@astrasyncai/verification-gateway 3.10.0 → 3.11.0

package/dist/bin/astrasync-claude-hook.js

@@ -25,9 +25,7 @@ __export(hook_exports, {
   resolveGuardConfig: () => resolveGuardConfig
 });
 module.exports = __toCommonJS(hook_exports);
-var import_fs4 = require("fs");
-var import_os = require("os");
-var import_path3 = require("path");
+var import_path4 = require("path");
 
 // src/gateway/types.ts
 var HIGH_RISK_COMMANDS = [
@@ -49,7 +47,9 @@ var HIGH_RISK_COMMANDS = [
   "git push",
   "npm publish",
   "docker",
-  "kubectl"
+  "kubectl",
+  "gh pr create",
+  "gh pr merge"
 ];
 var SENSITIVE_PATHS = [
   ".ssh",
@@ -68,6 +68,164 @@ var SENSITIVE_PATHS = [
   ".pypirc"
 ];
 
+// src/local-evaluator/command-matcher.ts
+var WRAPPERS = /* @__PURE__ */ new Set([
+  "sudo",
+  "doas",
+  "env",
+  "nohup",
+  "time",
+  "timeout",
+  "nice",
+  "ionice",
+  "stdbuf",
+  "xargs",
+  "command",
+  "exec",
+  "builtin"
+]);
+var ASSIGN_RE = /^[a-z_][a-z0-9_]*=/;
+var MAX_WRAPPER_HOPS = 4;
+var MAX_RECURSION_DEPTH = 3;
+var MAX_COMMAND_LENGTH = 1e5;
+var LOCAL_HOST_RE = /^(localhost|127\.0\.0\.1|::1|[a-z0-9.-]*\.localhost)$/;
+function buildRiskList(entries) {
+  const singleWord = /* @__PURE__ */ new Set();
+  const multiWord = [];
+  for (const entry of entries) {
+    const words = entry.toLowerCase().trim().split(/\s+/);
+    if (words.length === 1) singleWord.add(words[0]);
+    else multiWord.push(words);
+  }
+  multiWord.sort((a, b) => b.length - a.length);
+  return { singleWord, multiWord };
+}
+function stripHeredocBodies(text) {
+  const lines = text.split("\n");
+  const kept = [];
+  let terminator = null;
+  for (const line of lines) {
+    if (terminator !== null) {
+      if (line.trim() === terminator) terminator = null;
+      continue;
+    }
+    kept.push(line);
+    const heredoc = line.match(/<<-?\s*['"]?(\w+)['"]?/);
+    if (heredoc) terminator = heredoc[1];
+  }
+  return kept.join("\n");
+}
+function extractDollarSubstitutions(text, collect) {
+  let result = text;
+  let start = result.indexOf("$(");
+  let iterations = 0;
+  while (start !== -1 && iterations < 50) {
+    iterations++;
+    let depth = 0;
+    let end = result.length;
+    for (let i = start + 1; i < result.length; i++) {
+      if (result[i] === "(") depth++;
+      else if (result[i] === ")") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          break;
+        }
+      }
+    }
+    collect(result.slice(start + 2, end));
+    result = `${result.slice(0, start)} ${result.slice(Math.min(end + 1, result.length))}`;
+    start = result.indexOf("$(");
+  }
+  return result;
+}
+function extractBacktickSubstitutions(text, collect) {
+  if (!text.includes("`")) return text;
+  const chunks = text.split("`");
+  const kept = [];
+  for (let i = 0; i < chunks.length; i++) {
+    if (i % 2 === 1) collect(chunks[i]);
+    else kept.push(chunks[i]);
+  }
+  return kept.join(" ");
+}
+function basename(token) {
+  const slash = token.lastIndexOf("/");
+  return slash === -1 ? token : token.slice(slash + 1);
+}
+function matchSegment(segment, list) {
+  const tokens = segment.split(/\s+/).filter((t) => /[a-z0-9]/.test(t));
+  let i = 0;
+  let hops = 0;
+  while (i < tokens.length) {
+    while (i < tokens.length && (tokens[i] === "export" || ASSIGN_RE.test(tokens[i]))) i++;
+    if (i >= tokens.length) return null;
+    const cmd = basename(tokens[i]);
+    const significant = [cmd, ...tokens.slice(i + 1).filter((t) => !t.startsWith("-"))];
+    for (const entry of list.multiWord) {
+      if (entry.length <= significant.length && entry.every((w, j) => significant[j] === w)) {
+        return entry.join(" ");
+      }
+    }
+    if (list.singleWord.has(cmd)) return cmd;
+    if (WRAPPERS.has(cmd) && hops < MAX_WRAPPER_HOPS) {
+      hops++;
+      i++;
+      while (i < tokens.length && (tokens[i].startsWith("-") || ASSIGN_RE.test(tokens[i]))) i++;
+      continue;
+    }
+    return null;
+  }
+  return null;
+}
+function collectMatches(command, list, matches, depth) {
+  if (depth > MAX_RECURSION_DEPTH || command.length > MAX_COMMAND_LENGTH) return;
+  let text = command.toLowerCase();
+  text = stripHeredocBodies(text);
+  const recurse = (inner) => collectMatches(inner, list, matches, depth + 1);
+  text = extractDollarSubstitutions(text, recurse);
+  text = extractBacktickSubstitutions(text, recurse);
+  text = text.replace(/'[^']*'/g, " ").replace(/"[^"]*"/g, " ");
+  text = text.replace(/(^|\s)#[^\n]*/g, " ");
+  const segments = text.split(/\|\||&&|[;|&\n]|[({]/);
+  for (const segment of segments) {
+    const matched = matchSegment(segment, list);
+    if (matched) matches.add(matched);
+  }
+}
+function matchHighRiskCommands(command, highRiskCommands = HIGH_RISK_COMMANDS) {
+  if (!command) return [];
+  const matches = /* @__PURE__ */ new Set();
+  collectMatches(command, buildRiskList(highRiskCommands), matches, 0);
+  return [...matches];
+}
+function isLocalhostOnlyNetworkCommand(command) {
+  const text = command.toLowerCase();
+  const tokens = text.split(/\s+/).map((t) => t.replace(/^["'`]+|["'`,;)]+$/g, ""));
+  let localCount = 0;
+  for (const token of tokens) {
+    let host = null;
+    if (token.includes("://")) {
+      let rest = token.slice(token.indexOf("://") + 3);
+      const at = rest.indexOf("@");
+      if (at !== -1) rest = rest.slice(at + 1);
+      host = rest.split(/[/?#]/)[0];
+    } else if (/^[a-z0-9.[\]:-]+:\d+(\/.*)?$/.test(token)) {
+      host = token.split("/")[0];
+    } else if (/^(localhost|127\.0\.0\.1|\[?::1\]?)(\/.*)?$/.test(token)) {
+      host = token.split("/")[0];
+    }
+    if (host === null) continue;
+    const bare = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+    if (LOCAL_HOST_RE.test(bare)) {
+      localCount++;
+    } else {
+      return false;
+    }
+  }
+  return localCount > 0;
+}
+
 // src/local-evaluator/evaluator.ts
 var LocalEvaluator = class {
   constructor(policy) {
@@ -218,12 +376,10 @@ var LocalEvaluator = class {
       return score;
     }
     if (context.purpose === "shell.exec" && context.target) {
-      const targetLower = context.target.toLowerCase();
-      for (const cmd of HIGH_RISK_COMMANDS) {
-        if (targetLower.startsWith(cmd) || targetLower.includes(` ${cmd} `) || targetLower.includes(` ${cmd}`)) {
-          score = Math.max(score, 80);
-          break;
-        }
+      const matched = matchHighRiskCommands(context.target);
+      const localProbeOnly = matched.length > 0 && matched.every((cmd) => cmd === "curl" || cmd === "wget") && isLocalhostOnlyNetworkCommand(context.target);
+      if (matched.length > 0 && !localProbeOnly) {
+        score = Math.max(score, 80);
       }
     }
     if ((context.purpose === "file.read" || context.purpose === "file.write" || context.purpose === "file.delete") && context.target) {
@@ -3534,7 +3690,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "3.10.0";
+var SDK_VERSION = "3.11.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -4049,10 +4205,12 @@ function toGatewayConfig(config) {
   };
 }
 function toVerificationRequest(context, astraId) {
+  const dotIndex = context.purpose.indexOf(".");
+  const dotted = dotIndex > 0;
   return {
     credentials: { astraId },
-    purpose: context.purpose,
-    action: context.action,
+    purpose: dotted ? context.purpose.slice(0, dotIndex) : context.purpose,
+    action: dotted ? context.purpose : context.action,
     resourceType: context.resourceType,
     resource: context.target,
     transactionValue: context.transactionValue,
@@ -4092,8 +4250,75 @@ async function verifyOnline(config, context, astraId) {
 // src/gateway/modes/hybrid.ts
 var import_fs2 = require("fs");
 var import_path = require("path");
+
+// src/gateway/redact.ts
+var marker = (type2) => `[REDACTED:${type2}]`;
+var REDACTION_PATTERNS = [
+  // Multi-line blocks first so later single-line patterns don't shred them.
+  {
+    type: "private-key",
+    re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g
+  },
+  // URL userinfo credentials (https://user:pass@, x-access-token:ghp_…@).
+  {
+    type: "url-credentials",
+    re: /([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]+@/gi,
+    replacement: `$1${marker("url-credentials")}@`
+  },
+  // Known token formats.
+  { type: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{20,255}\b/g },
+  { type: "github-token", re: /\bgithub_pat_[A-Za-z0-9_]{20,255}\b/g },
+  { type: "astrasync-key", re: /\bkya_[A-Fa-f0-9]{32,128}\b/g },
+  { type: "openai-key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+  { type: "aws-access-key-id", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+  // Bearer/token headers.
+  {
+    type: "bearer-token",
+    re: /\b(bearer\s+)[a-z0-9._~+/=-]{16,}/gi,
+    replacement: `$1${marker("bearer-token")}`
+  },
+  // Generic KEY=value / key: value assignments with secret-ish names.
+  {
+    type: "assigned-secret",
+    re: /\b((?:password|passwd|secret|token|api[_-]?key|apikey|access[_-]?key|client[_-]?secret|private[_-]?key)\s*[=:]\s*)(['"]?)[^\s'"&;]{8,}\2/gi,
+    replacement: `$1$2${marker("assigned-secret")}$2`
+  }
+];
+function redactSecrets(text) {
+  let result = text;
+  for (const { type: type2, re, replacement } of REDACTION_PATTERNS) {
+    result = result.replace(re, replacement ?? marker(type2));
+  }
+  return result;
+}
+function redactDeep(value) {
+  if (typeof value === "string") {
+    return redactSecrets(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactDeep(item));
+  }
+  if (value !== null && typeof value === "object" && !(value instanceof Date)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactDeep(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src/gateway/modes/hybrid.ts
 var MAX_QUEUE_SIZE = 1e3;
 var MAX_RETRIES = 3;
+var FLUSH_TIMEOUT = /* @__PURE__ */ Symbol("flush-timeout");
+function delay(ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(FLUSH_TIMEOUT), ms);
+    if (typeof timer.unref === "function") timer.unref();
+  });
+}
 var HybridSyncQueue = class {
   constructor(config, persistPath) {
     this.queue = [];
@@ -4114,12 +4339,12 @@ var HybridSyncQueue = class {
   /**
    * Stop periodic sync and flush remaining entries.
    */
-  async stop() {
+  async stop(flushOptions = {}) {
     if (this.timer) {
       clearInterval(this.timer);
       this.timer = null;
     }
-    await this.flush();
+    await this.flush(flushOptions);
     this.saveToDisk();
   }
   /**
@@ -4131,8 +4356,8 @@ var HybridSyncQueue = class {
     }
     this.queue.push({
       id: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-      context,
-      decision,
+      context: redactDeep(context),
+      decision: redactDeep(decision),
       timestamp: /* @__PURE__ */ new Date(),
       retryCount: 0,
       status: "pending"
@@ -4142,16 +4367,21 @@ var HybridSyncQueue = class {
   /**
    * Flush pending entries to the API.
    */
-  async flush() {
+  async flush(options = {}) {
     if (this.processing) return;
     this.processing = true;
     try {
       const pending = this.queue.filter((e) => e.status === "pending");
-      for (const entry of pending) {
-        try {
-          await verifyOnline(this.config, entry.context);
+      const batch = typeof options.limit === "number" ? pending.slice(0, options.limit) : pending;
+      for (const entry of batch) {
+        const attempt = verifyOnline(this.config, entry.context, this.config.agentId).then(() => "synced").catch(() => "error");
+        const result = options.perEntryTimeoutMs ? await Promise.race([attempt, delay(options.perEntryTimeoutMs)]) : await attempt;
+        if (result === FLUSH_TIMEOUT) {
+          break;
+        }
+        if (result === "synced") {
           entry.status = "synced";
-        } catch {
+        } else {
           entry.retryCount++;
           if (entry.retryCount >= MAX_RETRIES) {
             entry.status = "failed";
@@ -4228,8 +4458,22 @@ var TraceLogger = class {
       id: this.generateId(),
       timestamp: /* @__PURE__ */ new Date(),
       type: "evaluation",
-      context,
-      decision
+      context: redactDeep(context),
+      decision: redactDeep(decision)
+    });
+  }
+  /**
+   * Log a tool call the guard saw but did not govern. One line per skip
+   * keeps coverage holes (unmapped platform tools) visible in the traces
+   * instead of silently indistinguishable from ALLOW.
+   */
+  logSkipped(toolName, reason) {
+    if (!this.enabled) return;
+    this.write({
+      id: this.generateId(),
+      timestamp: /* @__PURE__ */ new Date(),
+      type: "skipped",
+      metadata: { toolName, reason }
     });
   }
   /**
@@ -4346,10 +4590,12 @@ var AstraSyncGateway = class {
   }
   /**
    * Graceful shutdown. Flushes sync queue and cleans up resources.
+   * Stateless callers (hooks) pass bounded flush options so sync never
+   * sits on a tool call's critical path.
    */
-  async shutdown() {
+  async shutdown(options) {
     if (this.syncQueue) {
-      await this.syncQueue.stop();
+      await this.syncQueue.stop(options?.syncFlush ?? {});
       this.syncQueue = null;
     }
     this.evaluator = null;
@@ -4372,7 +4618,7 @@ var AstraSyncGateway = class {
     let decision;
     switch (this.config.mode) {
       case "online":
-        decision = await verifyOnline(this.config, context, astraId);
+        decision = await verifyOnline(this.config, context, astraId ?? this.config.agentId);
         break;
       case "local":
         if (!this.evaluator) throw new Error("Local evaluator not initialized");
@@ -4427,6 +4673,13 @@ var AstraSyncGateway = class {
   getSyncStatus() {
     return this.syncQueue?.getStatus() || null;
   }
+  /**
+   * Record a tool call the calling adapter saw but did not govern
+   * (unmapped tool, skipTools, MCP with governMcp off). Trace-only.
+   */
+  logSkippedTool(toolName, reason) {
+    this.traceLogger?.logSkipped(toolName, reason);
+  }
 };
 
 // src/adapter-interface/interface.ts
@@ -4518,6 +4771,11 @@ function extractNetworkDomains(target) {
 // src/claude-code/tool-mapping.ts
 var CLAUDE_CODE_TOOL_MAP = {
   Bash: "shell.exec",
+  // Native Windows ships shell execution as a distinct PowerShell tool
+  // (hooks docs: "Tool Names in PreToolUse"). Found live on 10 Jul 2026 —
+  // the desktop-app runtime verification showed shell commands bypassing
+  // the guard entirely on Windows because only Bash was mapped/matched.
+  PowerShell: "shell.exec",
   Write: "file.write",
   Edit: "file.write",
   MultiEdit: "file.write",
@@ -4662,7 +4920,10 @@ var ClaudeCodeAdapter = class {
       timestamp: /* @__PURE__ */ new Date()
     };
     const interception = await this.interceptAction(action);
-    if (!interception.intercepted || !interception.context) return null;
+    if (!interception.intercepted || !interception.context) {
+      this.gateway.logSkippedTool(payload.tool_name, interception.skipReason ?? "not intercepted");
+      return null;
+    }
     const decision = await this.gateway.evaluate(interception.context);
     return this.decisionToHookOutput(decision);
   }
@@ -4674,9 +4935,10 @@ var ClaudeCodeAdapter = class {
   }
 };
 
-// src/claude-code/hook.ts
-var MAX_STDIN_BYTES = 1024 * 1024;
-var STDIN_TIMEOUT_MS = 5e3;
+// src/claude-code/guard-config.ts
+var import_fs4 = require("fs");
+var import_os = require("os");
+var import_path3 = require("path");
 function resolveGuardConfig(env, payloadCwd, home = (0, import_os.homedir)()) {
   const candidateRoots = [env.CLAUDE_PROJECT_DIR, payloadCwd, home].filter(
     (root) => typeof root === "string" && root.length > 0
@@ -4698,6 +4960,12 @@ function resolveGuardConfig(env, payloadCwd, home = (0, import_os.homedir)()) {
   }
   return null;
 }
+
+// src/claude-code/hook.ts
+var MAX_STDIN_BYTES = 1024 * 1024;
+var STDIN_TIMEOUT_MS = 5e3;
+var HYBRID_FLUSH_LIMIT = 3;
+var HYBRID_FLUSH_TIMEOUT_MS = 1500;
 function denyOutput(reason) {
   return {
     hookSpecificOutput: {
@@ -4729,13 +4997,25 @@ async function processHookPayload(payloadJson, options = {}) {
   }
   const failOpen = envFailOpen || resolved.settings.failOpen === true;
   try {
+    let mode = resolved.settings.mode === "hybrid" ? "hybrid" : "local";
+    if (mode === "hybrid" && !(resolved.settings.apiBaseUrl && resolved.settings.apiKey)) {
+      console.error(
+        "AstraSync Local Guard: guard.json requests hybrid mode but apiBaseUrl/apiKey are missing \u2014 running local-only"
+      );
+      mode = "local";
+    }
     const gatewayConfig = {
-      mode: "local",
+      mode,
       policyFile: resolved.policyFile,
       posture: resolved.settings.posture ?? "active",
       traceEnabled: true,
-      tracePath: (0, import_path3.join)(resolved.guardDir, "traces"),
-      debug: false
+      tracePath: (0, import_path4.join)(resolved.guardDir, "traces"),
+      debug: false,
+      ...mode === "hybrid" && {
+        apiBaseUrl: resolved.settings.apiBaseUrl,
+        apiKey: resolved.settings.apiKey,
+        agentId: resolved.settings.agentId
+      }
     };
     const gateway = options.gatewayFactory ? options.gatewayFactory(gatewayConfig) : new AstraSyncGateway(gatewayConfig);
     await gateway.initialize();
@@ -4748,7 +5028,9 @@ async function processHookPayload(payloadJson, options = {}) {
     await adapter.initialize({ gateway, adapterOptions: {} });
     const output = await adapter.evaluatePayload(payload);
     await adapter.shutdown();
-    await gateway.shutdown();
+    await gateway.shutdown({
+      syncFlush: { limit: HYBRID_FLUSH_LIMIT, perEntryTimeoutMs: HYBRID_FLUSH_TIMEOUT_MS }
+    });
     return { output, exitCode: 0 };
   } catch (err) {
     if (failOpen) return { output: null, exitCode: 0 };