Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
See full implementation: core/scripts/tool-proxy.sh
Phase 4 — Pipe-Through (piping-server pattern)
// piping-server insight: stream data process-to-process via HTTP pipe// No disk write — data flows in-memory. Useful for large tool results.import { Transform } from'stream'classToolResultPipeextendsTransform {
#scanned = 0readonly #maxBytes = 16 * 1024_transform(chunk: Buffer, _enc: string, cb: (err: Error | null, data?: Buffer) => void) {
this.#scanned += chunk.lengthif (this.#scanned > this.#maxBytes) {
this.push(Buffer.from('\n[TRUNCATED — 16KB cap]\n'))
this.end()
cb(null)
return
}
// In-flight PII scan on streaming chunk — no buffering to diskconst clean = chunk.toString().replace(/Bearer [A-Za-z0-9._-]+/g, '[REDACTED]')
cb(null, Buffer.from(clean))
}
}
// Pipe tool stdout through sanitize transform in-memoryasyncfunctionpipedToolExec(cmd: string): Promise<string> {
const { stdout } = awaitexecAsync(cmd)
const pipe = newToolResultPipe()
returnnewPromise((resolve, reject) => {
constchunks: Buffer[] = []
pipe.on('data', c => chunks.push(c))
pipe.on('end', () =>resolve(Buffer.concat(chunks).toString()))
pipe.on('error', reject)
pipe.end(Buffer.from(stdout))
})
}
// Rule: never write raw tool output to disk — pipe through sanitize transform// Rule: streaming PII scan prevents large-result buffering in memory
Express Scope: Global vs Tool-Specific Middleware
// Express insight: global middleware vs router-scoped — apply the same here// Global: every tool call
toolRouter.use(interceptLayer) // all tools
toolRouter.use(sanitizeLayer) // all tools// Tool-specific: only Bash gets mutate layer (file tools don't need ulimit)
toolRouter.tool('Bash', mutateLayer)
toolRouter.tool('Bash', resourceCapLayer)
// Error middleware (always last — 4-arg signature)
toolRouter.use((err: Error, ctx: ToolContext, next: Next) => {
auditLog.error({ tool: ctx.tool, err: err.message, gate: (err asany).gate })
// Do NOT re-throw — error middleware terminates the chain
})
// Rule: error middleware must be LAST in the chain// Rule: tool-specific middleware reduces blast radius vs applying everything globally
Anti-Fake-Pass Checklist
❌ next() called after interceptor already threw (double-dispatch crash)
❌ Sanitize strips chars but doesn't re-validate after strip (second-order injection)
❌ Mutate adds ulimit but doesn't log the mutation to audit trail
❌ Response interceptor missing — raw tool output with PII returned to agent
❌ Pipe writes to /tmp instead of in-memory transform (disk trace left behind)
❌ Global middleware applied to file-read tools (ulimit on Read = wasted overhead)
❌ Error middleware not last — subsequent middleware never sees the error
❌ auto-quote-vars interceptor modifies URL args (breaks curl with $HOSTNAME in URL)
