opencode-varlock 0.0.9 → 0.0.10

package/README.md

@@ -1,16 +1,27 @@
 # opencode-varlock
 
-OpenCode plugin that gives agents access to environment variables without revealing secret values.
+[![npm version](https://img.shields.io/npm/v/opencode-varlock)](https://www.npmjs.com/package/opencode-varlock)
+[![CI](https://github.com/itlackey/opencode-varlock/actions/workflows/test.yml/badge.svg)](https://github.com/itlackey/opencode-varlock/actions/workflows/test.yml)
 
-> Warning
+OpenCode plugin that gives agents access to secrets without revealing the values. The plugin leverages [varlock](https://varlock.dev) and [opencode](https://opencode.ai) features to provide a multi-layered defense against intentional and accidental secret leakage by OpenCode agents.
+
+> [!Important]
 > This plugin is still early in development, and there is active work underway to improve its security model and edge-case protections. PRs, issue reports, and security feedback are very welcome.
 
 ## What it does
 
 - provides `load_env` so agents can use `.env` values without seeing them directly
-- provides `load_secrets` and `secret_status` when the Varlock CLI is available
-- blocks direct secret reads with permission presets plus a `tool.execute.before` guard
-- tries to catch common workarounds like interpreter-based env reads
+- provides `load_secrets` and `secret_status` when the [Varlock CLI](https://varlock.dev) is available
+- uses `varlock load --format json` and `varlock printenv` to integrate with the varlock.dev CLI
+- blocks direct secret reads with a `tool.execute.before` guard covering:
+  - 50+ bash deny patterns and 9 interpreter-based env read detectors
+  - 30+ file processor commands (`sed`, `awk`, `dd`, `tee`, `xxd`, etc.)
+  - shell redirects, encoding/eval bypasses, and variable listing commands
+  - varlock CLI self-exfiltration (`varlock printenv`, `varlock load --format env`)
+- scrubs loaded secret values from tool output via a `tool.execute.after` hook
+- whitelists `.env.schema` and `.env.example` (safe for AI consumption per varlock.dev design)
+- validates config files and prevents agents from tampering with plugin configuration
+- prevents symlink traversal and command injection in tool arguments
 
 ## Install
 
@@ -25,9 +36,45 @@ Add the package to your `opencode.json` file:
 
 ## Configuration
 
+### Permissions
+
+In addition to adding the plugin to the array, we recommend adding some additional permission settings to your config. There are a few recommended "presets" in the [assets/permissions.json](assets/permissions.json) file, but here is a basic example:
+
+```json
+{
+  "permission": {
+    "bash": {
+      "cat *.env*": "deny",
+      "less *.env*": "deny",
+      "more *.env*": "deny",
+      "head *.env*": "deny",
+      "tail *.env*": "deny",
+      "grep * .env*": "deny",
+      "echo $*": "deny",
+      "python*getenv*": "deny",
+      "python*os.environ*": "deny",
+      "python*open*env*": "deny",
+      "node*process.env*": "deny",
+      "printenv*": "deny",
+      "env": "deny",
+      "export -p": "deny",
+      "source .env*": "deny",
+      "varlock printenv*": "deny",
+      "varlock load --show*": "deny",
+      "varlock load --format*": "deny",
+      "varlock load -f*": "deny",
+      "sed * .env*": "deny",
+      "awk * .env*": "deny"
+    }
+  }
+}
+```
+
+### Plugin Config
+
 `varlock.config.json` is optional.
 
-If you do not provide one, the plugin uses its built-in defaults from [assets/varlock.config.json](assets/varlock.config.json). Create a local config only when you want to override those defaults.
+If you do not provide one, the plugin uses its built-in defaults from [assets/varlock.config.json](assets/varlock.config.json). Create a local config and place it in your `.opencode` or `~/.config/opencode` directory when you want to override those defaults.
 
 Quick example:
 
@@ -41,11 +88,6 @@ Quick example:
 }
 ```
 
-Useful files:
-- default config: `assets/varlock.config.json`
-- JSON schema: `assets/varlock.schema.json`
-- recommended permission configurations: `assets/permissions.json`
-
 ## Docs
 
 - setup and overrides: `docs/configuration.md`
@@ -54,14 +96,11 @@ Useful files:
 - exported APIs and tools: `docs/api.md`
 - Docker + pass guide: `docs/docker-pass-guide.md`
 
-## Repo layout
+## Useful files
 
-```text
-src/    TypeScript source
-assets/ Packaged JSON assets
-docs/   Guides and reference docs
-tests/  Unit and integration tests
-```
+- default config: `assets/varlock.config.json`
+- JSON schema: `assets/varlock.schema.json`
+- recommended permission configurations: `assets/permissions.json`
 
 ## License
 

package/assets/permissions.json

@@ -18,14 +18,22 @@
         "head *.env*": "deny",
         "tail *.env*": "deny",
         "grep * .env*": "deny",
+        "sed * .env*": "deny",
+        "awk * .env*": "deny",
         "echo $*": "deny",
         "python*getenv*": "deny",
         "python*os.environ*": "deny",
+        "python*open*env*": "deny",
         "node*process.env*": "deny",
+        "node*readFileSync*env*": "deny",
         "printenv*": "deny",
         "env": "deny",
         "export -p": "deny",
         "source .env*": "deny",
+        "varlock printenv*": "deny",
+        "varlock load --show*": "deny",
+        "varlock load --format*": "deny",
+        "varlock load -f*": "deny",
         "npm test": "allow",
         "npm run *": "allow",
         "bun test": "allow",
@@ -42,22 +50,27 @@
     "permission": {
       "read": {
         "*.env*": "deny",
+        "*.env.schema": "allow",
+        "*.env.example": "allow",
         "*.pem": "deny",
         "*.key": "deny",
         "*credentials*": "deny",
         "*.pgpass": "deny",
+        "*varlock.config*": "deny",
         "*": "ask"
       },
       "write": {
         "*.env*": "deny",
         "*.pem": "deny",
         "*.key": "deny",
+        "*varlock.config*": "deny",
         "*": "ask"
       },
       "edit": {
         "*.env*": "deny",
         "*.pem": "deny",
         "*.key": "deny",
+        "*varlock.config*": "deny",
         "*": "ask"
       },
       "bash": {
@@ -67,20 +80,39 @@
         "head *.env*": "deny",
         "tail *.env*": "deny",
         "grep * .env*": "deny",
+        "sed * .env*": "deny",
+        "awk * .env*": "deny",
+        "cut * .env*": "deny",
+        "sort .env*": "deny",
+        "dd if=.env*": "deny",
+        "tee * .env*": "deny",
+        "xxd .env*": "deny",
         "echo $*": "deny",
         "python*getenv*": "deny",
         "python*os.environ*": "deny",
+        "python*open*env*": "deny",
         "node*process.env*": "deny",
+        "node*readFileSync*env*": "deny",
+        "ruby*File.read*env*": "deny",
         "printenv*": "deny",
         "env": "deny",
         "env *": "deny",
         "export -p": "deny",
         "declare -x": "deny",
+        "compgen -v": "deny",
+        "compgen -A variable": "deny",
+        "typeset -x": "deny",
         "source .env*": "deny",
         ". .env*": "deny",
         "set -a*": "deny",
         "curl *env*": "deny",
         "wget *env*": "deny",
+        "varlock printenv*": "deny",
+        "varlock load --show*": "deny",
+        "varlock load --format*": "deny",
+        "varlock load -f*": "deny",
+        "*base64*|*bash*": "deny",
+        "*base64*|*sh*": "deny",
         "npm test": "allow",
         "npm run *": "allow",
         "bun test": "allow",
@@ -97,20 +129,25 @@
     "permission": {
       "read": {
         "*.env*": "deny",
+        "*.env.schema": "allow",
+        "*.env.example": "allow",
         "*.pem": "deny",
         "*.key": "deny",
         "*credentials*": "deny",
         "*secret*": "deny",
+        "*varlock.config*": "deny",
         "*": "allow"
       },
       "write": {
         "*.env*": "deny",
+        "*varlock.config*": "deny",
         "*.ts": "ask",
         "*.js": "ask",
         "*": "deny"
       },
       "edit": {
         "*.env*": "deny",
+        "*varlock.config*": "deny",
         "*.ts": "ask",
         "*.js": "ask",
         "*": "deny"
@@ -141,17 +178,27 @@
         "permission": {
           "read": {
             "*.env*": "deny",
+            "*.env.schema": "allow",
+            "*.env.example": "allow",
             "*.pem": "deny",
+            "*varlock.config*": "deny",
             "*": "allow"
           },
           "bash": {
             "cat *.env*": "deny",
+            "sed * .env*": "deny",
+            "awk * .env*": "deny",
             "printenv*": "deny",
             "echo $*": "deny",
             "python*getenv*": "deny",
             "python*os.environ*": "deny",
+            "python*open*env*": "deny",
             "node*process.env*": "deny",
             "env": "deny",
+            "compgen -v": "deny",
+            "varlock printenv*": "deny",
+            "varlock load --format*": "deny",
+            "varlock load --show*": "deny",
             "docker *": "allow",
             "npm *": "allow",
             "bun *": "allow",

package/assets/varlock.config.json

@@ -13,7 +13,8 @@
       ".pem",
       ".key",
       "credentials",
-      ".pgpass"
+      ".pgpass",
+      "varlock.config"
     ],
 
     "sensitiveGlobs": [
@@ -26,7 +27,9 @@
       "**/credentials",
       "**/credentials.*",
       "**/.pgpass",
-      "secrets/**"
+      "secrets/**",
+      "**/varlock.config.json",
+      "**/.opencode/varlock.config.json"
     ],
 
     "bashDenyPatterns": [],
@@ -43,7 +46,7 @@
   },
 
   "varlock": {
-    "$comment": "Varlock integration - pull secrets from pass, Azure KV, AWS, 1Password, etc.",
+    "$comment": "Varlock integration - uses varlock load/printenv to pull secrets from configured backends",
 
     "enabled": false,
     "autoDetect": true,

package/dist/config.d.ts

@@ -36,6 +36,11 @@ export type PluginConfig = {
     varlock: VarlockConfig;
 };
 export declare const DEFAULT_CONFIG: PluginConfig;
+/**
+ * Validates a parsed config object against the expected schema.
+ * Returns an array of human-readable error strings (empty = valid).
+ */
+export declare function validateConfig(config: unknown, logger?: ConfigLogger): string[];
 export declare function loadConfig(cwd: string, overrides?: DeepPartial<PluginConfig>, logger?: ConfigLogger): PluginConfig;
 type DeepPartial<T> = {
     [K in keyof T]?: T[K] extends object ? DeepPartial<T[K]> : T[K];

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE;IACjC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE1B,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,cAAc,EAAE,YAqC5B,CAAA;AAOD,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,WAAW,CAAC,YAAY,CAAM,EACzC,MAAM,CAAC,EAAE,YAAY,GACpB,YAAY,CAyCd;AAED,KAAK,WAAW,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAChE,CAAA;AAED,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GACrB,CAAC,CAyBH;AAED,YAAY,EAAE,WAAW,EAAE,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE;IACjC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAE1B,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,cAAc,EAAE,YAwC5B,CAAA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,EACf,MAAM,CAAC,EAAE,YAAY,GACpB,MAAM,EAAE,CA8HV;AAwFD,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,WAAW,CAAC,YAAY,CAAM,EACzC,MAAM,CAAC,EAAE,YAAY,GACpB,YAAY,CAkFd;AAED,KAAK,WAAW,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAChE,CAAA;AAED,wBAAgB,SAAS,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACrD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GACrB,CAAC,CAyBH;AAED,YAAY,EAAE,WAAW,EAAE,CAAA"}

package/dist/config.js

@@ -19,6 +19,7 @@ export const DEFAULT_CONFIG = {
             ".key",
             "credentials",
             ".pgpass",
+            "varlock.config",
         ],
         sensitiveGlobs: [
             "**/.env",
@@ -31,6 +32,8 @@ export const DEFAULT_CONFIG = {
             "**/credentials.*",
             "**/.pgpass",
             "secrets/**",
+            "**/varlock.config.json",
+            "**/.opencode/varlock.config.json",
         ],
         bashDenyPatterns: [],
         blockedReadTools: ["read", "grep", "glob", "view"],
@@ -47,6 +50,177 @@ export const DEFAULT_CONFIG = {
         namespace: "app",
     },
 };
+/**
+ * Validates a parsed config object against the expected schema.
+ * Returns an array of human-readable error strings (empty = valid).
+ */
+export function validateConfig(config, logger) {
+    const errors = [];
+    if (typeof config !== "object" || config === null) {
+        errors.push("Config must be an object");
+        return errors;
+    }
+    const c = config;
+    // Validate guard section
+    if (c.guard !== undefined) {
+        if (typeof c.guard !== "object" || c.guard === null) {
+            errors.push("guard must be an object");
+        }
+        else {
+            if (c.guard.enabled !== undefined &&
+                typeof c.guard.enabled !== "boolean") {
+                errors.push(`guard.enabled must be boolean, got ${typeof c.guard.enabled}`);
+            }
+            if (c.guard.sensitivePatterns !== undefined &&
+                !Array.isArray(c.guard.sensitivePatterns)) {
+                errors.push("guard.sensitivePatterns must be an array");
+            }
+            if (c.guard.sensitiveGlobs !== undefined &&
+                !Array.isArray(c.guard.sensitiveGlobs)) {
+                errors.push("guard.sensitiveGlobs must be an array");
+            }
+            if (c.guard.bashDenyPatterns !== undefined &&
+                !Array.isArray(c.guard.bashDenyPatterns)) {
+                errors.push("guard.bashDenyPatterns must be an array");
+            }
+            if (c.guard.blockedReadTools !== undefined &&
+                !Array.isArray(c.guard.blockedReadTools)) {
+                errors.push("guard.blockedReadTools must be an array");
+            }
+            if (c.guard.blockedWriteTools !== undefined &&
+                !Array.isArray(c.guard.blockedWriteTools)) {
+                errors.push("guard.blockedWriteTools must be an array");
+            }
+            // Validate array contents are strings
+            for (const arrKey of [
+                "sensitivePatterns",
+                "sensitiveGlobs",
+                "bashDenyPatterns",
+                "blockedReadTools",
+                "blockedWriteTools",
+            ]) {
+                if (Array.isArray(c.guard[arrKey])) {
+                    for (let i = 0; i < c.guard[arrKey].length; i++) {
+                        if (typeof c.guard[arrKey][i] !== "string") {
+                            errors.push(`guard.${arrKey}[${i}] must be a string`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // Validate env section
+    if (c.env !== undefined) {
+        if (typeof c.env !== "object" || c.env === null) {
+            errors.push("env must be an object");
+        }
+        else {
+            if (c.env.enabled !== undefined && typeof c.env.enabled !== "boolean") {
+                errors.push(`env.enabled must be boolean, got ${typeof c.env.enabled}`);
+            }
+            if (c.env.allowedRoot !== undefined &&
+                typeof c.env.allowedRoot !== "string") {
+                errors.push("env.allowedRoot must be a string");
+            }
+        }
+    }
+    // Validate varlock section
+    if (c.varlock !== undefined) {
+        if (typeof c.varlock !== "object" || c.varlock === null) {
+            errors.push("varlock must be an object");
+        }
+        else {
+            if (c.varlock.enabled !== undefined &&
+                typeof c.varlock.enabled !== "boolean") {
+                errors.push(`varlock.enabled must be boolean, got ${typeof c.varlock.enabled}`);
+            }
+            if (c.varlock.autoDetect !== undefined &&
+                typeof c.varlock.autoDetect !== "boolean") {
+                errors.push(`varlock.autoDetect must be boolean, got ${typeof c.varlock.autoDetect}`);
+            }
+            if (c.varlock.command !== undefined &&
+                typeof c.varlock.command !== "string") {
+                errors.push("varlock.command must be a string");
+            }
+            if (c.varlock.namespace !== undefined &&
+                typeof c.varlock.namespace !== "string") {
+                errors.push("varlock.namespace must be a string");
+            }
+        }
+    }
+    return errors;
+}
+/**
+ * Removes invalid keys from a parsed config so they won't be merged.
+ * Mutates the object in place and returns the list of keys that were removed.
+ */
+function sanitizeConfig(config) {
+    const removed = [];
+    const sections = [
+        {
+            name: "guard",
+            booleans: ["enabled"],
+            strings: [],
+            arrays: [
+                "sensitivePatterns",
+                "sensitiveGlobs",
+                "bashDenyPatterns",
+                "blockedReadTools",
+                "blockedWriteTools",
+            ],
+        },
+        {
+            name: "env",
+            booleans: ["enabled"],
+            strings: ["allowedRoot"],
+            arrays: [],
+        },
+        {
+            name: "varlock",
+            booleans: ["enabled", "autoDetect"],
+            strings: ["command", "namespace"],
+            arrays: [],
+        },
+    ];
+    for (const section of sections) {
+        const s = config[section.name];
+        if (s === undefined)
+            continue;
+        if (typeof s !== "object" || s === null) {
+            delete config[section.name];
+            removed.push(section.name);
+            continue;
+        }
+        for (const key of section.booleans) {
+            if (s[key] !== undefined && typeof s[key] !== "boolean") {
+                delete s[key];
+                removed.push(`${section.name}.${key}`);
+            }
+        }
+        for (const key of section.strings) {
+            if (s[key] !== undefined && typeof s[key] !== "string") {
+                delete s[key];
+                removed.push(`${section.name}.${key}`);
+            }
+        }
+        for (const key of section.arrays) {
+            if (s[key] !== undefined && !Array.isArray(s[key])) {
+                delete s[key];
+                removed.push(`${section.name}.${key}`);
+            }
+            else if (Array.isArray(s[key])) {
+                // Filter out non-string elements from arrays
+                const original = s[key];
+                const filtered = original.filter((v) => typeof v === "string");
+                if (filtered.length !== original.length) {
+                    s[key] = filtered;
+                    removed.push(`${section.name}.${key} (non-string elements removed)`);
+                }
+            }
+        }
+    }
+    return removed;
+}
 const CONFIG_FILENAMES = [
     "varlock.config.json",
     ".opencode/varlock.config.json",
@@ -61,6 +235,24 @@ export function loadConfig(cwd, overrides = {}, logger) {
                 const parsed = JSON.parse(raw);
                 delete parsed.$schema;
                 delete parsed.$comment;
+                // Validate and warn about any schema violations
+                const validationErrors = validateConfig(parsed, logger);
+                if (validationErrors.length > 0) {
+                    logger?.({
+                        level: "warn",
+                        message: "config validation warnings",
+                        extra: { filepath, errors: validationErrors },
+                    });
+                }
+                // Remove invalid values so they don't override safe defaults
+                const removedKeys = sanitizeConfig(parsed);
+                if (removedKeys.length > 0) {
+                    logger?.({
+                        level: "warn",
+                        message: "invalid config values removed before merge",
+                        extra: { filepath, removedKeys },
+                    });
+                }
                 merged = deepMerge(merged, parsed);
                 logger?.({
                     level: "info",
@@ -80,6 +272,26 @@ export function loadConfig(cwd, overrides = {}, logger) {
             }
         }
     }
+    // Validate and sanitize programmatic overrides the same way
+    if (overrides && typeof overrides === "object") {
+        const overridesObj = overrides;
+        const overrideErrors = validateConfig(overridesObj, logger);
+        if (overrideErrors.length > 0) {
+            logger?.({
+                level: "warn",
+                message: "config validation warnings in programmatic overrides",
+                extra: { errors: overrideErrors },
+            });
+        }
+        const removedKeys = sanitizeConfig(overridesObj);
+        if (removedKeys.length > 0) {
+            logger?.({
+                level: "warn",
+                message: "invalid override values removed before merge",
+                extra: { removedKeys },
+            });
+        }
+    }
     merged = deepMerge(merged, overrides);
     if (merged.env.allowedRoot && !isAbsolute(merged.env.allowedRoot)) {
         merged.env.allowedRoot = resolve(cwd, merged.env.allowedRoot);

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAmC1C,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE;YACjB,MAAM;YACN,SAAS;YACT,MAAM;YACN,MAAM;YACN,aAAa;YACb,SAAS;SACV;QACD,cAAc,EAAE;YACd,SAAS;YACT,WAAW;YACX,eAAe;YACf,oBAAoB;YACpB,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,kBAAkB;YAClB,YAAY;YACZ,YAAY;SACb;QACD,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAClD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACrC;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,GAAG;KACjB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,KAAK;KACjB;CACF,CAAA;AAED,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,+BAA+B;CAChC,CAAA;AAED,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,YAAuC,EAAE,EACzC,MAAqB;IAErB,IAAI,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAA;IAE5C,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAE9B,OAAO,MAAM,CAAC,OAAO,CAAA;gBACrB,OAAO,MAAM,CAAC,QAAQ,CAAA;gBAEtB,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAClC,MAAM,EAAE,CAAC;oBACP,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,eAAe;oBACxB,KAAK,EAAE,EAAE,QAAQ,EAAE;iBACpB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC;oBACP,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,wBAAwB;oBACjC,KAAK,EAAE;wBACL,QAAQ;wBACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAgB,CAAC,CAAA;IAE5C,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC/D,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAMD,MAAM,UAAU,SAAS,CACvB,MAAS,EACT,MAAsB;IAEtB,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAmB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YAAE,SAAQ;QAErD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QACrC,CAAC;aAAM,IACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAC/B,MAAM,CAAC,GAAG,CAAwB,EAClC,MAA6B,CAC9B,CAAA;QACH,CAAC;aAAM,CAAC;YACN,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAmC1C,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE;YACjB,MAAM;YACN,SAAS;YACT,MAAM;YACN,MAAM;YACN,aAAa;YACb,SAAS;YACT,gBAAgB;SACjB;QACD,cAAc,EAAE;YACd,SAAS;YACT,WAAW;YACX,eAAe;YACf,oBAAoB;YACpB,UAAU;YACV,UAAU;YACV,gBAAgB;YAChB,kBAAkB;YAClB,YAAY;YACZ,YAAY;YACZ,wBAAwB;YACxB,kCAAkC;SACnC;QACD,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAClD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACrC;IACD,GAAG,EAAE;QACH,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,GAAG;KACjB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,KAAK;KACjB;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAe,EACf,MAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACvC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,CAAC,GAAG,MAA6B,CAAA;IAEvC,yBAAyB;IACzB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,IACE,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;gBAC7B,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,EACpC,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,sCAAsC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAC/D,CAAA;YACH,CAAC;YACD,IACE,CAAC,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACvC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YACzD,CAAC;YACD,IACE,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;gBACpC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EACtC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;YACtD,CAAC;YACD,IACE,CAAC,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACtC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACxC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;YACxD,CAAC;YACD,IACE,CAAC,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBACtC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EACxC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;YACxD,CAAC;YACD,IACE,CAAC,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACvC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YACzD,CAAC;YACD,sCAAsC;YACtC,KAAK,MAAM,MAAM,IAAI;gBACnB,mBAAmB;gBACnB,gBAAgB;gBAChB,kBAAkB;gBAClB,kBAAkB;gBAClB,mBAAmB;aACpB,EAAE,CAAC;gBACF,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBAChD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;4BAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAA;wBACvD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACzE,CAAC;YACD,IACE,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS;gBAC/B,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,QAAQ,EACrC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC1C,CAAC;aAAM,CAAC;YACN,IACE,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EACtC,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,wCAAwC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CACnE,CAAA;YACH,CAAC;YACD,IACE,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;gBAClC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,EACzC,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,2CAA2C,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CACzE,CAAA;YACH,CAAC;YACD,IACE,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,EACrC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YACjD,CAAC;YACD,IACE,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;gBACjC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EACvC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAA2B;IACjD,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,MAAM,QAAQ,GAKT;QACH;YACE,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,EAAE;YACX,MAAM,EAAE;gBACN,mBAAmB;gBACnB,gBAAgB;gBAChB,kBAAkB;gBAClB,kBAAkB;gBAClB,mBAAmB;aACpB;SACF;QACD;YACE,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,aAAa,CAAC;YACxB,MAAM,EAAE,EAAE;SACX;QACD;YACE,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;YACnC,OAAO,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;YACjC,MAAM,EAAE,EAAE;SACX;KACF,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAQ;QAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC3B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;YACxC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACjC,6CAA6C;gBAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAc,CAAA;gBACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CACnD,CAAA;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACxC,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;oBACjB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,gCAAgC,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,+BAA+B;CAChC,CAAA;AAED,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,YAAuC,EAAE,EACzC,MAAqB;IAErB,IAAI,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAA;IAE5C,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAE9B,OAAO,MAAM,CAAC,OAAO,CAAA;gBACrB,OAAO,MAAM,CAAC,QAAQ,CAAA;gBAEtB,gDAAgD;gBAChD,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACvD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,EAAE,CAAC;wBACP,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,4BAA4B;wBACrC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;qBAC9C,CAAC,CAAA;gBACJ,CAAC;gBAED,6DAA6D;gBAC7D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;gBAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,EAAE,CAAC;wBACP,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,4CAA4C;wBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;qBACjC,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAClC,MAAM,EAAE,CAAC;oBACP,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,eAAe;oBACxB,KAAK,EAAE,EAAE,QAAQ,EAAE;iBACpB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC;oBACP,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,wBAAwB;oBACjC,KAAK,EAAE;wBACL,QAAQ;wBACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,SAAgC,CAAA;QACrD,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAC3D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,CAAC;gBACP,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,sDAAsD;gBAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;aAClC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,CAAA;QAChD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,CAAC;gBACP,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,8CAA8C;gBACvD,KAAK,EAAE,EAAE,WAAW,EAAE;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAgB,CAAC,CAAA;IAE5C,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC/D,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAMD,MAAM,UAAU,SAAS,CACvB,MAAS,EACT,MAAsB;IAEtB,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAmB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YAAE,SAAQ;QAErD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;QACrC,CAAC;aAAM,IACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAC/B,MAAM,CAAC,GAAG,CAAwB,EAClC,MAA6B,CAC9B,CAAA;QACH,CAAC;aAAM,CAAC;YACN,CAAC;YAAC,MAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA0C9C,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AACjC,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAA;AAe/C,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAClB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAwFzD;AAsBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuChD"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA0J9C,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AACjC,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,CAAA;AAG/C,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAClB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAgMzD;AAyDD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuChD"}

package/dist/guard.js

@@ -2,6 +2,16 @@
  * EnvGuard - tool.execute.before hook that prevents agents from
  * reading sensitive files or running commands that expose secrets.
  */
+/* ------------------------------------------------------------------ *
+ *  Task 6: Safe env file patterns that should NOT be blocked
+ * ------------------------------------------------------------------ */
+const SAFE_ENV_PATTERNS = [".env.schema", ".env.example", ".env.sample"];
+/* ------------------------------------------------------------------ *
+ *  Task 1: Block varlock CLI self-exfiltration
+ *  Task 8: Block set/compgen/declare/typeset variable listing
+ *  Task 10: Block targeted recursive grep for .env files
+ *  (Existing deny patterns preserved)
+ * ------------------------------------------------------------------ */
 const BUILTIN_BASH_DENY = [
     "cat .env",
     "less .env",
@@ -40,7 +50,24 @@ const BUILTIN_BASH_DENY = [
     'find . -name "*.env"',
     "curl.*env",
     "wget.*env",
+    // Task 1: varlock CLI self-exfiltration
+    "varlock printenv",
+    "varlock load --show-all",
+    "varlock load --format env",
+    "varlock load --format shell",
+    "varlock load -f env",
+    "varlock load -f shell",
+    // Task 8: compgen/typeset variable listing
+    "compgen -v",
+    "compgen -A variable",
+    "typeset -x",
+    // Task 10: recursive grep targeting .env files
+    "grep --include=*.env*",
+    "rg -g '*.env*'",
 ];
+/* ------------------------------------------------------------------ *
+ *  Existing: Regex patterns for runtime env-value reads via interpreters
+ * ------------------------------------------------------------------ */
 const ENV_VALUE_READ_PATTERNS = [
     /\bpython\d*\b[\s\S]*\bos\.getenv\s*\(/i,
     /\bpython\d*\b[\s\S]*\bos\.environ(?:\s*\[|\s*\.get\s*\()/i,
@@ -52,6 +79,44 @@ const ENV_VALUE_READ_PATTERNS = [
     /\bjava\b[\s\S]*\bSystem\.getenv\s*\(/i,
     /\bperl\b[\s\S]*\bENV\s*\{/i,
 ];
+/* ------------------------------------------------------------------ *
+ *  Task 2: Sensitive file read via interpreter (open(), File.read, etc.)
+ *  Catches python open('.env'), ruby File.read('.env'), node fs.readFileSync('.env'), etc.
+ * ------------------------------------------------------------------ */
+const SENSITIVE_FILE_SUFFIX_RE = "(?:\\.env\\b|\\.pem\\b|\\.key\\b|credentials|\\.pgpass|\\.secret)";
+const SENSITIVE_FILE_READ_VIA_INTERPRETER = [
+    // Python: open(), pathlib, Path()
+    new RegExp(`\\bpython\\d*\\b[\\s\\S]*\\bopen\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    new RegExp(`\\bpython\\d*\\b[\\s\\S]*pathlib[\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    new RegExp(`\\bpython\\d*\\b[\\s\\S]*\\bPath\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    // Ruby: File.read, File.open, IO.read
+    new RegExp(`\\bruby\\b[\\s\\S]*(?:File\\.(?:read|open)|IO\\.read)\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    // Node: fs.readFileSync, readFileSync, readFile
+    new RegExp(`\\bnode\\b[\\s\\S]*(?:readFileSync|readFile)\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    // Bun: Bun.file, readFileSync
+    new RegExp(`\\bbun\\b[\\s\\S]*(?:Bun\\.file|readFileSync)\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    // Perl: open()
+    new RegExp(`\\bperl\\b[\\s\\S]*\\bopen\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+    // PHP: file_get_contents, fopen, file
+    new RegExp(`\\bphp\\b[\\s\\S]*(?:file_get_contents|fopen|\\bfile\\b)\\s*\\([\\s\\S]*${SENSITIVE_FILE_SUFFIX_RE}`, "i"),
+];
+/* ------------------------------------------------------------------ *
+ *  Task 5: Encoding / eval bypass patterns — pipe to shell, eval subshell
+ * ------------------------------------------------------------------ */
+const PIPE_TO_SHELL_RE = /\|\s*(?:bash|sh|zsh|dash)\s*$/im;
+const EVAL_SUBSHELL_RE = /\beval\s+"\$\(/i;
+/* ------------------------------------------------------------------ *
+ *  Task 7: printf format string bypass — catches printf with $VAR reference
+ * ------------------------------------------------------------------ */
+const PRINTF_VAR_RE = /\bprintf\b[\s\S]*\$[A-Za-z_]/i;
+/* ------------------------------------------------------------------ *
+ *  Task 8: bare `set` piped or at end of command (set | grep, etc.)
+ * ------------------------------------------------------------------ */
+const SET_PIPE_RE = /\bset\s*(\||$|>)/im;
+/* ------------------------------------------------------------------ *
+ *  Task 9: bare `env` command detection (fixed from literal \n)
+ * ------------------------------------------------------------------ */
+const BARE_ENV_RE = /(?:^|\s|;|&&|\|\|)env\s*$/im;
 export function createEnvGuard(config) {
     const { sensitivePatterns, sensitiveGlobs, bashDenyPatterns, blockedReadTools, blockedWriteTools, } = config;
     const bashDeny = [...BUILTIN_BASH_DENY, ...bashDenyPatterns];
@@ -59,6 +124,20 @@ export function createEnvGuard(config) {
         source: g,
         regex: globToRegex(g),
     }));
+    /* ---------------------------------------------------------------- *
+     *  Task 4: Build shell redirect patterns dynamically from sensitivePatterns
+     * ---------------------------------------------------------------- */
+    const shellRedirectPatterns = [];
+    for (const sp of sensitivePatterns) {
+        // Skip safe patterns in redirect construction
+        if (SAFE_ENV_PATTERNS.some((safe) => sp.toLowerCase() === safe.toLowerCase())) {
+            continue;
+        }
+        const escaped = escapeRegex(sp);
+        shellRedirectPatterns.push(new RegExp(`\\b(?:read|mapfile|readarray)\\b[\\s\\S]*<[\\s\\S]*${escaped}`, "i"));
+        shellRedirectPatterns.push(new RegExp(`<\\s*\\S*${escaped}`, "i"));
+        shellRedirectPatterns.push(new RegExp(`\\bexec\\b[\\s\\S]*<[\\s\\S]*${escaped}`, "i"));
+    }
     return async (input, output) => {
         const args = output.args;
         if (blockedReadTools.includes(input.tool)) {
@@ -78,28 +157,90 @@ export function createEnvGuard(config) {
         if (input.tool === "bash") {
             const rawCommand = String(args.command ?? "");
             const cmd = rawCommand.toLowerCase();
+            /* -- Existing: runtime env-value read patterns -- */
             for (const pattern of ENV_VALUE_READ_PATTERNS) {
                 if (pattern.test(rawCommand)) {
                     throw new Error(`[varlock] Blocked: bash command appears to read environment variable values at runtime. ` +
                         `Use the load_env or load_secrets tool instead.`);
                 }
             }
+            /* -- Task 2: sensitive file read via interpreter -- */
+            for (const pattern of SENSITIVE_FILE_READ_VIA_INTERPRETER) {
+                if (pattern.test(rawCommand)) {
+                    throw new Error(`[varlock] Blocked: bash command appears to read a sensitive file via interpreter. ` +
+                        `Use the load_env or load_secrets tool instead.`);
+                }
+            }
+            /* -- Task 5: pipe-to-shell and eval subshell bypass -- */
+            if (PIPE_TO_SHELL_RE.test(rawCommand)) {
+                throw new Error(`[varlock] Blocked: bash command pipes output into a shell interpreter. ` +
+                    `This pattern is not allowed for security reasons.`);
+            }
+            if (EVAL_SUBSHELL_RE.test(rawCommand)) {
+                throw new Error(`[varlock] Blocked: bash command uses eval with command substitution. ` +
+                    `This pattern is not allowed for security reasons.`);
+            }
+            /* -- Task 7: printf with variable reference -- */
+            if (PRINTF_VAR_RE.test(rawCommand)) {
+                throw new Error(`[varlock] Blocked: bash command uses printf with a variable reference. ` +
+                    `Use the load_env or load_secrets tool instead.`);
+            }
+            /* -- Task 8: bare set piped/redirected -- */
+            if (SET_PIPE_RE.test(rawCommand)) {
+                throw new Error(`[varlock] Blocked: bash command uses "set" in a way that may expose variables. ` +
+                    `Use the load_env or load_secrets tool instead.`);
+            }
+            /* -- Task 9: bare env command -- */
+            if (BARE_ENV_RE.test(rawCommand)) {
+                throw new Error(`[varlock] Blocked: bare "env" command may expose environment variables. ` +
+                    `Use the load_env or load_secrets tool instead.`);
+            }
+            /* -- Existing + Task 6 safe-pattern check: string deny patterns -- */
             for (const pattern of bashDeny) {
                 if (cmd.includes(pattern.toLowerCase())) {
+                    // Task 6: If the command only references safe env files, allow it
+                    if (isSafeEnvReference(rawCommand)) {
+                        continue;
+                    }
                     throw new Error(`[varlock] Blocked: bash command matches deny pattern "${pattern}". ` +
                         `Use the load_env or load_secrets tool to access secrets.`);
                 }
             }
+            /* -- Existing + Task 3: file viewer/processor regex with sensitive patterns -- */
             for (const sp of sensitivePatterns) {
-                const fileAccessRe = new RegExp(`(cat|less|more|head|tail|bat|vim?|nano|code|type|get-content|select-string)\\s+\\S*${escapeRegex(sp)}`, "i");
+                // Task 6: skip safe env patterns
+                if (SAFE_ENV_PATTERNS.some((safe) => sp.toLowerCase() === safe.toLowerCase())) {
+                    continue;
+                }
+                // Task 3: expanded list of file processors
+                // Use [\s\S]* between command and pattern to match across flags/arguments
+                const fileAccessRe = new RegExp(`(cat|less|more|head|tail|bat|vim?|nano|code|type|get-content|select-string|sed|awk|cut|sort|tac|rev|paste|dd|tee|xargs|nl|fold|strings|xxd|od|hexdump|column)\\s[\\s\\S]*${escapeRegex(sp)}`, "i");
                 if (fileAccessRe.test(rawCommand)) {
+                    // Task 6: allow safe env file references
+                    if (isSafeEnvReference(rawCommand)) {
+                        continue;
+                    }
                     throw new Error(`[varlock] Blocked: bash command appears to read a sensitive file (*${sp}*). ` +
                         `Use the load_env or load_secrets tool instead.`);
                 }
             }
+            /* -- Task 4: shell redirect patterns -- */
+            for (const pattern of shellRedirectPatterns) {
+                if (pattern.test(rawCommand)) {
+                    if (isSafeEnvReference(rawCommand)) {
+                        continue;
+                    }
+                    throw new Error(`[varlock] Blocked: bash command uses shell redirects to read a sensitive file. ` +
+                        `Use the load_env or load_secrets tool instead.`);
+                }
+            }
             if (compiledGlobs.length > 0) {
                 const tokens = extractPathTokens(rawCommand);
                 for (const token of tokens) {
+                    // Task 6: skip safe env file tokens
+                    if (isSafeEnvToken(token)) {
+                        continue;
+                    }
                     for (const { source, regex } of compiledGlobs) {
                         if (regex.test(token)) {
                             throw new Error(`[varlock] Blocked: bash command references "${token}" which matches glob "${source}". ` +
@@ -111,8 +252,35 @@ export function createEnvGuard(config) {
         }
     };
 }
+/* ------------------------------------------------------------------ *
+ *  Task 6: Safe env pattern helpers
+ * ------------------------------------------------------------------ */
+/**
+ * Returns true if a path ends with a known safe env file suffix.
+ */
+function isSafeEnvToken(token) {
+    const lower = token.toLowerCase();
+    return SAFE_ENV_PATTERNS.some((safe) => lower.endsWith(safe.toLowerCase()));
+}
+/**
+ * Returns true if the command ONLY references safe env files (e.g. .env.example)
+ * and does NOT reference actual secret env files.
+ * We check if every .env mention in the command is a safe one.
+ */
+function isSafeEnvReference(command) {
+    // Find all .env references in the command
+    const envRefs = command.match(/\S*\.env\S*/gi);
+    if (!envRefs)
+        return false;
+    // Every .env reference must be a safe pattern
+    return envRefs.every((ref) => SAFE_ENV_PATTERNS.some((safe) => ref.toLowerCase().endsWith(safe.toLowerCase())));
+}
 function isSensitive(path, patterns, globs) {
     const lower = path.toLowerCase();
+    // Task 6: allow safe env files through
+    if (SAFE_ENV_PATTERNS.some((safe) => lower.endsWith(safe.toLowerCase()))) {
+        return false;
+    }
     if (patterns.some((p) => lower.includes(p.toLowerCase()))) {
         return true;
     }

package/dist/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,eAAe;IACf,OAAO;IACP,OAAO;IACP,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,eAAe;IACf,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,WAAW;IACX,WAAW;CACZ,CAAA;AAMD,MAAM,uBAAuB,GAAG;IAC9B,wCAAwC;IACxC,2DAA2D;IAC3D,kEAAkE;IAClE,iEAAiE;IACjE,uCAAuC;IACvC,6CAA6C;IAC7C,8BAA8B;IAC9B,uCAAuC;IACvC,4BAA4B;CAC7B,CAAA;AAED,MAAM,UAAU,cAAc,CAC5B,MAAmB;IAEnB,MAAM,EACJ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,GAAG,MAAM,CAAA;IAEV,MAAM,QAAQ,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;KACtB,CAAC,CAAC,CAAA;IAEH,OAAO,KAAK,EAAE,KAAgB,EAAE,MAAkB,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAExB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YAC5E,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,KAAK;oBACrD,gDAAgD,CACnD,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YAC5D,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,KAAK;oBAChD,qDAAqD,CACxD,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAEpC,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,0FAA0F;wBACxF,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,KAAK,CACb,yDAAyD,OAAO,KAAK;wBACnE,0DAA0D,CAC7D,CAAA;gBACH,CAAC;YACH,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,sFAAsF,WAAW,CAAC,EAAE,CAAC,EAAE,EACvG,GAAG,CACJ,CAAA;gBACD,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,sEAAsE,EAAE,MAAM;wBAC5E,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;gBAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;wBAC9C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;4BACtB,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,yBAAyB,MAAM,KAAK;gCACtF,gDAAgD,CACnD,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,QAAkB,EAClB,KAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAEhC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAET,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAElB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,IAAI,UAAU,CAAA;oBACpB,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,IAAI,CAAA;oBACd,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,OAAO,CAAA;gBACjB,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,MAAM,CAAA;YAChB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAA;YACf,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,SAAS,CAAA;YACnB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAA;YACnB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,EAAE,CAAA;YACZ,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,4DAA4D,CAAA;IAC5E,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAA6B,CAAA;IAEjC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;wEAEwE;AACxE,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,CAAC,CAAA;AAExE;;;;;wEAKwE;AACxE,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,eAAe;IACf,OAAO;IACP,OAAO;IACP,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,eAAe;IACf,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,WAAW;IACX,WAAW;IAEX,wCAAwC;IACxC,kBAAkB;IAClB,yBAAyB;IACzB,2BAA2B;IAC3B,6BAA6B;IAC7B,qBAAqB;IACrB,uBAAuB;IAEvB,2CAA2C;IAC3C,YAAY;IACZ,qBAAqB;IACrB,YAAY;IAEZ,+CAA+C;IAC/C,uBAAuB;IACvB,gBAAgB;CACjB,CAAA;AAED;;wEAEwE;AACxE,MAAM,uBAAuB,GAAG;IAC9B,wCAAwC;IACxC,2DAA2D;IAC3D,kEAAkE;IAClE,iEAAiE;IACjE,uCAAuC;IACvC,6CAA6C;IAC7C,8BAA8B;IAC9B,uCAAuC;IACvC,4BAA4B;CAC7B,CAAA;AAED;;;wEAGwE;AACxE,MAAM,wBAAwB,GAC5B,mEAAmE,CAAA;AAErE,MAAM,mCAAmC,GAAa;IACpD,kCAAkC;IAClC,IAAI,MAAM,CACR,mDAAmD,wBAAwB,EAAE,EAC7E,GAAG,CACJ;IACD,IAAI,MAAM,CACR,4CAA4C,wBAAwB,EAAE,EACtE,GAAG,CACJ;IACD,IAAI,MAAM,CACR,mDAAmD,wBAAwB,EAAE,EAC7E,GAAG,CACJ;IACD,sCAAsC;IACtC,IAAI,MAAM,CACR,wEAAwE,wBAAwB,EAAE,EAClG,GAAG,CACJ;IACD,gDAAgD;IAChD,IAAI,MAAM,CACR,+DAA+D,wBAAwB,EAAE,EACzF,GAAG,CACJ;IACD,8BAA8B;IAC9B,IAAI,MAAM,CACR,gEAAgE,wBAAwB,EAAE,EAC1F,GAAG,CACJ;IACD,eAAe;IACf,IAAI,MAAM,CACR,6CAA6C,wBAAwB,EAAE,EACvE,GAAG,CACJ;IACD,sCAAsC;IACtC,IAAI,MAAM,CACR,2EAA2E,wBAAwB,EAAE,EACrG,GAAG,CACJ;CACF,CAAA;AAED;;wEAEwE;AACxE,MAAM,gBAAgB,GAAG,iCAAiC,CAAA;AAC1D,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAE1C;;wEAEwE;AACxE,MAAM,aAAa,GAAG,+BAA+B,CAAA;AAErD;;wEAEwE;AACxE,MAAM,WAAW,GAAG,oBAAoB,CAAA;AAExC;;wEAEwE;AACxE,MAAM,WAAW,GAAG,6BAA6B,CAAA;AAMjD,MAAM,UAAU,cAAc,CAC5B,MAAmB;IAEnB,MAAM,EACJ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,GAAG,MAAM,CAAA;IAEV,MAAM,QAAQ,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;KACtB,CAAC,CAAC,CAAA;IAEH;;0EAEsE;IACtE,MAAM,qBAAqB,GAAa,EAAE,CAAA;IAC1C,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,8CAA8C;QAC9C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC9E,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC/B,qBAAqB,CAAC,IAAI,CACxB,IAAI,MAAM,CACR,sDAAsD,OAAO,EAAE,EAC/D,GAAG,CACJ,CACF,CAAA;QACD,qBAAqB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAClE,qBAAqB,CAAC,IAAI,CACxB,IAAI,MAAM,CAAC,gCAAgC,OAAO,EAAE,EAAE,GAAG,CAAC,CAC3D,CAAA;IACH,CAAC;IAED,OAAO,KAAK,EAAE,KAAgB,EAAE,MAAkB,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAExB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YAC5E,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,KAAK;oBACrD,gDAAgD,CACnD,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YAC5D,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,KAAK;oBAChD,qDAAqD,CACxD,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;YAEpC,qDAAqD;YACrD,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,0FAA0F;wBACxF,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,uDAAuD;YACvD,KAAK,MAAM,OAAO,IAAI,mCAAmC,EAAE,CAAC;gBAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,oFAAoF;wBAClF,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,0DAA0D;YAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,yEAAyE;oBACvE,mDAAmD,CACtD,CAAA;YACH,CAAC;YACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,uEAAuE;oBACrE,mDAAmD,CACtD,CAAA;YACH,CAAC;YAED,kDAAkD;YAClD,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,yEAAyE;oBACvE,gDAAgD,CACnD,CAAA;YACH,CAAC;YAED,6CAA6C;YAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,iFAAiF;oBAC/E,gDAAgD,CACnD,CAAA;YACH,CAAC;YAED,oCAAoC;YACpC,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,0EAA0E;oBACxE,gDAAgD,CACnD,CAAA;YACH,CAAC;YAED,sEAAsE;YACtE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACxC,kEAAkE;oBAClE,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnC,SAAQ;oBACV,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,yDAAyD,OAAO,KAAK;wBACnE,0DAA0D,CAC7D,CAAA;gBACH,CAAC;YACH,CAAC;YAED,kFAAkF;YAClF,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBACnC,iCAAiC;gBACjC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC9E,SAAQ;gBACV,CAAC;gBACD,2CAA2C;gBAC3C,0EAA0E;gBAC1E,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,4KAA4K,WAAW,CAAC,EAAE,CAAC,EAAE,EAC7L,GAAG,CACJ,CAAA;gBACD,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,yCAAyC;oBACzC,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnC,SAAQ;oBACV,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,sEAAsE,EAAE,MAAM;wBAC5E,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,2CAA2C;YAC3C,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnC,SAAQ;oBACV,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,iFAAiF;wBAC/E,gDAAgD,CACnD,CAAA;gBACH,CAAC;YACH,CAAC;YAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;gBAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,oCAAoC;oBACpC,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1B,SAAQ;oBACV,CAAC;oBACD,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;wBAC9C,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;4BACtB,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,yBAAyB,MAAM,KAAK;gCACtF,gDAAgD,CACnD,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;wEAEwE;AAExE;;GAEG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IACjC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,0CAA0C;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,8CAA8C;IAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3B,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC/C,CACF,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,QAAkB,EAClB,KAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAEhC,uCAAuC;IACvC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAET,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAElB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,IAAI,UAAU,CAAA;oBACpB,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,IAAI,CAAA;oBACd,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,OAAO,CAAA;gBACjB,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,MAAM,CAAA;YAChB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAA;YACf,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,SAAS,CAAA;YACnB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,IAAI,GAAG,EAAE,CAAA;YACnB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,EAAE,CAAA;YACZ,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,4DAA4D,CAAA;IAC5E,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAA6B,CAAA;IAEjC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export { default } from "./plugin.js";
+export { createSecretRegistry, type SecretRegistry } from "./scrubber.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -1,2 +1,3 @@
 export { default } from "./plugin.js";
+export { createSecretRegistry } from "./scrubber.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAA"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,WAAW,EAAqB,MAAM,aAAa,CAAA;AAQhG,eAAO,MAAM,aAAa,EAAE,MAE3B,CAAA;AAED,wBAAgB,mBAAmB,CACjC,SAAS,GAAE,WAAW,CAAC,YAAY,CAAM,GACxC,MAAM,CA4ER;AAED,eAAe,aAAa,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,WAAW,EAAqB,MAAM,aAAa,CAAA;AAShG,eAAO,MAAM,aAAa,EAAE,MAE3B,CAAA;AAED,wBAAgB,mBAAmB,CACjC,SAAS,GAAE,WAAW,CAAC,YAAY,CAAM,GACxC,MAAM,CAwHR;AAED,eAAe,aAAa,CAAA"}

package/dist/plugin.js

@@ -1,6 +1,7 @@
 import { tool } from "@opencode-ai/plugin";
 import { loadConfig } from "./config.js";
 import { createEnvGuard } from "./guard.js";
+import { createSecretRegistry } from "./scrubber.js";
 import { createLoadEnvTool, createLoadSecretsTool, createSecretStatusTool, } from "./tools.js";
 export const VarlockPlugin = async (ctx) => {
     return createVarlockPlugin()(ctx);
@@ -36,12 +37,13 @@ export function createVarlockPlugin(overrides = {}) {
                 varlockAvailable = false;
             }
         }
+        const registry = createSecretRegistry();
         const tools = {};
         if (config.env.enabled) {
-            tools.load_env = createLoadEnvTool(config.env);
+            tools.load_env = createLoadEnvTool(config.env, registry);
         }
         if (varlockAvailable) {
-            tools.load_secrets = createLoadSecretsTool($, config.varlock);
+            tools.load_secrets = createLoadSecretsTool($, config.varlock, registry);
             tools.secret_status = createSecretStatusTool($, config.varlock);
         }
         const hookResult = {
@@ -70,6 +72,47 @@ export function createVarlockPlugin(overrides = {}) {
         if (config.guard.enabled) {
             hookResult["tool.execute.before"] = createEnvGuard(config.guard);
         }
+        hookResult["tool.execute.after"] = async (input, output) => {
+            // Scrub secret values from tool output
+            if (registry.size() > 0) {
+                if (typeof output.result === "string") {
+                    output.result = registry.scrub(output.result);
+                }
+                if (typeof output.error === "string") {
+                    output.error = registry.scrub(output.error);
+                }
+            }
+            // After file write/edit, run varlock scan to check for leaked secrets
+            if (varlockAvailable && (input.tool === "write" || input.tool === "edit")) {
+                const filePath = output.args?.filePath ?? output.args?.path ?? output.args?.file;
+                if (filePath) {
+                    try {
+                        const scanResult = await $ `${config.varlock.command} scan ${filePath}`.quiet();
+                        if (scanResult.exitCode !== 0) {
+                            await log({
+                                level: "warn",
+                                message: "varlock scan detected potential secret leak in written file",
+                                extra: { file: filePath },
+                            });
+                        }
+                    }
+                    catch {
+                        // scan not available or failed, non-critical
+                    }
+                }
+            }
+        };
+        hookResult["shell.env"] = async (_input, _output) => {
+            // Log which secret-managed env vars are being passed to shell
+            // This is observability, not blocking — the guard handles blocking
+            if (registry.size() > 0) {
+                await log({
+                    level: "debug",
+                    message: "shell execution with managed secrets in environment",
+                    extra: { managedVarCount: registry.size() },
+                });
+            }
+        };
         return hookResult;
     };
 }

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,UAAU,EAA0D,MAAM,aAAa,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,aAAa,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IACjD,OAAO,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAuC,EAAE;IAEzC,OAAO,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QAEtC,MAAM,GAAG,GAAiB,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5D,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnB,IAAI,EAAE;oBACJ,OAAO,EAAE,kBAAkB;oBAC3B,KAAK;oBACL,OAAO;oBACP,KAAK;iBACN;aACF,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QAE9C,IAAI,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;QAC7C,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAA,SAAS,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAA;gBAC/D,gBAAgB,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAA;gBACxC,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,GAAG,CAAC;wBACR,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,2BAA2B;wBACpC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;qBAC3C,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB,GAAG,KAAK,CAAA;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA4C,EAAE,CAAA;QAEzD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,CAAC,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,YAAY,GAAG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;YAC7D,KAAK,CAAC,aAAa,GAAG,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,UAAU,GAAwB;YACtC,IAAI,EAAE,KAAK;YAEX,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAA+B,EAAE,EAAE;gBACtD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAa,EAAE,CAAA;oBAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO;wBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC5C,IAAI,gBAAgB;wBAAE,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;oBAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO;wBACtC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,QAAQ;wBAClG,CAAC,CAAC,UAAU,CAAA;oBAEd,MAAM,GAAG,CAAC;wBACR,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,iBAAiB;wBAC1B,KAAK,EAAE;4BACL,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM;4BACrC,KAAK,EAAE,WAAW;yBACnB;qBACF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;SACF,CAAA;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,UAAU,CAAC,qBAAqB,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;AACH,CAAC;AAED,eAAe,aAAa,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,UAAU,EAA0D,MAAM,aAAa,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,aAAa,GAAW,KAAK,EAAE,GAAG,EAAE,EAAE;IACjD,OAAO,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAuC,EAAE;IAEzC,OAAO,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QAEtC,MAAM,GAAG,GAAiB,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5D,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnB,IAAI,EAAE;oBACJ,OAAO,EAAE,kBAAkB;oBAC3B,KAAK;oBACL,OAAO;oBACP,KAAK;iBACN;aACF,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QAE9C,IAAI,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAA;QAC7C,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAA,SAAS,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAA;gBAC/D,gBAAgB,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAA;gBACxC,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,GAAG,CAAC;wBACR,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,2BAA2B;wBACpC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;qBAC3C,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB,GAAG,KAAK,CAAA;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAA;QACvC,MAAM,KAAK,GAA4C,EAAE,CAAA;QAEzD,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,CAAC,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC1D,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,YAAY,GAAG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACvE,KAAK,CAAC,aAAa,GAAG,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,UAAU,GAAwB;YACtC,IAAI,EAAE,KAAK;YAEX,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAA+B,EAAE,EAAE;gBACtD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACrC,MAAM,OAAO,GAAa,EAAE,CAAA;oBAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO;wBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC5C,IAAI,gBAAgB;wBAAE,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;oBAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO;wBACtC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,QAAQ;wBAClG,CAAC,CAAC,UAAU,CAAA;oBAEd,MAAM,GAAG,CAAC;wBACR,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,iBAAiB;wBAC1B,KAAK,EAAE;4BACL,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM;4BACrC,KAAK,EAAE,WAAW;yBACnB;qBACF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;SACF,CAAA;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,UAAU,CAAC,qBAAqB,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,CAAC;QAED,UAAU,CAAC,oBAAoB,CAAC,GAAG,KAAK,EAAE,KAAU,EAAE,MAAW,EAAE,EAAE;YACnE,uCAAuC;YACvC,IAAI,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACtC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,IAAI,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAA;gBAChF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,MAAM,CAAC,CAAA,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,SAAS,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAA;wBAC9E,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;4BAC9B,MAAM,GAAG,CAAC;gCACR,KAAK,EAAE,MAAM;gCACb,OAAO,EAAE,6DAA6D;gCACtE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAC1B,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,6CAA6C;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,UAAU,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE;YAC5D,8DAA8D;YAC9D,mEAAmE;YACnE,IAAI,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC;oBACR,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,qDAAqD;oBAC9D,KAAK,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;iBAC5C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAA;QAED,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;AACH,CAAC;AAED,eAAe,aAAa,CAAA"}

package/dist/scrubber.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Output scrubber - tool.execute.after hook that redacts secret values
+ * from tool output before they reach the agent context.
+ */
+export type SecretRegistry = {
+    /** Register a secret value that should be redacted from output */
+    register(name: string, value: string): void;
+    /** Scrub all registered secret values from a string */
+    scrub(text: string): string;
+    /** Get count of registered secrets */
+    size(): number;
+};
+export declare function createSecretRegistry(): SecretRegistry;
+//# sourceMappingURL=scrubber.d.ts.map

package/dist/scrubber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.d.ts","sourceRoot":"","sources":["../src/scrubber.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,cAAc,GAAG;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,uDAAuD;IACvD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,sCAAsC;IACtC,IAAI,IAAI,MAAM,CAAA;CACf,CAAA;AAED,wBAAgB,oBAAoB,IAAI,cAAc,CA6BrD"}

package/dist/scrubber.js

@@ -0,0 +1,33 @@
+/**
+ * Output scrubber - tool.execute.after hook that redacts secret values
+ * from tool output before they reach the agent context.
+ */
+export function createSecretRegistry() {
+    const secrets = new Map(); // name -> value
+    return {
+        register(name, value) {
+            if (value && value.length >= 3) { // don't scrub trivially short values
+                secrets.set(name, value);
+            }
+        },
+        scrub(text) {
+            let result = text;
+            for (const [name, value] of secrets) {
+                // Only replace if the value is substantial enough to avoid false positives
+                if (value.length >= 8) {
+                    result = result.replaceAll(value, `[REDACTED:${name}]`);
+                }
+                else if (value.length >= 3) {
+                    // For shorter values, only replace exact matches with word boundaries
+                    const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                    result = result.replace(new RegExp(`\\b${escaped}\\b`, 'g'), `[REDACTED:${name}]`);
+                }
+            }
+            return result;
+        },
+        size() {
+            return secrets.size;
+        },
+    };
+}
+//# sourceMappingURL=scrubber.js.map

package/dist/scrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubber.js","sourceRoot":"","sources":["../src/scrubber.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,gBAAgB;IAE1D,OAAO;QACL,QAAQ,CAAC,IAAY,EAAE,KAAa;YAClC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,qCAAqC;gBACrE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAY;YAChB,IAAI,MAAM,GAAG,IAAI,CAAA;YACjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACpC,2EAA2E;gBAC3E,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtB,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,CAAC,CAAA;gBACzD,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBAC7B,sEAAsE;oBACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;oBAC5D,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,EAAE,GAAG,CAAC,EAAE,aAAa,IAAI,GAAG,CAAC,CAAA;gBACpF,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAED,IAAI;YACF,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools.d.ts

@@ -1,5 +1,6 @@
 import type { EnvConfig, VarlockConfig } from "./config.js";
-export declare function createLoadEnvTool(envConfig: EnvConfig): {
+import type { SecretRegistry } from "./scrubber.js";
+export declare function createLoadEnvTool(envConfig: EnvConfig, registry?: SecretRegistry): {
     description: string;
     args: {
         path: import("zod").ZodDefault<import("zod").ZodOptional<import("zod").ZodString>>;
@@ -12,7 +13,7 @@ export declare function createLoadEnvTool(envConfig: EnvConfig): {
         prefix?: string | undefined;
     }, context: import("@opencode-ai/plugin").ToolContext): Promise<string>;
 };
-export declare function createLoadSecretsTool($: any, varlockConfig: VarlockConfig): {
+export declare function createLoadSecretsTool($: any, varlockConfig: VarlockConfig, registry?: SecretRegistry): {
     description: string;
     args: {
         namespace: import("zod").ZodDefault<import("zod").ZodOptional<import("zod").ZodString>>;

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS;;;;;;;;;;;;EAyFrD;AAED,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,GAAG,EACN,aAAa,EAAE,aAAa;;;;;;;;;;;;;;EAoG7B;AAED,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,GAAG,EACN,aAAa,EAAE,aAAa;;;;;;;;EAsD7B"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAYnD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,cAAc;;;;;;;;;;;;EAuGhF;AAED,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,GAAG,EACN,aAAa,EAAE,aAAa,EAC5B,QAAQ,CAAC,EAAE,cAAc;;;;;;;;;;;;;;EAmH1B;AAED,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,GAAG,EACN,aAAa,EAAE,aAAa;;;;;;;;EA6D7B"}

package/dist/tools.js

@@ -1,8 +1,20 @@
 import { tool } from "@opencode-ai/plugin";
-import { readFileSync, existsSync } from "fs";
+import { readFileSync, existsSync, realpathSync } from "fs";
 import { resolve } from "path";
-export function createLoadEnvTool(envConfig) {
-    const allowedRoot = resolve(envConfig.allowedRoot);
+const SAFE_INPUT_RE = /^[a-zA-Z0-9_.\-\/]+$/;
+function validateInput(value, label) {
+    if (!SAFE_INPUT_RE.test(value)) {
+        throw new Error(`[varlock] Invalid ${label}: "${value}". Only alphanumeric, hyphens, underscores, dots, and slashes are allowed.`);
+    }
+}
+export function createLoadEnvTool(envConfig, registry) {
+    let allowedRoot;
+    try {
+        allowedRoot = realpathSync(resolve(envConfig.allowedRoot));
+    }
+    catch {
+        allowedRoot = resolve(envConfig.allowedRoot);
+    }
     return tool({
         description: [
             "Load environment variables from a .env file into the running process.",
@@ -35,7 +47,12 @@ export function createLoadEnvTool(envConfig) {
             if (!existsSync(envPath)) {
                 throw new Error(`[varlock] File not found: ${envPath}`);
             }
-            const content = readFileSync(envPath, "utf-8");
+            const realPath = realpathSync(envPath);
+            if (!realPath.startsWith(allowedRoot)) {
+                throw new Error(`[varlock] Path "${args.path}" resolves outside the allowed root via symlink. ` +
+                    `Only .env files under "${allowedRoot}" are permitted.`);
+            }
+            const content = readFileSync(realPath, "utf-8");
             const loaded = [];
             const skipped = [];
             for (const line of content.split("\n")) {
@@ -61,6 +78,7 @@ export function createLoadEnvTool(envConfig) {
                     continue;
                 }
                 process.env[keyPart] = value;
+                registry?.register(keyPart, value);
                 loaded.push(keyPart);
             }
             return JSON.stringify({
@@ -76,7 +94,7 @@ export function createLoadEnvTool(envConfig) {
         },
     });
 }
-export function createLoadSecretsTool($, varlockConfig) {
+export function createLoadSecretsTool($, varlockConfig, registry) {
     const cmd = varlockConfig.command;
     const defaultNs = varlockConfig.namespace;
     return tool({
@@ -107,17 +125,27 @@ export function createLoadSecretsTool($, varlockConfig) {
         },
         async execute(args) {
             const ns = args.namespace;
+            if (ns) {
+                validateInput(ns, "namespace");
+            }
+            if (args.envPrefix) {
+                validateInput(args.envPrefix, "envPrefix");
+            }
             let keyList;
             if (args.keys && args.keys.length > 0) {
+                for (const key of args.keys) {
+                    validateInput(key, "key");
+                }
                 keyList = args.keys;
             }
             else {
                 try {
-                    const raw = await $ `${cmd} list ${ns}`.text();
-                    keyList = raw
-                        .trim()
-                        .split("\n")
-                        .filter((k) => k.length > 0);
+                    const raw = await $ `${cmd} load --format json`.text();
+                    const parsed = JSON.parse(raw);
+                    keyList = Object.keys(parsed);
+                    if (ns) {
+                        keyList = keyList.filter((k) => k.toLowerCase().startsWith(ns.toLowerCase()));
+                    }
                 }
                 catch (err) {
                     throw new Error(`[varlock] Failed to list keys in namespace "${ns}": ${err.message}`);
@@ -135,9 +163,10 @@ export function createLoadSecretsTool($, varlockConfig) {
                     continue;
                 }
                 try {
-                    const value = (await $ `${cmd} get ${ns}/${key}`.text()).trim();
+                    const value = (await $ `${cmd} printenv ${key}`.text()).trim();
                     if (value) {
                         process.env[envName] = value;
+                        registry?.register(envName, value);
                         loaded.push(envName);
                     }
                 }
@@ -183,13 +212,17 @@ export function createSecretStatusTool($, varlockConfig) {
         },
         async execute(args) {
             const ns = args.namespace;
+            if (ns) {
+                validateInput(ns, "namespace");
+            }
             let available;
             try {
-                const raw = await $ `${cmd} list ${ns}`.text();
-                available = raw
-                    .trim()
-                    .split("\n")
-                    .filter((k) => k.length > 0);
+                const raw = await $ `${cmd} load --format json`.text();
+                const parsed = JSON.parse(raw);
+                available = Object.keys(parsed);
+                if (ns) {
+                    available = available.filter((k) => k.toLowerCase().startsWith(ns.toLowerCase()));
+                }
             }
             catch (err) {
                 throw new Error(`[varlock] Cannot list namespace "${ns}": ${err.message}`);

package/dist/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAG9B,MAAM,UAAU,iBAAiB,CAAC,SAAoB;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAElD,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,wCAAwC;SACzC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,MAAM;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CAAC,4CAA4C,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,MAAM;iBAClB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,oDAAoD,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,MAAM;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;SACjE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,uCAAuC;oBACjE,0BAA0B,WAAW,kBAAkB,CAC1D,CAAA;YACH,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,OAAO,GAAa,EAAE,CAAA;YAE5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;gBAE3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAClC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAE1B,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACnC,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBAE7D,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC3C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;oBACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC5B,CAAC;gBAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACrB,SAAQ;gBACV,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;gBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtB,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,MAAM;gBACN,OAAO;gBACP,OAAO,EACL,UAAU,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;oBACvE,CAAC,OAAO,CAAC,MAAM;wBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC/D,CAAC,CAAC,EAAE,CAAC;aACV,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,CAAM,EACN,aAA4B;IAE5B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IAEzC,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,iEAAiE;YACjE,sFAAsF;YACtF,gEAAgE;SACjE,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,SAAS,CAAC;iBAClB,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,IAAI,EAAE,IAAI,CAAC,MAAM;iBACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;iBAC3B,QAAQ,EAAE;iBACV,QAAQ,CACP,4EAA4E,CAC7E;YACH,QAAQ,EAAE,IAAI,CAAC,MAAM;iBAClB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,oDAAoD,CAAC;YACjE,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,8EAA8E,CAC/E;SACJ;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;YAEzB,IAAI,OAAiB,CAAA;YACrB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAA,GAAG,GAAG,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;oBAC7C,OAAO,GAAG,GAAG;yBACV,IAAI,EAAE;yBACN,KAAK,CAAC,IAAI,CAAC;yBACX,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACxC,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CACb,+CAA+C,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,CACrE,CAAA;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,OAAO,GAAa,EAAE,CAAA;YAE5B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS;oBAC5B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE;oBACzC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;gBAErB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACrB,SAAQ;gBACV,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAA,GAAG,GAAG,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;oBAC9D,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;wBAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACtB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG;gBACZ,UAAU,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;aACtE,CAAA;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBACzD,MAAM,EAAE,WAAW,EAAE,EAAE;gBACvB,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,aAA4B;IAE5B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IAEzC,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,4DAA4D;YAC5D,8CAA8C;YAC9C,8DAA8D;SAC/D,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,SAAS,CAAC;iBAClB,QAAQ,CAAC,8BAA8B,CAAC;SAC5C;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;YAEzB,IAAI,SAAmB,CAAA;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAA,GAAG,GAAG,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;gBAC7C,SAAS,GAAG,GAAG;qBACZ,IAAI,EAAE;qBACN,KAAK,CAAC,IAAI,CAAC;qBACX,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACxC,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,CAC1D,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;gBACjC,OAAO;oBACL,GAAG;oBACH,OAAO;oBACP,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG;iBAC/B,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;YAEzD,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,SAAS,CAAC,MAAM;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,WAAW;gBACxC,IAAI,EAAE,MAAM;aACb,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAI9B,MAAM,aAAa,GAAG,sBAAsB,CAAA;AAE5C,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qBAAqB,KAAK,MAAM,KAAK,4EAA4E,CAClH,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAoB,EAAE,QAAyB;IAC/E,IAAI,WAAmB,CAAA;IACvB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,wCAAwC;SACzC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,MAAM;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CAAC,4CAA4C,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,MAAM;iBAClB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,oDAAoD,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,MAAM;iBAChB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,mDAAmD,CAAC;SACjE;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAElC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,uCAAuC;oBACjE,0BAA0B,WAAW,kBAAkB,CAC1D,CAAA;YACH,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,mDAAmD;oBAC7E,0BAA0B,WAAW,kBAAkB,CAC1D,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC/C,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,OAAO,GAAa,EAAE,CAAA;YAE5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;gBAE3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;gBAClC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAE1B,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACnC,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBAE7D,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC3C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;oBACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC5B,CAAC;gBAED,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACrB,SAAQ;gBACV,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;gBAC5B,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACtB,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,MAAM;gBACN,OAAO;gBACP,OAAO,EACL,UAAU,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;oBACvE,CAAC,OAAO,CAAC,MAAM;wBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC/D,CAAC,CAAC,EAAE,CAAC;aACV,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,CAAM,EACN,aAA4B,EAC5B,QAAyB;IAEzB,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IAEzC,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,iEAAiE;YACjE,sFAAsF;YACtF,gEAAgE;SACjE,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,SAAS,CAAC;iBAClB,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,IAAI,EAAE,IAAI,CAAC,MAAM;iBACd,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;iBAC3B,QAAQ,EAAE;iBACV,QAAQ,CACP,4EAA4E,CAC7E;YACH,QAAQ,EAAE,IAAI,CAAC,MAAM;iBAClB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,oDAAoD,CAAC;YACjE,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,8EAA8E,CAC/E;SACJ;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;YAEzB,IAAI,EAAE,EAAE,CAAC;gBACP,aAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAiB,CAAA;YACrB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC3B,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAA,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAA;oBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC9B,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC7B,IAAI,EAAE,EAAE,CAAC;wBACP,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CACrC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAA;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CACb,+CAA+C,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,CACrE,CAAA;gBACH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,OAAO,GAAa,EAAE,CAAA;YAE5B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS;oBAC5B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE;oBACzC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;gBAErB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACrB,SAAQ;gBACV,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAA,GAAG,GAAG,aAAa,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;oBAC7D,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAA;wBAC5B,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;wBAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACtB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAClB,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG;gBACZ,UAAU,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;aACtE,CAAA;YACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBACzD,MAAM,EAAE,WAAW,EAAE,EAAE;gBACvB,MAAM;gBACN,OAAO;gBACP,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,aAA4B;IAE5B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IAEzC,OAAO,IAAI,CAAC;QACV,WAAW,EAAE;YACX,4DAA4D;YAC5D,8CAA8C;YAC9C,8DAA8D;SAC/D,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,IAAI,EAAE;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM;iBACnB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,OAAO,CAAC,SAAS,CAAC;iBAClB,QAAQ,CAAC,8BAA8B,CAAC;SAC5C;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAA;YAEzB,IAAI,EAAE,EAAE,CAAC;gBACP,aAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;YAChC,CAAC;YAED,IAAI,SAAmB,CAAA;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAA,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAA;gBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC9B,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBAC/B,IAAI,EAAE,EAAE,CAAC;oBACP,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CACzC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,CAC1D,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;gBACjC,OAAO;oBACL,GAAG;oBACH,OAAO;oBACP,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG;iBAC/B,CAAA;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;YAEzD,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,SAAS,CAAC,MAAM;gBACvB,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,WAAW;gBACxC,IAAI,EAAE,MAAM;aACb,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-varlock",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "type": "module",
   "description": "OpenCode plugin for secret management via Varlock with configurable env guard protection",
   "main": "./dist/index.js",
@@ -22,6 +22,10 @@
       "types": "./dist/tools.d.ts",
       "default": "./dist/tools.js"
     },
+    "./scrubber": {
+      "types": "./dist/scrubber.d.ts",
+      "default": "./dist/scrubber.js"
+    },
     "./plugin": {
       "types": "./dist/plugin.d.ts",
       "default": "./dist/plugin.js"