Function SecurityScanPlugin

plugins/security-scan.ts:22–39

({ $ })

}

export const SecurityScanPlugin = async ({ $ }) => {
  return {
    "tool.execute.before": async (input, output) => {
      // Only check file modification tools
      if (!["write", "edit", "patch"].includes(input.tool)) {
        return
      }

      const filePath = input.args?.file_path || input.args?.filePath || input.args?.path || ""

      if (filePath && isSensitiveFile(filePath)) {
        throw new Error(
          `SECURITY BLOCK: Cannot edit sensitive file "${filePath}". Edit manually if needed.`
        )
      }
    },
  }
}