codiedev 0.9.56 → 0.10.0-beta.2

package/dist/hook.js

@@ -47,6 +47,11 @@ const limitEventReporter_1 = require("./limitEventReporter");
 const codexLimitScan_1 = require("./codexLimitScan");
 const version_1 = require("./version");
 const captureLog_1 = require("./captureLog");
+const security_1 = require("./security");
+const securitySession_1 = require("./securitySession");
+const securityPolicy_1 = require("./securityPolicy");
+const securityFeature_1 = require("./securityFeature");
+const securityInventory_1 = require("./securityInventory");
 const captureExclusions_1 = require("./captureExclusions");
 const cursorHooks_1 = require("./cursorHooks");
 // Pure builder for the discovery additionalContext. Returns null when there are
@@ -121,6 +126,8 @@ async function readAndPostLimitEvent(hookInput, source, emitMinimalOnMiss) {
     const tp = hookInput.transcript_path;
     if (tp) {
         try {
+            // Codex invokes Stop after every turn. Bound this read so long-running
+            // sessions do not repeatedly load their entire rollout into memory.
             transcript = readTranscriptTailFile(tp);
         }
         catch {
@@ -210,10 +217,14 @@ async function runCodexLimitSweep(sessionId) {
             // A shorter timeout than the default: this is on the user's prompt
             // clock, and the next prompt retries anything that does not land.
             post: (payload) => (0, limitEventReporter_1.postLimitEvent)(config, payload, PROMPT_LIMIT_POST_TIMEOUT_MS),
-            // Unchanged rollouts cost one statSync and do not spend the read
-            // budget, so in steady state this is nearly free. The module default
-            // covers a cold start; see DEFAULT_MAX_SCANS for why it is not small.
+            // This runs on the prompt path, so keep it bounded. Unchanged rollouts
+            // cost one statSync and do not spend the read budget, so a busy machine
+            // cannot bury an unreported block behind newer idle sessions. When a
+            // block is still unreported it sits at the END of its rollout, so a
+            // small scan window is enough; the Stop path keeps the larger default
+            // for a session that kept going after the window reset.
             findOptions: { withinMs: 24 * 3600_000 },
+            maxScans: 8,
             scanOptions: { maxScanBytes: 4 * 1024 * 1024 },
         });
         if (posted > 0) {
@@ -320,7 +331,7 @@ timeoutMs) {
 // postJson variant that returns the parsed response body — the upload-URL
 // handshake needs the { uploadUrl } the server hands back. No timeout: runs
 // only in detached uploader children, never on the shutdown clock.
-function postJsonForResponse(url, body, bearerToken) {
+function postJsonForResponse(url, body, bearerToken, timeoutMs) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const data = JSON.stringify(body);
@@ -354,10 +365,145 @@ function postJsonForResponse(url, body, bearerToken) {
             });
         });
         req.on("error", reject);
+        if (timeoutMs) {
+            req.setTimeout(timeoutMs, () => {
+                req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+            });
+        }
         req.write(data);
         req.end();
     });
 }
+// Local policy runs synchronously before a tool executes. Workflow telemetry
+// is dispatched separately and fail-open, so a detector outage or timeout can
+// never delay or override the deterministic endpoint decision.
+async function runSecurityHook(hookInput, phase, source, uploadTelemetry = true) {
+    const config = (0, utils_1.readConfig)();
+    if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
+        return;
+    const policy = (0, securityPolicy_1.readEndpointSecurityPolicy)(undefined, undefined, config.companyId);
+    const sessionId = hookInput.session_id ?? hookInput.sessionId;
+    const sessionSignal = phase === "pre" ? (0, securitySession_1.readSessionSecuritySignal)(sessionId) : undefined;
+    const localDecision = (0, security_1.evaluateToolSecurity)(hookInput, phase, policy, source, sessionSignal);
+    if (phase === "post" && (0, security_1.securityInputHasSensitivePath)(hookInput)) {
+        (0, securitySession_1.recordSensitiveReadSignal)(sessionId);
+    }
+    const event = (0, security_1.buildSecurityWorkflowEvent)(hookInput, phase, source);
+    if (event) {
+        event.localDecision = localDecision.action;
+        event.localCategory = localDecision.category;
+    }
+    if (localDecision.action === "block" && phase === "pre") {
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: hookInput.session_id ?? hookInput.sessionId ?? "unknown",
+            outcome: "ok",
+            detail: `phase=${phase} localDecision=block category=${localDecision.category}`,
+        });
+        if (uploadTelemetry)
+            dispatchSecurityEventUpload(event);
+        const response = source === "cursor"
+            ? (0, cursorHooks_1.cursorPreToolBlockResponse)(localDecision.reason ?? "Codie blocked this action")
+            : {
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "deny",
+                    permissionDecisionReason: localDecision.reason,
+                },
+            };
+        process.stdout.write(JSON.stringify(response));
+        return;
+    }
+    if (!event)
+        return;
+    if (uploadTelemetry)
+        dispatchSecurityEventUpload(event);
+}
+function runPromptSecurityHook(hookInput, source, uploadTelemetry = true) {
+    const config = (0, utils_1.readConfig)();
+    if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
+        return false;
+    const decision = (0, security_1.evaluatePromptSecurity)(hookInput.prompt, (0, securityPolicy_1.readEndpointSecurityPolicy)(undefined, undefined, config.companyId), source);
+    if (decision.action !== "block")
+        return false;
+    (0, captureLog_1.appendCaptureLog)({
+        stage: "security",
+        sessionId: hookInput.session_id ?? hookInput.sessionId ?? "unknown",
+        outcome: "ok",
+        detail: `phase=prompt localDecision=block category=${decision.category} telemetry=${uploadTelemetry ? "enabled" : "suppressed"} cwd=${hookInput.cwd ?? "unknown"}`,
+    });
+    if (uploadTelemetry) {
+        dispatchSecurityEventUpload((0, security_1.buildBlockedSecurityPromptEvent)(hookInput, source, decision.category ?? "secret_in_prompt"));
+    }
+    const response = source === "cursor"
+        ? (0, cursorHooks_1.cursorPromptBlockResponse)(decision.reason ?? "Codie blocked this prompt")
+        : { decision: "block", reason: decision.reason };
+    process.stdout.write(JSON.stringify(response));
+    return true;
+}
+function dispatchAllowedPromptSecurityEvent(hookInput, source) {
+    const config = (0, utils_1.readConfig)();
+    if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
+        return;
+    const event = (0, security_1.buildSecurityPromptEvent)(hookInput, source, Date.now, (0, securityPolicy_1.readEndpointSecurityPolicy)(undefined, undefined, config.companyId));
+    if (event)
+        dispatchSecurityEventUpload(event);
+}
+function dispatchSecurityEventUpload(event) {
+    if (!event || !(0, securityFeature_1.isAgentSecurityEnabled)((0, utils_1.readConfig)()))
+        return;
+    try {
+        const child = (0, child_process_1.spawn)(process.execPath, [process.argv[1], "security-upload"], {
+            detached: true,
+            stdio: ["pipe", "ignore", "ignore"],
+        });
+        child.stdin?.end(JSON.stringify(event));
+        child.unref();
+    }
+    catch {
+        // Telemetry is best-effort and must never delay local enforcement.
+    }
+}
+async function runSecurityEventUpload() {
+    const config = (0, utils_1.readConfig)();
+    if (!config || !(0, securityFeature_1.isAgentSecurityEnabled)(config))
+        return;
+    const startedAt = Date.now();
+    try {
+        const raw = await readStdin();
+        const event = JSON.parse(raw);
+        const cachedPolicy = (0, securityPolicy_1.readEndpointSecurityPolicy)(undefined, undefined, config.companyId);
+        const eventWithEndpoint = (0, security_1.withEndpointIdentity)(event, {
+            endpointId: config.deviceId,
+            endpointName: config.deviceName,
+            cliVersion: version_1.CLI_VERSION,
+            securityRuntimeVersion: security_1.SECURITY_RUNTIME_VERSION,
+            securityPolicyVersion: cachedPolicy?.policyVersion,
+        });
+        const result = await postJsonForResponse(`${config.backendUrl}/api/cli/securityEvent`, { ...eventWithEndpoint }, config.token, 
+        // Leave room for a cold backend and durable scheduling. This uploader is
+        // detached, so the network budget never delays the developer's prompt or
+        // tool call. Policy refreshes use the separately signed sync endpoint.
+        5_000);
+        if (result?.policy?.schemaVersion === 1) {
+            (0, securityPolicy_1.writeEndpointSecurityPolicy)(result.policy, undefined, undefined, config.companyId);
+        }
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: event.sessionId,
+            outcome: "ok",
+            detail: `phase=${event.phase} elapsedMs=${Date.now() - startedAt} verdict=${String(result?.verdict ?? "unknown")}`,
+        });
+    }
+    catch (err) {
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "security",
+            sessionId: "upload",
+            outcome: "ERROR",
+            detail: `elapsedMs=${Date.now() - startedAt} ${err.message}`,
+        });
+    }
+}
 // Raw-bytes POST to a Convex storage upload URL (no auth header — the URL
 // itself is the one-time credential). Returns the parsed { storageId }.
 function postBytes(url, bytes, contentType) {
@@ -481,6 +627,20 @@ async function main() {
         }
         process.exit(0);
     }
+    // Daily component drift scan runs in a detached hook process. The parent
+    // SessionStart path only performs a timestamp read, so agent startup never
+    // waits for filesystem traversal or an inventory upload.
+    if (process.argv[2] === "security-inventory-upload") {
+        const config = (0, utils_1.readConfig)();
+        if (config && (0, securityFeature_1.isAgentSecurityEnabled)(config)) {
+            const inventory = (0, securityInventory_1.buildSecurityInventory)({ workspace: process.argv[3] || process.cwd() });
+            try {
+                await (0, securityInventory_1.uploadSecurityInventory)(inventory, config);
+            }
+            catch { /* retry after the daily inventory window */ }
+        }
+        process.exit(0);
+    }
     // Detached backup uploader child (spawned by runBackup below). The job file
     // carries only { root, files }; the child re-reads config from disk. No stdin
     // needed, so handle it before readStdin() like the capture uploader above.
@@ -517,6 +677,13 @@ async function main() {
         }
         process.exit(0);
     }
+    // Detached, best-effort security telemetry. Local policy decisions have
+    // already completed in the parent hook; this child can never delay or alter
+    // the developer's action.
+    if (process.argv[2] === "security-upload") {
+        await runSecurityEventUpload();
+        process.exit(0);
+    }
     let hookInput = {};
     try {
         const raw = await readStdin();
@@ -530,25 +697,57 @@ async function main() {
     catch {
         process.exit(0);
     }
-    // Local privacy boundary: every stdin-driven hook mode passes through this
-    // check BEFORE prompt discovery, limit-event tails, SessionStart pings,
-    // backup, self-heal, transcript reads, or detached dispatch. Ignored means
-    // no Codiedev request at all for this session.
-    if ((0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput)) {
+    // Privacy exclusions suppress every Codiedev upload, but they must never
+    // disable local security enforcement. Security hooks run first with telemetry
+    // disabled; all other hook modes still exit before making a network request.
+    const captureIgnored = (0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput);
+    const securityCommand = process.argv[2] ?? "";
+    const securityMatch = securityCommand.match(/^security-(pre|post|failure)(?:-(codex|cursor|codie))?$/);
+    if (securityMatch) {
+        const source = securityMatch[2] === "codex"
+            ? "codex"
+            : securityMatch[2] === "cursor"
+                ? "cursor"
+                : securityMatch[2] === "codie"
+                    ? "codie-harness"
+                    : "claude-code";
+        await runSecurityHook(hookInput, securityMatch[1], source, !captureIgnored);
         process.exit(0);
     }
     // UserPromptSubmit discovery path — separate from session capture.
+    const promptCommand = process.argv[2] ?? "";
+    if (promptCommand === "security-prompt-cursor") {
+        if (runPromptSecurityHook(hookInput, "cursor", !captureIgnored))
+            return;
+        if (captureIgnored)
+            return;
+        dispatchAllowedPromptSecurityEvent(hookInput, "cursor");
+        process.exit(0);
+    }
     if (process.argv[2] === "discover" ||
         process.argv[2] === "discover-codex" ||
         process.argv[2] === "discover-codie") {
+        const source = promptCommand === "discover-codex"
+            ? "codex"
+            : promptCommand === "discover-codie"
+                ? "codie-harness"
+                : "claude-code";
+        // Security runs first and locally. A blocked prompt is erased before it
+        // reaches the model, so discovery must not send it to the backend.
+        if (runPromptSecurityHook(hookInput, source, !captureIgnored))
+            return;
+        if (captureIgnored)
+            return;
+        dispatchAllowedPromptSecurityEvent(hookInput, source);
         // A Codex block leaves no hook of its own, so this prompt is the first
         // chance to report it. Runs before runDiscover, which exits the process.
-        if (process.argv[2] === "discover-codex") {
+        if (source === "codex")
             await runCodexLimitSweep(hookInput.session_id);
-        }
         await runDiscover(hookInput.prompt);
         return;
     }
+    if (captureIgnored)
+        process.exit(0);
     // StopFailure (matcher rate_limit): post the rate-limit event.
     if (process.argv[2] === "limit") {
         await runStopFailure(hookInput);
@@ -562,6 +761,16 @@ async function main() {
     if (process.argv[2] === "session-start" ||
         process.argv[2] === "session-start-cursor" ||
         process.argv[2] === "session-start-opencode") {
+        if ((0, securityFeature_1.isAgentSecurityEnabled)((0, utils_1.readConfig)()) && (0, securityInventory_1.securityInventoryDue)()) {
+            try {
+                const child = (0, child_process_1.spawn)(process.execPath, [process.argv[1], "security-inventory-upload", hookInput.cwd || process.cwd()], {
+                    detached: true,
+                    stdio: "ignore",
+                });
+                child.unref();
+            }
+            catch { /* daily inventory is best-effort */ }
+        }
         await runSessionStart(hookInput, process.argv[2] === "session-start-opencode"
             ? "opencode"
             : process.argv[2] === "session-start-cursor"
@@ -598,8 +807,6 @@ async function main() {
         if (transcript_path) {
             try {
                 (0, utils_1.dispatchCaptureFinish)({
-                    // "capture" = the claude-code entrypoint literal, same as the
-                    // SessionEnd path below (resolveMode maps it to claude-code).
                     mode: process.argv[2] === "backup-cursor" ? "capture-cursor" : "capture",
                     session_id,
                     transcript_path,
@@ -660,10 +867,9 @@ async function main() {
             transcript_path,
             cwd,
             workspace_roots,
-            // final:true ONLY for claude-code's SessionEnd. Codex routes its
-            // per-turn Stop hook through "capture-codex" — final:true there would
-            // close the server lease every turn. Cursor SessionEnd is final:true;
-            // Codex remains the legacy final-omitted per-turn path.
+            // final:true for real SessionEnd signals (Claude Code and Cursor).
+            // Codex routes its per-turn Stop hook through "capture-codex" —
+            // final:true there would close the server lease every turn.
             final: (0, utils_1.resolveCaptureFinal)(process.argv[2]),
         }, process.argv[1], { spawn: child_process_1.spawn, writeFileSync: fs.writeFileSync, tmpFile: jobFile, openSync: fs.openSync, closeSync: fs.closeSync });
     }
@@ -784,8 +990,10 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
     const stats = parserMode === "codex"
         ? (0, utils_1.parseCodexStats)(transcriptContent)
         : (0, utils_1.parseClaudeCodeStats)(transcriptContent);
-    // Never use parsed message count here: Cursor's private JSONL shape can
-    // evolve independently, and parser drift must not discard a real session.
+    // Cursor can emit duplicate lifecycle notifications while one transcript
+    // path is still byte-empty. Never use parsed message count here: Cursor's
+    // private JSONL shape can evolve independently, and parser drift must not
+    // silently discard a real non-empty session.
     if (parserMode === "cursor" && (0, cursorHooks_1.isCursorTranscriptEmpty)(rawTranscriptContent)) {
         (0, captureLog_1.appendCaptureLog)({
             stage: "capture-finish",
@@ -794,7 +1002,8 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
             detail: "empty-cursor-transcript",
         });
         // A non-final stop snapshot is only a backup; reporting it as a skipped
-        // session would close server-side coverage while the session is alive.
+        // session would close/remove server-side start coverage while the session
+        // is still alive. The real SessionEnd remains responsible for a skip ping.
         if ((0, utils_1.shouldReportCaptureSkip)(input.final)) {
             await postSessionSkip(config, session_id, "empty-cursor-transcript");
         }
@@ -902,8 +1111,9 @@ async function runCaptureFinishInner(input, config, session_id, transcript_path,
                 body: payload,
                 scopePaths,
             }, hookScriptPath, { spawn: child_process_1.spawn, writeFileSync: fs.writeFileSync, tmpFile, openSync: fs.openSync, closeSync: fs.closeSync });
-            // Persist the immediate payload before removing the older scheduled
-            // snapshot. Every immediate dispatch supersedes a sleeping deferred job.
+            // The immediate payload is durable before removing the older scheduled
+            // snapshot. Do this for every immediate dispatch, not only SessionEnd:
+            // first/outside-window snapshots also supersede a sleeping deferred job.
             if (session_id)
                 (0, utils_1.cancelDeferredCaptureUpload)(session_id);
             // Retry any earlier capture jobs that failed to upload (transient network

package/dist/limitEvent.d.ts

@@ -7,6 +7,10 @@ export interface LimitEvent {
 }
 export declare function classifyLimitKind(text: string): LimitKind;
 export declare function parseLimitEventFromTranscript(transcript: string): LimitEvent | null;
-/** Parse the structured rate-limit snapshot written to Codex rollout JSONL. */
+/**
+ * Codex writes a structured RateLimitSnapshot on token_count events. A normal
+ * turn has `rate_limit_reached_type: null`; a blocked turn names the exact
+ * boundary. Reading that field avoids locale-dependent terminal copy.
+ */
 export declare function parseCodexLimitEventFromTranscript(transcript: string): LimitEvent | null;
 export declare function tailForLimitEvent(transcript: string, maxChars?: number): string;

package/dist/limitEvent.js

@@ -51,36 +51,11 @@ function parseLimitEventFromTranscript(transcript) {
     }
     return found;
 }
-/**
- * Codex's `rate_limit_reached_type` is exactly five values (read off the 0.154
- * binary): `rate_limit_reached`, `workspace_{owner,member}_credits_depleted`
- * and `workspace_{owner,member}_usage_limit_reached`.
- *
- * The split that matters to a reader of the dashboard is "someone must act on
- * money" vs "this dev is throttled and it will reset" — so map on what the
- * snapshot actually asserts, not on the word "credits":
- *
- * - A member out of their OWN allowance is a rate limit. Real snapshots carry
- *   `spend_control_reached: null` and `individual_limit: null` — nobody
- *   configured a budget, the window is simply used up. Calling that personal
- *   spend tells a manager the dev overspent, which is not what happened.
- *
- *   Deliberately NOT gated on `individual_limit`: it has only ever been
- *   observed null, so its populated shape and meaning are unknown, and a
- *   wrong guess reinstates the mislabel this exists to remove. The reason
- *   string is the causal signal; `individual_limit` is at best correlative.
- * - A member whose ADMIN capped them (`usage_limit_reached`) is personal spend:
- *   there really is a cap, and someone can raise it.
- * - Anything owner-scoped is org spend — the org's allowance or credits are
- *   gone and somebody has to act.
- */
 function codexLimitKind(reason, spendControlReached) {
     if (spendControlReached || reason.startsWith("workspace_owner_"))
         return "org_spend";
-    if (reason === "workspace_member_usage_limit_reached")
+    if (reason.startsWith("workspace_member_"))
         return "user_spend";
-    if (reason === "workspace_member_credits_depleted")
-        return "session";
     return reason === "rate_limit_reached" ? "session" : "other";
 }
 function codexResetText(rateLimits) {
@@ -94,7 +69,11 @@ function codexResetText(rateLimits) {
         .sort((a, b) => a - b)[0];
     return resetAt ? new Date(resetAt * 1000).toISOString() : null;
 }
-/** Parse the structured rate-limit snapshot written to Codex rollout JSONL. */
+/**
+ * Codex writes a structured RateLimitSnapshot on token_count events. A normal
+ * turn has `rate_limit_reached_type: null`; a blocked turn names the exact
+ * boundary. Reading that field avoids locale-dependent terminal copy.
+ */
 function parseCodexLimitEventFromTranscript(transcript) {
     let found = null;
     for (const line of transcript.split("\n")) {

package/dist/security.d.ts

@@ -0,0 +1,102 @@
+export type SecurityHookPhase = "pre" | "post" | "failure";
+export type AgentSurface = "claude-code" | "codex" | "cursor" | "codie-harness";
+export declare const SECURITY_RUNTIME_VERSION = 1;
+export interface RawSecurityHookInput {
+    session_id?: string;
+    sessionId?: string;
+    cwd?: string;
+    hook_event_name?: string;
+    hookEventName?: string;
+    tool_name?: string;
+    toolName?: string;
+    tool_input?: unknown;
+    toolInput?: unknown;
+    tool_response?: unknown;
+    toolResponse?: unknown;
+    tool_use_id?: string;
+    toolUseId?: string;
+    duration_ms?: number;
+    durationMs?: number;
+    error?: unknown;
+    prompt?: string;
+}
+export interface SecurityWorkflowEvent {
+    schemaVersion: 1;
+    source: AgentSurface;
+    phase: SecurityHookPhase;
+    sessionId: string;
+    toolName: string;
+    toolUseId?: string;
+    cwd?: string;
+    observedAt: number;
+    toolDurationMs?: number;
+    payload: unknown;
+    redactionCount: number;
+    localDecision?: LocalSecurityAction;
+    localCategory?: LocalSecurityDecision["category"];
+    endpointId?: string;
+    endpointName?: string;
+    cliVersion?: string;
+    securityRuntimeVersion?: number;
+    securityPolicyVersion?: number;
+}
+export type LocalSecurityAction = "allow" | "alert" | "block";
+export type SecurityCategory = "secret_in_prompt" | "secret_exfiltration" | "destructive_outside_workspace" | "sensitive_file_read" | "sensitive_file_write" | "protected_agent_config_write" | "unapproved_network_egress" | "untrusted_mcp_tool" | "unapproved_command" | "obfuscated_shell_command" | "package_install" | "sensitive_read_then_egress";
+export interface EndpointSecurityPolicy {
+    schemaVersion: 1;
+    policyVersion: number;
+    enforcementMode: "alert" | "block";
+    rules: Partial<Record<SecurityCategory, LocalSecurityAction>>;
+    constraints?: {
+        allowedMcpServers?: string[];
+        allowedHosts?: string[];
+        allowedCommands?: string[];
+    };
+    exceptions: Array<{
+        scope: "company" | "user" | "source" | "repository" | "tool" | "category";
+        scopeValue: string;
+    }>;
+    fetchedAt: number;
+    signature?: {
+        algorithm: "Ed25519";
+        keyId: string;
+        signedAt: number;
+        value: string;
+    };
+}
+export interface LocalSecurityDecision {
+    action: LocalSecurityAction;
+    category?: SecurityCategory;
+    reason?: string;
+}
+export declare function withEndpointIdentity(event: SecurityWorkflowEvent, identity: {
+    endpointId?: string;
+    endpointName?: string;
+    cliVersion?: string;
+    securityRuntimeVersion?: number;
+    securityPolicyVersion?: number;
+}): SecurityWorkflowEvent;
+/**
+ * Runs before a user prompt reaches the model. This is intentionally narrow:
+ * block credential material, but allow safe references such as
+ * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
+ * without pasting their values.
+ */
+export declare function evaluatePromptSecurity(prompt: string | undefined, policy?: EndpointSecurityPolicy, source?: AgentSurface): LocalSecurityDecision;
+/** Runs synchronously before a tool executes. No network or model is involved. */
+export declare function evaluateToolSecurity(input: RawSecurityHookInput, phase: SecurityHookPhase, policy?: EndpointSecurityPolicy, source?: AgentSurface, sessionContext?: {
+    sensitiveReadAt?: number;
+    now?: number;
+}): LocalSecurityDecision;
+export declare function securityInputHasSensitivePath(input: RawSecurityHookInput): boolean;
+export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;
+/**
+ * Captures the intent side of the causal chain without weakening the local
+ * privacy boundary. A prompt that the deterministic policy blocks never
+ * becomes an uploadable event; allowed prompts are redacted and bounded using
+ * the same sanitizer as tool payloads.
+ */
+export declare function buildSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd" | "prompt">, source: AgentSurface, now?: () => number, policy?: EndpointSecurityPolicy): SecurityWorkflowEvent | null;
+/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
+ * intentionally omitted; administrators still see that prevention occurred. */
+export declare function buildBlockedSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd">, source: AgentSurface, category: NonNullable<LocalSecurityDecision["category"]>, now?: () => number): SecurityWorkflowEvent | null;