.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "eval": "node dist/index.cjs"
   }
-}
+}