@bookedsolid/rea 0.31.0 → 0.33.0

package/hooks/env-file-protection.sh

@@ -1,124 +1,157 @@
 #!/bin/bash
 # PreToolUse hook: env-file-protection.sh
-# Fires BEFORE every Bash tool call.
-# Blocks commands that read .env* / .envrc files via shell text utilities.
+# 0.33.0+ — Node-binary shim for `rea hook env-file-protection`.
 #
-# Rationale: .env files contain credentials. Reading them via Bash exposes
-# the values in command output, logs, and agent transcripts. Load credentials
-# in code only (process.env, os.environ, etc.) — never via shell reads.
+# Pre-0.33.0 the gate's full body lived here as bash (124 LOC, the
+# segment splitter + `source`/`cp` anchor patterns + utility-vs-.env
+# co-occurrence check). The migration to the parser-backed Node binary
+# moves all of that into `src/hooks/env-file-protection/index.ts`. This
+# shim is the Claude Code dispatcher's view of the hook — it forwards
+# stdin to the CLI and exits with whatever the CLI returns.
 #
-# Trigger: command matches ALL of:
-#   1. Uses a text-reading utility (list below)
-#   2. References a .env* or .envrc filename
+# Behavioral contract is preserved byte-for-byte: exit 0 on
+# pass-through / no-match, exit 2 on HALT / .env access detected /
+# malformed payload (fail-closed).
 #
-# Exit codes:
-#   0 = allow
-#   2 = block (env file read detected)
+# # CLI-resolution trust boundary
+#
+# Mirrors the 0.32.0 final shim shape (round-8 of the codex iteration
+# on the three Phase 1 pilots). The resolved CLI MUST live INSIDE
+# realpath(CLAUDE_PROJECT_DIR) AND have an ancestor `package.json`
+# whose `name` is `@bookedsolid/rea`. Defends against symlink-out and
+# tarball-replacement attacks on the resolved CLI.
+#
+# # Fail-closed posture
+#
+# env-file-protection is a BLOCKING-tier gate — the pre-0.33.0 bash
+# body refused on .env access without a compiled CLI. The early-exit
+# branches (CLI missing, node missing, sandbox failed, version skew)
+# fail closed AFTER the relevance pre-gate passes. Irrelevant Bash
+# calls exit 0 regardless of CLI state.
 
 set -uo pipefail
 
-# Source shared shell-segment splitter (0.15.0). Replaces full-command
-# grep that false-positives on commit messages mentioning `.env` (e.g.
-# `git commit -m "stop reading .env via cat"`).
-# shellcheck source=_lib/cmd-segments.sh
-source "$(dirname "$0")/_lib/cmd-segments.sh"
-
-INPUT=$(cat)
-
-# ── Dependency check ──────────────────────────────────────────────────────────
-if ! command -v jq >/dev/null 2>&1; then
-  printf 'REA ERROR: jq is required but not installed.\n' >&2
-  printf 'Install: brew install jq  OR  apt-get install -y jq\n' >&2
-  exit 2
-fi
-
-# ── HALT check ────────────────────────────────────────────────────────────────
-# 0.16.0: HALT check sourced from shared _lib/halt-check.sh.
+# 1. HALT check.
 # shellcheck source=_lib/halt-check.sh
 source "$(dirname "$0")/_lib/halt-check.sh"
 check_halt
 REA_ROOT=$(rea_root)
 
-CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+proj="${CLAUDE_PROJECT_DIR:-$REA_ROOT}"
 
-if [[ -z "$CMD" ]]; then
+# 2. Relevance pre-gate. Capture stdin + check for `.env` substring
+#    BEFORE any CLI/sandbox/probe work so unrelated Bash calls
+#    (`ls`, `pnpm test`, `git status`, …) exit 0 even when the CLI
+#    is missing/stale/sandboxed-out.
+#
+#    2026-05-15 codex round-2 P2 fix: the substring scan MUST run
+#    against `tool_input.command` ONLY, not the raw JSON payload —
+#    otherwise a benign `git commit -m "stop reading .env"` (where
+#    `.env` appears inside the commit message ARG, NOT as a file
+#    target) would hit the fail-closed branch on a fresh checkout
+#    where the CLI is unbuilt. Pre-fix the raw scan saw the substring
+#    inside the payload's "command" string-quoted body and refused.
+#
+#    Strategy: extract `tool_input.command` via `jq` (already required
+#    by 5 other hooks; trust assumption is consistent). When `jq` is
+#    not installed, fall back to scanning the raw payload — the cost
+#    is the same over-trigger the bash original had, NOT a new
+#    regression. When `jq` IS installed (the common case), the
+#    pre-gate is field-scoped.
+INPUT=$(cat)
+RELEVANT=0
+PROBE=""
+if command -v jq >/dev/null 2>&1; then
+  PROBE=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
+  if printf '%s' "$PROBE" | grep -qE '\.env'; then
+    RELEVANT=1
+  fi
+else
+  # jq-less fallback — match the pre-0.33.0 over-trigger posture.
+  if printf '%s' "$INPUT" | grep -qE '\.env'; then
+    RELEVANT=1
+  fi
+fi
+if [ "$RELEVANT" -eq 0 ]; then
   exit 0
 fi
 
-truncate_cmd() {
-  local STR="$1"
-  local MAX=100
-  if [[ ${#STR} -gt $MAX ]]; then
-    printf '%s' "${STR:0:$MAX}..."
-  else
-    printf '%s' "$STR"
-  fi
-}
+# 3. Resolve the rea CLI through the fixed 2-tier sandboxed order.
+REA_ARGV=()
+RESOLVED_CLI_PATH=""
+if [ -f "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/node_modules/@bookedsolid/rea/dist/cli/index.js"
+elif [ -f "$proj/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/dist/cli/index.js"
+fi
 
-# Text-reading utilities (shell and common alternatives)
-# Defense-in-depth: this list catches the most common shell-based exfiltration
-# vectors. It is NOT exhaustive. Known gaps include:
-#   - Docker volume mounts (docker run -v .env:/...) — separate concern
-#   - Editor commands (vim, nano, code) — not typically used by agents
-#   - Redirects/process substitution (< .env) without a listed utility
-#   - Network tools (curl file://, nc) — low-risk in agent context
-# The goal is to block casual and accidental reads, not defeat a determined
-# adversary with shell access.
-PATTERN_UTILITY='(cat|head|tail|less|more|grep|sed|awk|bat|strings|printf|xargs|tee|jq|python3?[[:space:]]+-c|ruby[[:space:]]+-e)[[:space:]]'
-# Also catch: source/., cp (reads then writes elsewhere).
-#
-# 0.16.3 discord-ops Round 9 #4 fix: anchored on segment-start. Pre-fix
-# `any_segment_matches` matched anywhere in the segment, so
-# `git commit -m "fix: don't source .env files"` fired even though no
-# real source-of-.env was happening — the trigger words appeared inside
-# the quoted commit-message body. The patterns are command prefixes
-# (`source PATH`, `. PATH`, `cp X PATH`), so segment-start anchoring is
-# the correct shape.
-PATTERN_SOURCE='(source|\.)[[:space:]]+[^;|&]*\.env'
-PATTERN_CP_ENV='cp[[:space:]]+[^;|&]*\.env'
-# .env* files or .envrc (direnv)
-PATTERN_ENV_FILE='(\.env[a-zA-Z0-9._-]*|\.envrc)([[:space:]]|"|'"'"'|$)'
+if [ "${#REA_ARGV[@]}" -eq 0 ]; then
+  # Blocking-tier: fail closed. The pre-0.33.0 bash body enforced
+  # .env protection without a CLI. Refuse and tell the operator how
+  # to restore protection.
+  printf 'rea: env-file-protection cannot run — the rea CLI is not built.\n' >&2
+  printf 'Run `pnpm install && pnpm build` (or `npm install` for a consumer install) to restore protection.\n' >&2
+  printf 'This shim fails closed because the pre-0.33.0 bash body enforced .env protection without a CLI.\n' >&2
+  exit 2
+fi
 
-# 0.16.2 helix-017 P2 #2: utility AND env-filename must co-occur within
-# the SAME shell segment. Pre-fix this set two independent booleans
-# (any segment with utility OR any segment with .env) and AND'd them,
-# which false-positived across multi-segment constructions like
-# `echo "log: cat is broken" ; touch foo.env` (utility in segment 1,
-# .env name in segment 2). Detection is fundamentally a same-segment
-# co-occurrence property.
-MATCHES_BOTH_SAME_SEGMENT=0
-if any_segment_matches_both "$CMD" "$PATTERN_UTILITY" "$PATTERN_ENV_FILE"; then
-  MATCHES_BOTH_SAME_SEGMENT=1
+# 4. Realpath sandbox check.
+if ! command -v node >/dev/null 2>&1; then
+  printf 'rea: env-file-protection cannot run — `node` is not on PATH.\n' >&2
+  printf 'Install Node 22+ (engines.node) to restore .env protection.\n' >&2
+  exit 2
 fi
 
-# Direct source/cp of .env files — always block (segment-start anchored
-# per discord-ops Round 9 #4).
-if any_segment_starts_with "$CMD" "$PATTERN_SOURCE" || \
-   any_segment_starts_with "$CMD" "$PATTERN_CP_ENV"; then
-  TRUNCATED_CMD=$(truncate_cmd "$CMD")
-  {
-    printf 'ENV FILE PROTECTION: Direct sourcing or copying of .env files is blocked.\n'
-    printf '\n'
-    printf '  Command: %s\n' "$TRUNCATED_CMD"
-    printf '\n'
-    printf '  Rule: Load credentials in code only — never via shell source or cp.\n'
-    printf '  Use: process.env.VAR_NAME, os.environ["VAR_NAME"], etc.\n'
-  } >&2
+sandbox_check=$(node -e '
+  const fs = require("fs");
+  const path = require("path");
+  const cli = process.argv[1];
+  const projDir = process.argv[2];
+  let real, realProj;
+  try { real = fs.realpathSync(cli); } catch (e) {
+    process.stdout.write("bad:realpath"); process.exit(1);
+  }
+  try { realProj = fs.realpathSync(projDir); } catch (e) {
+    process.stdout.write("bad:realpath-proj"); process.exit(1);
+  }
+  const sep = path.sep;
+  const projWithSep = realProj.endsWith(sep) ? realProj : realProj + sep;
+  if (!(real === realProj || real.startsWith(projWithSep))) {
+    process.stdout.write("bad:cli-escapes-project"); process.exit(1);
+  }
+  let cur = path.dirname(path.dirname(path.dirname(real)));
+  let found = false;
+  for (let i = 0; i < 20 && cur && cur !== path.dirname(cur); i += 1) {
+    const pj = path.join(cur, "package.json");
+    if (fs.existsSync(pj)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(pj, "utf8"));
+        if (data && data.name === "@bookedsolid/rea") { found = true; break; }
+      } catch (e) { /* keep walking */ }
+    }
+    cur = path.dirname(cur);
+  }
+  if (!found) { process.stdout.write("bad:no-rea-pkg-json"); process.exit(1); }
+  process.stdout.write("ok");
+' -- "$RESOLVED_CLI_PATH" "$proj" 2>/dev/null)
+
+if [ "$sandbox_check" != "ok" ]; then
+  printf 'rea: env-file-protection FAILED sandbox check (%s) — refusing.\n' "$sandbox_check" >&2
   exit 2
 fi
 
-if [[ $MATCHES_BOTH_SAME_SEGMENT -eq 1 ]]; then
-  TRUNCATED_CMD=$(truncate_cmd "$CMD")
-  {
-    printf 'ENV FILE PROTECTION: Reading .env files via Bash is blocked.\n'
-    printf '\n'
-    printf '  Command: %s\n' "$TRUNCATED_CMD"
-    printf '\n'
-    printf '  Rule: Load credentials in code only, never via shell.\n'
-    printf '  Use: process.env.VAR_NAME, os.environ["VAR_NAME"], etc.\n'
-    printf '  .env files must not be read via shell utilities in agent sessions.\n'
-  } >&2
+# 5. Version-probe.
+probe_out=$("${REA_ARGV[@]}" hook env-file-protection --help 2>&1)
+probe_status=$?
+if [ "$probe_status" -ne 0 ] || ! printf '%s' "$probe_out" | grep -q -e 'env-file-protection'; then
+  printf 'rea: this shim requires the `rea hook env-file-protection` subcommand (introduced in 0.33.0).\n' >&2
+  printf 'The resolved CLI at %s does not implement it.\n' "$RESOLVED_CLI_PATH" >&2
+  printf 'Run `pnpm install` (or `npm install`) to sync the CLI; refusing in the meantime to preserve enforcement.\n' >&2
   exit 2
 fi
 
-exit 0
+# 6. Forward stdin (already captured up-front for the relevance gate).
+printf '%s' "$INPUT" | "${REA_ARGV[@]}" hook env-file-protection
+exit $?

package/hooks/pr-issue-link-gate.sh

@@ -1,65 +1,134 @@
-#!/usr/bin/env bash
-# pr-issue-link-gate.sh — PreToolUse: Bash
+#!/bin/bash
+# PreToolUse hook: pr-issue-link-gate.sh
+# 0.32.0+ — Node-binary shim for `rea hook pr-issue-link-gate`.
 #
-# Ensures every `gh pr create` command references at least one GitHub issue
-# via closes/fixes/resolves #N syntax in the PR body. When the magic keyword
-# is present, GitHub automatically closes the linked issue when the PR merges
-# to the default branch and creates a cross-reference in the issue timeline.
+# Pre-0.32.0 the gate's full body lived here as bash; the migration to
+# the parser-backed Node binary moves the matching + advisory logic
+# into `src/hooks/pr-issue-link-gate/index.ts`. This shim is the
+# Claude Code dispatcher's view of the hook — it forwards stdin to the
+# CLI and exits with whatever the CLI returns.
 #
-# This gate is ADVISORY (exit 0) — it warns but does not block. Some PRs
-# legitimately have no linked issue (chores, hotfixes, release PRs). The
-# advisory gives the agent an opportunity to add the link before proceeding.
+# Behavioral contract is preserved byte-for-byte: ALWAYS exit 0 except
+# under HALT (exit 2) or a malformed payload (exit 2, fail-closed).
 #
-# Only active for Bash tool calls containing `gh pr create`.
-# JSONL-only projects (no GitHub) are unaffected — gh is unavailable there.
+# # CLI-resolution trust boundary
 #
-# Triggered by: PreToolUse — Bash tool
-
-set -euo pipefail
+# Codex round 1 P1 (2026-05-15): mirrors the realpath sandbox check
+# from `delegation-advisory.sh` §3 and `protected-paths-bash-gate.sh`
+# §6. The resolved CLI MUST live INSIDE realpath(CLAUDE_PROJECT_DIR)
+# AND have an ancestor `package.json` whose `name` is
+# `@bookedsolid/rea`. Pre-fix the shim executed
+# `node_modules/@bookedsolid/rea/dist/cli/index.js` directly without
+# realpathing the target, which would let an attacker who controlled
+# `node_modules/@bookedsolid/rea` (symlink-out, postinstall script,
+# tarball-replacement) ship forged review code that intercepts every
+# Bash dispatch.
+#
+# Sandboxed resolution order (PATH is INTENTIONALLY OMITTED):
+#   1. node_modules/@bookedsolid/rea/dist/cli/index.js (consumer-side)
+#   2. dist/cli/index.js under CLAUDE_PROJECT_DIR (dogfood)
+#
+# When NO rea CLI is reachable through the sandboxed order, this hook
+# falls through to allow (exit 0) — the advisory is a nudge, not a
+# security claim. The bash-tier path gates fail-closed because they
+# protect write surfaces; this gate only emits prose.
+#
+# # Version skew
+#
+# Codex round 1 P1 (2026-05-15): a fresh `rea init` against a stale
+# `node_modules/@bookedsolid/rea` would deliver this 0.32.0 shim while
+# the installed CLI lacks the `hook pr-issue-link-gate` subcommand —
+# every Bash dispatch would then fail with `unknown command` (exit 1).
+# Probe the subcommand's `--help` output before propagating the exit
+# code; on probe failure, advise the operator to `pnpm install` and
+# fall through silently so the workspace stays usable.
 
-# shellcheck source=_lib/common.sh
-source "$(dirname "$0")/_lib/common.sh"
+set -uo pipefail
 
+# 1. HALT check. Even though the CLI re-checks for defense-in-depth,
+#    short-circuit here so we never spawn `node` while frozen.
+# shellcheck source=_lib/halt-check.sh
+source "$(dirname "$0")/_lib/halt-check.sh"
 check_halt
+REA_ROOT=$(rea_root)
 
-INPUT="$(cat)"
-TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+proj="${CLAUDE_PROJECT_DIR:-$REA_ROOT}"
 
-if [[ "$TOOL_NAME" != "Bash" ]]; then
-  exit 0
+# 2. Resolve the rea CLI through the fixed 2-tier sandboxed order.
+REA_ARGV=()
+RESOLVED_CLI_PATH=""
+if [ -f "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/node_modules/@bookedsolid/rea/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/node_modules/@bookedsolid/rea/dist/cli/index.js"
+elif [ -f "$proj/dist/cli/index.js" ]; then
+  REA_ARGV=(node "$proj/dist/cli/index.js")
+  RESOLVED_CLI_PATH="$proj/dist/cli/index.js"
 fi
 
-COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+if [ "${#REA_ARGV[@]}" -eq 0 ]; then
+  exit 0
+fi
 
-# Only intercept gh pr create
-if ! echo "$COMMAND" | grep -qE 'gh\s+pr\s+create'; then
+# 3. Realpath sandbox check — mirrors delegation-advisory.sh §3.
+if ! command -v node >/dev/null 2>&1; then
   exit 0
 fi
 
-require_jq
+sandbox_check=$(node -e '
+  const fs = require("fs");
+  const path = require("path");
+  const cli = process.argv[1];
+  const projDir = process.argv[2];
+  let real, realProj;
+  try { real = fs.realpathSync(cli); } catch (e) {
+    process.stdout.write("bad:realpath"); process.exit(1);
+  }
+  try { realProj = fs.realpathSync(projDir); } catch (e) {
+    process.stdout.write("bad:realpath-proj"); process.exit(1);
+  }
+  const sep = path.sep;
+  const projWithSep = realProj.endsWith(sep) ? realProj : realProj + sep;
+  if (!(real === realProj || real.startsWith(projWithSep))) {
+    process.stdout.write("bad:cli-escapes-project"); process.exit(1);
+  }
+  let cur = path.dirname(path.dirname(path.dirname(real)));
+  let found = false;
+  for (let i = 0; i < 20 && cur && cur !== path.dirname(cur); i += 1) {
+    const pj = path.join(cur, "package.json");
+    if (fs.existsSync(pj)) {
+      try {
+        const data = JSON.parse(fs.readFileSync(pj, "utf8"));
+        if (data && data.name === "@bookedsolid/rea") { found = true; break; }
+      } catch (e) { /* keep walking */ }
+    }
+    cur = path.dirname(cur);
+  }
+  if (!found) { process.stdout.write("bad:no-rea-pkg-json"); process.exit(1); }
+  process.stdout.write("ok");
+' -- "$RESOLVED_CLI_PATH" "$proj" 2>/dev/null)
 
-# Check for closing keywords followed by an issue number
-# Accepted: closes #N, fixes #N, resolves #N (case-insensitive, any spacing)
-if echo "$COMMAND" | grep -qiE '(closes|fixes|resolves)\s+#[0-9]+'; then
+if [ "$sandbox_check" != "ok" ]; then
+  printf 'rea: pr-issue-link-gate skipped (sandbox check: %s)\n' "$sandbox_check" >&2
   exit 0
 fi
 
-# Advisory — warn but do not block.
-# Chore PRs, release PRs, and hotfixes may legitimately have no linked issue.
-printf 'PR ISSUE LINK ADVISORY: This PR does not reference a GitHub issue.\n' >&2
-printf '\n' >&2
-printf 'When a PR body includes a closing reference, GitHub automatically:\n' >&2
-printf '  - Closes the issue when the PR merges to the default branch\n' >&2
-printf '  - Creates a cross-reference in the issue timeline\n' >&2
-printf '  - Links the PR in the CHANGELOG context\n' >&2
-printf '\n' >&2
-printf 'Add to the --body:\n' >&2
-printf '  closes #N    closes one issue\n' >&2
-printf '  fixes #N     same effect\n' >&2
-printf '  resolves #N  same effect\n' >&2
-printf '  closes #N, closes #M   closes multiple issues\n' >&2
-printf '\n' >&2
-printf 'If this is a chore, release, or hotfix PR with no upstream issue, you may proceed.\n' >&2
+# 4. Version-probe: confirm the resolved CLI implements the
+#    `hook pr-issue-link-gate` subcommand. A stale node_modules from
+#    a fresh `rea init` against an older installed version would
+#    otherwise turn every Bash dispatch into a hard failure.
+probe_out=$("${REA_ARGV[@]}" hook pr-issue-link-gate --help 2>&1)
+probe_status=$?
+if [ "$probe_status" -ne 0 ] || ! printf '%s' "$probe_out" | grep -q -e 'pr-issue-link-gate'; then
+  printf 'rea: this shim requires the `rea hook pr-issue-link-gate` subcommand (introduced in 0.32.0).\n' >&2
+  printf 'The resolved CLI at %s does not implement it.\n' "$RESOLVED_CLI_PATH" >&2
+  printf 'Run `pnpm install` (or `npm install`) to sync the CLI to the version this shim expects.\n' >&2
+  exit 0
+fi
 
-# Exit 0 — advisory only, does not block the PR creation
-exit 0
+# 5. Forward stdin to the CLI synchronously. The advisory text must
+#    reach the operator's stderr before this hook returns; the CLI's
+#    own exit code is the hook's exit code (0 normally, 2 under HALT
+#    or malformed payload).
+INPUT=$(cat)
+printf '%s' "$INPUT" | "${REA_ARGV[@]}" hook pr-issue-link-gate
+exit $?