pullfrog 0.1.81 → 0.1.83

package/dist/agents/claudePretoolGate.d.ts

@@ -59,16 +59,16 @@ export declare function buildClaudePretoolGateSource(deniedTools: readonly strin
  * settings JSON file or a JSON string`), but we use a path so the script
  * and its config sit side-by-side under `ctx.tmpdir`.
  *
- * `execToolDenyRules` are the native exec tools (Bash/Monitor/REPL/Workflow +
- * their `Agent(...)` forms) to deny at a settings-source rule — the
- * authoritative, bypass-immune layer. `--disallowedTools` alone (a `cliArg`
- * deny) was observed to leak under `--dangerously-skip-permissions`, so the
- * deny is carried here too. The single consumer is `buildClaudeSettings`, which
+ * `denyRules` are the native tools to deny (`CLAUDE_DENIED_TOOLS` + their
+ * `Agent(...)` forms) at a settings-source rule — the authoritative,
+ * bypass-immune layer. `--disallowedTools` alone (a `cliArg` deny) was observed
+ * to leak under `--dangerously-skip-permissions`, so the deny is carried here
+ * too. The single consumer is `buildClaudeSettings`, which
  * spreads `hooks` and folds `permissions.deny` into its richer deny list; that
  * one object is then written to BOTH the `--settings` flag and the `/etc`
  * managed file, which is what keeps the two surfaces from drifting (#1179).
  */
-export declare function buildClaudePretoolGateSettings(scriptAbsolutePath: string, execToolDenyRules: string[]): {
+export declare function buildClaudePretoolGateSettings(scriptAbsolutePath: string, denyRules: string[]): {
     hooks: {
         PreToolUse: Array<{
             matcher: string;

package/dist/agents/opencodePlugin.d.ts

@@ -81,5 +81,10 @@ export declare const PULLFROG_OPENCODE_PLUGIN_SOURCE: string;
  * session via `tool.execute.before`, complementing the runtime backstops from
  * PR #796 (action/mcp/checkout.ts, action/mcp/git.ts). Deny-list source of
  * truth: `action/agents/subagentToolGates.ts`.
+ *
+ * Also hard-blocks the native `bash` tool for EVERY session. bash stays in the
+ * tool list because Zen's free tier rejects a request without it (2026-09-17);
+ * `permission.bash: "ask"` is the fail-closed backstop should this plugin ever
+ * not load. see wiki/security.md.
  */
 export declare function buildOpencodeSubagentGateSource(deniedTools: readonly string[]): string;