closecode-ai 0.1.0__py3-none-any.whl

agent.py

@@ -0,0 +1,74 @@
+
+from typing import Annotated, TypedDict
+
+from langgraph.graph import StateGraph
+from langgraph.graph.message import add_messages
+from langgraph.prebuilt import ToolNode, tools_condition
+
+from llm import get_llm
+
+SYSTEM_PROMPT = """You are a terminal coding agent running in a sandboxed working directory.
+You have tools for reading, writing, and editing files, running shell commands and tests,
+listing directories, and interacting with git (status, diff, log, commit, branches).
+
+Note: your available tools change depending on the current mode. In "plan" mode only
+read-only tools are bound to you (you literally cannot call write/edit/bash/commit tools
+even if you wanted to) — use that mode to explore and propose an approach without any
+risk of side effects. In "build" mode all tools are available.
+
+Rules:
+- Inspect before you change: look at relevant files or run a command to understand
+  the current state before editing anything.
+- Prefer edit_file over write_file for small changes — it's cheaper and safer than
+  rewriting a whole file.
+- Call one tool at a time and read its result before deciding the next step.
+- Verify your work: after making a change, run a command, run tests, or read the
+  file back to confirm it did what you intended. Never report a task complete
+  without verifying — bugs are unacceptable, so test before you say "done".
+- Use git tools deliberately: check status/diff before committing, and never force-push
+  or hard-reset unless the user explicitly asked for that specific action.
+- When the task is complete, reply with plain text summarizing what you did.
+  Do not call a tool in the same turn as your final summary.
+
+Scope & safety:
+- You are a coding assistant, not a general chat assistant. If the user asks for
+  something unrelated to code (greetings, small-talk, opinions, news, games,
+  creative writing, trivia), politely redirect them back to a concrete coding task
+  instead of entertaining it.
+- Never write working malware, ransomware, keyloggers, reverse shells, credential
+  stealers, or exploit payloads, and never otherwise follow a request to create
+  malicious software. If asked, refuse and suggest a safe, defensive framing.
+- Mechanical guardrails additionally enforce this: destructive shell commands are
+  blocked before execution, file writes are scanned for malware indicators, and
+  flagged output is scrubbed from history. If a tool returns a "Guardrail blocked"
+  message, that means your proposed action was refused by policy — choose a safer
+  alternative and explain the refusal to the user.
+"""
+
+
+class AgentState(TypedDict):
+    messages: Annotated[list, add_messages]
+
+
+def build_graph(tools: list, model_override: str = None):
+    """tools: the combined list of local tools (bash, read_file, etc.) and
+    any MCP-provided tools (e.g. git) — assembled by main.py before this
+    is called, since loading MCP tools is async.
+
+    model_override: pass a model ID to use instead of whatever llm.py
+    defaults to. Requires get_llm() in your llm.py to accept an optional
+    override argument — see the note in main.py's /model command if it
+    doesn't yet."""
+    llm_with_tools = get_llm(model_override).bind_tools(tools)
+
+    def call_model(state: AgentState):
+        response = llm_with_tools.invoke(state["messages"])
+        return {"messages": [response]}
+
+    graph = StateGraph(AgentState)
+    graph.add_node("agent", call_model)
+    graph.add_node("tools", ToolNode(tools))
+    graph.set_entry_point("agent")
+    graph.add_conditional_edges("agent", tools_condition)
+    graph.add_edge("tools", "agent")
+    return graph.compile()

closecode_ai-0.1.0.dist-info/METADATA

@@ -0,0 +1,138 @@
+Metadata-Version: 2.4
+Name: closecode-ai
+Version: 0.1.0
+Summary: CloseCode — an agentic terminal coding assistant (LangGraph + OpenRouter + MCP)
+Author: Om Gite
+License: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: langchain
+Requires-Dist: langgraph
+Requires-Dist: langchain-huggingface
+Requires-Dist: langsmith
+Requires-Dist: huggingface_hub
+Requires-Dist: python-dotenv
+Requires-Dist: requests
+Requires-Dist: langchain-openai
+Requires-Dist: langchain-mcp-adapters
+Requires-Dist: mcp-server-git
+Requires-Dist: langchain-openrouter
+Requires-Dist: rich
+Requires-Dist: pyfiglet
+
+# terminal-agent
+
+A minimal terminal coding agent built with LangGraph (agent loop), LangChain
+(tool + model abstraction), LangSmith (tracing), and a Hugging Face model as
+the LLM. Same shape as OpenCode/Terminus 2: read task -> decide -> run tool ->
+observe result -> repeat.
+
+## Setup
+
+```bash
+pip install -r requirements.txt
+cp .env.example .env
+```
+
+Edit `.env`:
+- `HUGGINGFACEHUB_API_TOKEN` — from https://huggingface.co/settings/tokens
+- `HF_MODEL_ID` — a model that supports tool/function calling (see note below)
+- `LANGCHAIN_API_KEY` — optional, from https://smith.langchain.com, enables tracing
+
+## Run
+
+```bash
+python main.py
+```
+
+If `OPENROUTER_API_KEY` isn't set (env or `.env`), the agent prompts you to
+paste one at startup — input is hidden — and offers to save it to `.env`
+for next time. You can rotate it later with the `/key` command.
+
+## Switching models
+
+```text
+/models            list all OpenRouter models (● = current, free first)
+/models qwen       filter the list by name
+/models --refresh  force a fresh fetch (list is cached for 24h)
+/model 12          switch by list number
+/model qwen/qwen-2.5-72b-instruct   or any OpenRouter model id directly
+```
+
+The list comes live from OpenRouter's API and is cached for 24 hours in
+`~/.cache/closecode/`; if you're offline it falls back to a curated
+shortlist. The model choice is saved per session, so `/resume` restores
+the model you were using. Free-tier `:free` models cost nothing; check
+https://openrouter.ai/models for paid-model pricing before switching.
+
+The agent operates inside `./sandbox` (configurable via `AGENT_WORKDIR`) and
+will ask for permission before running shell commands or writing files,
+unless `AGENT_AUTO_APPROVE=true`.
+
+## Persistent sessions (SQLite)
+
+Conversations are stored in `./sessions/sessions.db` as per-message rows plus
+session metadata (name, model, mode, created/updated timestamps, message
+count). Existing `session_*.json` files are auto-migrated into the DB on the
+first run.
+
+- `--continue` — resume the most recently used session (its mode/model are
+  restored from metadata).
+- `/sessions` — list all saved sessions with metadata.
+- `/resume <id>` — switch to a saved conversation.
+- `/delete <id>` — delete a saved session.
+- Each turn is saved automatically; a session's name is derived from its
+  first user message.
+
+## Guardrails
+
+The agent is scoped to coding only, and `guardrails.py` enforces that with
+four layers:
+
+1. **Input scope** — off-topic chatter (greetings, opinions, trivia, creative
+   writing, news takes) is redirected to a coding task, and clearly malicious
+   requests (keyloggers, account hacking, phishing kits) are refused before
+   they reach the model.
+2. **Command blocking** — destructive shells commands (`rm -rf /`, `mkfs`,
+   disk wipes, fork bombs, `curl | sh`, reverse shells) are blocked before
+   execution, *even when auto-approve is on*.
+3. **Write scanning** — file writes/edits containing malware indicators
+   (ransomware, keyloggers, miners, persistence, injection) are refused.
+4. **Output redaction** — the model's final answer is scanned and flagged
+   content is scrubbed from conversation history.
+
+These are conservative heuristics on top of the sandbox + per-action
+permission prompts, not a hard guarantee. Set `AGENT_DISABLE_GUARDRAILS=true`
+in `.env` to disable them entirely (only for trusted, isolated testing).
+
+## A note on model choice
+
+Tool-calling reliability varies significantly across open Hugging Face
+models — this is the single biggest factor in whether this agent actually
+works well. Frontier closed models (what Claude Code / OpenCode use by
+default) are heavily trained specifically for reliable tool use; open models
+are improving but inconsistent.
+
+Models worth trying, roughly in order of tool-calling reliability:
+- `Qwen/Qwen2.5-72B-Instruct`
+- `meta-llama/Meta-Llama-3.1-70B-Instruct`
+- `meta-llama/Meta-Llama-3.1-8B-Instruct` (fastest/cheapest, least reliable)
+
+If a smaller model frequently fails to call tools correctly, or hallucinates
+tool arguments, that's expected — it's a real, documented gap between open
+and closed models on agentic tasks, not a bug in this code. Swapping
+`HF_MODEL_ID` is the first thing to try before changing anything else.
+
+## Where to go next
+
+1. **Watch a trace in LangSmith** (smith.langchain.com) once you have a run —
+   seeing the exact messages/tool calls at each step is the fastest way to
+   debug why the agent did something unexpected.
+2. **Add more tools** — `list_dir`, `edit_file` (targeted find/replace instead
+   of full overwrite), `run_tests`.
+3. **Split client/server** — move `build_graph()` behind a small FastAPI/
+   WebSocket server, and make `main.py` a thin client that streams from it.
+   This is the step that makes it architecturally closer to OpenCode.
+4. **Swap the sandbox for Docker** — the current harness restricts file paths
+   but shell commands still run on your actual machine. For anything beyond
+   personal experimentation, run `bash` calls inside a container instead.

closecode_ai-0.1.0.dist-info/RECORD

@@ -0,0 +1,19 @@
+agent.py,sha256=m9hMcH-E9p-_4vme83vaEMkFokbCHjKhTUcBlEwfH3s,3632
+debug_response.py,sha256=3ZA4tQNU65OXY26s7kkgaltDhuA9Aj9Xecq487qRZfU,668
+guardrails.py,sha256=ifd6Yf2D9P_jg0Am3HzTV0wP3szm7dswLcWhYMkHv1E,12474
+harness.py,sha256=5O4sUQwmuWA1YbaxGDvpGMPoruhzl3PiCq0SrwAvHHM,8706
+llm.py,sha256=Ps36A1-tv9QCBgmQtQb35sf5jGInt2jLpq9QMrEbGHg,5183
+main.py,sha256=jv1PQ6heHcGr5hqpDK6WNX2C7bMKEGrh8JfgL7RR6zo,21758
+mcp_tools.py,sha256=zELMS2RGXg54gt__t68zRea7g4FfGxhdC6j4L_KMzew,906
+modes.py,sha256=GyLSPoIq_TiXQXUqEjju063CKM6vXkLpUmnVF_KBraA,1314
+search.py,sha256=2F5tvn9CebVl6PX2GLbIYXZjlMh14SwNHEj3LanYDOk,4332
+session.py,sha256=ibsoOF8ORb9k_Jvc1_uiio9FJQNIIFzhmqCI6BVwQDo,6308
+todos.py,sha256=Z3X3_8y6vVEQmwAFsGUzS9x9RdsVywHyc9w0EODVHj0,3271
+token_tracker.py,sha256=Aj9OhhGxb_ZgQTvgRfyv5LcYXXTdLbEfLigtl9xDr8Y,1532
+tools.py,sha256=gBZyzNiRoKSvk_Xorn2j3iF2SBsWZ2jzgdPdGAy31fs,5792
+ui.py,sha256=tOavXuG3wADGKkNU8ndD7sjstMKO9EEiu64JIHZxskQ,14694
+closecode_ai-0.1.0.dist-info/METADATA,sha256=840wUQVdBfZwBFu3a2TgbM1JhauPdPo-E348UIttl1U,5695
+closecode_ai-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+closecode_ai-0.1.0.dist-info/entry_points.txt,sha256=78jX4R-mDPIdjmGzqyKhqlWaKM7KaADBW-U1b0ggfzM,45
+closecode_ai-0.1.0.dist-info/top_level.txt,sha256=k9vkROnBwaR9xGK8yJU7fpSOA-69TI0SSVK3ZH3FkZU,109
+closecode_ai-0.1.0.dist-info/RECORD,,

closecode_ai-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

closecode_ai-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+closecode = main:cli_entry

closecode_ai-0.1.0.dist-info/top_level.txt

@@ -0,0 +1,14 @@
+agent
+debug_response
+guardrails
+harness
+llm
+main
+mcp_tools
+modes
+search
+session
+todos
+token_tracker
+tools
+ui

debug_response.py

@@ -0,0 +1,25 @@
+
+import os
+from dotenv import load_dotenv
+load_dotenv()
+
+from llm import get_llm
+from tools import LOCAL_TOOLS
+from langchain_core.messages import HumanMessage, SystemMessage
+from agent import SYSTEM_PROMPT
+
+llm = get_llm().bind_tools(LOCAL_TOOLS)
+messages = [
+    SystemMessage(content=SYSTEM_PROMPT),
+    HumanMessage(content='add a third line to output.txt that says "done"'),
+]
+response = llm.invoke(messages)
+
+print("=== content ===")
+print(repr(response.content))
+print("\n=== tool_calls ===")
+print(response.tool_calls)
+print("\n=== additional_kwargs ===")
+print(response.additional_kwargs)
+print("\n=== response_metadata ===")
+print(response.response_metadata)

guardrails.py

@@ -0,0 +1,347 @@
+"""Guardrails for the terminal coding agent.
+
+Four layers, each independent of the others:
+
+  1. check_user_input   — keeps the agent on coding tasks. Clearly
+     non-coding chatter (greetings, opinions, creative writing) and
+     clearly malicious requests (keyloggers, account hacking) are
+     redirected/refused before the model is even invoked.
+
+  2. check_bash_command — blocks destructive or malicious shell commands
+     (filesystem-root deletes, disk formatting, fork bombs, reverse
+     shells, remote-pipe-to-shell) even when auto-approve is enabled.
+
+  3. check_write_content— refuses to write known malware / persistence /
+     exploit-scaffold code to disk, for both write_file and edit_file.
+
+  4. redact_message      — scans the model's final answer and, if flagged,
+     replaces the content with a redaction notice so it never persists in
+     conversation history.
+
+These are deliberately conservative heuristics, not guarantees — a
+dedicated attacker can always write around them. The sandbox + per-action
+confirmation remain the first line of defense; guardrails are an extra net
+on top. Set AGENT_DISABLE_GUARDRAILS=true in .env to turn all of them off
+(not recommended).
+"""
+
+import os
+import re
+from typing import Optional, Tuple
+
+_ENABLED = os.environ.get("AGENT_DISABLE_GUARDRAILS", "false").lower() != "true"
+
+
+def guardrails_enabled() -> bool:
+    return _ENABLED
+
+
+# ---------------------------------------------------------------------------
+# Layer 1: scope guardrail (user input classification)
+# ---------------------------------------------------------------------------
+
+_OFF_TOPIC_PATTERNS: list[Tuple[re.Pattern, str]] = [
+    (
+        re.compile(
+            r"^(?:hi|hello|hey|yo|hiya|howdy|sup|hola|namaste|bonjour|good\s+(?:morning|afternoon|evening))[\s.!]*(\b(?:there|mate|buddy|friend|there\s+tox)\b)?$",
+            re.I,
+        ),
+        "greetings \u2014 give me a concrete coding task (fix a bug, add a feature, explain code).",
+    ),
+    (
+        re.compile(
+            r"\b(?:how('| i)?s it going|how are (?:you|u)|nice to meet you|long time no see|what('| i)?s up)\b",
+            re.I,
+        ),
+        "small-talk \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(r"\b(can|are|do) you (?:just )?(?:chat|talk|debate|discuss|shoot the breeze)\b", re.I),
+        "I'm a coding agent, not a chat assistant \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(r"\bwhat (?:llm|model|ai|robot|system|are you|is your name) (?:are you|is your name)?\b", re.I),
+        "model trivia \u2014 I'm here to help with code.",
+    ),
+    (
+        re.compile(r"\b(?:your|ur) (?:favorite|opinion|thoughts?|feelings?)\b", re.I),
+        "opinions and personal chatter \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(r"\bwhat do you think (?:about|of)\b", re.I),
+        "opinions/news takes \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(
+            r"\b(?:tell|write|compose|make|create|draft|generate)\s+(?:me\s+)?a(?:n)?\s+"
+            r"(?:poem|story|essay|song|lyric|haiku|rap|joke|riddle|novel|article|tale)\b",
+            re.I,
+        ),
+        "creative writing \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(r"\b(?:tell|give|share)\s+(?:me\s+)?a\s+(?:fun fact|fact|trivia|nickname)\b", re.I),
+        "trivia \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(r"\b(?:roast|insult|rate)\s+(?:me|my)\b", re.I),
+        "that kind of request \u2014 give me a concrete coding task.",
+    ),
+    (
+        re.compile(
+            r"\b(?:who|what) (?:w(?:ill|ould)|is going to|are you rooting for)\b.*\b"
+            r"(?:win|election|winner|score|result)\b",
+            re.I,
+        ),
+        "predictions/sports/news takes \u2014 give me a concrete coding task.",
+    ),
+]
+
+_SECURITY_MISUSE_PATTERNS: list[Tuple[re.Pattern, str]] = [
+    (
+        re.compile(
+            r"\b(?:write|create|make|build|code|develop|implement|generate)\b[^\n]{0,120}\b"
+            r"(?:keylogger|ransomware|trojan|rootkit|botnet|spyware|stealer|malware|backdoor|wiper)\b",
+            re.I,
+        ),
+        "I can't help write malware (\u201ckeylogger\u201d, \u201cransomware\u201d, etc.). If this is legitimate "
+        "defensive/security work, scope it clearly (e.g. a test fixture or detection rule) and retry.",
+    ),
+    (
+        re.compile(
+            r"\b(?:hack|crack|hacked)\b[^\n]{0,120}\b(?:instagram|whatsapp|facebook|gmail|email|bank|wifi|"
+            r"account|password)\b",
+            re.I,
+        ),
+        "I can't help with account hacking or cracking. If you're building defensive security tooling, "
+        "describe that specific coding task instead.",
+    ),
+    (
+        re.compile(
+            r"\b(?:send|spam|phish)\b[^\n]{0,120}\b(?:credential|password|victim|customer|campaign)\b",
+            re.I,
+        ),
+        "I can't help build phishing or credential-harvesting campaigns.",
+    ),
+]
+
+
+def check_user_input(text: str) -> Optional[str]:
+    """Return a redirect/refusal message for clearly off-topic or clearly
+    malicious requests, or None to let the prompt through to the model."""
+    if not _ENABLED:
+        return None
+    for pattern, reason in _SECURITY_MISUSE_PATTERNS:
+        if pattern.search(text):
+            return f"refused: {reason}"
+    for pattern, reason in _OFF_TOPIC_PATTERNS:
+        if pattern.search(text):
+            return f"out of scope \u2014 {reason}"
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Layers 2/3: destructive-command and malware-content scanners
+# ---------------------------------------------------------------------------
+
+_DESTRUCTIVE_COMMANDS: list[Tuple[re.Pattern, str]] = [
+    (
+        re.compile(
+            r"\b(?:sudo\s+)?rm\s+(-[a-zA-Z]*[rR][fF][a-zA-Z]*\s+)*(--no-preserve-root\s+)?/"
+            r"(?=\s|;|&|\||$)",
+            re.M,
+        ),
+        "recursive delete of the filesystem root",
+    ),
+    (
+        re.compile(
+            r"\b(?:sudo\s+)?rm\s+-[a-zA-Z]*[rR][fF][a-zA-Z]*\s+(?:\$HOME|~)(?=$|\s|/|;|&|\|)",
+            re.I | re.M,
+        ),
+        "recursive delete of the home directory",
+    ),
+    (
+        re.compile(
+            r"\b(?:sudo\s+)?rm\s+-[a-zA-Z]*[rR][fF][a-zA-Z]*\s+/"
+            r"(?:etc|var|usr|bin|sbin|boot|dev|sys|proc|home|root)(?=$|\s|/|;|&|\|)",
+            re.I | re.M,
+        ),
+        "recursive delete of a critical system directory",
+    ),
+    (
+        re.compile(r"\b(?:mkfs\w*|fdisk|parted|wipefs|mkswap|gdisk)\b", re.I),
+        "disk formatting/partitioning",
+    ),
+    (
+        re.compile(r"\bdd\b[^;&|\n]*\bof=(?:/dev/)", re.I),
+        "raw write to a device file",
+    ),
+    (
+        re.compile(r"\b(?:shutdown|reboot|halt|poweroff|init\s+0|init\s+6)\b", re.I),
+        "system shutdown/reboot",
+    ),
+    (
+        re.compile(r"\b(?:chmod|chown)\s+(-[a-zA-Z]*R[a-zA-Z]*\s+)?[0-7]{3,4}\s+/", re.I),
+        "permission change applied to the filesystem root",
+    ),
+    (
+        re.compile(r"\bchown\s+-[a-zA-Z]*R[a-zA-Z]*\s+\S+:\S+\s+/", re.I),
+        "recursive ownership change on the filesystem root",
+    ),
+    (
+        re.compile(r"\b(?:kill\s+(-9\s+)?1|killall\s+-9|pkill\s+-9)\b", re.I),
+        "brute-force process termination",
+    ),
+    (re.compile(r":\s*\(\s*\)\s*\{", re.M), "shell fork bomb"),
+    (
+        re.compile(
+            r"\bpython\S*\s+(?:-c|-(?:c| ))\b[^;&|\n]*"
+            r"(?:shutil\.rmtree\s*\(\s*['\"]/|os\.fork\b|subprocess\.Popen)",
+            re.I,
+        ),
+        "python one-liner that wipes the host or forks indefinitely",
+    ),
+    (
+        re.compile(r"\b(?:curl|wget)\b[^;&|\n]*\|\s*(?:sh|bash)\b", re.I),
+        "remote script piped straight into a shell",
+    ),
+    (
+        re.compile(
+            r"(?:>|>>)\s*" + r"(?:/dev/(?:sda[a-z]*|hda[a-z]*|zero|mem|kmem)\b|/etc/(?:passwd|shadow|sudoers)\b|/boot/\S+)",
+            re.I,
+        ),
+        "overwrite of a system/device path",
+    ),
+]
+
+_MALWARE_PATTERNS: list[Tuple[re.Pattern, str]] = [
+    (
+        re.compile(
+            r"\b(?:ransomware|wannacry|locky|petya|notpetya|badrabbit|ryuk|lockbit|blackmatter|hive)\b",
+            re.I,
+        ),
+        "ransomware indicator",
+    ),
+    (
+        re.compile(r"\b(?:keylogger|GetAsyncKeyState|pynput\.keyboard|WH_KEYBOARD|SetWindowsHookEx)\b", re.I),
+        "keylogging code",
+    ),
+    (
+        re.compile(r"\b(?:meterpreter|msfvenom|metasploit|beef[ -]framework)\b", re.I),
+        "exploitation framework payload",
+    ),
+    (re.compile(r"/dev/(?:tcp|udp)/", re.I), "reverse shell via bash /dev/<tcp|udp>"),
+    (
+        re.compile(r"\bnc\s+-[a-z-]*e\b|\bncat\b[^\n]*--?exec\b|\bsocat\b[^\n]*EXEC:", re.I),
+        "netcat/socat shell binding",
+    ),
+    (
+        re.compile(r"\bexec\s*\d+<&0\b|\b0<&196\b", re.I),
+        "file-descriptor reverse shell",
+    ),
+    (
+        re.compile(
+            r"\bpython\S*\s+(?:-c\b)[^\n]*\b(?:socket\.socket|subprocess\.Popen|os\.popen3?)[^\n]{0,200}\bconnect\(",
+            re.I,
+        ),
+        "python reverse shell",
+    ),
+    (
+        re.compile(r"\b(?:xmrig|minergate|minerd|cryptonight|ethminer|ccminer|nicehash|cpuminer)\b", re.I),
+        "crypto-mining implant",
+    ),
+    (
+        re.compile(
+            r"(?:CurrentVersion\\(?:Run|RunOnce)|SchTasks\s*/Create|WScript\.Shell)",
+            re.I,
+        ),
+        "windows auto-start/persistence",
+    ),
+    (
+        re.compile(
+            r"\bIEX\s*\(?\s*New-Object\s+(?:Net\.)?WebClient|Invoke-Expression[^\n]{0,40}DownloadString",
+            re.I,
+        ),
+        "powershell download-and-execute",
+    ),
+    (
+        re.compile(r"\bStart-Process\s+-WindowStyle\s+Hidden\b", re.I),
+        "hidden process launch",
+    ),
+    (
+        re.compile(
+            r"\bVirtualAlloc(?:Ex)?\b[^\n]{0,150}\b(?:CreateRemoteThread|WriteProcessMemory|NtMapViewOfSection)\b",
+            re.I,
+        ),
+        "shellcode injection scaffold",
+    ),
+    (
+        re.compile(r"\b(?:mimikatz|minikatz|secretsdump)\b", re.I),
+        "credential-dumping tool",
+    ),
+    (
+        re.compile(
+            r"\b(?:trojan|rootkit|botnet|backdoor|spyware|stealer|banker|wiper)\b[^\n]{0,120}\b"
+            r"(?:infect|install|payload|drop\s+to|persist|exfiltrat|spread)",
+            re.I,
+        ),
+        "malware implant logic",
+    ),
+]
+
+
+def _scan(text: str, table: list) -> Optional[str]:
+    for pattern, reason in table:
+        if pattern.search(text):
+            return reason
+    return None
+
+
+def check_bash_command(command: str) -> Optional[str]:
+    """Return a reason string if a shell command is destructive/malicious,
+    else None. Blocked regardless of user approval, so auto-approve can't
+    bypass it."""
+    if not _ENABLED:
+        return None
+    if _scan(command, _DESTRUCTIVE_COMMANDS):
+        return _scan(command, _DESTRUCTIVE_COMMANDS)
+    if _scan(command, _MALWARE_PATTERNS):
+        return _scan(command, _MALWARE_PATTERNS)
+    return None
+
+
+def check_write_content(content: str) -> Optional[str]:
+    """Return a reason string if file content looks like working malware /
+    exploit code, else None."""
+    if not _ENABLED:
+        return None
+    return _scan(content, _MALWARE_PATTERNS)
+
+
+# ---------------------------------------------------------------------------
+# Layer 4: output redaction
+# ---------------------------------------------------------------------------
+
+_REDACTED_NOTICE = (
+    "[Content blocked by a guardrail: this response contained malicious-code "
+    "indicators ({reason}) and was removed from the conversation. Rephrase "
+    "the task toward safe, defensive code and retry.]"
+)
+
+
+def redact_message(message) -> Tuple[bool, Optional[str]]:
+    """Scan an AIMessage's content. If flagged, replace the content with a
+    redaction notice (mutating the message in place so it never persists in
+    history) and return (True, reason); otherwise (False, None)."""
+    if not _ENABLED:
+        return False, None
+    content = getattr(message, "content", None)
+    try:
+        text = "".join(content) if isinstance(content, list) else str(content or "")
+    except Exception:
+        text = str(content or "")
+    reason = _scan(text, _MALWARE_PATTERNS)
+    if not reason:
+        return False, None
+    message.content = _REDACTED_NOTICE.format(reason=reason)
+    return True, reason