codiedev 0.9.89 → 0.9.90

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr" | "limit" | "self-update";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr" | "limit" | "self-update" | "prompt-guard";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/codie.js

@@ -176,6 +176,57 @@ function installBrandWordmarkUnsafe(runtime) {
             (0, child_process_1.spawnSync)("codesign", ["--force", "--sign", "-", runtime], { stdio: "ignore" });
     }
 }
+async function runNonInteractive(runtime, runtimeArgs, env) {
+    const detached = process.platform !== "win32";
+    const child = (0, child_process_1.spawn)(runtime, runtimeArgs, {
+        stdio: ["pipe", "pipe", "pipe"],
+        env,
+        detached,
+    });
+    if (child.stdin)
+        process.stdin.pipe(child.stdin);
+    const signalChild = (signal) => {
+        if (detached && child.pid) {
+            try {
+                process.kill(-child.pid, signal);
+                return;
+            }
+            catch {
+                // Fall back to the direct child if its process group already exited.
+            }
+        }
+        child.kill(signal);
+    };
+    const forwardInterrupt = () => signalChild("SIGINT");
+    const forwardTermination = () => signalChild("SIGTERM");
+    process.once("SIGINT", forwardInterrupt);
+    process.once("SIGTERM", forwardTermination);
+    return await new Promise((resolve, reject) => {
+        child.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+        child.stderr?.on("data", (chunk) => {
+            // The Codiedev plugin stopped a prompt with a key in it: print its
+            // reason plainly instead of the private marker line.
+            const text = chunk.toString("utf8");
+            if (!text.includes(codieLauncher_1.PROMPT_BLOCK_MARKER))
+                return process.stderr.write(chunk);
+            process.stderr.write(text.split(/\r?\n/).map((line) => (0, codieLauncher_1.promptBlockLine)(line) ?? line).join("\n"));
+        });
+        child.once("error", (error) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
+            process.removeListener("SIGINT", forwardInterrupt);
+            process.removeListener("SIGTERM", forwardTermination);
+            reject(error);
+        });
+        child.once("close", (status) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
+            process.removeListener("SIGINT", forwardInterrupt);
+            process.removeListener("SIGTERM", forwardTermination);
+            resolve(status);
+        });
+    });
+}
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
     if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN) {
@@ -303,6 +354,10 @@ async function main() {
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
     const nonInteractiveRun = runtimeArgs[0] === "run";
+    // A run has no TUI to show a stopped prompt; the plugin hands the reason
+    // back on stderr instead (see runNonInteractive).
+    if (nonInteractiveRun)
+        env.CODIEDEV_PROMPT_BLOCK_OUTPUT = "marker";
     if (nonInteractiveRun) {
         // The TUI paints its own live status line from the same endpoint. A
         // non-interactive run has no TUI, so the budget arrives as two printed
@@ -315,10 +370,7 @@ async function main() {
             if (line)
                 console.error(line);
         }
-        const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
-        if (result.error)
-            throw result.error;
-        process.exitCode = result.status === null ? 1 : result.status;
+        process.exitCode = (await runNonInteractive(runtime, runtimeArgs, env)) ?? 1;
         if (reportCost) {
             // The gateway books a request's cost after it has answered, so a poll
             // fired the instant the run closes can miss the last one.

package/dist/codieLauncher.d.ts

@@ -89,3 +89,6 @@ export declare function parseCodieArgs(argv: string[]): {
     overrides: Record<string, string>;
 };
 export declare function validateCodieArgs(args: string[], catalog: CatalogModel[]): void;
+export declare const PROMPT_BLOCK_MARKER = "__CODIEDEV_PROMPT_BLOCKED__";
+/** The reason on a marker line, or null for any other line. */
+export declare function promptBlockLine(line: string): string | null;

package/dist/codieLauncher.js

@@ -42,7 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = void 0;
+exports.PROMPT_BLOCK_MARKER = exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = void 0;
 exports.usableModelCost = usableModelCost;
 exports.usableModelLimit = usableModelLimit;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
@@ -56,6 +56,7 @@ exports.resolveCapturePlugin = resolveCapturePlugin;
 exports.fetchApprovedCatalog = fetchApprovedCatalog;
 exports.parseCodieArgs = parseCodieArgs;
 exports.validateCodieArgs = validateCodieArgs;
+exports.promptBlockLine = promptBlockLine;
 const path = __importStar(require("path"));
 const url_1 = require("url");
 const harnessDirs_1 = require("./harnessDirs");
@@ -461,3 +462,17 @@ function validateCodieArgs(args, catalog) {
         }
     }
 }
+exports.PROMPT_BLOCK_MARKER = "__CODIEDEV_PROMPT_BLOCKED__";
+/** The reason on a marker line, or null for any other line. */
+function promptBlockLine(line) {
+    const at = line.indexOf(exports.PROMPT_BLOCK_MARKER);
+    if (at < 0)
+        return null;
+    try {
+        const reason = JSON.parse(line.slice(at + exports.PROMPT_BLOCK_MARKER.length)).reason;
+        return typeof reason === "string" && reason.trim() ? `\n${reason.trim()}` : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/hook.js

@@ -64,6 +64,7 @@ const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
 const cliSession_1 = require("./cliSession");
 const utils_2 = require("./utils");
+const promptGuard_1 = require("./promptGuard");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
 // (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
@@ -597,6 +598,48 @@ async function main() {
     catch {
         process.exit(0);
     }
+    // Privacy exclusions suppress every Codiedev upload.
+    const captureIgnored = (0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput);
+    // Background refresh of the company's "stop prompts with a key" setting.
+    if (process.argv[2] === "prompt-guard-refresh") {
+        await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
+        await (0, promptGuard_1.refreshPromptGuardPolicy)((0, utils_1.readConfig)());
+        process.exit(0);
+    }
+    // Stop a prompt with a key in it, when the company turned that on. Runs
+    // before discovery (which would send the prompt to the backend) and even
+    // where capture is excluded: it's local and never uploads the prompt.
+    const PROMPT_HOOKS = {
+        discover: "claude-code",
+        "discover-codex": "codex",
+        "discover-codie": "codie-harness",
+        "discover-copilot": "copilot",
+        "discover-pi": "pi",
+        "prompt-guard-cursor": "cursor",
+    };
+    const promptHarness = PROMPT_HOOKS[process.argv[2] ?? ""];
+    if (promptHarness) {
+        const guard = (0, promptGuard_1.checkPrompt)(hookInput.prompt, promptHarness, (0, promptGuard_1.readPromptGuardPolicy)());
+        // An ignored session makes no Codiedev request, not even this refresh.
+        if (!captureIgnored)
+            (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
+        if (guard.blocked) {
+            (0, captureLog_1.appendCaptureLog)({
+                stage: "prompt-guard",
+                sessionId: hookInput.session_id ?? "unknown",
+                outcome: "ok",
+                detail: `blocked harness=${promptHarness} rule=${guard.key.rule}`,
+            });
+            process.stdout.write(JSON.stringify(guard.response));
+            if (!captureIgnored)
+                await (0, promptGuard_1.reportPromptBlocked)((0, utils_1.readConfig)(), guard.key.rule, promptHarness);
+            process.exit(0);
+        }
+        if (promptHarness === "cursor") {
+            process.stdout.write(JSON.stringify({ continue: true }));
+            process.exit(0);
+        }
+    }
     // Local privacy boundary: every stdin-driven hook mode passes through this
     // check BEFORE prompt discovery, limit-event tails, SessionStart pings,
     // backup, self-heal, transcript reads, or detached dispatch. Ignored means
@@ -665,6 +708,8 @@ async function main() {
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
         // Local session scrub of past sessions on this machine (hourly, detached).
         (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
+        // Keep "stop prompts with a key" current before the first prompt.
+        (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         // Claude Code adds SessionStart stdout to the session context.
         if (packNag && process.argv[2] === "session-start")
@@ -716,6 +761,8 @@ async function main() {
     }
     if (process.argv[2] === "capture-codex")
         (0, utils_1.ensureCodexLimitHookInstalled)();
+    if (/-opencode(?:-final)?$/.test(process.argv[2] ?? ""))
+        (0, utils_1.ensureOpenCodePluginCurrent)();
     const { session_id, transcript_path, cwd, workspace_roots } = hookInput;
     // Read here, in the process the harness spawned: the detached capture child
     // is reparented once this exits and can no longer see who launched it.

package/dist/promptGuard.d.ts

@@ -0,0 +1,63 @@
+import { spawn as nodeSpawn } from "child_process";
+import { type ExtraRule } from "./scrub/promptRules";
+export type PromptHarness = "claude-code" | "codex" | "cursor" | "codie-harness" | "copilot" | "pi";
+export interface TokenFormat {
+    name: string;
+    source: string;
+    keyword?: string;
+}
+export interface PromptGuardPolicy {
+    blockPrompts: boolean;
+    formats: TokenFormat[];
+    fetchedAt: number;
+}
+export declare const REFRESH_MS: number;
+export interface PromptKey {
+    rule: string;
+    label: string;
+    hint: string;
+}
+export declare function keyLabel(rule: string): string;
+/** The company's own token formats as scrub rules; a bad one is skipped. */
+export declare function formatRules(formats: readonly TokenFormat[]): ExtraRule[];
+/** The first real key in a prompt, or null. */
+export declare function findPromptKey(prompt: string, formats?: readonly TokenFormat[], now?: number): PromptKey | null;
+/** What the person sees. Names the kind of key and its last four, says
+ *  nothing was sent, and how to do it instead. */
+export declare function blockMessage(key: PromptKey): string;
+/** The hook's stdout for each harness when it stops a prompt. */
+export declare function blockResponse(harness: PromptHarness, message: string): Record<string, unknown>;
+export declare function readPromptGuardPolicy(stateDir?: string): PromptGuardPolicy | null;
+export declare function writePromptGuardPolicy(policy: PromptGuardPolicy, stateDir?: string): void;
+interface GuardConfig {
+    token?: string;
+    backendUrl?: string;
+}
+/** Ask the server for the company's setting and cache it. On any failure the
+ *  last cached answer stays (and its age makes the next hook try again). */
+export declare function refreshPromptGuardPolicy(config: GuardConfig | null, fetchImpl?: typeof fetch, stateDir?: string, now?: number): Promise<PromptGuardPolicy | null>;
+/** Start a background refresh when the cached setting is missing or stale.
+ *  Stamps the cache's age first so a burst of hooks starts only one. */
+export declare function maybeSpawnPromptGuardRefresh(opts: {
+    connected: boolean;
+    stateDir?: string;
+    now?: number;
+    hookEntry?: string;
+    spawn?: typeof nodeSpawn;
+    force?: boolean;
+}): "spawned" | "fresh" | "disabled" | "error";
+export interface PromptCheck {
+    blocked: false;
+}
+export interface PromptBlocked {
+    blocked: true;
+    key: PromptKey;
+    message: string;
+    response: Record<string, unknown>;
+}
+/** Check one prompt against the cached setting. Never throws. */
+export declare function checkPrompt(prompt: string | undefined, harness: PromptHarness, policy: PromptGuardPolicy | null, now?: number): PromptCheck | PromptBlocked;
+/** Tell the server a prompt was stopped: the rule and harness only. Detached
+ *  and best-effort; a slow network never holds the prompt hook. */
+export declare function reportPromptBlocked(config: GuardConfig | null, rule: string, harness: PromptHarness, fetchImpl?: typeof fetch): Promise<void>;
+export {};

package/dist/promptGuard.js

@@ -0,0 +1,261 @@
+"use strict";
+// Stop a prompt that has a key in it before it reaches the model. Off unless
+// a company admin turns it on (Team Security → Settings → Stop prompts with a
+// key). Everything happens on the laptop: the prompt and the key are never
+// sent anywhere; when a prompt is stopped the server only hears which kind of
+// key it was and which harness, for the team's activity feed.
+//
+// Precision over recall: only a provider's own key format (sk-ant-…, ghp_…,
+// AKIA…), a private key block, a password in a URL, or one of the company's
+// own token formats stops a prompt, and only when the value looks real (not a
+// placeholder, sample or test value: scrub/rules notWorthRotating). Generic
+// shapes (KEY=value, Bearer …, JWTs) never stop one; the scrub still removes
+// them from stored sessions.
+//
+// The hook must answer fast and offline, so it reads a cached copy of the
+// company's setting. The cache is refreshed in the background (at session
+// start, and from the prompt hook when it is over REFRESH_MS old).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_MS = void 0;
+exports.keyLabel = keyLabel;
+exports.formatRules = formatRules;
+exports.findPromptKey = findPromptKey;
+exports.blockMessage = blockMessage;
+exports.blockResponse = blockResponse;
+exports.readPromptGuardPolicy = readPromptGuardPolicy;
+exports.writePromptGuardPolicy = writePromptGuardPolicy;
+exports.refreshPromptGuardPolicy = refreshPromptGuardPolicy;
+exports.maybeSpawnPromptGuardRefresh = maybeSpawnPromptGuardRefresh;
+exports.checkPrompt = checkPrompt;
+exports.reportPromptBlocked = reportPromptBlocked;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const configDir_1 = require("./configDir");
+const promptRules_1 = require("./scrub/promptRules");
+const scrubProviderRules_1 = require("./scrub/scrubProviderRules");
+exports.REFRESH_MS = 10 * 60_000;
+const CACHE_FILE = "prompt-guard.json";
+const FETCH_TIMEOUT_MS = 8_000;
+const LABELS = {
+    ...scrubProviderRules_1.PROVIDER_RULE_LABELS,
+    "supabase-token": "Supabase token", "groq-key": "Groq key", "xai-key": "xAI key", "replicate-token": "Replicate token",
+    "aws-access-key": "AWS key", "openai-key": "OpenAI key", "anthropic-key": "Anthropic key",
+    "github-token": "GitHub token", "gitlab-token": "GitLab token", "stripe-key": "Stripe key",
+    "slack-token": "Slack token", "slack-webhook": "Slack webhook", "google-api-key": "Google API key",
+    "pem-private-key": "private key", "convex-deploy-key": "Convex deploy key", "linear-key": "Linear key",
+    "codiedev-key": "Codiedev key", "fireworks-key": "Fireworks key", "npm-token": "npm token",
+    "sendgrid-key": "SendGrid key", "twilio-key": "Twilio key", "azure-storage-key": "Azure storage key",
+    "azure-sas": "Azure SAS token", "url-password": "password in a URL",
+    "curl-auth-header": "token in a curl command", "curl-auth-user": "password in a curl command",
+};
+/** Keys that are real but not worth stopping a prompt for: Stripe test-mode
+ *  keys (sandbox data only), and a Firebase web config's apiKey (public by
+ *  design: it ships in every Firebase web app). A Google key anywhere else
+ *  (Gemini, Maps server keys) still stops the prompt. */
+function harmlessHere(rule, value, prompt) {
+    if (rule === "stripe-key" && /^[sr]k_test_/.test(value))
+        return true;
+    if (rule === "google-api-key" && /firebaseapp\.com|authDomain|firebaseConfig/i.test(prompt))
+        return true;
+    return false;
+}
+function keyLabel(rule) {
+    if (rule.startsWith("custom:"))
+        return rule.slice("custom:".length);
+    return LABELS[rule] ?? rule.replace(/-/g, " ");
+}
+/** The company's own token formats as scrub rules; a bad one is skipped. */
+function formatRules(formats) {
+    const out = [];
+    for (const f of formats) {
+        try {
+            out.push({ name: `custom:${f.name}`, re: new RegExp(`(?<![A-Za-z0-9])${f.source}(?![A-Za-z0-9_-])`, "g"), ...(f.keyword ? { keywords: [f.keyword] } : {}) });
+        }
+        catch { /* skip */ }
+    }
+    return out;
+}
+/** The first real key in a prompt, or null. */
+function findPromptKey(prompt, formats = [], now = Date.now()) {
+    if (!prompt || prompt.length > 2_000_000)
+        return null;
+    const { redactions } = (0, promptRules_1.scrubSecrets)(prompt, { extraRules: formatRules(formats) });
+    for (const r of redactions) {
+        if (promptRules_1.GENERIC_RULES.has(r.rule))
+            continue;
+        const value = prompt.slice(r.start, r.end);
+        if ((0, promptRules_1.notWorthRotating)({ rule: r.rule, value }, now))
+            continue;
+        if (harmlessHere(r.rule, value, prompt))
+            continue;
+        return { rule: r.rule, label: keyLabel(r.rule), hint: (0, promptRules_1.hintOf)(r.rule, value) };
+    }
+    return null;
+}
+/** What the person sees. Names the kind of key and its last four, says
+ *  nothing was sent, and how to do it instead. */
+function blockMessage(key) {
+    const article = /^[aeiou]/i.test(key.label) ? "an" : "a";
+    return `Codiedev stopped this prompt: it has ${article} ${key.label} in it (…${key.hint}). ` +
+        "Nothing was sent to the model. Put the key in an environment variable or .env file and refer to it by name " +
+        "(for example $API_KEY), then send the prompt again. Your team turned on this check.";
+}
+/** The hook's stdout for each harness when it stops a prompt. */
+function blockResponse(harness, message) {
+    // Cursor: beforeSubmitPrompt. Everyone else that reads stdout (Claude
+    // Code, Codex, Copilot's userPromptSubmitted, and our Codie / pi adapters)
+    // takes the Claude-style decision.
+    if (harness === "cursor")
+        return { continue: false, user_message: message };
+    return { decision: "block", reason: message };
+}
+// ---------------------------------------------------------------------------
+// The company's setting, cached on the laptop
+// ---------------------------------------------------------------------------
+function cachePath(stateDir) {
+    return path.join(stateDir, CACHE_FILE);
+}
+function readPromptGuardPolicy(stateDir = (0, configDir_1.codiedevStateDir)()) {
+    try {
+        const v = JSON.parse(fs.readFileSync(cachePath(stateDir), "utf8"));
+        if (typeof v.fetchedAt !== "number")
+            return null;
+        return {
+            blockPrompts: v.blockPrompts === true,
+            formats: Array.isArray(v.formats) ? v.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string").slice(0, 50) : [],
+            fetchedAt: v.fetchedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writePromptGuardPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)()) {
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const file = cachePath(stateDir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(policy), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** Ask the server for the company's setting and cache it. On any failure the
+ *  last cached answer stays (and its age makes the next hook try again). */
+async function refreshPromptGuardPolicy(config, fetchImpl = fetch, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!config?.token || !config.backendUrl)
+        return null;
+    try {
+        const res = await fetchImpl(`${config.backendUrl}/api/cli/promptGuard`, {
+            headers: { Authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const formats = Array.isArray(body.formats)
+            ? body.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string" && f.source.length <= 300).slice(0, 50)
+            : [];
+        const policy = { blockPrompts: body.blockPrompts === true, formats, fetchedAt: now };
+        writePromptGuardPolicy(policy, stateDir);
+        return policy;
+    }
+    catch {
+        return null;
+    }
+}
+/** Start a background refresh when the cached setting is missing or stale.
+ *  Stamps the cache's age first so a burst of hooks starts only one. */
+function maybeSpawnPromptGuardRefresh(opts) {
+    try {
+        if (!opts.connected || process.env.CODIEDEV_PROMPT_GUARD_CHILD)
+            return "disabled";
+        const stateDir = opts.stateDir ?? (0, configDir_1.codiedevStateDir)();
+        const now = opts.now ?? Date.now();
+        const stamp = path.join(stateDir, "prompt-guard.refresh");
+        if (!opts.force) {
+            const cached = readPromptGuardPolicy(stateDir);
+            if (cached && now - cached.fetchedAt < exports.REFRESH_MS && cached.fetchedAt <= now)
+                return "fresh";
+        }
+        try {
+            const last = fs.statSync(stamp).mtimeMs;
+            if (now - last < 60_000 && last <= now)
+                return "fresh"; // one in flight
+        }
+        catch { /* never */ }
+        fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(stamp, String(now));
+        const t = new Date(now);
+        fs.utimesSync(stamp, t, t);
+        const child = (opts.spawn ?? child_process_1.spawn)(process.execPath, [opts.hookEntry ?? path.join(__dirname, "hook.js"), "prompt-guard-refresh"], {
+            detached: true,
+            stdio: "ignore",
+            env: { ...process.env, CODIEDEV_PROMPT_GUARD_CHILD: "1" },
+        });
+        child.on?.("error", () => { });
+        child.unref?.();
+        return "spawned";
+    }
+    catch {
+        return "error";
+    }
+}
+/** Check one prompt against the cached setting. Never throws. */
+function checkPrompt(prompt, harness, policy, now = Date.now()) {
+    try {
+        if (!policy?.blockPrompts || !prompt)
+            return { blocked: false };
+        const key = findPromptKey(prompt, policy.formats, now);
+        if (!key)
+            return { blocked: false };
+        const message = blockMessage(key);
+        return { blocked: true, key, message, response: blockResponse(harness, message) };
+    }
+    catch {
+        return { blocked: false };
+    }
+}
+/** Tell the server a prompt was stopped: the rule and harness only. Detached
+ *  and best-effort; a slow network never holds the prompt hook. */
+function reportPromptBlocked(config, rule, harness, fetchImpl = fetch) {
+    if (!config?.token || !config.backendUrl)
+        return Promise.resolve();
+    return fetchImpl(`${config.backendUrl}/api/cli/promptBlocked`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ rule: rule.slice(0, 80), harness }),
+        signal: AbortSignal.timeout(3_000),
+    }).then(() => undefined, () => undefined);
+}

package/dist/scrub/promptRules.d.ts

@@ -0,0 +1,119 @@
+export interface Redaction {
+    rule: string;
+    start: number;
+    end: number;
+}
+export interface ScrubResult {
+    text: string;
+    redactions: Redaction[];
+}
+/** Rules a caller adds for one scrub (a company's own token formats). */
+export interface ExtraRule {
+    name: string;
+    re: RegExp;
+    keywords?: readonly string[];
+}
+/** Shannon entropy in bits per character, as Gitleaks measures it. */
+export declare function shannonEntropy(s: string): number;
+export declare function scrubSecrets(input: string, opts?: {
+    extraRules?: readonly ExtraRule[];
+}): ScrubResult;
+/** Rewrite `input` with each span replaced by `[REDACTED:<rule>]`. Spans must
+ *  be sorted by start and not overlap. One forward pass: repeated
+ *  slice+concat would copy the whole string per redaction (quadratic). */
+export declare function redactSpans(input: string, spans: readonly Redaction[]): string;
+/** Where in a session a secret appeared. "typed" is a short message the
+ *  person wrote; "pasted" is a long one (a log, config or JSON dump pasted in);
+ *  "attached" is text the harness added to the person's turn (an @-mentioned
+ *  file, a resumed session's summary). Older rows say "prompt" for all three. */
+export type SecretWhere = "typed" | "pasted" | "attached" | "prompt" | "tool_call" | "commit" | "tool_output" | "assistant" | "unknown";
+export interface SecretLocation {
+    where: SecretWhere;
+    /** Tool or MCP tool name for tool calls/outputs when the transcript has it. */
+    tool?: string;
+}
+export interface SecretFinding {
+    rule: string;
+    /** Last four alphanumeric characters of the redacted value — enough for a
+     *  person to recognise which key to rotate, never enough to use it. */
+    hint: string;
+    /** Distinct places in the session the key appeared. */
+    locations: SecretLocation[];
+    /** The variable or field it was assigned to (`X_BEARER_TOKEN`), when the
+     *  text shows one. A name, never the value. */
+    name?: string;
+    /** The file it was written to or read from (`altcap-bot/.env`), when the
+     *  text shows one: last two path parts only. */
+    file?: string;
+}
+/** What a caller may check before a key becomes a finding (exceptions).
+ *  `value` is the key itself: use it to compare, never store it. */
+export interface KeyContext {
+    rule: string;
+    value: string;
+    name?: string;
+    file?: string;
+}
+export declare const GENERIC_RULES: ReadonlySet<string>;
+/** Values that share a key's shape but are test or sample values: words
+ *  joined by _ or - with only digits or one repeated character between
+ *  (`cdv_local_pilot_token_2026`, `…_token_000000`), a long counting run
+ *  (`sk-1234567890…`), or a long repeated tail. Still removed from sessions;
+ *  just not listed as a key to rotate. */
+export declare function looksLikeTestValue(value: string): boolean;
+export declare const isTestFile: (file: string) => boolean;
+/** Where in one transcript line (a JSONL record) some text appeared, and the
+ *  file that line reads or writes, if it names one. For any detector that
+ *  works line by line (PHI/PII). `text` is the matched text as it reads
+ *  after JSON unescaping. */
+export declare function locateInLine(line: string, text: string): SecretLocation & {
+    file?: string;
+};
+/** Where each `[REDACTED:<rule>]` marker sits in an already-scrubbed
+ *  transcript. Re-labels older findings that predate typed/pasted/attached. */
+export declare function locateMarkers(scrubbed: string, rule: string): SecretLocation[];
+/** Rules that match a shape (a secret-named variable, a header, a URL, a PEM
+ *  block) rather than a provider's own key format. */
+export declare const SHAPE_RULES: ReadonlySet<string>;
+/** The name or location of a secret, or a value built from words, rather
+ *  than a random key: an ARN, a secret-store path, or a value whose letters
+ *  are mostly whole words (`mobile-data/client2`, `bracecomb-hc-service`,
+ *  `mobileDataClientV2`). A random key does not break into words, whatever
+ *  separators it has: under 1% of random 16-character keys pass this, and
+ *  next to none at 24 or more. */
+export declare function namesASecret(v: string): boolean;
+/** True when a redacted value should not be listed as a key to rotate: a
+ *  placeholder, a sample or test value, a reference to a variable, or a
+ *  credential that expires by itself. `now` is injectable for tests. */
+export declare function notWorthRotating(k: KeyContext, now?: number): boolean;
+/** Last four letters or digits of a value. A PEM block ends in a fixed
+ *  footer, and in a transcript its line breaks are a literal `\n`: the hint
+ *  comes from the key body, without either. */
+export declare function hintOf(rule: string, value: string): string;
+/** One finding per distinct (rule, last-4) in a scrub result, with every
+ *  distinct place it appeared. */
+export declare function secretFindings(input: string, redactions: Redaction[], opts?: {
+    skip?: (k: KeyContext) => boolean;
+    now?: number;
+}): SecretFinding[];
+export interface PossibleSecret {
+    label: string;
+    prefix?: string;
+    hint: string;
+    length: number;
+    shape: "hex" | "base64" | "alnum";
+    snippet: string;
+    locations: SecretLocation[];
+    /** Spans in the text this was read from, for redaction once confirmed. */
+    spans: Array<{
+        start: number;
+        end: number;
+    }>;
+}
+export declare function possibleSecrets(text: string, limit?: number): PossibleSecret[];
+/** Redact every occurrence of an already-reviewed possible secret. */
+export declare function redactPossible(text: string, match: {
+    label: string;
+    hint: string;
+    length: number;
+}, rule?: string): ScrubResult;