@agent-beam/beam 0.2.37 → 0.2.39

package/README.md

@@ -84,19 +84,13 @@ MCP responses can be filtered locally before sensitive content reaches an agent.
 
 AgentBeam is not Claude-specific. Setup discovers the agents actually installed on the machine and installs the appropriate native hook for each selected agent.
 
-| Agent | Hook support |
-|---|---|
-| Claude Code | Pre-tool protection and activity capture |
-| Codex | Pre-tool protection and activity capture |
-| Gemini CLI | Before-tool protection and activity capture |
-| GitHub Copilot CLI | Pre-tool protection and activity capture |
-| Cursor | Pre-tool protection and activity capture |
-| Hermes Agent | Pre-tool shell hook in `~/.hermes/config.yaml`; asks for approval on first use |
-| OpenClaw | `before_tool_call` plugin, registered with `openclaw plugins install --link` |
-| OpenCode | Shim-based protection where supported |
-| Jev (TypeSafe AI) | Discovery only — config/artifact presence; ecosystem is too fragmented across third-party CLIs (`jev-cli`, `jev-axi`, `jev-guard`) for a single hook contract yet |
-
-Agent configuration is updated non-destructively, without replacing existing hooks.
+Beam now provides **27 native agent hook/plugin integrations**, covering prompts, pre-tool calls, results, failures, permissions and session/subagent events where the host exposes them. Supported agents include Claude Code, Codex, Cursor, Copilot CLI, VS Code Copilot Chat, Gemini, Windsurf/Devin Desktop, OpenCode, OpenClaw, Pi, Kimi, Qwen, Cline, Amp, Auggie, Kiro, Goose, Kilo, OpenHands, Crush, Junie, Antigravity, Factory Droid, Grok Build, Devin CLI, Hermes and Muse Code. Jev remains discovery-only.
+
+Run `beam agent list --events` for exact event names or see the [full coverage and capture guide](docs/agent-hooks.md). Re-run `beam agent install-all` to upgrade detected agents, then restart the affected hosts and approve changed hooks where required. OpenHands needs an explicit repository config path; VS Code shares Copilot's hook file.
+
+Activity now includes **redacted user prompts**, tool arguments/results, file and directory paths, search terms, URLs and supplied edit details. Open an action in Studio to inspect these fields. Events queue locally when the collector is unavailable. Capture is bounded and depends on host callbacks; shell side effects and uninstrumented tools cannot be reconstructed completely from hooks.
+
+Agent configuration is merged with existing settings, with an original-file backup. New integrations have fixture and generated-callback coverage; live host/version validation is still required.
 
 ## Optional Jev action judging
 

package/dist/access-risk.d.ts

@@ -0,0 +1,10 @@
+import type { ActionContext } from "./action-context.js";
+import type { Severity } from "./rule-catalog.js";
+export type AccessAssessment = {
+    severity: Severity;
+    explanation: string;
+} | {
+    suppress: true;
+};
+export declare function environmentRisk(context: ActionContext): AccessAssessment | undefined;
+export declare function assessAccessFinding(ruleId: string, context: ActionContext): AccessAssessment | undefined;

package/dist/access-risk.js

@@ -0,0 +1,43 @@
+const routineName = (name) => /^(?:AWS_REGION|AWS_DEFAULT_REGION|NODE_ENV|PORT|HOST|LANG|TZ|CI|TERM|PWD)$/.test(name);
+const privatePath = (path) => /(?:^|[/\\])\.env(?:[.\\/]|rc\b|$)|\.ssh[/\\]|\.aws[/\\]credentials\b|id_(?:rsa|ed25519)|\.npmrc\b|\.netrc\b|kubeconfig|\.pgpass\b|credentials\.json/i.test(path);
+function scopedTemporaryConfiguration(path) {
+    if (/[$`*?{}()[\]~]/.test(path) || path.split(/[\\/]/).some(p => p === "." || p === ".."))
+        return false;
+    const match = /^\/(?:tmp|private\/tmp|var\/tmp)\/([A-Za-z0-9._-]+)\//.exec(path);
+    return !!match && /(?:^|[-_.])(?:test|tests|temp|tmp|scratch|verify)(?:$|[-_.])/i.test(match[1]) && !/(?:^|[-_.])(?:prod|production|credentials?|secrets?|backups?)(?:$|[-_.])/i.test(match[1]);
+}
+export function environmentRisk(context) {
+    const actions = context.actions;
+    if (context.truncated)
+        return undefined;
+    if (actions.some(a => a.operation === "environment-dump" || (a.target ?? "").includes("/proc/self/environ")))
+        return { severity: "high", explanation: "The request accesses the exported process environment without restricting it to named entries. Returned values and exposure are not established by this request alone." };
+    const lookups = actions.filter(a => a.operation === "environment-lookup");
+    // Unknown commands may contain additional environment access that the parser
+    // cannot classify. Preserve the stronger fallback instead of guessing.
+    if (lookups.length && !actions.some(a => a.operation === "command")) {
+        if (lookups.some(a => a.origin !== "inline-assignment" && (!a.variableNames?.length || a.variableNames.some(name => !routineName(name)))))
+            return { severity: "medium", explanation: "The request looks up named inherited environment variables that may contain credentials or unclassified private configuration. It does not dump the whole environment; review authorization and returned output." };
+        if (lookups.every(a => a.origin === "inline-assignment"))
+            return { severity: "info", explanation: "The request looks up named values supplied as literal inline assignments in the same command. This lookup does not access inherited values for those names; recorded values remain redacted." };
+        return { severity: "info", explanation: "The request looks up named environment configuration entries without a whole-environment dump. Only recognized routine configuration names were identified; this is recorded for visibility." };
+    }
+    if (actions.length && actions.every(a => ["file-read", "file-search", "source-search", "file-write", "delete", "git-change", "network-request", "network-scan", "mcp-call"].includes(a.operation)))
+        return { suppress: true };
+    return undefined;
+}
+export function assessAccessFinding(ruleId, context) {
+    if (ruleId === "credentials.environment")
+        return environmentRisk(context);
+    if (ruleId !== "source.private_files" && ruleId !== "credentials.access")
+        return undefined;
+    if (context.truncated)
+        return undefined;
+    const reads = context.actions.filter(a => ["file-read", "file-search", "file-write"].includes(a.operation) && privatePath(a.resolvedPath ?? a.target ?? ""));
+    if (reads.length && !context.actions.some(a => a.operation === "command") && reads.every(a => scopedTemporaryConfiguration(a.resolvedPath ?? a.target ?? "")))
+        return { severity: "medium", explanation: "The request targets a private configuration location under a narrowly scoped temporary test directory. Its contents are not verified as fake or harmless; review access and returned output." };
+    if (context.actions.length && context.actions.every(a => a.operation === "source-search"))
+        return ruleId === "source.private_files" ? { suppress: true } : { severity: "info", explanation: "The request searches source code for credential-related text. This reference alone does not establish a credential-file read or disclosure." };
+    return undefined;
+}
+//# sourceMappingURL=access-risk.js.map

package/dist/access-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-risk.js","sourceRoot":"","sources":["../src/access-risk.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,GAAG,CAAC,IAAW,EAAE,EAAE,CAAC,4EAA4E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7H,MAAM,WAAW,GAAG,CAAC,IAAW,EAAE,EAAE,CAAC,sJAAsJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvM,SAAS,4BAA4B,CAAC,IAAW;IAC/C,IAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,GAAG,IAAE,CAAC,KAAG,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC;IAC5F,MAAM,KAAK,GAAC,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,KAAK,IAAI,+DAA+D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,2EAA2E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClM,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,OAAO,GAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,IAAG,OAAO,CAAC,SAAS;QAAC,OAAO,SAAS,CAAC;IACtC,IAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,kBAAkB,IAAE,CAAC,CAAC,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,WAAW,EAAC,wKAAwK,EAAC,CAAC;IAClT,MAAM,OAAO,GAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,oBAAoB,CAAC,CAAC;IACpE,6EAA6E;IAC7E,uEAAuE;IACvE,IAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,mBAAmB,IAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,EAAC,QAAQ,EAAC,QAAQ,EAAC,WAAW,EAAC,kNAAkN,EAAC,CAAC;QAC3X,IAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,mBAAmB,CAAC;YAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,WAAW,EAAC,8LAA8L,EAAC,CAAC;QACxR,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,WAAW,EAAC,8LAA8L,EAAC,CAAC;IACtO,CAAC;IACD,IAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,WAAW,EAAC,aAAa,EAAC,eAAe,EAAC,YAAY,EAAC,QAAQ,EAAC,YAAY,EAAC,iBAAiB,EAAC,cAAc,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;IAC/M,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAa,EAAC,OAAqB;IACrE,IAAG,MAAM,KAAG,yBAAyB;QAAC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,IAAG,MAAM,KAAG,sBAAsB,IAAE,MAAM,KAAG,oBAAoB;QAAC,OAAO,SAAS,CAAC;IACnF,IAAG,OAAO,CAAC,SAAS;QAAC,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,WAAW,EAAC,aAAa,EAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAE,WAAW,CAAC,CAAC,CAAC,YAAY,IAAE,CAAC,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC,CAAC;IACjJ,IAAG,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,4BAA4B,CAAC,CAAC,CAAC,YAAY,IAAE,CAAC,CAAC,MAAM,IAAE,EAAE,CAAC,CAAC;QAAC,OAAO,EAAC,QAAQ,EAAC,QAAQ,EAAC,WAAW,EAAC,8LAA8L,EAAC,CAAC;IACzX,IAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,SAAS,KAAG,eAAe,CAAC;QAAC,OAAO,MAAM,KAAG,sBAAsB,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAA,CAAC,CAAA,EAAC,QAAQ,EAAC,MAAM,EAAC,WAAW,EAAC,6IAA6I,EAAC,CAAC;IACtT,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/action-context.d.ts

@@ -0,0 +1,30 @@
+export type ActionOperation = "file-read" | "file-search" | "source-search" | "environment-lookup" | "environment-dump" | "file-write" | "delete" | "network-request" | "network-scan" | "git-change" | "mcp-call" | "command";
+export type ClassifiedAction = {
+    operation: ActionOperation;
+    evidence: "tool-arguments" | "shell-syntax";
+    target?: string;
+    resolvedPath?: string;
+    variableNames?: string[];
+    scope?: "file-content" | "requested-lines" | "matching-output" | "named-variables" | "all-exported";
+    lineStart?: number;
+    lineEnd?: number;
+    executable?: string;
+    origin?: "inline-assignment" | "inherited-environment";
+    privileged?: boolean;
+    insecureTransport?: boolean;
+};
+export type ActionContext = {
+    schemaVersion: 1;
+    workingDirectory?: string;
+    repository?: {
+        root: string;
+        name: string;
+        branch?: string;
+        commit?: string;
+    };
+    actions: ClassifiedAction[];
+    truncated: boolean;
+};
+/** Describe requested operations only. No command execution, secret-file reads,
+ * output inspection, or inferred successful key access occurs here. */
+export declare function classifyActionContext(tool: string, input: Record<string, unknown>, cwd: string, command: string, safe: (s: string) => string, includeRepository?: boolean, depth?: number): ActionContext;

package/dist/action-context.js

@@ -0,0 +1,203 @@
+import { dirname, basename, isAbsolute, join, resolve } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { shellActionCommands } from "./credential-egress.js";
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const isDynamic = (value) => /[$`*?{}()[\]~]/.test(value);
+const asString = (value) => typeof value === "string" ? value : "";
+const positive = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 1_000_000_000 ? value : undefined;
+function smallFile(path) {
+    try {
+        const s = statSync(path);
+        return s.isFile() && s.size <= 8192 ? readFileSync(path, "utf8").trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function repositoryAt(cwd, safe) {
+    if (!isAbsolute(cwd) || isDynamic(cwd))
+        return undefined;
+    let root = cwd;
+    for (let depth = 0; depth < 24; depth++) {
+        const marker = join(root, ".git");
+        if (existsSync(marker)) {
+            const pointer = smallFile(marker)?.match(/^gitdir:\s*(.+)$/m)?.[1];
+            const gitdir = pointer ? resolve(root, pointer) : marker;
+            const head = smallFile(join(gitdir, "HEAD"));
+            const ref = head?.match(/^ref:\s*(refs\/heads\/[A-Za-z0-9_./-]+)$/)?.[1];
+            const common = smallFile(join(gitdir, "commondir"));
+            const refRoot = common ? resolve(gitdir, common) : gitdir;
+            const commit = ref ? smallFile(join(refRoot, ref)) : head;
+            return { root: safe(root), name: safe(basename(root)), branch: ref ? safe(ref.slice(11)) : undefined, commit: commit && /^[a-f0-9]{40,64}$/i.test(commit) ? commit : undefined };
+        }
+        const parent = dirname(root);
+        if (parent === root)
+            break;
+        root = parent;
+    }
+    return undefined;
+}
+/** Describe requested operations only. No command execution, secret-file reads,
+ * output inspection, or inferred successful key access occurs here. */
+export function classifyActionContext(tool, input, cwd, command, safe, includeRepository = true, depth = 0) {
+    const actions = [];
+    let working = cwd;
+    let omitted = false;
+    if (depth > 4)
+        return { schemaVersion: 1, actions: [], truncated: true };
+    const add = (action) => { if (actions.length >= 12) {
+        omitted = true;
+        return;
+    } actions.push(action); };
+    const file = (operation, target, extra = {}) => add({ operation, evidence: command ? "shell-syntax" : "tool-arguments", target: safe(target), resolvedPath: !isDynamic(target) && working && isAbsolute(working) ? safe(resolve(working, target)) : isAbsolute(target) && !isDynamic(target) ? safe(target) : undefined, ...extra });
+    const path = asString(input.file_path ?? input.path ?? input.filePath);
+    if (/^(?:read|read_file|read_text_file|view)$/i.test(tool) && path) {
+        const start = positive(input.start_line) ?? (tool.toLowerCase() === "read" ? positive(input.offset) : undefined);
+        const end = positive(input.end_line) ?? (start && positive(input.limit) ? start + Number(input.limit) - 1 : undefined);
+        file("file-read", path, { scope: start || end ? "requested-lines" : "file-content", lineStart: start, lineEnd: end });
+    }
+    else if (/^(?:write|edit|write_file|apply_patch|multiedit)$/i.test(tool) && path)
+        file("file-write", path);
+    else if (/^mcp(?:__|:|\.)/i.test(tool))
+        add({ operation: "mcp-call", evidence: "tool-arguments", target: safe(tool) });
+    else if (!command && /^web(?:__|\.)|^(?:webfetch|websearch|fetch|browse)$/i.test(tool))
+        add({ operation: "network-request", evidence: "tool-arguments", target: safe(asString(input.url) || tool) });
+    if (command)
+        for (const c of shellActionCommands(command)) {
+            const tokens = c.tokens;
+            let at = 0;
+            let privileged = false;
+            const inlineNames = new Set();
+            while (/^[A-Za-z_]\w*=/.test(tokens[at]?.value ?? "")) {
+                const token = tokens[at];
+                const name = token.value.split("=", 1)[0];
+                if (!/[$`]/.test(token.raw))
+                    inlineNames.add(name);
+                at++;
+            }
+            if (tokens[at]?.value === "sudo") {
+                privileged = true;
+                at++;
+                if (tokens[at]?.value.startsWith("-")) {
+                    add({ operation: "command", evidence: "shell-syntax", executable: "sudo", privileged: true });
+                    continue;
+                }
+            }
+            const cmd = basename(tokens[at]?.value ?? "").toLowerCase();
+            const args = tokens.slice(at + 1).map(t => t.value);
+            if (!cmd)
+                continue;
+            if (/^(?:bash|sh|zsh)$/.test(cmd) && args.length === 2 && /^-[a-z]*c[a-z]*$/.test(args[0])) {
+                const code = tokens[at + 2];
+                if (code && (code.raw.startsWith("'") || code.raw.startsWith('"') && !/[$`]/.test(code.raw))) {
+                    const nested = classifyActionContext("Bash", {}, working, code.value, safe, false, depth + 1);
+                    for (const action of nested.actions)
+                        add(action.operation === "environment-lookup" && action.variableNames?.every(name => inlineNames.has(name)) ? { ...action, origin: "inline-assignment" } : action);
+                    omitted ||= nested.truncated;
+                    continue;
+                }
+            }
+            if (cmd === "cd") {
+                working = args[0] && !isDynamic(args[0]) && !c.pipe ? resolve(working || cwd, args[0]) : "";
+                continue;
+            }
+            if (/^(?:echo|printf)$/.test(cmd)) {
+                const redirect = args.findIndex(a => a === ">" || a === ">>");
+                const target = redirect >= 0 ? args[redirect + 1] : args.find(a => /^>/.test(a))?.replace(/^>+/, "");
+                if (target)
+                    file("file-write", target, { executable: cmd, privileged });
+                continue;
+            }
+            if (cmd === "env" || cmd === "printenv" || cmd === "export" && args.includes("-p")) {
+                const names = args.filter(a => !a.startsWith("-") && a.length <= 128 && ENV_NAME.test(a));
+                if (args.some(a => /^(?:--help|--version|-h)$/.test(a)) || cmd === "printenv" && args.some(a => !a.startsWith("-") && !names.includes(a))) {
+                    add({ operation: "command", evidence: "shell-syntax", executable: cmd, privileged });
+                    continue;
+                }
+                if (cmd === "env" && args.length) {
+                    add({ operation: "command", evidence: "shell-syntax", executable: cmd, privileged });
+                    continue;
+                }
+                add({ operation: names.length ? "environment-lookup" : "environment-dump", evidence: "shell-syntax", target: "process environment", variableNames: names.length ? names.slice(0, 12) : undefined, origin: names.length && names.every(name => inlineNames.has(name)) ? "inline-assignment" : "inherited-environment", scope: names.length ? "named-variables" : "all-exported", executable: cmd, privileged });
+                continue;
+            }
+            if (/^(?:node|bun|python[23]?)$/.test(cmd)) {
+                const flag = args.findIndex(a => /^(?:-e|-p|--eval|--print|-c)$/.test(a));
+                const code = flag >= 0 ? (args[flag + 1] ?? "").trim() : "";
+                const js = /^(?:console\.(?:log|info)\(\s*)?process\.env(?:\.([A-Za-z_][A-Za-z0-9_]{0,127})|\[['"]([A-Za-z_][A-Za-z0-9_]{0,127})['"]\])\s*\)?;?$/.exec(code);
+                const py = /^import\s+os\s*;\s*print\(\s*os\.(?:environ\[['"]([A-Za-z_][A-Za-z0-9_]{0,127})['"]\]|getenv\(['"]([A-Za-z_][A-Za-z0-9_]{0,127})['"]\))\s*\)\s*;?$/.exec(code);
+                const key = /^(?:node|bun)$/.test(cmd) ? js?.[1] ?? js?.[2] : py?.[1] ?? py?.[2];
+                if (key) {
+                    add({ operation: "environment-lookup", evidence: "shell-syntax", target: "process environment", variableNames: [key], origin: inlineNames.has(key) ? "inline-assignment" : "inherited-environment", scope: "named-variables", executable: cmd, privileged });
+                    continue;
+                }
+            }
+            if (/^(?:grep|rg)$/.test(cmd)) {
+                let pattern;
+                const paths = [];
+                for (let i = 0; i < args.length; i++) {
+                    const arg = args[i];
+                    if (/^(?:-e|--regexp)$/.test(arg)) {
+                        pattern = args[++i];
+                        continue;
+                    }
+                    if (/^(?:-A|-B|-C|-m|--max-count|--glob|-g|-f|--file)$/.test(arg)) {
+                        i++;
+                        continue;
+                    }
+                    if (arg.startsWith("-"))
+                        continue;
+                    if (pattern === undefined)
+                        pattern = arg;
+                    else if (!/^[012]?>|^\d>&/.test(arg))
+                        paths.push(arg);
+                }
+                const key = pattern?.match(/^\^([A-Za-z_][A-Za-z0-9_]{0,127})=/)?.[1];
+                for (const target of paths.length ? paths : ["standard input"]) {
+                    const sourceSearch = Boolean(pattern && /(?:process\.env|os\.environ|System\.getenv)/.test(pattern) && !/(?:^|\/)\.env(?:\.|$)/.test(target));
+                    if (target === "standard input")
+                        add({ operation: "file-search", evidence: "shell-syntax", target, scope: "matching-output", variableNames: key ? [key] : undefined, executable: cmd, privileged });
+                    else
+                        file(sourceSearch ? "source-search" : "file-search", target, { scope: "matching-output", variableNames: key ? [key] : undefined, executable: cmd, privileged });
+                }
+                continue;
+            }
+            if (/^(?:cat|head|tail|sed)$/.test(cmd)) {
+                if (tokens.some(t => /^>/.test(t.value))) {
+                    const redirect = args.findIndex(a => a === ">" || a === ">>");
+                    const target = redirect >= 0 ? args[redirect + 1] : args.find(a => /^>/.test(a))?.replace(/^>+/, "");
+                    if (target)
+                        file("file-write", target, { executable: cmd, privileged });
+                    continue;
+                }
+                let candidates = args.filter(a => !a.startsWith("-") && !/^\d+$/.test(a) && !/^\d?>/.test(a));
+                if (cmd === "sed")
+                    candidates = candidates.slice(1);
+                for (const target of candidates)
+                    file("file-read", target, { scope: "file-content", executable: cmd, privileged });
+                continue;
+            }
+            if (cmd === "rm") {
+                for (const target of args.filter(a => !a.startsWith("-")))
+                    file("delete", target, { executable: cmd, privileged });
+                continue;
+            }
+            if (/^(?:curl|wget|scp|rsync)$/.test(cmd)) {
+                const destination = args.find(a => /^https?:\/\//i.test(a)) ?? args.find(a => /^[^/\s]+@[^/\s]+:/.test(a));
+                add({ operation: "network-request", evidence: "shell-syntax", target: destination ? safe(destination) : undefined, executable: cmd, privileged, insecureTransport: args.some(a => a === "-k" || a === "--insecure" || a === "--no-check-certificate") });
+                continue;
+            }
+            if (/^(?:nmap|masscan|rustscan)$/.test(cmd)) {
+                add({ operation: "network-scan", evidence: "shell-syntax", target: safe(args.filter(a => !a.startsWith("-")).join(" ")).slice(0, 300), executable: cmd, privileged });
+                continue;
+            }
+            if (cmd === "git" && /^(?:push|reset|clean|filter-branch|filter-repo)$/.test(args[0] ?? "")) {
+                add({ operation: "git-change", evidence: "shell-syntax", target: safe(args[0]), executable: cmd, privileged });
+                continue;
+            }
+            if (!/^(?:echo|printf|ls|mkdir|true|head|wc)$/.test(cmd))
+                add({ operation: "command", evidence: "shell-syntax", executable: safe(cmd), privileged });
+        }
+    return { schemaVersion: 1, workingDirectory: cwd ? safe(cwd) : undefined, repository: includeRepository ? repositoryAt(cwd, safe) : undefined, actions, truncated: omitted };
+}
+//# sourceMappingURL=action-context.js.map

package/dist/action-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-context.js","sourceRoot":"","sources":["../src/action-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAgB7D,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAC5C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzJ,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACnJ,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,IAA2B;IAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,KAAK,IAAI,KAAK,GAAC,CAAC,EAAC,KAAK,GAAC,EAAE,EAAC,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;QAC/B,IAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjE,MAAM,MAAM,GAAC,OAAO,CAAA,CAAC,CAAA,OAAO,CAAC,IAAI,EAAC,OAAO,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC;YAClD,MAAM,IAAI,GAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAC,IAAI,EAAE,KAAK,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,MAAM,GAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAC,WAAW,CAAC,CAAC,CAAC;YACjD,MAAM,OAAO,GAAC,MAAM,CAAA,CAAC,CAAA,OAAO,CAAC,MAAM,EAAC,MAAM,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC;YACnD,MAAM,MAAM,GAAC,GAAG,CAAA,CAAC,CAAA,SAAS,CAAC,IAAI,CAAC,OAAO,EAAC,GAAG,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;YACnD,OAAO,EAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAC,MAAM,EAAC,GAAG,CAAA,CAAC,CAAA,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,MAAM,EAAC,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,MAAM,CAAA,CAAC,CAAA,SAAS,EAAC,CAAC;QAClK,CAAC;QACD,MAAM,MAAM,GAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAA,IAAG,MAAM,KAAG,IAAI;YAAC,MAAM;QAAA,IAAI,GAAC,MAAM,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAA6B,EAAE,GAAW,EAAE,OAAe,EAAE,IAAwB,EAAE,iBAAiB,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC;IAC5K,MAAM,OAAO,GAAqB,EAAE,CAAC;IAAA,IAAI,OAAO,GAAC,GAAG,CAAC;IAAA,IAAI,OAAO,GAAC,KAAK,CAAC;IACvE,IAAG,KAAK,GAAC,CAAC;QAAC,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,OAAO,EAAC,EAAE,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC;IAC9D,MAAM,GAAG,GAAC,CAAC,MAAuB,EAAC,EAAE,GAAG,IAAG,OAAO,CAAC,MAAM,IAAE,EAAE,EAAC,CAAC;QAAA,OAAO,GAAC,IAAI,CAAC;QAAA,OAAO;IAAA,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAC,CAAC,SAAyB,EAAC,MAAa,EAAC,QAAgC,EAAE,EAAC,EAAE,CAAA,GAAG,CAAC,EAAC,SAAS,EAAC,QAAQ,EAAC,OAAO,CAAA,CAAC,CAAA,cAAc,CAAA,CAAC,CAAA,gBAAgB,EAAC,MAAM,EAAC,IAAI,CAAC,MAAM,CAAC,EAAC,YAAY,EAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAE,OAAO,IAAE,UAAU,CAAC,OAAO,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAA,UAAU,CAAC,MAAM,CAAC,IAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,GAAG,KAAK,EAAC,CAAC,CAAC;IAClV,MAAM,IAAI,GAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,IAAE,KAAK,CAAC,IAAI,IAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,IAAI,EAAE,CAAC;QAChE,MAAM,KAAK,GAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAG,MAAM,CAAA,CAAC,CAAA,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC,CAAC;QACvG,MAAM,GAAG,GAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAE,CAAC,KAAK,IAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA,CAAC,CAAA,KAAK,GAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC,CAAC;QACzG,IAAI,CAAC,WAAW,EAAC,IAAI,EAAC,EAAC,KAAK,EAAC,KAAK,IAAE,GAAG,CAAA,CAAC,CAAA,iBAAiB,CAAA,CAAC,CAAA,cAAc,EAAC,SAAS,EAAC,KAAK,EAAC,OAAO,EAAC,GAAG,EAAC,CAAC,CAAC;IACzG,CAAC;SAAM,IAAG,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAE,IAAI;QAAE,IAAI,CAAC,YAAY,EAAC,IAAI,CAAC,CAAC;SACpG,IAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAC,GAAG,CAAC,EAAC,SAAS,EAAC,UAAU,EAAC,QAAQ,EAAC,gBAAgB,EAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;SACzG,IAAG,CAAC,OAAO,IAAI,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAC,GAAG,CAAC,EAAC,SAAS,EAAC,iBAAiB,EAAC,QAAQ,EAAC,gBAAgB,EAAC,MAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAE,IAAI,CAAC,EAAC,CAAC,CAAC;IAC1L,IAAG,OAAO;QAAE,KAAI,MAAM,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,MAAM,MAAM,GAAC,CAAC,CAAC,MAAM,CAAC;YAAA,IAAI,EAAE,GAAC,CAAC,CAAC;YAAA,IAAI,UAAU,GAAC,KAAK,CAAC;YAAA,MAAM,WAAW,GAAC,IAAI,GAAG,EAAU,CAAC;YACxF,OAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,IAAE,EAAE,CAAC,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,IAAI,GAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,IAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjD,EAAE,EAAE,CAAC;YACP,CAAC;YACD,IAAG,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,KAAG,MAAM,EAAC,CAAC;gBAAA,UAAU,GAAC,IAAI,CAAC;gBAAA,EAAE,EAAE,CAAC;gBAAA,IAAG,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAC,CAAC;oBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,UAAU,EAAC,MAAM,EAAC,UAAU,EAAC,IAAI,EAAC,CAAC,CAAC;oBAAA,SAAS;gBAAA,CAAC;YAAA,CAAC;YAC1L,MAAM,GAAG,GAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,IAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAAA,MAAM,IAAI,GAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,KAAK,CAAC,CAAC;YACtG,IAAG,CAAC,GAAG;gBAAC,SAAS;YACjB,IAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,GAAC,MAAM,CAAC,EAAE,GAAC,CAAC,CAAC,CAAC;gBACxB,IAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC1F,MAAM,MAAM,GAAC,qBAAqB,CAAC,MAAM,EAAC,EAAE,EAAC,OAAO,EAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,KAAK,EAAC,KAAK,GAAC,CAAC,CAAC,CAAC;oBACpF,KAAI,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;wBAAC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAG,oBAAoB,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAA,EAAE,CAAA,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAA,EAAC,GAAG,MAAM,EAAC,MAAM,EAAC,mBAAmB,EAAC,CAAA,CAAC,CAAA,MAAM,CAAC,CAAC;oBAC1L,OAAO,KAAK,MAAM,CAAC,SAAS,CAAC;oBAAA,SAAS;gBACxC,CAAC;YACH,CAAC;YACD,IAAG,GAAG,KAAG,IAAI,EAAC,CAAC;gBAAA,OAAO,GAAC,IAAI,CAAC,CAAC,CAAC,IAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAE,CAAC,CAAC,CAAC,IAAI,CAAA,CAAC,CAAA,OAAO,CAAC,OAAO,IAAE,GAAG,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC;gBAAA,SAAS;YAAA,CAAC;YACxG,IAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,GAAG,IAAE,CAAC,KAAG,IAAI,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAC,QAAQ,IAAE,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,QAAQ,GAAC,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAC,EAAE,CAAC,CAAC;gBACxF,IAAG,MAAM;oBAAC,IAAI,CAAC,YAAY,EAAC,MAAM,EAAC,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,IAAG,GAAG,KAAG,KAAK,IAAE,GAAG,KAAG,UAAU,IAAE,GAAG,KAAG,QAAQ,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtE,MAAM,KAAK,GAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,CAAC,CAAC,MAAM,IAAE,GAAG,IAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChF,IAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC;oBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;oBAAA,SAAS;gBAAA,CAAC;gBACzN,IAAG,GAAG,KAAG,KAAK,IAAE,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,GAAG,CAAC,EAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;oBAAA,SAAS;gBAAC,CAAC;gBACvH,GAAG,CAAC,EAAC,SAAS,EAAC,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,oBAAoB,CAAA,CAAC,CAAA,kBAAkB,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,qBAAqB,EAAC,aAAa,EAAC,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,MAAM,EAAC,KAAK,CAAC,MAAM,IAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAA,EAAE,CAAA,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA,CAAC,CAAA,mBAAmB,CAAA,CAAC,CAAA,uBAAuB,EAAC,KAAK,EAAC,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,iBAAiB,CAAA,CAAC,CAAA,cAAc,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAAA,SAAS;YACrX,CAAC;YACD,IAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,EAAE,CAAA,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,MAAM,IAAI,GAAC,IAAI,IAAE,CAAC,CAAA,CAAC,CAAA,CAAC,IAAI,CAAC,IAAI,GAAC,CAAC,CAAC,IAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,CAAC,CAAA,EAAE,CAAC;gBAChD,MAAM,EAAE,GAAC,sIAAsI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3J,MAAM,EAAE,GAAC,oJAAoJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzK,MAAM,GAAG,GAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC,CAAC,IAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,EAAE,EAAE,CAAC,CAAC,CAAC,IAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACvE,IAAG,GAAG,EAAC,CAAC;oBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,oBAAoB,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,qBAAqB,EAAC,aAAa,EAAC,CAAC,GAAG,CAAC,EAAC,MAAM,EAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,mBAAmB,CAAA,CAAC,CAAA,uBAAuB,EAAC,KAAK,EAAC,iBAAiB,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;oBAAA,SAAS;gBAAA,CAAC;YAC7P,CAAC;YACD,IAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,IAAI,OAAwB,CAAC;gBAAA,MAAM,KAAK,GAAU,EAAE,CAAC;gBACrD,KAAI,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,MAAM,EAAC,CAAC,EAAE,EAAC,CAAC;oBAC7B,MAAM,GAAG,GAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAA,IAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC;wBAAA,OAAO,GAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;wBAAA,SAAS;oBAAA,CAAC;oBAChF,IAAG,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC;wBAAA,CAAC,EAAE,CAAC;wBAAA,SAAS;oBAAA,CAAC;oBAChF,IAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAC,SAAS;oBAAA,IAAG,OAAO,KAAG,SAAS;wBAAC,OAAO,GAAC,GAAG,CAAC;yBAAK,IAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzH,CAAC;gBACD,MAAM,GAAG,GAAC,OAAO,EAAE,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpE,KAAI,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,KAAK,CAAA,CAAC,CAAA,CAAC,gBAAgB,CAAC,EAAC,CAAC;oBACzD,MAAM,YAAY,GAAC,OAAO,CAAC,OAAO,IAAE,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,IAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;oBACxI,IAAG,MAAM,KAAG,gBAAgB;wBAAC,GAAG,CAAC,EAAC,SAAS,EAAC,aAAa,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,KAAK,EAAC,iBAAiB,EAAC,aAAa,EAAC,GAAG,CAAA,CAAC,CAAA,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;;wBAC1K,IAAI,CAAC,YAAY,CAAA,CAAC,CAAA,eAAe,CAAA,CAAC,CAAA,aAAa,EAAC,MAAM,EAAC,EAAC,KAAK,EAAC,iBAAiB,EAAC,aAAa,EAAC,GAAG,CAAA,CAAC,CAAA,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBACrJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,IAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,CAAC;oBAAA,MAAM,QAAQ,GAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,GAAG,IAAE,CAAC,KAAG,IAAI,CAAC,CAAC;oBAAA,MAAM,MAAM,GAAC,QAAQ,IAAE,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,QAAQ,GAAC,CAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAC,EAAE,CAAC,CAAC;oBAAA,IAAG,MAAM;wBAAC,IAAI,CAAC,YAAY,EAAC,MAAM,EAAC,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;oBAAA,SAAS;gBAAA,CAAC;gBAC7P,IAAI,UAAU,GAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtF,IAAG,GAAG,KAAG,KAAK;oBAAC,UAAU,GAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9C,KAAI,MAAM,MAAM,IAAI,UAAU;oBAAC,IAAI,CAAC,WAAW,EAAC,MAAM,EAAC,EAAC,KAAK,EAAC,cAAc,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAAA,SAAS;YACpH,CAAC;YACD,IAAG,GAAG,KAAG,IAAI,EAAC,CAAC;gBAAA,KAAI,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAAC,IAAI,CAAC,QAAQ,EAAC,MAAM,EAAC,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAAA,SAAS;YAAA,CAAC;YAClI,IAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC;gBAAA,MAAM,WAAW,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,iBAAiB,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,WAAW,CAAA,CAAC,CAAA,IAAI,CAAC,WAAW,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,iBAAiB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,IAAI,IAAE,CAAC,KAAG,YAAY,IAAE,CAAC,KAAG,wBAAwB,CAAC,EAAC,CAAC,CAAC;gBAAA,SAAS;YAAA,CAAC;YACpX,IAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC;gBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,cAAc,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAAA,SAAS;YAAA,CAAC;YAC/M,IAAG,GAAG,KAAG,KAAK,IAAE,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAE,EAAE,CAAC,EAAC,CAAC;gBAAA,GAAG,CAAC,EAAC,SAAS,EAAC,YAAY,EAAC,QAAQ,EAAC,cAAc,EAAC,MAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,GAAG,EAAC,UAAU,EAAC,CAAC,CAAC;gBAAA,SAAS;YAAA,CAAC;YACrM,IAAG,CAAC,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAC,GAAG,CAAC,EAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,cAAc,EAAC,UAAU,EAAC,IAAI,CAAC,GAAG,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC;QAC7I,CAAC;IACD,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,gBAAgB,EAAC,GAAG,CAAA,CAAC,CAAA,IAAI,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,UAAU,EAAC,iBAAiB,CAAA,CAAC,CAAA,YAAY,CAAC,GAAG,EAAC,IAAI,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAC,CAAC;AAC5J,CAAC"}

package/dist/activity.d.ts

@@ -0,0 +1,22 @@
+import type { Obj } from './agents.js';
+export interface Activity {
+    hookEvent: string;
+    toolCallId?: string;
+    parentSession?: string;
+    input?: unknown;
+    output?: unknown;
+    prompt?: string;
+    assistant?: string;
+    paths?: string[];
+    urls?: string[];
+    searchTerms?: string[];
+    edits?: unknown;
+    status?: string;
+    error?: string;
+    details?: unknown;
+    truncated: boolean;
+}
+/** One command projection for telemetry, detection, and pre-tool policy enforcement. */
+export declare function commandOf(raw: Obj): string;
+export declare function activityType(raw: Obj, fallback: string): string;
+export declare function activityFor(raw: Obj, redact: (text: string) => string): Activity | undefined;

package/dist/activity.js

@@ -0,0 +1,132 @@
+import { hookKind } from './hook-catalog.js';
+const object = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+/** One command projection for telemetry, detection, and pre-tool policy enforcement. */
+export function commandOf(raw) {
+    const input = object(raw.tool_input ?? raw.input);
+    const value = [raw.command, raw.observed_command, raw.command_line, raw.commandLine, raw.cmd, input.command, input.cmd, input.command_line, input.commandLine, input.script, input.commandText]
+        .find(v => typeof v === 'string' && v.trim() || Array.isArray(v) && v.length > 0);
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value) && value.every(v => typeof v === 'string')) {
+        if (/^(?:.*[\\/])?(?:ba|z|da|k)?sh(?:\.exe)?$/i.test(value[0]) && /^-[a-z]*c[a-z]*$/i.test(value[1] ?? '') && typeof value[2] === 'string')
+            return value[2];
+        return value.map(v => /^[\w./:@=-]+$/.test(v) ? v : "'" + v.replace(/'/g, "'\\''") + "'").join(' ');
+    }
+    const tool = String(raw.tool_name ?? raw.tool ?? '');
+    if (/^(?:bash|shell|terminal|exec_command|shell_command|run_shell_command)$/i.test(tool) && typeof raw.tool_input === 'string')
+        return raw.tool_input;
+    return '';
+}
+export function activityType(raw, fallback) {
+    const tool = String(raw.tool_name ?? raw.tool ?? '').toLowerCase();
+    const input = object(raw.tool_input ?? raw.input);
+    if (/(?:^|[.:])(?:bash|shell|sh|zsh|exec_command|shell_command|exec|terminal|local_shell|command|execute_bash|run_shell_command|execute_command|run_command|run_terminal_cmd|runterminalcommand|runinterminal|powershell|pwsh)$/.test(tool))
+        return 'command.exec';
+    if (/^(read|readfile|read_file|read_text_file|view|view_file)$/.test(tool))
+        return 'file.read';
+    if (/^(write|edit|write_file|edit_file|str_replace_editor|str_replace|apply_patch|replace|replace_in_file|multiedit|write_to_file|editfile|editfiles|createfile|create_file|create|writefile|replace_string_in_file|insert_edit_into_file|multi_replace_string_in_file)$/.test(tool))
+        return 'file.write';
+    if (/^(ls|list_dir|list_directory|list_files|readdir|directory_tree|listdirectory|listdir)$/.test(tool))
+        return 'directory.read';
+    if (/^(glob|grep|search_files|file_search|find_files|rg)$/.test(tool))
+        return 'file.search';
+    if (/web.?search|search.?web/.test(tool) || input.search_query !== undefined)
+        return 'web.search';
+    if (/web.?fetch|fetch_url|fetch.?web|browse|navigate|open_url/.test(tool) || input.open !== undefined)
+        return 'browser.navigate';
+    return fallback;
+}
+// A bounded, field-aware projection prevents arbitrary envelopes, histories and credentials
+// from entering activity telemetry. No referenced files or browser pages are read here.
+export function activityFor(raw, redact) {
+    if (!raw.hook_event_name && raw.source_type !== 'hook')
+        return undefined;
+    let budget = 48000, truncated = raw.capture_truncated === true;
+    function clean(value, depth = 0, key = '') {
+        if (/password|secret|authorization|cookie|credential|api[_-]?key|access[_-]?token|refresh[_-]?token/i.test(key))
+            return '[REDACTED]';
+        if (budget <= 0 || depth > 8) {
+            truncated = true;
+            return '[TRUNCATED]';
+        }
+        if (typeof value === 'string') {
+            const redacted = redact(value);
+            const limit = Math.min(12000, budget);
+            const out = redacted.slice(0, limit);
+            budget -= out.length;
+            if (out.length < redacted.length)
+                truncated = true;
+            return out;
+        }
+        if (Array.isArray(value)) {
+            if (value.length > 100)
+                truncated = true;
+            return value.slice(0, 100).map(v => clean(v, depth + 1));
+        }
+        if (value && typeof value === 'object') {
+            const entries = Object.entries(value);
+            if (entries.length > 100)
+                truncated = true;
+            return Object.fromEntries(entries.slice(0, 100).map(([k, v]) => [k, clean(v, depth + 1, k)]));
+        }
+        return value;
+    }
+    const input = raw.tool_input ?? raw.input;
+    const paths = new Set(), urls = new Set(), searchTerms = new Set();
+    function targets(value, depth = 0) {
+        if (depth > 6 || !value || typeof value !== 'object')
+            return;
+        for (const [key, v] of Object.entries(value).slice(0, 100)) {
+            if (typeof v === 'string') {
+                if (/^(?:path|file_path|filePath|directory|directory_path|dir|target_file|filename|file|workdir)$/.test(key))
+                    paths.add(redact(v).slice(0, 2000));
+                if (/^(?:url|uri|ref_id|website|endpoint)$/.test(key) && /^https?:\/\//i.test(v))
+                    urls.add(redact(v).slice(0, 2000));
+                if (/^(?:q|query|search_term|search_query|searchQuery|pattern)$/.test(key))
+                    searchTerms.add(redact(v).slice(0, 2000));
+                if (/^(?:patch|patchText|patch_text|diff|command)$/.test(key) && /^\*\*\* (?:Update|Add|Delete) File:/m.test(v))
+                    for (const match of v.matchAll(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/gm))
+                        paths.add(redact(match[1]).slice(0, 2000));
+            }
+            else {
+                if (Array.isArray(v) && /^(files|paths|directories)$/.test(key))
+                    for (const p of v.slice(0, 100))
+                        if (typeof p === 'string')
+                            paths.add(redact(p).slice(0, 2000));
+                targets(v, depth + 1);
+            }
+        }
+    }
+    if (typeof input === 'string')
+        for (const match of input.matchAll(/^\*\*\* (?:Update|Add|Delete) File:\s*(.+)$/gm))
+            paths.add(redact(match[1]).slice(0, 2000));
+    targets(input);
+    targets({ file_path: raw.file_path, url: raw.url });
+    const args = object(input);
+    const before = args.old_string ?? args.old_str ?? args.oldString ?? args.oldText ?? args.old_text;
+    const after = args.new_string ?? args.new_str ?? args.newString ?? args.newText ?? args.new_text;
+    const patch = args.patch ?? args.patchText ?? args.patch_text ?? args.diff;
+    const hookEvent = String(raw.hook_event_name ?? '');
+    const kind = hookKind(hookEvent);
+    const a = {
+        hookEvent: String(clean(hookEvent)),
+        ...(raw.tool_use_id ? { toolCallId: String(clean(raw.tool_use_id)) } : {}),
+        ...(raw.parent_session_id ? { parentSession: String(clean(raw.parent_session_id)) } : {}),
+        ...(kind === 'prompt' && typeof raw.prompt === 'string' ? { prompt: String(clean(raw.prompt)) } : {}),
+        ...(raw.assistant_text ? { assistant: String(clean(raw.assistant_text)) } : {}),
+        ...(input !== undefined ? { input: clean(input) } : {}),
+        ...(raw.tool_response !== undefined ? { output: clean(raw.tool_response) } : {}),
+        ...(paths.size ? { paths: [...paths].slice(0, 25) } : {}),
+        ...(urls.size ? { urls: [...urls].slice(0, 25) } : {}),
+        ...(searchTerms.size ? { searchTerms: [...searchTerms].slice(0, 25) } : {}),
+        ...(typeof input === 'string' && /^(?:\*\*\* Begin Patch|diff --git|--- )/m.test(input) ? { edits: clean({ patch: input }) } : {}),
+        ...((args.edits ?? raw.edits ?? patch ?? before ?? after) !== undefined ? { edits: clean(args.edits ?? raw.edits ?? { old: before, new: after, patch }) } : {}),
+        ...(raw.status ? { status: String(clean(raw.status)) } : kind === 'failure' || raw.is_error ? { status: 'failed' } : {}),
+        ...(raw.error ? { error: String(clean(raw.error)) } : {}),
+        details: clean(Object.fromEntries(['reason', 'decision', 'permission_decision', 'permissionDecision', 'approval', 'approved', 'agent_id', 'agent_type', 'subagent_id', 'child_session_id', 'exit_code', 'exitCode', 'duration_ms'].filter(k => raw[k] !== undefined).map(k => [k, raw[k]]))),
+        truncated: false,
+    };
+    a.truncated = truncated || paths.size > 25 || urls.size > 25 || searchTerms.size > 25;
+    return a;
+}
+//# sourceMappingURL=activity.js.map

package/dist/activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAQ7C,MAAM,MAAM,GAAG,CAAC,CAAU,EAAO,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACpG,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;SAC5L,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpE,IAAI,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5J,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IACtJ,OAAO,EAAE,CAAC;AACZ,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,QAAgB;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,4NAA4N,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IACnQ,IAAI,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/F,IAAI,qQAAqQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IAC1S,IAAI,wFAAwF,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACjI,IAAI,sDAAsD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IAC5F,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAClG,IAAI,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC;IACjI,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,4FAA4F;AAC5F,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,GAAQ,EAAE,MAAgC;IACpE,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC;IAC/D,SAAS,KAAK,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE;QAChD,IAAI,iGAAiG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC;QACrI,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO,aAAa,CAAC;QAAC,CAAC;QACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;YAAC,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;gBAAE,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO,GAAG,CAAC;QAAC,CAAC;QACrO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAChI,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;gBAAE,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3N,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAE,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3F,SAAS,OAAO,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,8FAA8F,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;gBACjJ,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;gBACpH,IAAI,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;gBACrH,IAAI,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;YAC9O,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,GAAG,CAAC;wBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;4BAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;gBAC/J,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,IAAI,CAAC,CAAC,CAAC;IAC9J,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAa;QAClB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/J,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAC,UAAU,EAAC,qBAAqB,EAAC,oBAAoB,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,YAAY,EAAC,aAAa,EAAC,kBAAkB,EAAC,WAAW,EAAC,UAAU,EAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChR,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,CAAC,CAAC,SAAS,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC;IAAC,OAAO,CAAC,CAAC;AAClG,CAAC"}

package/dist/agent-hook-install.d.ts

@@ -0,0 +1,8 @@
+import { type HookSpec } from './hook-catalog.js';
+import type { CustomInstaller } from './agent-installers.js';
+export declare function agentHookPath(spec: HookSpec, home: string, settings?: string): string;
+export declare function agentDetectionPaths(spec: HookSpec, home: string): string[];
+export declare function optionalText(path: string): Promise<string>;
+export declare function writeHookFile(path: string, content: string, mode?: number): Promise<void>;
+export declare function catalogInstaller(spec: HookSpec, settings?: string): CustomInstaller;
+export declare const CATALOG_INSTALLERS: Record<string, CustomInstaller>;