@cleocode/cleo 2026.10.1 → 2026.10.2

package/bin/cleo.js

@@ -105,7 +105,23 @@ function heapCapApplied() {
   return carriesCap((process.env.NODE_OPTIONS ?? '').split(/\s+/));
 }
 
-if (heapCapApplied()) {
+if (
+  args[0] === 'hook' &&
+  args[1] === 'heavy-command' &&
+  !args.includes('--help') &&
+  !args.includes('-h')
+) {
+  // T12983: `cleo hook heavy-command` runs before every shell command an agent
+  // issues, so it skips the re-exec and the CLI bootstrap and loads only the
+  // hook runtime (`cleo hook --help` still goes through the CLI). Hooks are
+  // fail-open: a failure here exits 0 and the agent's command runs unchanged.
+  try {
+    const { runHookCli } = await import(resolve(__dirname, '../dist/cli/hook-entry.js'));
+    process.exitCode = await runHookCli(args.slice(1));
+  } catch (err) {
+    process.stderr.write(`[cleo hook] skipped: ${err instanceof Error ? err.message : err}\n`);
+  }
+} else if (heapCapApplied()) {
   // Single-process path: signals reach the CLI directly, no child to orphan.
   await import(cliPath);
 } else {

package/dist/cli/hook-entry.js

@@ -0,0 +1,372 @@
+(() => {
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/hook-entry.ts
+import { readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var HEAVY_HOOK_PROVIDERS = [
+  "claude-code",
+  "codex",
+  "kimi",
+  "opencode"
+];
+var BASH_DEFAULT_MS = 12e4;
+var BASH_MAX_MS = 6e5;
+var MIN_WAIT_SEC = 30;
+var MAX_WAIT_SEC = 300;
+var DEFAULT_WAIT_SEC = 60;
+var REWRITE_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "auto"]);
+var MAX_STDIN_BYTES = 1024 * 1024;
+async function readProcessStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += buf.length;
+    if (size > MAX_STDIN_BYTES) return "";
+    chunks.push(buf);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function processHookIo() {
+  return {
+    readStdin: readProcessStdin,
+    writeStdout: (text) => process.stdout.write(text),
+    // stdout-discipline-allowed: PreToolUse hook protocol, the harness parses this JSON (not LAFS, not rendered output) // stdout-write-allowed: PreToolUse hook protocol output read raw by the harness
+    writeStderr: (text) => process.stderr.write(text),
+    env: process.env,
+    cwd: process.cwd()
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseHookInput(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!isRecord(raw)) return null;
+  const toolInput = raw.tool_input;
+  if (!isRecord(toolInput) || typeof toolInput.command !== "string") return null;
+  const toolName = typeof raw.tool_name === "string" ? raw.tool_name : void 0;
+  if (toolName !== void 0 && !/^(bash|shell|exec_command)$/i.test(toolName)) return null;
+  const str = (v) => typeof v === "string" ? v : void 0;
+  return {
+    ...toolName === void 0 ? {} : { tool_name: toolName },
+    tool_input: { ...toolInput, command: toolInput.command },
+    ...str(raw.cwd) === void 0 ? {} : { cwd: str(raw.cwd) },
+    ...str(raw.permission_mode) === void 0 ? {} : { permission_mode: str(raw.permission_mode) }
+  };
+}
+function positiveMs(value) {
+  const n = value === void 0 ? Number.NaN : Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : void 0;
+}
+function heavyHookWaitBudget(provider, toolInput, env = {}) {
+  if (toolInput.run_in_background === true) return {};
+  if (provider !== "claude-code" && provider !== "opencode") {
+    return { waitTimeoutSec: DEFAULT_WAIT_SEC };
+  }
+  const fromEnv = provider === "claude-code";
+  const def = (fromEnv ? positiveMs(env.BASH_DEFAULT_TIMEOUT_MS) : void 0) ?? BASH_DEFAULT_MS;
+  const max = Math.max(
+    (fromEnv ? positiveMs(env.BASH_MAX_TIMEOUT_MS) : void 0) ?? BASH_MAX_MS,
+    def
+  );
+  const asked = typeof toolInput.timeout === "number" && toolInput.timeout > 0 ? toolInput.timeout : def;
+  const effective = Math.min(asked, max);
+  const room = Math.floor((max - effective) / 1e3);
+  const waitTimeoutSec = Math.max(
+    MIN_WAIT_SEC,
+    Math.min(MAX_WAIT_SEC, Math.round(effective / 1e3), room)
+  );
+  return { waitTimeoutSec, timeoutMs: Math.min(max, effective + waitTimeoutSec * 1e3) };
+}
+function heavyHookContext(plan, pressure, provider = "claude-code") {
+  const lines = [];
+  const governed = plan.action === "none" ? "" : plan.segments.map((s) => s.governed).join(" ; ");
+  if (plan.action === "rewrite" && provider === "kimi") {
+    lines.push(
+      `[cleo] Not run: heavy commands share the machine-wide resource budget. Re-run it as: ${plan.command}`
+    );
+  } else if (plan.action === "rewrite") {
+    lines.push(
+      `[cleo] Routed heavy work through the machine-wide budget: ${governed}. cleo run passes the command its stdin, stdout, stderr and exit code; exit 75 means it was not admitted before the wait ran out (E_RESOURCE_DEFERRED on stderr lists holders and ways forward).`
+    );
+  } else if (plan.action === "warn") {
+    lines.push(
+      `[cleo] Heavy command not rewritten because ${plan.reason}. Run it governed so it shares the machine-wide budget: ${governed}`
+    );
+  }
+  if (pressure !== null) lines.push(pressure);
+  return lines.join("\n");
+}
+function demote(plan, reason) {
+  return plan.action === "rewrite" ? { action: "warn", reason, segments: plan.segments } : plan;
+}
+function renderHeavyHookAnswer(provider, toolInput, plan, context, timeoutMs) {
+  if (plan.action === "none" && context === "") return "";
+  const rewrite = plan.action === "rewrite";
+  if (provider === "opencode") {
+    const answer = {
+      ...rewrite ? { command: plan.command } : {},
+      ...rewrite && timeoutMs !== void 0 ? { timeout: timeoutMs } : {},
+      ...context === "" ? {} : { context }
+    };
+    return `${JSON.stringify(answer)}
+`;
+  }
+  if (provider === "kimi") {
+    if (!rewrite) return `${context}
+`;
+    const deny = {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: context
+      }
+    };
+    return `${JSON.stringify(deny)}
+`;
+  }
+  const updatedInput = rewrite ? {
+    ...toolInput,
+    command: plan.command,
+    ...provider === "claude-code" && timeoutMs !== void 0 ? { timeout: timeoutMs } : {}
+  } : void 0;
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      ...rewrite && provider === "codex" ? { permissionDecision: "allow" } : {},
+      ...updatedInput === void 0 ? {} : { updatedInput },
+      ...context === "" ? {} : { additionalContext: context }
+    }
+  };
+  return `${JSON.stringify(output)}
+`;
+}
+function wordBase(word) {
+  return word.split("/").pop() ?? word;
+}
+function heavyRuleWords(argv) {
+  const out = [];
+  for (const w of argv) {
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || w.startsWith("-") || /^\d+$/.test(w)) continue;
+    out.push(wordBase(w));
+    if (out.length === 4) break;
+  }
+  return out;
+}
+function ruleWords(pattern) {
+  return pattern.split(/[\s:*()]+/).filter((w) => w !== "" && !w.startsWith("-")).map(wordBase);
+}
+function claudeRuleFiles(projectDir, env) {
+  const managed = process.platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : process.platform === "win32" ? "C:\\Program Files\\ClaudeCode\\managed-settings.json" : "/etc/claude-code/managed-settings.json";
+  const configDir = env.CLAUDE_CONFIG_DIR || join(env.HOME || homedir(), ".claude");
+  return [
+    managed,
+    join(configDir, "settings.json"),
+    join(projectDir, ".claude", "settings.json"),
+    join(projectDir, ".claude", "settings.local.json")
+  ];
+}
+function claudeGuardedBashRules(files) {
+  const patterns = [];
+  let unreadable = null;
+  for (const file of files) {
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(file, "utf-8"));
+    } catch (err) {
+      const code = err.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") unreadable ??= file;
+      continue;
+    }
+    const permissions = isRecord(raw) ? raw.permissions : void 0;
+    if (!isRecord(permissions)) continue;
+    for (const key of ["deny", "ask"]) {
+      const rules = permissions[key];
+      if (!Array.isArray(rules)) continue;
+      for (const rule of rules) {
+        if (typeof rule !== "string") continue;
+        const trimmed = rule.trim();
+        if (trimmed === "Bash") {
+          patterns.push("*");
+          continue;
+        }
+        const match = /^Bash\((.*)\)$/s.exec(trimmed);
+        if (match?.[1] !== void 0) patterns.push(match[1]);
+      }
+    }
+  }
+  return { patterns, unreadable };
+}
+function codexGuardedWords(projectDir, env) {
+  const home = env.CODEX_HOME || join(env.HOME || homedir(), ".codex");
+  const out = [];
+  for (const dir of [join(home, "rules"), join(projectDir, ".codex", "rules")]) {
+    let names;
+    try {
+      names = readdirSync(dir).filter((n) => n.endsWith(".rules"));
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      let text;
+      try {
+        text = readFileSync(join(dir, name), "utf-8");
+      } catch {
+        continue;
+      }
+      if (!/decision\s*=\s*["'](forbidden|prompt)["']/.test(text)) continue;
+      for (const m of text.matchAll(/"([^"\\]*)"|'([^'\\]*)'/g)) {
+        for (const w of ruleWords(m[1] ?? m[2] ?? "")) out.push(w);
+      }
+    }
+  }
+  return out;
+}
+function guardedHeavyCommand(provider, segments, projectDir, env, files = claudeRuleFiles(projectDir, env)) {
+  let rules;
+  if (provider === "claude-code") {
+    const found = claudeGuardedBashRules(files);
+    if (found.unreadable !== null) return { kind: "unreadable", file: found.unreadable };
+    rules = found.patterns.map(ruleWords);
+    if (rules.some((words) => words.length === 0)) return { kind: "all" };
+  } else if (provider === "codex") {
+    const words = codexGuardedWords(projectDir, env);
+    rules = words.length === 0 ? [] : [words];
+  } else {
+    return null;
+  }
+  for (const segment of segments) {
+    const words = heavyRuleWords(segment.argv);
+    const first = words[0];
+    if (first === void 0) continue;
+    for (const rule of rules) {
+      if (provider === "codex") {
+        const hit = words.slice(0, 3).find((w) => rule.includes(w));
+        if (hit !== void 0) return { kind: "word", word: hit };
+        continue;
+      }
+      const lead = rule[0];
+      if (lead !== void 0 && words.includes(lead)) return { kind: "word", word: lead };
+      if (rule.includes(first)) return { kind: "word", word: first };
+    }
+  }
+  return null;
+}
+function providerProjectDir(provider, env) {
+  return provider === "claude-code" ? env.CLAUDE_PROJECT_DIR || void 0 : void 0;
+}
+async function heavyCommandHook(provider, stdin, io) {
+  const envMode = io.env.CLEO_HEAVY_COMMAND_HOOK?.trim().toLowerCase();
+  if (envMode === "off") return "";
+  const input = parseHookInput(stdin);
+  if (input?.tool_input === void 0) return "";
+  const core = await import("@cleocode/core/resources/heavy-command.js");
+  const cwd = input.cwd ?? io.cwd;
+  const budget = heavyHookWaitBudget(provider, input.tool_input, io.env);
+  let plan = core.planHeavyCommand(input.tool_input.command, {
+    cwd,
+    ...budget.waitTimeoutSec === void 0 ? {} : { waitTimeoutSec: budget.waitTimeoutSec }
+  });
+  if (plan.action === "none") return "";
+  const projectRoot = providerProjectDir(provider, io.env) ?? core.heavyHookProjectRoot(cwd);
+  const mode = core.resolveHeavyHookMode(
+    envMode,
+    core.isHeavyCommandHookMode(envMode) ? void 0 : await core.configuredHeavyHookMode(projectRoot)
+  );
+  if (mode === "off") return "";
+  if (mode === "warn") {
+    plan = demote(
+      plan,
+      "the hook is in warn mode (CLEO_HEAVY_COMMAND_HOOK or resources.heavyCommandHook)"
+    );
+  }
+  if (!core.executableOnPath("cleo", io.env.PATH)) plan = demote(plan, "`cleo` is not on PATH");
+  if (provider !== "kimi" && !REWRITE_MODES.has(input.permission_mode ?? "")) {
+    plan = demote(
+      plan,
+      `rewriting it would change which permission rules match it, so the hook rewrites only in bypassPermissions or auto mode (this session: ${input.permission_mode ?? "unknown"})`
+    );
+  }
+  if (plan.action === "rewrite") {
+    const hit = guardedHeavyCommand(provider, plan.segments, projectRoot, io.env);
+    const where = provider === "codex" ? "Codex rules" : "Claude Code settings";
+    if (hit?.kind === "word") {
+      plan = demote(
+        plan,
+        `a deny or ask rule in your ${where} names \`${hit.word}\`, and a rewrite would hide the command from it`
+      );
+    } else if (hit?.kind === "all") {
+      plan = demote(
+        plan,
+        `a deny or ask rule in your ${where} covers every Bash command, and a rewrite would hide the command from it`
+      );
+    } else if (hit?.kind === "unreadable") {
+      plan = demote(
+        plan,
+        `${hit.file} could not be read or parsed, so the hook cannot tell whether a deny or ask rule names the command`
+      );
+    }
+  }
+  const context = heavyHookContext(plan, await core.heavyPressureNotice(), provider);
+  return renderHeavyHookAnswer(provider, input.tool_input, plan, context, budget.timeoutMs);
+}
+var USAGE = "usage: cleo hook heavy-command [--provider claude-code|codex|kimi|opencode] < hook-input.json\n";
+async function runHookCli(argv, io = processHookIo()) {
+  const [name, ...rest] = argv;
+  if (name !== "heavy-command") {
+    io.writeStderr(USAGE);
+    return 1;
+  }
+  const flag = rest.findIndex((a) => a === "--provider" || a.startsWith("--provider="));
+  const value = flag === -1 ? "claude-code" : rest[flag]?.split("=")[1] ?? rest[flag + 1];
+  const provider = HEAVY_HOOK_PROVIDERS.find((p) => p === value);
+  if (provider === void 0) {
+    io.writeStderr(USAGE);
+    return 1;
+  }
+  try {
+    const answer = await heavyCommandHook(provider, await io.readStdin(), io);
+    if (answer !== "") io.writeStdout(answer);
+  } catch (err) {
+    io.writeStderr(
+      `[cleo hook] heavy-command skipped: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+  return 0;
+}
+export {
+  HEAVY_HOOK_PROVIDERS,
+  claudeGuardedBashRules,
+  claudeRuleFiles,
+  codexGuardedWords,
+  guardedHeavyCommand,
+  heavyCommandHook,
+  heavyHookContext,
+  heavyHookWaitBudget,
+  heavyRuleWords,
+  parseHookInput,
+  processHookIo,
+  renderHeavyHookAnswer,
+  runHookCli
+};
+//# sourceMappingURL=hook-entry.js.map