@adtl/gateway 0.8.1 → 0.8.2

package/README.md

@@ -128,7 +128,27 @@ Labels only get stricter as a session goes on. A session that has read anything
 
 ### Policy
 
-Rules match on `session.integrity`, `session.confidentiality`, `tool.egress`, `tool` (`server.tool` globs such as `github.*`), and, for tools that declare [action-metadata](#tools-that-describe-themselves-action-metadata), `tool.outcome` (`benign`, `consequential`, `irreversible`) and `tool.requiresReview`. They decide `allow`, `ask` or `block`. When several rules match, the most restrictive decision wins. A tool that says `requiresReview: true` gets `ask` when no rule blocks it; set `policy.honorRequiresReview: false` to turn that off. `ask` waits for a human when [approvals](#approvals) are configured, and blocks otherwise.
+Rules match on `session.integrity`, `session.confidentiality`, `tool.egress`, `tool` (`server.tool` globs such as `github.*`), [`call.copiesPrivate`](#copied-private-values), and, for tools that declare [action-metadata](#tools-that-describe-themselves-action-metadata), `tool.outcome` (`benign`, `consequential`, `irreversible`) and `tool.requiresReview`. They decide `allow`, `ask` or `block`. When several rules match, the most restrictive decision wins. A tool that says `requiresReview: true` gets `ask` when no rule blocks it; set `policy.honorRequiresReview: false` to turn that off. `ask` waits for a human when [approvals](#approvals) are configured, and blocks otherwise.
+
+#### Copied private values
+
+`call.copiesPrivate: true` matches a call whose arguments hold a value the session read earlier from a `private` or `secret` result: a token from `.env` pasted into a report, a password written into a script. A session label can't tell that write from a normal one, because nearly every session is already private; copied values can.
+
+```yaml
+policy:
+  rules:
+    - name: ask-before-copying-private-values
+      when: { call.copiesPrivate: true, tool.egress: [internal, external, public, unknown] }
+      then: ask
+```
+
+- Only secret-like values count: 16 or more letters, digits, `_`, `-` or `+` in a row, with both letters and digits, not plain hex (so git commit ids, hashes and UUIDs don't count), and not a folder name in a path.
+- The session keeps hashes of those values, never the values (`<session>.values` next to the session's label file). `ADTL_SESSIONS_DIR` and the hooks' self-protection cover it.
+- It works for calls through the gateway and for the Claude Code hooks, which share the session. A sub-agent's calls are checked against its parent's values too.
+- It only sees verbatim copies. A value that was re-encoded, split or paraphrased doesn't match.
+- A session store that can't tell (a custom `SessionStore` without `hasPrivateValue`) counts every call as copying, so the rule fails closed.
+
+On [MCPHunt's traces](../../examples/mcphunt-eval/), this rule on top of the example policy stops 78.0% of leaks with 12.7% of clean runs interrupted, against 95.2% and 95.7% for asking before every write once the session is private.
 
 ### Gateway
 

package/dist/gateway.d.ts

@@ -6,7 +6,7 @@ import type { TotpVerifier } from "./totp.js";
 import type { AuditSink } from "./audit.js";
 import { type Authorizer, type Principal } from "./authorizer.js";
 import type { InterceptorInvoker } from "./invoker.js";
-export declare const GATEWAY_VERSION = "0.8.1";
+export declare const GATEWAY_VERSION = "0.8.2";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export declare const GATEWAY_DECISION_KEY = "adtl/gateway";
 export interface GatewayLogger {

package/dist/gateway.js

@@ -38,7 +38,7 @@ import { callBindingHash } from "@adtl/labels";
 import { ElicitationChannel, supportsElicitation } from "./elicitation.js";
 import { authorize } from "./authorizer.js";
 import { TOOL_SEPARATOR } from "./config.js";
-export const GATEWAY_VERSION = "0.8.1";
+export const GATEWAY_VERSION = "0.8.2";
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";
 const stderrLogger = {

package/dist/hooks/claudeCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AA6BA,OAAO,EAKL,KAAK,UAAU,EAIf,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9I;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAanE;AAED,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhH;AAkED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAUpD;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CAiF3E;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAG3E"}
+{"version":3,"file":"claudeCode.d.ts","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AA6BA,OAAO,EAOL,KAAK,UAAU,EAIf,KAAK,YAAY,EAElB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9I;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAanE;AAED,uGAAuG;AACvG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKhH;AAkED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAUpD;AAoBD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,GAAG,WAAW,CAqF3E;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAG3E"}

package/dist/hooks/claudeCode.js

@@ -27,7 +27,7 @@
  * Errors fail closed: a PreToolUse hook that can't decide denies the call.
  */
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { callHash, evaluatePolicy, labelResult, toolEgress, join, } from "@adtl/labels";
+import { callHash, evaluatePolicy, labelResult, secretFingerprints, toolEgress, usesCopiesPrivate, join, } from "@adtl/labels";
 import { chunkHashes, valueHashes } from "@adtl/ledger";
 import { TOTP_KEYCHAIN_SERVICE } from "../totp.js";
 import { CLAUDE_CODE_PRESET, CLAUDE_CODE_SERVER } from "./preset.js";
@@ -139,8 +139,15 @@ export function addedLines(output) {
 function sessionFor(input, opts) {
     const parent = typeof input.agent_id === "string" ? opts.agents?.parentOf(input.agent_id) : undefined;
     if (!parent || parent === input.session_id)
-        return { id: input.session_id, get: () => opts.sessions.get(input.session_id) };
-    return { id: parent, get: () => join(opts.sessions.get(parent), opts.sessions.get(input.session_id)) };
+        return { id: input.session_id, ids: [input.session_id], get: () => opts.sessions.get(input.session_id) };
+    return { id: parent, ids: [parent, input.session_id], get: () => join(opts.sessions.get(parent), opts.sessions.get(input.session_id)) };
+}
+/** Whether `args` hold a value one of the sessions read from a private source; undefined if the store can't tell. */
+function copiesPrivate(sessions, ids, args) {
+    if (!sessions.hasPrivateValue)
+        return undefined;
+    const prints = secretFingerprints(args ?? {});
+    return ids.some((id) => sessions.hasPrivateValue(id, prints));
 }
 export function handleHook(input, opts) {
     const event = input.hook_event_name;
@@ -179,16 +186,21 @@ export function handleHook(input, opts) {
             opts.ledger.record(written, before, session.id, route);
         }
         const sessionLabel = join(session.get(), opts.sessions.observe(session.id, label));
+        // Secret-like values read from a private source, for call.copiesPrivate (hashes only).
+        if (label.confidentiality !== "public")
+            opts.sessions.rememberPrivateValues?.(session.id, secretFingerprints(output));
         opts.audit?.write({ ...base, outcome: "forwarded", label, ...(ledger ? { ledger } : {}), sessionLabel, durationMs: 0 });
         return NOTHING;
     }
     const hash = callHash(route.server, route.tool, input.tool_input ?? {});
     const current = session.get();
     const guard = protectedTarget(input, route, opts.protect);
+    const copies = usesCopiesPrivate(config.policy) ? copiesPrivate(opts.sessions, session.ids, input.tool_input) : undefined;
     const policy = evaluatePolicy(config.policy, {
         session: current,
         ...route,
         egress: toolEgress(config, route.server, route.tool),
+        ...(copies !== undefined ? { copiesPrivate: copies } : {}),
     });
     const d = guard && (guard.decision === "block" || policy.decision === "allow")
         ? { decision: guard.decision, reason: guard.reason, matched: ["adtl-self-protection"] }

package/dist/hooks/claudeCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,WAAW,EACX,UAAU,EAMV,IAAI,GACL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuCrE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE7C,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,CAAC,kBAAkB,CAAC,EAAE;gBACpB,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,KAAK;gBACpD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE;aAChD;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,aAAa,GAAG,MAAM;IAChE,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAuC,EAAE,OAA+B;IACjH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,yDAAyD;QACzD,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACnF,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7I,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAyC,EAAE,IAAiB;IAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5H,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,IAAiB;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YAC1G,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,OAAO,CAAC;IACxG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3G,OAAO,OAAO,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAA2C,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3J,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,YAAqB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,kBAA2B,EAAE,GAAG,KAAK,EAAE,CAAC;IAE/H,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAyD,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;YACD,8EAA8E;YAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmB,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,OAAO,EAAE,OAAO;QAChB,GAAG,KAAK;QACR,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,CAAC,GACL,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvF,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IACpC,MAAM,KAAK,GAAe;QACxB,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAE1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE;YACN,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBACzD,wBAAwB,EACtB,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,2CAA2C,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG;aAC/H;SACF;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,KAAyB,EAAE,GAAW;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"claudeCode.js","sourceRoot":"","sources":["../../src/hooks/claudeCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,iBAAiB,EAMjB,IAAI,GACL,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuCrE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE7C,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,CAAC,kBAAkB,CAAC,EAAE;gBACpB,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,KAAK;gBACpD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,EAAE,EAAE,GAAG,kBAAkB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE;aAChD;SACF;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,aAAa,GAAG,MAAM;IAChE,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAuC,EAAE,OAA+B;IACjH,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QACrG,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,yDAAyD;QACzD,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACnF,CAAC;QACD,2CAA2C;QAC3C,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7I,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAyC,EAAE,IAAiB;IAC9E,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACrJ,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED,qHAAqH;AACrH,SAAS,aAAa,CAAC,QAAsB,EAAE,GAAa,EAAE,IAAa;IACzE,IAAI,CAAC,QAAQ,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,IAAiB;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YAC1G,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,oBAAoB;QAAE,OAAO,OAAO,CAAC;IACxG,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3G,OAAO,OAAO,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAA2C,EAAE,IAAI,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3J,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,YAAqB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,kBAA2B,EAAE,GAAG,KAAK,EAAE,CAAC;IAE/H,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;QAC1D,IAAI,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAyD,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;YACD,8EAA8E;YAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACnF,uFAAuF;QACvF,IAAI,KAAK,CAAC,eAAe,KAAK,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtH,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1H,MAAM,MAAM,GAAmB,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,OAAO,EAAE,OAAO;QAChB,GAAG,KAAK;QACR,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,CAAC,GACL,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAClE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvF,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IACpC,MAAM,KAAK,GAAe;QACxB,GAAG,IAAI;QACP,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACzE,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,OAAO;QACrB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAE1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE;YACN,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBACzD,wBAAwB,EACtB,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,2CAA2C,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,MAAM,GAAG;aAC/H;SACF;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,OAAO,CAAC,KAAyB,EAAE,GAAW;IAC5D,MAAM,OAAO,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC;AACvE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adtl/gateway",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Experimental: MCP gateway that labels every tool result and blocks risky tool calls using ADTL trust labels",
   "keywords": [
     "mcp",
@@ -47,9 +47,9 @@
     "url": "https://github.com/probita-ai/adtl/issues"
   },
   "dependencies": {
-    "@adtl/interceptors": "0.8.1",
-    "@adtl/labels": "0.8.1",
-    "@adtl/ledger": "0.8.1",
+    "@adtl/interceptors": "0.8.2",
+    "@adtl/labels": "0.8.2",
+    "@adtl/ledger": "0.8.2",
     "@modelcontextprotocol/sdk": "1.32.2",
     "nodemailer": "10.3.1",
     "qrcode-terminal": "0.12.0",

package/src/gateway.ts

@@ -63,7 +63,7 @@ import { authorize, type AuthorizationRequest, type Authorizer, type Denial, typ
 import { TOOL_SEPARATOR } from "./config.js";
 import type { Blocked, InterceptorInvoker, InterceptorRun, PhaseOutcome } from "./invoker.js";
 
-export const GATEWAY_VERSION = "0.8.1";
+export const GATEWAY_VERSION = "0.8.2";
 
 /** `_meta` key on gateway-generated error results describing why a call was stopped. */
 export const GATEWAY_DECISION_KEY = "adtl/gateway";

package/src/hooks/claudeCode.ts

@@ -31,7 +31,9 @@ import {
   callHash,
   evaluatePolicy,
   labelResult,
+  secretFingerprints,
   toolEgress,
+  usesCopiesPrivate,
   type AdtlConfig,
   type Decision,
   type PolicyDecision,
@@ -190,10 +192,17 @@ export function addedLines(output: unknown): string[] {
  * parent session, else the call's own. When the two differ, the sub-agent's own
  * label is read too, so nothing it saw is lost.
  */
-function sessionFor(input: HookInput & { session_id: string }, opts: HookOptions): { id: string; get(): Label } {
+function sessionFor(input: HookInput & { session_id: string }, opts: HookOptions): { id: string; ids: string[]; get(): Label } {
   const parent = typeof input.agent_id === "string" ? opts.agents?.parentOf(input.agent_id) : undefined;
-  if (!parent || parent === input.session_id) return { id: input.session_id, get: () => opts.sessions.get(input.session_id) };
-  return { id: parent, get: () => join(opts.sessions.get(parent), opts.sessions.get(input.session_id)) };
+  if (!parent || parent === input.session_id) return { id: input.session_id, ids: [input.session_id], get: () => opts.sessions.get(input.session_id) };
+  return { id: parent, ids: [parent, input.session_id], get: () => join(opts.sessions.get(parent), opts.sessions.get(input.session_id)) };
+}
+
+/** Whether `args` hold a value one of the sessions read from a private source; undefined if the store can't tell. */
+function copiesPrivate(sessions: SessionStore, ids: string[], args: unknown): boolean | undefined {
+  if (!sessions.hasPrivateValue) return undefined;
+  const prints = secretFingerprints(args ?? {});
+  return ids.some((id) => sessions.hasPrivateValue!(id, prints));
 }
 
 export function handleHook(input: HookInput, opts: HookOptions): HookOutcome {
@@ -233,6 +242,8 @@ export function handleHook(input: HookInput, opts: HookOptions): HookOutcome {
       opts.ledger.record(written, before, session.id, route);
     }
     const sessionLabel = join(session.get(), opts.sessions.observe(session.id, label));
+    // Secret-like values read from a private source, for call.copiesPrivate (hashes only).
+    if (label.confidentiality !== "public") opts.sessions.rememberPrivateValues?.(session.id, secretFingerprints(output));
     opts.audit?.write({ ...base, outcome: "forwarded", label, ...(ledger ? { ledger } : {}), sessionLabel, durationMs: 0 });
     return NOTHING;
   }
@@ -240,10 +251,12 @@ export function handleHook(input: HookInput, opts: HookOptions): HookOutcome {
   const hash = callHash(route.server, route.tool, input.tool_input ?? {});
   const current = session.get();
   const guard = protectedTarget(input, route, opts.protect);
+  const copies = usesCopiesPrivate(config.policy) ? copiesPrivate(opts.sessions, session.ids, input.tool_input) : undefined;
   const policy: PolicyDecision = evaluatePolicy(config.policy, {
     session: current,
     ...route,
     egress: toolEgress(config, route.server, route.tool),
+    ...(copies !== undefined ? { copiesPrivate: copies } : {}),
   });
   const d: PolicyDecision =
     guard && (guard.decision === "block" || policy.decision === "allow")