@adtl/gateway 0.2.0 → 0.3.1

package/src/gateway.ts

@@ -5,6 +5,11 @@
  * tools/list  → every upstream's tools, renamed <upstream>__<tool>
  * tools/call  → request interceptors (adtl.policy) → upstream → response
  *               interceptors (adtl.label) → agent
+ * prompts/*   → like tools: renamed <upstream>__<prompt>, results labeled
+ * resources/* → URIs pass through unchanged and are routed to the upstream
+ *               that lists them (or whose template matches). Results are
+ *               labeled. A URI more than one upstream could serve is refused,
+ *               since ADTL could not tell which server to label it as.
  *
  * When a call is stopped, the agent receives a normal tool result with
  * `isError: true` explaining why, so the model can tell the user.
@@ -20,10 +25,24 @@
 import { randomUUID } from "node:crypto";
 import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { UriTemplate } from "@modelcontextprotocol/sdk/shared/uriTemplate.js";
 import {
   CallToolRequestSchema,
+  ErrorCode,
+  GetPromptRequestSchema,
+  ListPromptsRequestSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
   ListToolsRequestSchema,
+  McpError,
+  ReadResourceRequestSchema,
   type CallToolResult,
+  type GetPromptResult,
+  type Prompt,
+  type ReadResourceResult,
+  type Resource,
+  type ResourceTemplate,
+  type ServerCapabilities,
   type Tool,
 } from "@modelcontextprotocol/sdk/types.js";
 import type { InvocationContext } from "@adtl/interceptors";
@@ -32,7 +51,7 @@ import type { AuditEntry, AuditSink } from "./audit.js";
 import { TOOL_SEPARATOR } from "./config.js";
 import type { Blocked, ChainOutcome, InterceptorInvoker } from "./invoker.js";
 
-export const GATEWAY_VERSION = "0.2.0";
+export const GATEWAY_VERSION = "0.3.1";
 
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";
@@ -43,6 +62,21 @@ interface Route {
   annotations?: Tool["annotations"];
 }
 
+interface PromptRoute {
+  upstream: string;
+  prompt: string;
+}
+
+interface TemplateRoute {
+  upstream: string;
+  template: UriTemplate;
+}
+
+interface Page<T> {
+  items: T[];
+  nextCursor?: string | undefined;
+}
+
 export interface GatewayLogger {
   info(msg: string): void;
   warn(msg: string): void;
@@ -110,6 +144,10 @@ export class AdtlGateway {
   private readonly log: GatewayLogger;
   private readonly approvals: ApprovalBroker | undefined;
   private routes = new Map<string, Route>();
+  private promptRoutes = new Map<string, PromptRoute>();
+  /** Resource URI → the upstreams that list it. */
+  private resourceRoutes = new Map<string, Set<string>>();
+  private templateRoutes: TemplateRoute[] = [];
 
   constructor(opts: AdtlGatewayOptions) {
     this.upstreams = opts.upstreams;
@@ -122,10 +160,15 @@ export class AdtlGateway {
 
   /** The downstream MCP server the agent connects to. */
   createServer(): Server {
+    // Offer resources and prompts only if some upstream does (the SDK refuses handlers for undeclared capabilities).
+    const offers = (c: "resources" | "prompts") => [...this.upstreams.values()].some((u) => u.getServerCapabilities()?.[c]);
+    const capabilities: ServerCapabilities = { tools: {} };
+    if (offers("resources")) capabilities.resources = {};
+    if (offers("prompts")) capabilities.prompts = {};
     const server = new Server(
       { name: "adtl-gateway", version: GATEWAY_VERSION },
       {
-        capabilities: { tools: {} },
+        capabilities,
         instructions:
           "Tools from several MCP servers, named <server>__<tool>. ADTL checks each call against trust labels; " +
           "if a call is stopped, the result explains why.",
@@ -141,32 +184,214 @@ export class AdtlGateway {
               extra.sendNotification({ method: "notifications/progress", params: { progressToken, progress, message } });
       return this.callTool(req.params.name, req.params.arguments ?? {}, progress ? { progress } : {});
     });
+    if (capabilities.resources) {
+      server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await this.listResources() }));
+      server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
+        resourceTemplates: await this.listResourceTemplates(),
+      }));
+      server.setRequestHandler(ReadResourceRequestSchema, async (req) => this.readResource(req.params.uri));
+    }
+    if (capabilities.prompts) {
+      server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await this.listPrompts() }));
+      server.setRequestHandler(GetPromptRequestSchema, async (req) => this.getPrompt(req.params.name, req.params.arguments));
+    }
     return server;
   }
 
-  async listTools(): Promise<Tool[]> {
-    const routes = new Map<string, Route>();
-    const tools: Tool[] = [];
+  /** Every upstream's items from one list method, following cursors. Upstreams that fail are skipped with a warning. */
+  private async listAll<T>(
+    method: string,
+    capability: "tools" | "resources" | "prompts",
+    page: (client: Client, cursor?: string) => Promise<Page<T>>,
+  ): Promise<{ upstream: string; item: T }[]> {
+    const out: { upstream: string; item: T }[] = [];
     for (const [upstream, client] of this.upstreams) {
+      if (capability !== "tools" && !client.getServerCapabilities()?.[capability]) continue;
       let cursor: string | undefined;
       try {
         do {
-          const page = await client.listTools(cursor ? { cursor } : {});
-          for (const t of page.tools) {
-            const name = `${upstream}${TOOL_SEPARATOR}${t.name}`;
-            routes.set(name, { upstream, tool: t.name, ...(t.annotations ? { annotations: t.annotations } : {}) });
-            tools.push({ ...t, name });
-          }
-          cursor = page.nextCursor;
+          const p = await page(client, cursor);
+          for (const item of p.items) out.push({ upstream, item });
+          cursor = p.nextCursor;
         } while (cursor);
       } catch (err) {
-        this.log.warn(`tools/list failed for ${upstream}: ${(err as Error).message}`);
+        this.log.warn(`${method} failed for ${upstream}: ${(err as Error).message}`);
       }
     }
+    return out;
+  }
+
+  async listTools(): Promise<Tool[]> {
+    const all = await this.listAll("tools/list", "tools", async (c, cursor) => {
+      const p = await c.listTools(cursor ? { cursor } : {});
+      return { items: p.tools, nextCursor: p.nextCursor };
+    });
+    const routes = new Map<string, Route>();
+    const tools = all.map(({ upstream, item: t }) => {
+      const name = `${upstream}${TOOL_SEPARATOR}${t.name}`;
+      routes.set(name, { upstream, tool: t.name, ...(t.annotations ? { annotations: t.annotations } : {}) });
+      return { ...t, name };
+    });
     this.routes = routes;
     return tools;
   }
 
+  async listPrompts(): Promise<Prompt[]> {
+    const all = await this.listAll("prompts/list", "prompts", async (c, cursor) => {
+      const p = await c.listPrompts(cursor ? { cursor } : {});
+      return { items: p.prompts, nextCursor: p.nextCursor };
+    });
+    const routes = new Map<string, PromptRoute>();
+    const prompts = all.map(({ upstream, item: p }) => {
+      const name = `${upstream}${TOOL_SEPARATOR}${p.name}`;
+      routes.set(name, { upstream, prompt: p.name });
+      return { ...p, name };
+    });
+    this.promptRoutes = routes;
+    return prompts;
+  }
+
+  async listResources(): Promise<Resource[]> {
+    const all = await this.listAll("resources/list", "resources", async (c, cursor) => {
+      const p = await c.listResources(cursor ? { cursor } : {});
+      return { items: p.resources, nextCursor: p.nextCursor };
+    });
+    const routes = new Map<string, Set<string>>();
+    for (const { upstream, item } of all) {
+      const ups = routes.get(item.uri) ?? new Set<string>();
+      ups.add(upstream);
+      routes.set(item.uri, ups);
+    }
+    for (const [uri, ups] of routes) {
+      if (ups.size > 1) this.log.warn(`resource ${uri} is offered by ${[...ups].join(", ")}; reading it will be refused`);
+    }
+    this.resourceRoutes = routes;
+    return all.map((a) => a.item);
+  }
+
+  async listResourceTemplates(): Promise<ResourceTemplate[]> {
+    const all = await this.listAll("resources/templates/list", "resources", async (c, cursor) => {
+      const p = await c.listResourceTemplates(cursor ? { cursor } : {});
+      return { items: p.resourceTemplates, nextCursor: p.nextCursor };
+    });
+    const routes: TemplateRoute[] = [];
+    for (const { upstream, item } of all) {
+      try {
+        routes.push({ upstream, template: new UriTemplate(item.uriTemplate) });
+      } catch (err) {
+        this.log.warn(`ignoring resource template ${item.uriTemplate} from ${upstream}: ${(err as Error).message}`);
+      }
+    }
+    this.templateRoutes = routes;
+    return all.map((a) => a.item);
+  }
+
+  /** The one upstream that serves `uri`: an exact listing wins, then template matches. */
+  private async resourceUpstream(uri: string): Promise<string> {
+    if (!this.resourceRoutes.has(uri)) await this.listResources();
+    let candidates = [...(this.resourceRoutes.get(uri) ?? [])];
+    if (candidates.length === 0) {
+      if (this.templateRoutes.length === 0) await this.listResourceTemplates();
+      candidates = [...new Set(this.templateRoutes.filter((t) => t.template.match(uri) !== null).map((t) => t.upstream))];
+    }
+    if (candidates.length === 0) throw new McpError(ErrorCode.InvalidParams, `Unknown resource: ${uri}`);
+    if (candidates.length > 1) {
+      throw new McpError(
+        ErrorCode.InvalidParams,
+        `Resource ${uri} could come from more than one server (${candidates.join(", ")}). ` +
+          `ADTL can't tell which server to label it as, so it was not read.`,
+      );
+    }
+    return candidates[0]!;
+  }
+
+  async readResource(uri: string): Promise<ReadResourceResult> {
+    const upstream = await this.resourceUpstream(uri);
+    const client = this.upstreams.get(upstream)!;
+    return this.forwardLabeled("resources/read", upstream, { resource: uri }, { uri }, (params) =>
+      client.readResource(params as { uri: string }),
+    );
+  }
+
+  async getPrompt(name: string, args?: Record<string, string>): Promise<GetPromptResult> {
+    let route = this.promptRoutes.get(name);
+    if (!route) {
+      await this.listPrompts();
+      route = this.promptRoutes.get(name);
+    }
+    if (!route) throw new McpError(ErrorCode.InvalidParams, `Unknown prompt: ${name}`);
+    const client = this.upstreams.get(route.upstream)!;
+    return this.forwardLabeled(
+      "prompts/get",
+      route.upstream,
+      { prompt: route.prompt },
+      { name: route.prompt, ...(args ? { arguments: args } : {}) },
+      (params) => client.getPrompt(params as { name: string; arguments?: Record<string, string> }),
+    );
+  }
+
+  /**
+   * Forward a resources/read or prompts/get request through the interceptor
+   * chain: request interceptors → upstream → response interceptors (adtl.label).
+   * These requests have no tool result to carry an error, so a stopped request
+   * becomes a JSON-RPC error.
+   */
+  private async forwardLabeled<R extends object>(
+    event: "resources/read" | "prompts/get",
+    upstream: string,
+    target: { resource: string } | { prompt: string },
+    params: Record<string, unknown>,
+    send: (params: Record<string, unknown>) => Promise<R>,
+  ): Promise<R> {
+    const started = performance.now();
+    const context: InvocationContext = {
+      sessionId: this.sessionId,
+      timestamp: new Date().toISOString(),
+      principal: { type: "anonymous" },
+    };
+    const config = { server: upstream };
+    const audit = this.invoker.modeOverride === "audit" ? { mode: "audit" as const } : {};
+    const finish = (entry: Pick<AuditEntry, "outcome"> & Partial<AuditEntry>) =>
+      this.audit?.write({
+        ts: context.timestamp!,
+        sessionId: this.sessionId,
+        event,
+        server: upstream,
+        ...target,
+        ...entry,
+        durationMs: Math.round(performance.now() - started),
+      });
+    const what = "resource" in target ? `resource ${target.resource}` : `prompt ${upstream}${TOOL_SEPARATOR}${target.prompt}`;
+
+    const req = await this.invoker.runRequest({ event, payload: { method: event, params }, config, context });
+    if (req.blocked) {
+      finish({ outcome: "blocked", decision: req.blocked.decision, reason: req.blocked.reason, warnings: req.warnings });
+      this.log.info(`${req.blocked.decision} ${what}: ${req.blocked.reason}`);
+      throw new McpError(ErrorCode.InvalidRequest, `ADTL blocked this request: ${req.blocked.reason}`);
+    }
+    const forwarded = (req.payload as { params: Record<string, unknown> }).params;
+
+    let result: R;
+    try {
+      result = await send(forwarded);
+    } catch (err) {
+      finish({ outcome: "upstream_error", reason: (err as Error).message, ...audit, warnings: req.warnings });
+      throw err;
+    }
+
+    const res = await this.invoker.runResponse({ event, payload: { method: event, params: forwarded, result }, config, context });
+    const warnings = [...req.warnings, ...res.warnings];
+    if (res.blocked) {
+      // Fail closed: unlabeled content must not reach the agent.
+      finish({ outcome: "blocked", decision: res.blocked.decision, reason: res.blocked.reason, warnings });
+      this.log.warn(`${what} withheld: ${res.blocked.reason}`);
+      throw new McpError(ErrorCode.InternalError, `ADTL could not label this content, so it was withheld: ${res.blocked.reason}`);
+    }
+    const label = infoOf(res, "adtl.label");
+    finish({ outcome: "forwarded", ...audit, label: label.label, sessionLabel: label.sessionLabel, warnings });
+    return (res.payload as { result: R }).result;
+  }
+
   async callTool(name: string, args: Record<string, unknown>, opts: CallOptions = {}): Promise<CallToolResult> {
     const started = performance.now();
     let route = this.routes.get(name);

package/src/hooks/claudeCode.ts

@@ -0,0 +1,194 @@
+/**
+ * Claude Code hooks adapter: puts Claude Code's built-in tools (WebFetch, Read,
+ * Bash, …) and MCP servers that don't go through the gateway under the same
+ * labels and policy as gateway calls.
+ *
+ *   PreToolUse          runs the policy against the session label:
+ *                       block → deny, ask → Claude Code's permission prompt,
+ *                       allow → no answer, so Claude Code's own permissions apply
+ *   PostToolUse         labels the tool's output and adds it to the session label
+ *   PostToolUseFailure  same: a failed tool's error output still reaches the model
+ *
+ * Built-in tools are labeled as the server `claude-code` (see preset.ts); MCP
+ * tools `mcp__<server>__<tool>` as `<server>`. Tools of the gateway's own MCP
+ * server (`mcp__adtl__*` by default) are skipped: the gateway checks those.
+ *
+ * Hooks and gateway share one session label through a FileSessionStore keyed
+ * by Claude Code's session id, which the gateway reads from
+ * `CLAUDE_CODE_SESSION_ID`.
+ *
+ * Errors fail closed: a PreToolUse hook that can't decide denies the call.
+ */
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import {
+  callHash,
+  evaluatePolicy,
+  labelResult,
+  toolEgress,
+  type AdtlConfig,
+  type Decision,
+  type PolicyDecision,
+  type SessionStore,
+} from "@adtl/labels";
+import type { AuditEntry, AuditSink } from "../audit.js";
+import { CLAUDE_CODE_PRESET, CLAUDE_CODE_SERVER } from "./preset.js";
+
+export interface HookInput {
+  session_id?: string;
+  hook_event_name?: string;
+  tool_name?: string;
+  tool_input?: unknown;
+  tool_response?: unknown;
+  /** PostToolUseFailure: the error the tool returned. */
+  error?: unknown;
+  cwd?: string;
+}
+
+export interface HookOptions {
+  config: AdtlConfig;
+  sessions: SessionStore;
+  /** Name of the gateway in Claude Code's MCP config; its tools are skipped. Default `adtl`. */
+  gatewayServer?: string;
+  /** `audit`: decide and log, but never deny or ask. */
+  mode?: "active" | "audit";
+  audit?: AuditSink;
+  /** Files the agent must not change: the ADTL config and the session directory. */
+  protect?: { configPath?: string; sessionsDir?: string };
+}
+
+/** What the hook process prints and exits with. */
+export interface HookOutcome {
+  stdout?: Record<string, unknown>;
+  stderr?: string;
+  exitCode: number;
+}
+
+const NOTHING: HookOutcome = { exitCode: 0 };
+
+/** `config` with labels for Claude Code's built-in tools; rules under `servers.claude-code` win. */
+export function withClaudeCodePreset(config: AdtlConfig): AdtlConfig {
+  const own = config.servers[CLAUDE_CODE_SERVER];
+  return {
+    ...config,
+    servers: {
+      ...config.servers,
+      [CLAUDE_CODE_SERVER]: {
+        acceptServerClaims: own?.acceptServerClaims ?? false,
+        ...(own?.defaults ? { defaults: own.defaults } : {}),
+        tools: { ...CLAUDE_CODE_PRESET, ...own?.tools },
+      },
+    },
+  };
+}
+
+/** Which ADTL server and tool a Claude Code tool name is, or undefined for the gateway's own tools. */
+export function routeTool(toolName: string, gatewayServer = "adtl"): { server: string; tool: string } | undefined {
+  const m = /^mcp__(.+?)__(.+)$/.exec(toolName);
+  if (!m) return { server: CLAUDE_CODE_SERVER, tool: toolName };
+  if (m[1] === gatewayServer) return undefined;
+  return { server: m[1]!, tool: m[2]! };
+}
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+function inside(path: string, dir: string): boolean {
+  const r = relative(dir, path);
+  return r === "" || (!r.startsWith(`..${sep}`) && r !== ".." && !isAbsolute(r));
+}
+
+/**
+ * A best-effort guard against the agent clearing its own taint by editing the
+ * config or deleting session files. Not a sandbox: Bash can always find a way.
+ */
+function protectedTarget(input: HookInput, route: { server: string; tool: string }, protect: HookOptions["protect"]): { decision: Decision; reason: string } | undefined {
+  if (!protect || route.server !== CLAUDE_CODE_SERVER) return undefined;
+  const args = isRecord(input.tool_input) ? input.tool_input : {};
+  const cwd = input.cwd ?? process.cwd();
+  const path = typeof args.file_path === "string" ? args.file_path : typeof args.notebook_path === "string" ? args.notebook_path : undefined;
+  if (path !== undefined && ["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(route.tool)) {
+    const abs = resolve(cwd, path);
+    if (protect.configPath && abs === resolve(protect.configPath)) {
+      return { decision: "block", reason: "The agent may not change the ADTL config; edit it yourself" };
+    }
+    if (protect.sessionsDir && inside(abs, resolve(protect.sessionsDir))) {
+      return { decision: "block", reason: "The agent may not change ADTL session labels" };
+    }
+  }
+  const command = typeof args.command === "string" ? args.command : undefined;
+  if (command !== undefined && ["Bash", "Monitor"].includes(route.tool)) {
+    const marks = [".adtl/sessions", protect.sessionsDir].filter((m): m is string => !!m);
+    if (marks.some((m) => command.includes(m))) {
+      return { decision: "ask", reason: "This command touches ADTL session labels" };
+    }
+  }
+  return undefined;
+}
+
+export function handleHook(input: HookInput, opts: HookOptions): HookOutcome {
+  const event = input.hook_event_name;
+  if (event !== "PreToolUse" && event !== "PostToolUse" && event !== "PostToolUseFailure") return NOTHING;
+  if (typeof input.tool_name !== "string" || typeof input.session_id !== "string" || input.session_id === "") {
+    return failure(event, "hook input has no tool_name or session_id");
+  }
+  const route = routeTool(input.tool_name, opts.gatewayServer);
+  if (!route) return NOTHING;
+  const config = withClaudeCodePreset(opts.config);
+  const ts = new Date().toISOString();
+  const base = { ts, sessionId: input.session_id, event: "tools/call" as const, ...route, via: "claude-code-hook" as const };
+
+  if (event !== "PreToolUse") {
+    const label = labelResult({ ...route, result: input.tool_response ?? input.error ?? null }, config);
+    const sessionLabel = opts.sessions.observe(input.session_id, label);
+    opts.audit?.write({ ...base, outcome: "forwarded", label, sessionLabel, durationMs: 0 });
+    return NOTHING;
+  }
+
+  const hash = callHash(route.server, route.tool, input.tool_input ?? {});
+  const session = opts.sessions.get(input.session_id);
+  const guard = protectedTarget(input, route, opts.protect);
+  const policy: PolicyDecision = evaluatePolicy(config.policy, {
+    session,
+    ...route,
+    egress: toolEgress(config, route.server, route.tool),
+  });
+  const d: PolicyDecision =
+    guard && (guard.decision === "block" || policy.decision === "allow")
+      ? { decision: guard.decision, reason: guard.reason, matched: ["adtl-self-protection"] }
+      : policy;
+  if (d.decision === "allow") return NOTHING;
+
+  const audit = opts.mode === "audit";
+  const entry: AuditEntry = {
+    ...base,
+    outcome: audit ? "forwarded" : d.decision === "ask" ? "asked" : "blocked",
+    decision: d.decision,
+    ...(audit ? { mode: "audit" as const } : {}),
+    reason: d.reason,
+    matched: d.matched,
+    callHash: hash,
+    sessionLabel: session,
+    durationMs: 0,
+  };
+  opts.audit?.write(entry);
+  if (audit) return NOTHING;
+
+  return {
+    exitCode: 0,
+    stdout: {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: d.decision === "ask" ? "ask" : "deny",
+        permissionDecisionReason:
+          d.decision === "ask" ? `ADTL: ${d.reason}. Approve only if you expected this call.` : `ADTL blocked this call: ${d.reason}.`,
+      },
+    },
+  };
+}
+
+/** Fail closed: exit 2 stops a PreToolUse call and shows the reason to Claude. */
+export function failure(event: string | undefined, why: string): HookOutcome {
+  const stopped = event === "PreToolUse" ? " The call was stopped." : "";
+  return { exitCode: 2, stderr: `ADTL hook error: ${why}.${stopped}` };
+}

package/src/hooks/index.ts

@@ -0,0 +1,3 @@
+export * from "./claudeCode.js";
+export * from "./preset.js";
+export * from "./run.js";

package/src/hooks/preset.ts

@@ -0,0 +1,47 @@
+/**
+ * Labels for Claude Code's built-in tools, used when `servers.claude-code`
+ * doesn't override them. Built-in tools are labeled as the server `claude-code`.
+ *
+ * - Local reads (Read, Grep, Glob) are trusted but private: your own files.
+ *   Files written from untrusted content aren't tracked until the v0.4 ledger.
+ * - Web tools bring in untrusted content, and their URL or query can carry
+ *   data out, so their egress is external.
+ * - Bash can do anything: its output has unknown integrity, and its egress is
+ *   unknown.
+ * - Edits and bookkeeping tools return nothing worth labeling.
+ */
+import type { ToolRule } from "@adtl/labels";
+
+export const CLAUDE_CODE_SERVER = "claude-code";
+
+const localRead: ToolRule = { integrity: "trusted", confidentiality: "private", egress: "none" };
+const localWrite: ToolRule = { integrity: "trusted", confidentiality: "public", egress: "none" };
+const web: ToolRule = { integrity: "untrusted", confidentiality: "public", egress: "external" };
+const shell: ToolRule = { integrity: "unknown", confidentiality: "private", egress: "unknown" };
+
+export const CLAUDE_CODE_PRESET: Record<string, ToolRule> = {
+  Read: localRead,
+  Grep: localRead,
+  Glob: localRead,
+  LS: localRead,
+  NotebookRead: localRead,
+  Write: localWrite,
+  Edit: localWrite,
+  MultiEdit: localWrite,
+  NotebookEdit: localWrite,
+  TodoWrite: localWrite,
+  AskUserQuestion: localWrite,
+  Skill: localWrite,
+  ToolSearch: localWrite,
+  EnterPlanMode: localWrite,
+  ExitPlanMode: localWrite,
+  WebFetch: web,
+  WebSearch: web,
+  Bash: shell,
+  BashOutput: shell,
+  KillShell: localWrite,
+  Monitor: shell,
+  // A sub-agent's own tool calls go through these hooks too; its answer mixes what it saw.
+  Agent: { integrity: "unknown", confidentiality: "private", egress: "none" },
+  Task: { integrity: "unknown", confidentiality: "private", egress: "none" },
+};

package/src/hooks/run.ts

@@ -0,0 +1,49 @@
+/**
+ * `adtl-gateway hook --config adtl.yaml`: the command Claude Code runs for
+ * PreToolUse, PostToolUse and PostToolUseFailure. Reads the hook event from
+ * stdin and answers on stdout (JSON) or stderr (with exit code 2).
+ *
+ * The config needs no `gateway:` section; if there is one, its `audit` log and
+ * `mode` are used, so hook and gateway write to the same audit log.
+ */
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { FileSessionStore, defaultSessionsDir } from "@adtl/labels";
+import { parseConfigText } from "@adtl/interceptors";
+import { parse as parseYaml } from "yaml";
+import { JsonlAuditLog } from "../audit.js";
+import { failure, handleHook, type HookInput, type HookOutcome } from "./claudeCode.js";
+
+export interface RunHookOptions {
+  configPath: string;
+  stdin: string;
+  gatewayServer?: string;
+  env?: NodeJS.ProcessEnv;
+}
+
+export async function runHook(opts: RunHookOptions): Promise<HookOutcome> {
+  let input: HookInput;
+  try {
+    input = JSON.parse(opts.stdin) as HookInput;
+  } catch {
+    // Without the event name we can't tell whether this is a PreToolUse call; refuse it to be safe.
+    return failure("PreToolUse", "hook input on stdin is not JSON");
+  }
+  try {
+    const path = resolve(input.cwd ?? process.cwd(), opts.configPath);
+    const text = await readFile(path, "utf8");
+    const config = parseConfigText(text, path);
+    const gw = ((parseYaml(text) ?? {}) as { gateway?: { audit?: unknown; mode?: unknown } }).gateway ?? {};
+    const sessionsDir = defaultSessionsDir(opts.env ?? process.env);
+    return handleHook(input, {
+      config,
+      sessions: new FileSessionStore(sessionsDir),
+      ...(opts.gatewayServer ? { gatewayServer: opts.gatewayServer } : {}),
+      mode: gw.mode === "audit" ? "audit" : "active",
+      ...(typeof gw.audit === "string" ? { audit: new JsonlAuditLog(resolve(dirname(path), gw.audit)) } : {}),
+      protect: { configPath: path, sessionsDir },
+    });
+  } catch (err) {
+    return failure(input.hook_event_name, (err as Error).message);
+  }
+}

package/src/index.ts

@@ -6,3 +6,5 @@ export * from "./ntfy.js";
 export * from "./email.js";
 export * from "./gateway.js";
 export * from "./startup.js";
+export * from "./init/index.js";
+export * from "./hooks/index.js";

package/src/init/index.ts

@@ -0,0 +1,3 @@
+export { PRESETS, choosePreset, type Preset } from "./presets.js";
+export { mergeIntoDocument, ruleFromHints, suggest, type MergeReport, type ServerScan, type ServerSuggestion, type ToolSuggestion } from "./suggest.js";
+export { runInit, type InitOptions, type InitResult } from "./run.js";