@canonmsg/claude-code-plugin 0.21.1 → 0.22.0

package/dist/approval-server.js

@@ -1,200 +0,0 @@
-import { createServer } from 'node:http';
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { buildClaudeApprovalDetails, classifyClaudeApprovalCategory, classifyClaudeApprovalRisk, } from './tool-policy.js';
-/**
- * HTTP server that bridges Claude Code's PermissionRequest hook
- * to Canon's ApprovalManager.
- *
- * Listens on localhost for POST /approve from Claude Code hooks.
- */
-export class ApprovalHttpServer {
-    server = null;
-    manager;
-    port;
-    getConversationId;
-    getIsOwnerTurn;
-    token;
-    maxBodyBytes;
-    requestTimeoutMs;
-    constructor(manager, getConversationId, opts) {
-        this.manager = manager;
-        this.getConversationId = getConversationId;
-        this.getIsOwnerTurn = opts?.getIsOwnerTurn ?? (() => true);
-        this.port = opts?.port ?? 19420;
-        this.token = opts?.token ?? randomBytes(32).toString('base64url');
-        this.maxBodyBytes = opts?.maxBodyBytes ?? 64 * 1024;
-        this.requestTimeoutMs = opts?.requestTimeoutMs ?? 10_000;
-    }
-    static MAX_PORT_RETRIES = 10;
-    get authToken() {
-        return this.token;
-    }
-    async start() {
-        const startPort = this.port;
-        return new Promise((resolve, reject) => {
-            this.server = createServer((req, res) => this.handleRequest(req, res));
-            this.server.on('error', (err) => {
-                if (err.code === 'EADDRINUSE') {
-                    this.port++;
-                    if (this.port - startPort >= ApprovalHttpServer.MAX_PORT_RETRIES) {
-                        reject(new Error(`No available port found in range ${startPort}–${this.port}`));
-                        return;
-                    }
-                    this.server.listen(this.port, '127.0.0.1');
-                }
-                else {
-                    reject(err);
-                }
-            });
-            this.server.listen(this.port, '127.0.0.1', () => {
-                const address = this.server?.address();
-                if (address && typeof address === 'object') {
-                    this.port = address.port;
-                }
-                console.error(`[canon] Approval server listening on 127.0.0.1:${this.port}`);
-                resolve(this.port);
-            });
-        });
-    }
-    async stop() {
-        return new Promise((resolve) => {
-            if (this.server) {
-                this.server.close(() => resolve());
-            }
-            else {
-                resolve();
-            }
-        });
-    }
-    handleRequest(req, res) {
-        if (req.method !== 'POST' || req.url !== '/approve') {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Not found' }));
-            return;
-        }
-        req.setTimeout(this.requestTimeoutMs, () => {
-            res.writeHead(408, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Request timeout' }));
-            req.destroy();
-        });
-        if (!this.hasValidToken(req)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-            return;
-        }
-        let body = '';
-        req.on('data', (chunk) => {
-            if (res.writableEnded)
-                return;
-            if (body.length + chunk.length > this.maxBodyBytes) {
-                res.writeHead(413, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Request body too large' }));
-                req.destroy();
-                return;
-            }
-            body += chunk.toString();
-        });
-        req.on('end', () => {
-            if (res.writableEnded)
-                return;
-            this.handleApproval(body, res).catch((err) => {
-                console.error('[canon] Approval handler error:', err);
-                if (res.writableEnded)
-                    return;
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Internal error' }));
-            });
-        });
-    }
-    hasValidToken(req) {
-        const authHeader = req.headers.authorization;
-        const bearer = typeof authHeader === 'string' && authHeader.toLowerCase().startsWith('bearer ')
-            ? authHeader.slice('bearer '.length).trim()
-            : null;
-        const headerToken = req.headers['x-canon-approval-token'];
-        const supplied = bearer || (typeof headerToken === 'string' ? headerToken : null);
-        if (!supplied)
-            return false;
-        const expected = Buffer.from(this.token);
-        const received = Buffer.from(supplied);
-        return expected.length === received.length && timingSafeEqual(expected, received);
-    }
-    async handleApproval(body, res) {
-        let payload;
-        try {
-            payload = JSON.parse(body);
-        }
-        catch {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Invalid JSON' }));
-            return;
-        }
-        const toolName = payload.tool_name ?? 'Unknown';
-        const toolInput = payload.tool_input ?? {};
-        // Determine risk level
-        const riskLevel = this.classifyRisk(toolName, toolInput);
-        const isOwnerTurn = this.getIsOwnerTurn();
-        // Find the conversation to send the approval to.
-        const conversationId = this.getConversationId();
-        if (!conversationId) {
-            console.error('[canon] No active conversation for approval — falling back to ask');
-            // Can't send approval message, fall through to terminal prompt.
-            this.sendHookResponse(res, 'ask');
-            return;
-        }
-        // Check session rules first for owner-triggered turns. Non-owner-triggered
-        // tools require a fresh owner decision so an old "approve all" does not
-        // turn into remote control of the owner's local runtime.
-        const existingRule = isOwnerTurn ? this.manager.checkSessionRules(toolName, conversationId) : null;
-        if (existingRule) {
-            const decision = existingRule.type === 'deny-tool' ? 'deny' : 'allow';
-            this.sendHookResponse(res, decision);
-            return;
-        }
-        try {
-            const result = await this.manager.requestApproval(conversationId, toolName, toolInput, {
-                riskLevel,
-                risk: classifyClaudeApprovalRisk(toolName, toolInput),
-                category: classifyClaudeApprovalCategory(toolName),
-                native: {
-                    runtime: 'claude-code',
-                    method: 'PermissionRequest',
-                    ...(payload.session_id ? { requestId: payload.session_id } : {}),
-                },
-                details: buildClaudeApprovalDetails(toolName, toolInput),
-                ignoreSessionRules: !isOwnerTurn,
-                allowSessionRule: isOwnerTurn,
-            });
-            this.sendHookResponse(res, result.decision);
-        }
-        catch (err) {
-            console.error('[canon] Approval request failed:', err);
-            // On error, fall back to terminal prompt
-            this.sendHookResponse(res, 'ask');
-        }
-    }
-    sendHookResponse(res, behavior) {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            hookSpecificOutput: {
-                hookEventName: 'PermissionRequest',
-                decision: { behavior },
-            },
-        }));
-    }
-    classifyRisk(toolName, toolInput) {
-        if (toolName !== 'Bash')
-            return 'normal';
-        const cmd = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const destructivePatterns = [
-            /\brm\s+(-rf?|--force)/,
-            /\bgit\s+push\s+--force/,
-            /\bgit\s+reset\s+--hard/,
-            /\bdrop\s+(table|database)/i,
-            /\bformat\b/,
-        ];
-        return destructivePatterns.some((p) => p.test(cmd))
-            ? 'destructive'
-            : 'normal';
-    }
-}

package/dist/mcp-args.d.ts

@@ -1,45 +0,0 @@
-import type { DirectSessionSelection, SendContextualMessageOptions } from '@canonmsg/core/contract';
-export type McpParseResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    error: string;
-};
-type ContentType = 'text' | 'image' | 'audio' | 'video' | 'file';
-export interface ReplyArgs {
-    conversationId: string;
-    text: string;
-}
-export declare function parseReplyArgs(value: unknown): McpParseResult<ReplyArgs>;
-export interface SendMessageArgs {
-    conversationId: string;
-    text: string;
-    contentType: ContentType;
-    imageUrl?: string;
-    audioUrl?: string;
-    videoUrl?: string;
-    fileUrl?: string;
-    mediaPath?: string;
-    fileName?: string;
-    mimeType?: string;
-    durationMs?: number;
-}
-export declare function parseSendMessageArgs(value: unknown): McpParseResult<SendMessageArgs>;
-export interface SendContextualMessageArgs {
-    sourceConversationId: string;
-    targetConversationId?: string;
-    targetUserId?: string;
-    text: string;
-    selfContext: SendContextualMessageOptions['selfContext'];
-    sessionSelection?: DirectSessionSelection;
-    messageOptions?: SendContextualMessageOptions['messageOptions'];
-}
-export declare function parseSendContextualMessageArgs(value: unknown): McpParseResult<SendContextualMessageArgs>;
-export interface SetTypingArgs {
-    conversationId: string;
-    typing: boolean;
-    status?: 'typing' | 'thinking';
-}
-export declare function parseSetTypingArgs(value: unknown): McpParseResult<SetTypingArgs>;
-export {};

package/dist/mcp-args.js

@@ -1,179 +0,0 @@
-function isRecord(value) {
-    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-function requiredString(record, key, maxLength = 4096) {
-    const value = record[key];
-    if (typeof value !== 'string') {
-        return { ok: false, error: `Missing ${key}` };
-    }
-    const trimmed = value.trim();
-    if (!trimmed) {
-        return { ok: false, error: `Missing ${key}` };
-    }
-    if (trimmed.length > maxLength) {
-        return { ok: false, error: `${key} is too long` };
-    }
-    return { ok: true, value: trimmed };
-}
-function optionalString(record, key, maxLength = 4096) {
-    const value = record[key];
-    if (typeof value !== 'string')
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed && trimmed.length <= maxLength ? trimmed : undefined;
-}
-function optionalNumber(record, key) {
-    const value = record[key];
-    return typeof value === 'number' && Number.isFinite(value) && value >= 0
-        ? value
-        : undefined;
-}
-function parseContentType(value) {
-    if (value == null)
-        return { ok: true, value: 'text' };
-    if (value === 'text' || value === 'image' || value === 'audio' || value === 'video' || value === 'file') {
-        return { ok: true, value };
-    }
-    return { ok: false, error: 'Invalid content_type' };
-}
-export function parseReplyArgs(value) {
-    if (!isRecord(value))
-        return { ok: false, error: 'Arguments must be an object' };
-    const conversationId = requiredString(value, 'conversation_id', 256);
-    if (!conversationId.ok)
-        return conversationId;
-    const text = requiredString(value, 'text');
-    if (!text.ok)
-        return text;
-    return {
-        ok: true,
-        value: {
-            conversationId: conversationId.value,
-            text: text.value,
-        },
-    };
-}
-export function parseSendMessageArgs(value) {
-    if (!isRecord(value))
-        return { ok: false, error: 'Arguments must be an object' };
-    const conversationId = requiredString(value, 'conversation_id', 256);
-    if (!conversationId.ok)
-        return conversationId;
-    const contentType = parseContentType(value.content_type);
-    if (!contentType.ok)
-        return contentType;
-    const imageUrl = optionalString(value, 'image_url', 4096);
-    const audioUrl = optionalString(value, 'audio_url', 4096);
-    const videoUrl = optionalString(value, 'video_url', 4096);
-    const fileUrl = optionalString(value, 'file_url', 4096);
-    const mediaPath = optionalString(value, 'media_path', 4096);
-    const fileName = optionalString(value, 'file_name', 512);
-    const mimeType = optionalString(value, 'mime_type', 256);
-    const durationMs = optionalNumber(value, 'duration_ms');
-    return {
-        ok: true,
-        value: {
-            conversationId: conversationId.value,
-            text: optionalString(value, 'text') ?? '',
-            contentType: contentType.value,
-            ...(imageUrl ? { imageUrl } : {}),
-            ...(audioUrl ? { audioUrl } : {}),
-            ...(videoUrl ? { videoUrl } : {}),
-            ...(fileUrl ? { fileUrl } : {}),
-            ...(mediaPath ? { mediaPath } : {}),
-            ...(fileName ? { fileName } : {}),
-            ...(mimeType ? { mimeType } : {}),
-            ...(durationMs != null ? { durationMs } : {}),
-        },
-    };
-}
-function parseSessionSelection(value) {
-    if (value == null)
-        return { ok: true, value: undefined };
-    const raw = typeof value === 'string'
-        ? value
-        : isRecord(value) && typeof value.mode === 'string'
-            ? value.mode
-            : null;
-    const mode = raw?.trim().toLowerCase().replace(/-/g, '_');
-    if (!mode)
-        return { ok: false, error: 'Invalid session_selection' };
-    if (mode === 'new' || mode === 'fresh' || mode === 'start_new') {
-        return { ok: true, value: { mode: 'new' } };
-    }
-    if (mode === 'continue_latest' || mode === 'latest' || mode === 'continue') {
-        return { ok: true, value: { mode: 'continue_latest' } };
-    }
-    if (mode === 'continue_or_create' || mode === 'auto' || mode === 'reuse_or_create') {
-        return { ok: true, value: { mode: 'continue_or_create' } };
-    }
-    return { ok: false, error: 'session_selection must be new, continue_latest, or continue_or_create' };
-}
-export function parseSendContextualMessageArgs(value) {
-    if (!isRecord(value))
-        return { ok: false, error: 'Arguments must be an object' };
-    const sourceConversationId = requiredString(value, 'source_conversation_id', 256);
-    if (!sourceConversationId.ok)
-        return sourceConversationId;
-    const text = requiredString(value, 'text');
-    if (!text.ok)
-        return text;
-    const targetConversationId = optionalString(value, 'target_conversation_id', 256);
-    const targetUserId = optionalString(value, 'target_user_id', 256);
-    if (Boolean(targetConversationId) === Boolean(targetUserId)) {
-        return { ok: false, error: 'Provide exactly one target_conversation_id or target_user_id' };
-    }
-    if (!isRecord(value.self_context)) {
-        return { ok: false, error: 'Missing self_context' };
-    }
-    const type = value.self_context.type;
-    const context = requiredString(value.self_context, 'context');
-    if (!context.ok)
-        return context;
-    if (type !== 'cross_session') {
-        return { ok: false, error: 'self_context.type must be cross_session' };
-    }
-    const sessionSelection = parseSessionSelection(value.session_selection);
-    if (!sessionSelection.ok)
-        return sessionSelection;
-    const messageOptions = isRecord(value.message_options)
-        ? value.message_options
-        : undefined;
-    return {
-        ok: true,
-        value: {
-            sourceConversationId: sourceConversationId.value,
-            ...(targetConversationId ? { targetConversationId } : {}),
-            ...(targetUserId ? { targetUserId } : {}),
-            text: text.value,
-            selfContext: {
-                type: 'cross_session',
-                context: context.value,
-            },
-            ...(sessionSelection.value ? { sessionSelection: sessionSelection.value } : {}),
-            ...(messageOptions ? { messageOptions } : {}),
-        },
-    };
-}
-export function parseSetTypingArgs(value) {
-    if (!isRecord(value))
-        return { ok: false, error: 'Arguments must be an object' };
-    const conversationId = requiredString(value, 'conversation_id', 256);
-    if (!conversationId.ok)
-        return conversationId;
-    if (typeof value.typing !== 'boolean') {
-        return { ok: false, error: 'typing must be a boolean' };
-    }
-    const status = value.status;
-    if (status !== undefined && status !== 'typing' && status !== 'thinking') {
-        return { ok: false, error: 'Invalid status' };
-    }
-    return {
-        ok: true,
-        value: {
-            conversationId: conversationId.value,
-            typing: value.typing,
-            ...(status ? { status } : {}),
-        },
-    };
-}

package/dist/server.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export declare function main(): Promise<void>;