codiedev 0.9.89 → 0.9.91

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr" | "limit" | "self-update";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr" | "limit" | "self-update" | "prompt-guard";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/codie.js

@@ -176,6 +176,57 @@ function installBrandWordmarkUnsafe(runtime) {
             (0, child_process_1.spawnSync)("codesign", ["--force", "--sign", "-", runtime], { stdio: "ignore" });
     }
 }
+async function runNonInteractive(runtime, runtimeArgs, env) {
+    const detached = process.platform !== "win32";
+    const child = (0, child_process_1.spawn)(runtime, runtimeArgs, {
+        stdio: ["pipe", "pipe", "pipe"],
+        env,
+        detached,
+    });
+    if (child.stdin)
+        process.stdin.pipe(child.stdin);
+    const signalChild = (signal) => {
+        if (detached && child.pid) {
+            try {
+                process.kill(-child.pid, signal);
+                return;
+            }
+            catch {
+                // Fall back to the direct child if its process group already exited.
+            }
+        }
+        child.kill(signal);
+    };
+    const forwardInterrupt = () => signalChild("SIGINT");
+    const forwardTermination = () => signalChild("SIGTERM");
+    process.once("SIGINT", forwardInterrupt);
+    process.once("SIGTERM", forwardTermination);
+    return await new Promise((resolve, reject) => {
+        child.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+        child.stderr?.on("data", (chunk) => {
+            // The Codiedev plugin stopped a prompt with a key in it: print its
+            // reason plainly instead of the private marker line.
+            const text = chunk.toString("utf8");
+            if (!text.includes(codieLauncher_1.PROMPT_BLOCK_MARKER))
+                return process.stderr.write(chunk);
+            process.stderr.write(text.split(/\r?\n/).map((line) => (0, codieLauncher_1.promptBlockLine)(line) ?? line).join("\n"));
+        });
+        child.once("error", (error) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
+            process.removeListener("SIGINT", forwardInterrupt);
+            process.removeListener("SIGTERM", forwardTermination);
+            reject(error);
+        });
+        child.once("close", (status) => {
+            if (child.stdin)
+                process.stdin.unpipe(child.stdin);
+            process.removeListener("SIGINT", forwardInterrupt);
+            process.removeListener("SIGTERM", forwardTermination);
+            resolve(status);
+        });
+    });
+}
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
     if (!process.env.CODIEDEV_GATEWAY_KEY && !process.env.CODIEDEV_TOKEN) {
@@ -303,6 +354,10 @@ async function main() {
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
     const nonInteractiveRun = runtimeArgs[0] === "run";
+    // A run has no TUI to show a stopped prompt; the plugin hands the reason
+    // back on stderr instead (see runNonInteractive).
+    if (nonInteractiveRun)
+        env.CODIEDEV_PROMPT_BLOCK_OUTPUT = "marker";
     if (nonInteractiveRun) {
         // The TUI paints its own live status line from the same endpoint. A
         // non-interactive run has no TUI, so the budget arrives as two printed
@@ -315,10 +370,7 @@ async function main() {
             if (line)
                 console.error(line);
         }
-        const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
-        if (result.error)
-            throw result.error;
-        process.exitCode = result.status === null ? 1 : result.status;
+        process.exitCode = (await runNonInteractive(runtime, runtimeArgs, env)) ?? 1;
         if (reportCost) {
             // The gateway books a request's cost after it has answered, so a poll
             // fired the instant the run closes can miss the last one.

package/dist/codieLauncher.d.ts

@@ -89,3 +89,6 @@ export declare function parseCodieArgs(argv: string[]): {
     overrides: Record<string, string>;
 };
 export declare function validateCodieArgs(args: string[], catalog: CatalogModel[]): void;
+export declare const PROMPT_BLOCK_MARKER = "__CODIEDEV_PROMPT_BLOCKED__";
+/** The reason on a marker line, or null for any other line. */
+export declare function promptBlockLine(line: string): string | null;

package/dist/codieLauncher.js

@@ -42,7 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = void 0;
+exports.PROMPT_BLOCK_MARKER = exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.USAGE_MODULE_PLACEHOLDER = void 0;
 exports.usableModelCost = usableModelCost;
 exports.usableModelLimit = usableModelLimit;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
@@ -56,6 +56,7 @@ exports.resolveCapturePlugin = resolveCapturePlugin;
 exports.fetchApprovedCatalog = fetchApprovedCatalog;
 exports.parseCodieArgs = parseCodieArgs;
 exports.validateCodieArgs = validateCodieArgs;
+exports.promptBlockLine = promptBlockLine;
 const path = __importStar(require("path"));
 const url_1 = require("url");
 const harnessDirs_1 = require("./harnessDirs");
@@ -461,3 +462,17 @@ function validateCodieArgs(args, catalog) {
         }
     }
 }
+exports.PROMPT_BLOCK_MARKER = "__CODIEDEV_PROMPT_BLOCKED__";
+/** The reason on a marker line, or null for any other line. */
+function promptBlockLine(line) {
+    const at = line.indexOf(exports.PROMPT_BLOCK_MARKER);
+    if (at < 0)
+        return null;
+    try {
+        const reason = JSON.parse(line.slice(at + exports.PROMPT_BLOCK_MARKER.length)).reason;
+        return typeof reason === "string" && reason.trim() ? `\n${reason.trim()}` : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/hook.js

@@ -64,6 +64,7 @@ const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
 const cliSession_1 = require("./cliSession");
 const utils_2 = require("./utils");
+const promptGuard_1 = require("./promptGuard");
 // Pure builder for the discovery additionalContext. Returns null when there are
 // no matches. The suggested `codiedev pull` command carries the EXACT top key
 // (e.g. "pr-push.md") rather than a "<key>" placeholder — otherwise agents
@@ -597,6 +598,48 @@ async function main() {
     catch {
         process.exit(0);
     }
+    // Privacy exclusions suppress every Codiedev upload.
+    const captureIgnored = (0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput);
+    // Background refresh of the company's "stop prompts with a key" setting.
+    if (process.argv[2] === "prompt-guard-refresh") {
+        await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
+        await (0, promptGuard_1.refreshPromptGuardPolicy)((0, utils_1.readConfig)());
+        process.exit(0);
+    }
+    // Stop a prompt with a key in it, when the company turned that on. Runs
+    // before discovery (which would send the prompt to the backend) and even
+    // where capture is excluded: it's local and never uploads the prompt.
+    const PROMPT_HOOKS = {
+        discover: "claude-code",
+        "discover-codex": "codex",
+        "discover-codie": "codie-harness",
+        "discover-copilot": "copilot",
+        "discover-pi": "pi",
+        "prompt-guard-cursor": "cursor",
+    };
+    const promptHarness = PROMPT_HOOKS[process.argv[2] ?? ""];
+    if (promptHarness) {
+        const guard = (0, promptGuard_1.checkPrompt)(hookInput.prompt, promptHarness, (0, promptGuard_1.readPromptGuardPolicy)());
+        // An ignored session makes no Codiedev request, not even this refresh.
+        if (!captureIgnored)
+            (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
+        if (guard.blocked) {
+            (0, captureLog_1.appendCaptureLog)({
+                stage: "prompt-guard",
+                sessionId: hookInput.session_id ?? "unknown",
+                outcome: "ok",
+                detail: `blocked harness=${promptHarness} rule=${guard.key.rule}`,
+            });
+            process.stdout.write(JSON.stringify(guard.response));
+            if (!captureIgnored)
+                await (0, promptGuard_1.reportPromptBlocked)((0, utils_1.readConfig)(), guard.key.rule, promptHarness);
+            process.exit(0);
+        }
+        if (promptHarness === "cursor") {
+            process.stdout.write(JSON.stringify({ continue: true }));
+            process.exit(0);
+        }
+    }
     // Local privacy boundary: every stdin-driven hook mode passes through this
     // check BEFORE prompt discovery, limit-event tails, SessionStart pings,
     // backup, self-heal, transcript reads, or detached dispatch. Ignored means
@@ -642,6 +685,11 @@ async function main() {
             // starts it (hourly throttle inside).
             (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
         }
+        // Scripted sessions (`claude -p`, the Agent SDK, `codex exec`, `codie run`,
+        // `pi -p`) get no suggestion: they run a fixed job and ignore it, and a
+        // pipeline fires this hook hundreds of times a day.
+        if (promptHarness && (0, launchContext_1.isScriptedPrompt)(promptHarness, hookInput))
+            return;
         if (process.argv[2] !== "discover-copilot")
             await runDiscover(hookInput.prompt);
         return;
@@ -665,6 +713,8 @@ async function main() {
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
         // Local session scrub of past sessions on this machine (hourly, detached).
         (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
+        // Keep "stop prompts with a key" current before the first prompt.
+        (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         // Claude Code adds SessionStart stdout to the session context.
         if (packNag && process.argv[2] === "session-start")
@@ -716,6 +766,8 @@ async function main() {
     }
     if (process.argv[2] === "capture-codex")
         (0, utils_1.ensureCodexLimitHookInstalled)();
+    if (/-opencode(?:-final)?$/.test(process.argv[2] ?? ""))
+        (0, utils_1.ensureOpenCodePluginCurrent)();
     const { session_id, transcript_path, cwd, workspace_roots } = hookInput;
     // Read here, in the process the harness spawned: the detached capture child
     // is reparented once this exits and can no longer see who launched it.

package/dist/launchContext.d.ts

@@ -43,4 +43,31 @@ export declare function hookLaunch(hookCommand: string | undefined, input: {
     copilotClientName?: string;
     detectCopilot?: () => string | undefined;
 }): string | undefined;
+/** Codex writes `session_meta` as the first line of its rollout file; its
+ *  `source` is "cli", "vscode", "exec" (`codex exec`), "mcp", or an object
+ *  for a sub-agent. A first line longer than `head` reads as unknown. */
+export declare function codexLaunchFromRolloutHead(head: string): string | undefined;
+export type PromptHookHarness = "claude-code" | "codex" | "codie-harness" | "copilot" | "pi";
+/**
+ * True when a prompt hook is running inside a session a script started
+ * (`claude -p`, the Agent SDK, `codex exec`, `codie run`, `pi -p`…). Such a
+ * session already knows what it is doing, so team-skill suggestions are
+ * skipped for it: the lookup would send every scripted prompt to the backend
+ * for advice nothing reads.
+ *
+ * Where the answer comes from, per harness:
+ *  - Codie and pi pass `launch` in the hook input (their plugin knows its argv).
+ *  - Claude Code names its entrypoint in the hook's environment: "cli" for a
+ *    person, "sdk-*" for a script.
+ *  - Codex records it on the first line of the rollout file the hook is given.
+ * Unknown or absent values are treated as a person, so nobody loses
+ * suggestions by mistake.
+ */
+export declare function isScriptedPrompt(harness: PromptHookHarness, input: {
+    launch?: unknown;
+    transcript_path?: unknown;
+}, deps?: {
+    env?: Record<string, string | undefined>;
+    readHead?: (file: string) => string;
+}): boolean;
 export {};

package/dist/launchContext.js

@@ -7,7 +7,10 @@ exports.windowsAncestors = windowsAncestors;
 exports.detectCursorLaunch = detectCursorLaunch;
 exports.detectCopilotLaunch = detectCopilotLaunch;
 exports.hookLaunch = hookLaunch;
+exports.codexLaunchFromRolloutHead = codexLaunchFromRolloutHead;
+exports.isScriptedPrompt = isScriptedPrompt;
 const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
 /**
  * How a harness that records nothing about its own launch was started.
  * Claude Code (`entrypoint`) and Codex (`session_meta.source`) stamp this in
@@ -198,3 +201,79 @@ function hookLaunch(hookCommand, input, deps = {}) {
     }
     return undefined;
 }
+/** Launch values a script drives. Mirrors isScriptedEntrypoint in
+ *  convex/lib/sessionAutomation.ts, plus pi's print/json/rpc modes, which
+ *  docs/dev-users/install.md also counts as scripted. */
+const SCRIPTED_LAUNCHES = new Set([
+    "codex:exec", "codex:mcp",
+    "codie:run", "codie:serve", "codie:acp",
+    "cursor:print", "copilot:print",
+    "pi:print", "pi:json", "pi:rpc",
+]);
+const isScriptedLaunch = (launch) => launch.startsWith("sdk") || SCRIPTED_LAUNCHES.has(launch);
+/** Codex writes `session_meta` as the first line of its rollout file; its
+ *  `source` is "cli", "vscode", "exec" (`codex exec`), "mcp", or an object
+ *  for a sub-agent. A first line longer than `head` reads as unknown. */
+function codexLaunchFromRolloutHead(head) {
+    const end = head.indexOf("\n");
+    if (end < 0)
+        return undefined;
+    try {
+        const first = JSON.parse(head.slice(0, end));
+        if (first?.type !== "session_meta")
+            return undefined;
+        const src = first.payload?.source;
+        if (typeof src === "string")
+            return VALUE.test(`codex:${src}`) ? `codex:${src}` : undefined;
+        if (src && typeof src === "object")
+            return `codex:${Object.keys(src)[0] ?? "other"}`;
+    }
+    catch {
+        // not JSON: unknown
+    }
+    return undefined;
+}
+/** The first `bytes` of a file, or "" when it can't be read. */
+function readHead(file, bytes = 256 * 1024) {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(file, "r");
+        const buf = Buffer.alloc(bytes);
+        return buf.toString("utf8", 0, (0, node_fs_1.readSync)(fd, buf, 0, bytes, 0));
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (fd !== undefined)
+            (0, node_fs_1.closeSync)(fd);
+    }
+}
+/**
+ * True when a prompt hook is running inside a session a script started
+ * (`claude -p`, the Agent SDK, `codex exec`, `codie run`, `pi -p`…). Such a
+ * session already knows what it is doing, so team-skill suggestions are
+ * skipped for it: the lookup would send every scripted prompt to the backend
+ * for advice nothing reads.
+ *
+ * Where the answer comes from, per harness:
+ *  - Codie and pi pass `launch` in the hook input (their plugin knows its argv).
+ *  - Claude Code names its entrypoint in the hook's environment: "cli" for a
+ *    person, "sdk-*" for a script.
+ *  - Codex records it on the first line of the rollout file the hook is given.
+ * Unknown or absent values are treated as a person, so nobody loses
+ * suggestions by mistake.
+ */
+function isScriptedPrompt(harness, input, deps = {}) {
+    if (typeof input.launch === "string" && VALUE.test(input.launch))
+        return isScriptedLaunch(input.launch);
+    if (harness === "claude-code") {
+        const entrypoint = (deps.env ?? process.env).CLAUDE_CODE_ENTRYPOINT;
+        return typeof entrypoint === "string" && entrypoint.startsWith("sdk");
+    }
+    if (harness === "codex" && typeof input.transcript_path === "string" && input.transcript_path) {
+        const launch = codexLaunchFromRolloutHead((deps.readHead ?? readHead)(input.transcript_path));
+        return launch !== undefined && isScriptedLaunch(launch);
+    }
+    return false;
+}

package/dist/promptGuard.d.ts

@@ -0,0 +1,63 @@
+import { spawn as nodeSpawn } from "child_process";
+import { type ExtraRule } from "./scrub/promptRules";
+export type PromptHarness = "claude-code" | "codex" | "cursor" | "codie-harness" | "copilot" | "pi";
+export interface TokenFormat {
+    name: string;
+    source: string;
+    keyword?: string;
+}
+export interface PromptGuardPolicy {
+    blockPrompts: boolean;
+    formats: TokenFormat[];
+    fetchedAt: number;
+}
+export declare const REFRESH_MS: number;
+export interface PromptKey {
+    rule: string;
+    label: string;
+    hint: string;
+}
+export declare function keyLabel(rule: string): string;
+/** The company's own token formats as scrub rules; a bad one is skipped. */
+export declare function formatRules(formats: readonly TokenFormat[]): ExtraRule[];
+/** The first real key in a prompt, or null. */
+export declare function findPromptKey(prompt: string, formats?: readonly TokenFormat[], now?: number): PromptKey | null;
+/** What the person sees. Names the kind of key and its last four, says
+ *  nothing was sent, and how to do it instead. */
+export declare function blockMessage(key: PromptKey): string;
+/** The hook's stdout for each harness when it stops a prompt. */
+export declare function blockResponse(harness: PromptHarness, message: string): Record<string, unknown>;
+export declare function readPromptGuardPolicy(stateDir?: string): PromptGuardPolicy | null;
+export declare function writePromptGuardPolicy(policy: PromptGuardPolicy, stateDir?: string): void;
+interface GuardConfig {
+    token?: string;
+    backendUrl?: string;
+}
+/** Ask the server for the company's setting and cache it. On any failure the
+ *  last cached answer stays (and its age makes the next hook try again). */
+export declare function refreshPromptGuardPolicy(config: GuardConfig | null, fetchImpl?: typeof fetch, stateDir?: string, now?: number): Promise<PromptGuardPolicy | null>;
+/** Start a background refresh when the cached setting is missing or stale.
+ *  Stamps the cache's age first so a burst of hooks starts only one. */
+export declare function maybeSpawnPromptGuardRefresh(opts: {
+    connected: boolean;
+    stateDir?: string;
+    now?: number;
+    hookEntry?: string;
+    spawn?: typeof nodeSpawn;
+    force?: boolean;
+}): "spawned" | "fresh" | "disabled" | "error";
+export interface PromptCheck {
+    blocked: false;
+}
+export interface PromptBlocked {
+    blocked: true;
+    key: PromptKey;
+    message: string;
+    response: Record<string, unknown>;
+}
+/** Check one prompt against the cached setting. Never throws. */
+export declare function checkPrompt(prompt: string | undefined, harness: PromptHarness, policy: PromptGuardPolicy | null, now?: number): PromptCheck | PromptBlocked;
+/** Tell the server a prompt was stopped: the rule and harness only. Detached
+ *  and best-effort; a slow network never holds the prompt hook. */
+export declare function reportPromptBlocked(config: GuardConfig | null, rule: string, harness: PromptHarness, fetchImpl?: typeof fetch): Promise<void>;
+export {};

package/dist/promptGuard.js

@@ -0,0 +1,261 @@
+"use strict";
+// Stop a prompt that has a key in it before it reaches the model. Off unless
+// a company admin turns it on (Team Security → Settings → Stop prompts with a
+// key). Everything happens on the laptop: the prompt and the key are never
+// sent anywhere; when a prompt is stopped the server only hears which kind of
+// key it was and which harness, for the team's activity feed.
+//
+// Precision over recall: only a provider's own key format (sk-ant-…, ghp_…,
+// AKIA…), a private key block, a password in a URL, or one of the company's
+// own token formats stops a prompt, and only when the value looks real (not a
+// placeholder, sample or test value: scrub/rules notWorthRotating). Generic
+// shapes (KEY=value, Bearer …, JWTs) never stop one; the scrub still removes
+// them from stored sessions.
+//
+// The hook must answer fast and offline, so it reads a cached copy of the
+// company's setting. The cache is refreshed in the background (at session
+// start, and from the prompt hook when it is over REFRESH_MS old).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_MS = void 0;
+exports.keyLabel = keyLabel;
+exports.formatRules = formatRules;
+exports.findPromptKey = findPromptKey;
+exports.blockMessage = blockMessage;
+exports.blockResponse = blockResponse;
+exports.readPromptGuardPolicy = readPromptGuardPolicy;
+exports.writePromptGuardPolicy = writePromptGuardPolicy;
+exports.refreshPromptGuardPolicy = refreshPromptGuardPolicy;
+exports.maybeSpawnPromptGuardRefresh = maybeSpawnPromptGuardRefresh;
+exports.checkPrompt = checkPrompt;
+exports.reportPromptBlocked = reportPromptBlocked;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const configDir_1 = require("./configDir");
+const promptRules_1 = require("./scrub/promptRules");
+const scrubProviderRules_1 = require("./scrub/scrubProviderRules");
+exports.REFRESH_MS = 10 * 60_000;
+const CACHE_FILE = "prompt-guard.json";
+const FETCH_TIMEOUT_MS = 8_000;
+const LABELS = {
+    ...scrubProviderRules_1.PROVIDER_RULE_LABELS,
+    "supabase-token": "Supabase token", "groq-key": "Groq key", "xai-key": "xAI key", "replicate-token": "Replicate token",
+    "aws-access-key": "AWS key", "openai-key": "OpenAI key", "anthropic-key": "Anthropic key",
+    "github-token": "GitHub token", "gitlab-token": "GitLab token", "stripe-key": "Stripe key",
+    "slack-token": "Slack token", "slack-webhook": "Slack webhook", "google-api-key": "Google API key",
+    "pem-private-key": "private key", "convex-deploy-key": "Convex deploy key", "linear-key": "Linear key",
+    "codiedev-key": "Codiedev key", "fireworks-key": "Fireworks key", "npm-token": "npm token",
+    "sendgrid-key": "SendGrid key", "twilio-key": "Twilio key", "azure-storage-key": "Azure storage key",
+    "azure-sas": "Azure SAS token", "url-password": "password in a URL",
+    "curl-auth-header": "token in a curl command", "curl-auth-user": "password in a curl command",
+};
+/** Keys that are real but not worth stopping a prompt for: Stripe test-mode
+ *  keys (sandbox data only), and a Firebase web config's apiKey (public by
+ *  design: it ships in every Firebase web app). A Google key anywhere else
+ *  (Gemini, Maps server keys) still stops the prompt. */
+function harmlessHere(rule, value, prompt) {
+    if (rule === "stripe-key" && /^[sr]k_test_/.test(value))
+        return true;
+    if (rule === "google-api-key" && /firebaseapp\.com|authDomain|firebaseConfig/i.test(prompt))
+        return true;
+    return false;
+}
+function keyLabel(rule) {
+    if (rule.startsWith("custom:"))
+        return rule.slice("custom:".length);
+    return LABELS[rule] ?? rule.replace(/-/g, " ");
+}
+/** The company's own token formats as scrub rules; a bad one is skipped. */
+function formatRules(formats) {
+    const out = [];
+    for (const f of formats) {
+        try {
+            out.push({ name: `custom:${f.name}`, re: new RegExp(`(?<![A-Za-z0-9])${f.source}(?![A-Za-z0-9_-])`, "g"), ...(f.keyword ? { keywords: [f.keyword] } : {}) });
+        }
+        catch { /* skip */ }
+    }
+    return out;
+}
+/** The first real key in a prompt, or null. */
+function findPromptKey(prompt, formats = [], now = Date.now()) {
+    if (!prompt || prompt.length > 2_000_000)
+        return null;
+    const { redactions } = (0, promptRules_1.scrubSecrets)(prompt, { extraRules: formatRules(formats) });
+    for (const r of redactions) {
+        if (promptRules_1.GENERIC_RULES.has(r.rule))
+            continue;
+        const value = prompt.slice(r.start, r.end);
+        if ((0, promptRules_1.notWorthRotating)({ rule: r.rule, value }, now))
+            continue;
+        if (harmlessHere(r.rule, value, prompt))
+            continue;
+        return { rule: r.rule, label: keyLabel(r.rule), hint: (0, promptRules_1.hintOf)(r.rule, value) };
+    }
+    return null;
+}
+/** What the person sees. Names the kind of key and its last four, says
+ *  nothing was sent, and how to do it instead. */
+function blockMessage(key) {
+    const article = /^[aeiou]/i.test(key.label) ? "an" : "a";
+    return `Codiedev stopped this prompt: it has ${article} ${key.label} in it (…${key.hint}). ` +
+        "Nothing was sent to the model. Put the key in an environment variable or .env file and refer to it by name " +
+        "(for example $API_KEY), then send the prompt again. Your team turned on this check.";
+}
+/** The hook's stdout for each harness when it stops a prompt. */
+function blockResponse(harness, message) {
+    // Cursor: beforeSubmitPrompt. Everyone else that reads stdout (Claude
+    // Code, Codex, Copilot's userPromptSubmitted, and our Codie / pi adapters)
+    // takes the Claude-style decision.
+    if (harness === "cursor")
+        return { continue: false, user_message: message };
+    return { decision: "block", reason: message };
+}
+// ---------------------------------------------------------------------------
+// The company's setting, cached on the laptop
+// ---------------------------------------------------------------------------
+function cachePath(stateDir) {
+    return path.join(stateDir, CACHE_FILE);
+}
+function readPromptGuardPolicy(stateDir = (0, configDir_1.codiedevStateDir)()) {
+    try {
+        const v = JSON.parse(fs.readFileSync(cachePath(stateDir), "utf8"));
+        if (typeof v.fetchedAt !== "number")
+            return null;
+        return {
+            blockPrompts: v.blockPrompts === true,
+            formats: Array.isArray(v.formats) ? v.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string").slice(0, 50) : [],
+            fetchedAt: v.fetchedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writePromptGuardPolicy(policy, stateDir = (0, configDir_1.codiedevStateDir)()) {
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const file = cachePath(stateDir);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(policy), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** Ask the server for the company's setting and cache it. On any failure the
+ *  last cached answer stays (and its age makes the next hook try again). */
+async function refreshPromptGuardPolicy(config, fetchImpl = fetch, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now()) {
+    if (!config?.token || !config.backendUrl)
+        return null;
+    try {
+        const res = await fetchImpl(`${config.backendUrl}/api/cli/promptGuard`, {
+            headers: { Authorization: `Bearer ${config.token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const formats = Array.isArray(body.formats)
+            ? body.formats.filter((f) => f && typeof f.name === "string" && typeof f.source === "string" && f.source.length <= 300).slice(0, 50)
+            : [];
+        const policy = { blockPrompts: body.blockPrompts === true, formats, fetchedAt: now };
+        writePromptGuardPolicy(policy, stateDir);
+        return policy;
+    }
+    catch {
+        return null;
+    }
+}
+/** Start a background refresh when the cached setting is missing or stale.
+ *  Stamps the cache's age first so a burst of hooks starts only one. */
+function maybeSpawnPromptGuardRefresh(opts) {
+    try {
+        if (!opts.connected || process.env.CODIEDEV_PROMPT_GUARD_CHILD)
+            return "disabled";
+        const stateDir = opts.stateDir ?? (0, configDir_1.codiedevStateDir)();
+        const now = opts.now ?? Date.now();
+        const stamp = path.join(stateDir, "prompt-guard.refresh");
+        if (!opts.force) {
+            const cached = readPromptGuardPolicy(stateDir);
+            if (cached && now - cached.fetchedAt < exports.REFRESH_MS && cached.fetchedAt <= now)
+                return "fresh";
+        }
+        try {
+            const last = fs.statSync(stamp).mtimeMs;
+            if (now - last < 60_000 && last <= now)
+                return "fresh"; // one in flight
+        }
+        catch { /* never */ }
+        fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+        fs.writeFileSync(stamp, String(now));
+        const t = new Date(now);
+        fs.utimesSync(stamp, t, t);
+        const child = (opts.spawn ?? child_process_1.spawn)(process.execPath, [opts.hookEntry ?? path.join(__dirname, "hook.js"), "prompt-guard-refresh"], {
+            detached: true,
+            stdio: "ignore",
+            env: { ...process.env, CODIEDEV_PROMPT_GUARD_CHILD: "1" },
+        });
+        child.on?.("error", () => { });
+        child.unref?.();
+        return "spawned";
+    }
+    catch {
+        return "error";
+    }
+}
+/** Check one prompt against the cached setting. Never throws. */
+function checkPrompt(prompt, harness, policy, now = Date.now()) {
+    try {
+        if (!policy?.blockPrompts || !prompt)
+            return { blocked: false };
+        const key = findPromptKey(prompt, policy.formats, now);
+        if (!key)
+            return { blocked: false };
+        const message = blockMessage(key);
+        return { blocked: true, key, message, response: blockResponse(harness, message) };
+    }
+    catch {
+        return { blocked: false };
+    }
+}
+/** Tell the server a prompt was stopped: the rule and harness only. Detached
+ *  and best-effort; a slow network never holds the prompt hook. */
+function reportPromptBlocked(config, rule, harness, fetchImpl = fetch) {
+    if (!config?.token || !config.backendUrl)
+        return Promise.resolve();
+    return fetchImpl(`${config.backendUrl}/api/cli/promptBlocked`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ rule: rule.slice(0, 80), harness }),
+        signal: AbortSignal.timeout(3_000),
+    }).then(() => undefined, () => undefined);
+}