@code-yeongyu/senpi 2026.6.28-4 → 2026.6.30

package/dist/core/extensions/builtin/hooks/trust-storage.js

@@ -0,0 +1,102 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import lockfile from "proper-lockfile";
+import { CONFIG_DIR_NAME, getAgentDir } from "../../../../config.js";
+import { emptyHookTrustState, readHookTrustStateJson } from "./trust.js";
+export class FileHookStateStorage {
+    constructor(options) {
+        const agentDir = options.agentDir ?? getAgentDir();
+        this.globalStatePath = join(agentDir, "hooks-state.json");
+        this.projectStatePath = join(options.cwd, CONFIG_DIR_NAME, "hooks-state.json");
+    }
+    read(scope) {
+        return withHookStateFileLock(statePathForScope(scope, this.globalStatePath, this.projectStatePath), (path) => readHookTrustStateJson(existsSync(path) ? readFileSync(path, "utf-8") : undefined));
+    }
+    update(scope, updater) {
+        return withHookStateFileLock(statePathForScope(scope, this.globalStatePath, this.projectStatePath), (path) => {
+            const current = readHookTrustStateJson(existsSync(path) ? readFileSync(path, "utf-8") : undefined);
+            const next = updater(current);
+            writeFileSync(path, serializeHookTrustState(next), "utf-8");
+            return next;
+        });
+    }
+}
+export class InMemoryHookStateStorage {
+    constructor() {
+        this.globalState = emptyHookTrustState();
+        this.projectState = emptyHookTrustState();
+    }
+    read(scope) {
+        return scope === "global" ? this.globalState : this.projectState;
+    }
+    update(scope, updater) {
+        const next = updater(this.read(scope));
+        if (scope === "global") {
+            this.globalState = next;
+        }
+        else {
+            this.projectState = next;
+        }
+        return next;
+    }
+}
+function statePathForScope(scope, globalStatePath, projectStatePath) {
+    return scope === "global" ? globalStatePath : projectStatePath;
+}
+function serializeHookTrustState(state) {
+    const sortedHooks = {};
+    for (const key of Object.keys(state.hooks).sort()) {
+        const entry = state.hooks[key];
+        if (entry !== undefined) {
+            sortedHooks[key] = entry;
+        }
+    }
+    return `${JSON.stringify({ version: 1, hooks: sortedHooks }, null, 2)}\n`;
+}
+function acquireHookStateLockSync(path) {
+    const stateDir = dirname(path);
+    mkdirSync(stateDir, { recursive: true });
+    const maxAttempts = 10;
+    const delayMs = 20;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            return lockfile.lockSync(stateDir, { realpath: false, lockfilePath: `${path}.lock` });
+        }
+        catch (error) {
+            const code = errorCode(error);
+            if (code !== "ELOCKED" || attempt === maxAttempts) {
+                throw error;
+            }
+            lastError = error;
+            const start = Date.now();
+            while (Date.now() - start < delayMs) {
+                Date.now();
+            }
+        }
+    }
+    if (lastError instanceof Error) {
+        throw lastError;
+    }
+    throw new Error("Failed to acquire hook state lock");
+}
+function errorCode(error) {
+    if (!isRecord(error)) {
+        return undefined;
+    }
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withHookStateFileLock(path, fn) {
+    const release = acquireHookStateLockSync(path);
+    try {
+        return fn(path);
+    }
+    finally {
+        release();
+    }
+}
+//# sourceMappingURL=trust-storage.js.map

package/dist/core/extensions/builtin/hooks/trust-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-storage.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/hooks/trust-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA8B,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAarG,MAAM,OAAO,oBAAoB;IAIhC,YAAY,OAAoC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,KAA4B;QAChC,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAC5G,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAClF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAA4B,EAAE,OAAoD;QACxF,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5G,MAAM,OAAO,GAAG,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,MAAM,OAAO,wBAAwB;IAArC;QACS,gBAAW,GAAmB,mBAAmB,EAAE,CAAC;QACpD,iBAAY,GAAmB,mBAAmB,EAAE,CAAC;IAe9D,CAAC;IAbA,IAAI,CAAC,KAA4B;QAChC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,KAA4B,EAAE,OAAoD;QACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAED,SAAS,iBAAiB,CAAC,KAA4B,EAAE,eAAuB,EAAE,gBAAwB;IACzG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAqB;IACrD,MAAM,WAAW,GAAmC,EAAE,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC;YACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBACnD,MAAM,KAAK,CAAC;YACb,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,SAAS,YAAY,KAAK,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAI,IAAY,EAAE,EAAuB;IACtE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { CONFIG_DIR_NAME, getAgentDir } from \"../../../../config.ts\";\nimport { emptyHookTrustState, type HookTrustStorageScope, readHookTrustStateJson } from \"./trust.ts\";\nimport type { HookTrustEntry, HookTrustState } from \"./types.ts\";\n\nexport interface HookStateStorage {\n\tread(scope: HookTrustStorageScope): HookTrustState;\n\tupdate(scope: HookTrustStorageScope, updater: (current: HookTrustState) => HookTrustState): HookTrustState;\n}\n\nexport type FileHookStateStorageOptions = {\n\treadonly agentDir?: string;\n\treadonly cwd: string;\n};\n\nexport class FileHookStateStorage implements HookStateStorage {\n\tprivate readonly globalStatePath: string;\n\tprivate readonly projectStatePath: string;\n\n\tconstructor(options: FileHookStateStorageOptions) {\n\t\tconst agentDir = options.agentDir ?? getAgentDir();\n\t\tthis.globalStatePath = join(agentDir, \"hooks-state.json\");\n\t\tthis.projectStatePath = join(options.cwd, CONFIG_DIR_NAME, \"hooks-state.json\");\n\t}\n\n\tread(scope: HookTrustStorageScope): HookTrustState {\n\t\treturn withHookStateFileLock(statePathForScope(scope, this.globalStatePath, this.projectStatePath), (path) =>\n\t\t\treadHookTrustStateJson(existsSync(path) ? readFileSync(path, \"utf-8\") : undefined),\n\t\t);\n\t}\n\n\tupdate(scope: HookTrustStorageScope, updater: (current: HookTrustState) => HookTrustState): HookTrustState {\n\t\treturn withHookStateFileLock(statePathForScope(scope, this.globalStatePath, this.projectStatePath), (path) => {\n\t\t\tconst current = readHookTrustStateJson(existsSync(path) ? readFileSync(path, \"utf-8\") : undefined);\n\t\t\tconst next = updater(current);\n\t\t\twriteFileSync(path, serializeHookTrustState(next), \"utf-8\");\n\t\t\treturn next;\n\t\t});\n\t}\n}\n\nexport class InMemoryHookStateStorage implements HookStateStorage {\n\tprivate globalState: HookTrustState = emptyHookTrustState();\n\tprivate projectState: HookTrustState = emptyHookTrustState();\n\n\tread(scope: HookTrustStorageScope): HookTrustState {\n\t\treturn scope === \"global\" ? this.globalState : this.projectState;\n\t}\n\n\tupdate(scope: HookTrustStorageScope, updater: (current: HookTrustState) => HookTrustState): HookTrustState {\n\t\tconst next = updater(this.read(scope));\n\t\tif (scope === \"global\") {\n\t\t\tthis.globalState = next;\n\t\t} else {\n\t\t\tthis.projectState = next;\n\t\t}\n\t\treturn next;\n\t}\n}\n\nfunction statePathForScope(scope: HookTrustStorageScope, globalStatePath: string, projectStatePath: string): string {\n\treturn scope === \"global\" ? globalStatePath : projectStatePath;\n}\n\nfunction serializeHookTrustState(state: HookTrustState): string {\n\tconst sortedHooks: Record<string, HookTrustEntry> = {};\n\tfor (const key of Object.keys(state.hooks).sort()) {\n\t\tconst entry = state.hooks[key];\n\t\tif (entry !== undefined) {\n\t\t\tsortedHooks[key] = entry;\n\t\t}\n\t}\n\treturn `${JSON.stringify({ version: 1, hooks: sortedHooks }, null, 2)}\\n`;\n}\n\nfunction acquireHookStateLockSync(path: string): () => void {\n\tconst stateDir = dirname(path);\n\tmkdirSync(stateDir, { recursive: true });\n\tconst maxAttempts = 10;\n\tconst delayMs = 20;\n\tlet lastError: unknown;\n\n\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\ttry {\n\t\t\treturn lockfile.lockSync(stateDir, { realpath: false, lockfilePath: `${path}.lock` });\n\t\t} catch (error) {\n\t\t\tconst code = errorCode(error);\n\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastError = error;\n\t\t\tconst start = Date.now();\n\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\tDate.now();\n\t\t\t}\n\t\t}\n\t}\n\n\tif (lastError instanceof Error) {\n\t\tthrow lastError;\n\t}\n\tthrow new Error(\"Failed to acquire hook state lock\");\n}\n\nfunction errorCode(error: unknown): string | undefined {\n\tif (!isRecord(error)) {\n\t\treturn undefined;\n\t}\n\tconst code = error.code;\n\treturn typeof code === \"string\" ? code : undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction withHookStateFileLock<T>(path: string, fn: (path: string) => T): T {\n\tconst release = acquireHookStateLockSync(path);\n\ttry {\n\t\treturn fn(path);\n\t} finally {\n\t\trelease();\n\t}\n}\n"]}

package/dist/core/extensions/builtin/hooks/trust.d.ts

@@ -0,0 +1,34 @@
+import type { ExecutableHookHandler, HookSourceScope, HookTrustEntry, HookTrustState } from "./types.ts";
+export type HookTrustPlatform = NodeJS.Platform;
+export type HookTrustStorageScope = "global" | "project";
+export type HookTrustOptions = {
+    readonly platform?: HookTrustPlatform;
+};
+export type HookTrustStorageOptions = {
+    readonly projectTrusted: boolean;
+};
+export type HookTrustRecord = {
+    readonly id: string;
+    readonly currentHash: string;
+    readonly enabled: boolean;
+    readonly trusted: boolean;
+    readonly executable: boolean;
+    readonly scope: HookSourceScope;
+    readonly sourcePath: string;
+    readonly matcher?: string;
+    readonly commandPreview: string;
+    readonly entry?: HookTrustEntry;
+};
+export declare function emptyHookTrustState(): HookTrustState;
+export declare function hookTrustId(handler: ExecutableHookHandler): string;
+export declare function buildHookTrustRecord(handler: ExecutableHookHandler, options?: HookTrustOptions): HookTrustRecord;
+export declare function createHookTrustEntry(handler: ExecutableHookHandler, options?: HookTrustOptions & {
+    readonly updatedAt?: string;
+}): HookTrustEntry;
+export declare function hashCommandHook(handler: ExecutableHookHandler, options?: HookTrustOptions): string;
+export declare function isCommandHookTrusted(handler: ExecutableHookHandler, state: HookTrustState, options?: HookTrustOptions): boolean;
+export declare function listHookTrustRecords(handlers: readonly ExecutableHookHandler[], state: HookTrustState, options?: HookTrustOptions): readonly HookTrustRecord[];
+export declare function filterExecutableTrustedHooks(handlers: readonly ExecutableHookHandler[], state: HookTrustState, options?: HookTrustOptions): readonly ExecutableHookHandler[];
+export declare function readHookTrustStateJson(input: string | undefined): HookTrustState;
+export declare function hookTrustStorageScope(handler: ExecutableHookHandler, options: HookTrustStorageOptions): HookTrustStorageScope | undefined;
+//# sourceMappingURL=trust.d.ts.map

package/dist/core/extensions/builtin/hooks/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/hooks/trust.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,qBAAqB,EAErB,eAAe,EACf,cAAc,EACd,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC;AAChD,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;CAChC,CAAC;AAYF,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAElE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,gBAAqB,GAAG,eAAe,CAepH;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,cAAc,CAWhB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,GAAE,gBAAqB,GAAG,MAAM,CAkBtG;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,qBAAqB,EAC9B,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,gBAAqB,GAC5B,OAAO,CAGT;AAED,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,EAC1C,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,gBAAqB,GAC5B,SAAS,eAAe,EAAE,CAE5B;AAED,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,SAAS,qBAAqB,EAAE,EAC1C,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,gBAAqB,GAC5B,SAAS,qBAAqB,EAAE,CAElC;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAYhF;AAED,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,uBAAuB,GAC9B,qBAAqB,GAAG,SAAS,CAKnC"}

package/dist/core/extensions/builtin/hooks/trust.js

@@ -0,0 +1,194 @@
+import { createHash } from "node:crypto";
+import { DEFAULT_HOOK_TIMEOUT_SECONDS, isValidHookTimeoutSeconds } from "./safety.js";
+const HOOK_STATE_VERSION = 1;
+export function emptyHookTrustState() {
+    return { version: HOOK_STATE_VERSION, hooks: {} };
+}
+export function hookTrustId(handler) {
+    return `hk_${sourceKeyHash(handler.source)}_${handler.event}_${handler.groupIndex}_${handler.handlerIndex}`;
+}
+export function buildHookTrustRecord(handler, options = {}) {
+    const id = hookTrustId(handler);
+    const currentHash = hashCommandHook(handler, options);
+    const commandPreview = selectedCommand(handler, options.platform ?? process.platform);
+    return {
+        id,
+        currentHash,
+        enabled: true,
+        trusted: false,
+        executable: false,
+        scope: handler.source.scope,
+        sourcePath: handler.source.sourcePath,
+        ...(handler.matcher === undefined ? {} : { matcher: handler.matcher }),
+        commandPreview,
+    };
+}
+export function createHookTrustEntry(handler, options = {}) {
+    const commandPreview = selectedCommand(handler, options.platform ?? process.platform);
+    return {
+        enabled: true,
+        trustedHash: hashCommandHook(handler, options),
+        scope: handler.source.scope,
+        sourcePath: handler.source.sourcePath,
+        ...(handler.matcher === undefined ? {} : { matcher: handler.matcher }),
+        commandPreview,
+        updatedAt: options.updatedAt ?? new Date().toISOString(),
+    };
+}
+export function hashCommandHook(handler, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const hook = {
+        async: false,
+        command: handler.config.command,
+        commandWindows: handler.config.commandWindows,
+        platformCommand: selectedCommand(handler, platform),
+        statusMessage: handler.config.statusMessage,
+        timeout: normalizedTimeout(handler.config.timeout),
+        type: "command",
+    };
+    const identity = {
+        event: handler.event,
+        hook,
+        matcher: handler.matcher,
+        sourceKeyHash: sourceKeyHash(handler.source),
+    };
+    return `sha256:${sha256Hex(JSON.stringify(canonicalJson(identity)))}`;
+}
+export function isCommandHookTrusted(handler, state, options = {}) {
+    const record = buildStatefulHookTrustRecord(handler, state, options);
+    return record.executable;
+}
+export function listHookTrustRecords(handlers, state, options = {}) {
+    return handlers.map((handler) => buildStatefulHookTrustRecord(handler, state, options));
+}
+export function filterExecutableTrustedHooks(handlers, state, options = {}) {
+    return handlers.filter((handler) => buildStatefulHookTrustRecord(handler, state, options).executable);
+}
+export function readHookTrustStateJson(input) {
+    if (input === undefined || input.trim() === "") {
+        return emptyHookTrustState();
+    }
+    try {
+        return parseHookTrustState(JSON.parse(input));
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return emptyHookTrustState();
+        }
+        return emptyHookTrustState();
+    }
+}
+export function hookTrustStorageScope(handler, options) {
+    if (handler.source.scope === "project") {
+        return options.projectTrusted ? "project" : undefined;
+    }
+    return "global";
+}
+function buildStatefulHookTrustRecord(handler, state, options) {
+    const base = buildHookTrustRecord(handler, options);
+    const entry = state.hooks[base.id];
+    const enabled = entry?.enabled ?? true;
+    const trusted = entry?.trustedHash === base.currentHash;
+    return {
+        ...base,
+        enabled,
+        trusted,
+        executable: enabled && trusted,
+        ...(entry === undefined ? {} : { entry }),
+    };
+}
+function parseHookTrustState(input) {
+    if (!isRecord(input) || input.version !== HOOK_STATE_VERSION || !isRecord(input.hooks)) {
+        return emptyHookTrustState();
+    }
+    const hooks = {};
+    for (const [id, entry] of Object.entries(input.hooks)) {
+        const parsed = parseHookTrustEntry(entry);
+        if (parsed !== undefined) {
+            hooks[id] = parsed;
+        }
+    }
+    return { version: HOOK_STATE_VERSION, hooks };
+}
+function parseHookTrustEntry(input) {
+    if (!isRecord(input)) {
+        return undefined;
+    }
+    const enabled = input.enabled;
+    const trustedHash = input.trustedHash;
+    const scope = input.scope;
+    const sourcePath = input.sourcePath;
+    const matcher = input.matcher;
+    const commandPreview = input.commandPreview;
+    const updatedAt = input.updatedAt;
+    if (typeof enabled !== "boolean" ||
+        (trustedHash !== undefined && typeof trustedHash !== "string") ||
+        !isHookSourceScope(scope) ||
+        typeof sourcePath !== "string" ||
+        (matcher !== undefined && typeof matcher !== "string") ||
+        typeof commandPreview !== "string" ||
+        typeof updatedAt !== "string") {
+        return undefined;
+    }
+    return {
+        enabled,
+        ...(trustedHash === undefined ? {} : { trustedHash }),
+        scope,
+        sourcePath,
+        ...(matcher === undefined ? {} : { matcher }),
+        commandPreview,
+        updatedAt,
+    };
+}
+function selectedCommand(handler, platform) {
+    if (platform === "win32" && handler.config.commandWindows !== undefined) {
+        return handler.config.commandWindows;
+    }
+    return handler.config.command;
+}
+function normalizedTimeout(timeout) {
+    if (timeout === undefined) {
+        return DEFAULT_HOOK_TIMEOUT_SECONDS;
+    }
+    if (!isValidHookTimeoutSeconds(timeout)) {
+        throw new Error("Invalid command hook timeout reached trust hashing.");
+    }
+    return timeout;
+}
+function sourceKeyHash(source) {
+    return sha256Hex([source.scope, source.sourcePath, source.pluginRoot ?? "", source.manifestPath ?? ""].join("\0")).slice(0, 12);
+}
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function canonicalJson(value) {
+    if (Array.isArray(value)) {
+        return value.map(canonicalJson);
+    }
+    if (!isJsonRecord(value)) {
+        return value;
+    }
+    const result = {};
+    for (const key of Object.keys(value).sort()) {
+        const child = value[key];
+        if (child !== undefined) {
+            result[key] = canonicalJson(child);
+        }
+    }
+    return result;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isJsonRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isHookSourceScope(value) {
+    return (value === "global" ||
+        value === "project" ||
+        value === "plugin" ||
+        value === "runtime" ||
+        value === "cli" ||
+        value === "managed");
+}
+//# sourceMappingURL=trust.js.map

package/dist/core/extensions/builtin/hooks/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/hooks/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAyCtF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,MAAM,UAAU,mBAAmB;IAClC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA8B;IACzD,OAAO,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA8B,EAAE,OAAO,GAAqB,EAAE;IAClG,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtF,OAAO;QACN,EAAE;QACF,WAAW;QACX,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;QAC3B,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACrC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,cAAc;KACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAA8B,EAC9B,OAAO,GAAuD,EAAE;IAEhE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtF,OAAO;QACN,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9C,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;QAC3B,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACrC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA8B,EAAE,OAAO,GAAqB,EAAE;IAC7F,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,IAAI,GAA6C;QACtD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;QAC/B,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;QAC7C,eAAe,EAAE,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnD,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;QAC3C,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAClD,IAAI,EAAE,SAAS;KACf,CAAC;IACF,MAAM,QAAQ,GAA6C;QAC1D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5C,CAAC;IACF,OAAO,UAAU,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAA8B,EAC9B,KAAqB,EACrB,OAAO,GAAqB,EAAE;IAE9B,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,QAA0C,EAC1C,KAAqB,EACrB,OAAO,GAAqB,EAAE;IAE9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,QAA0C,EAC1C,KAAqB,EACrB,OAAO,GAAqB,EAAE;IAE9B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC5B,OAAO,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO,mBAAmB,EAAE,CAAC;IAC9B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,OAA8B,EAC9B,OAAgC;IAEhC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,4BAA4B,CACpC,OAA8B,EAC9B,KAAqB,EACrB,OAAyB;IAEzB,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;IACxD,OAAO;QACN,GAAG,IAAI;QACP,OAAO;QACP,OAAO;QACP,UAAU,EAAE,OAAO,IAAI,OAAO;QAC9B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KACzC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,OAAO,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACC,OAAO,OAAO,KAAK,SAAS;QAC5B,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,CAAC;QAC9D,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACzB,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC;QACtD,OAAO,cAAc,KAAK,QAAQ;QAClC,OAAO,SAAS,KAAK,QAAQ,EAC5B,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,OAAO;QACP,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,KAAK;QACL,UAAU;QACV,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,cAAc;QACd,SAAS;KACT,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAA8B,EAAE,QAA2B;IACnF,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA2B;IACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,4BAA4B,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAChD,OAAO,SAAS,CACf,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,CACN,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,KAAK,KAAK,SAAS,CACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { DEFAULT_HOOK_TIMEOUT_SECONDS, isValidHookTimeoutSeconds } from \"./safety.ts\";\nimport type {\n\tExecutableHookHandler,\n\tHookSourceMetadata,\n\tHookSourceScope,\n\tHookTrustEntry,\n\tHookTrustState,\n} from \"./types.ts\";\n\nexport type HookTrustPlatform = NodeJS.Platform;\nexport type HookTrustStorageScope = \"global\" | \"project\";\n\nexport type HookTrustOptions = {\n\treadonly platform?: HookTrustPlatform;\n};\n\nexport type HookTrustStorageOptions = {\n\treadonly projectTrusted: boolean;\n};\n\nexport type HookTrustRecord = {\n\treadonly id: string;\n\treadonly currentHash: string;\n\treadonly enabled: boolean;\n\treadonly trusted: boolean;\n\treadonly executable: boolean;\n\treadonly scope: HookSourceScope;\n\treadonly sourcePath: string;\n\treadonly matcher?: string;\n\treadonly commandPreview: string;\n\treadonly entry?: HookTrustEntry;\n};\n\ntype JsonValue =\n\t| null\n\t| boolean\n\t| number\n\t| string\n\t| readonly JsonValue[]\n\t| { readonly [key: string]: JsonValue | undefined };\n\nconst HOOK_STATE_VERSION = 1;\n\nexport function emptyHookTrustState(): HookTrustState {\n\treturn { version: HOOK_STATE_VERSION, hooks: {} };\n}\n\nexport function hookTrustId(handler: ExecutableHookHandler): string {\n\treturn `hk_${sourceKeyHash(handler.source)}_${handler.event}_${handler.groupIndex}_${handler.handlerIndex}`;\n}\n\nexport function buildHookTrustRecord(handler: ExecutableHookHandler, options: HookTrustOptions = {}): HookTrustRecord {\n\tconst id = hookTrustId(handler);\n\tconst currentHash = hashCommandHook(handler, options);\n\tconst commandPreview = selectedCommand(handler, options.platform ?? process.platform);\n\treturn {\n\t\tid,\n\t\tcurrentHash,\n\t\tenabled: true,\n\t\ttrusted: false,\n\t\texecutable: false,\n\t\tscope: handler.source.scope,\n\t\tsourcePath: handler.source.sourcePath,\n\t\t...(handler.matcher === undefined ? {} : { matcher: handler.matcher }),\n\t\tcommandPreview,\n\t};\n}\n\nexport function createHookTrustEntry(\n\thandler: ExecutableHookHandler,\n\toptions: HookTrustOptions & { readonly updatedAt?: string } = {},\n): HookTrustEntry {\n\tconst commandPreview = selectedCommand(handler, options.platform ?? process.platform);\n\treturn {\n\t\tenabled: true,\n\t\ttrustedHash: hashCommandHook(handler, options),\n\t\tscope: handler.source.scope,\n\t\tsourcePath: handler.source.sourcePath,\n\t\t...(handler.matcher === undefined ? {} : { matcher: handler.matcher }),\n\t\tcommandPreview,\n\t\tupdatedAt: options.updatedAt ?? new Date().toISOString(),\n\t};\n}\n\nexport function hashCommandHook(handler: ExecutableHookHandler, options: HookTrustOptions = {}): string {\n\tconst platform = options.platform ?? process.platform;\n\tconst hook: { [key: string]: JsonValue | undefined } = {\n\t\tasync: false,\n\t\tcommand: handler.config.command,\n\t\tcommandWindows: handler.config.commandWindows,\n\t\tplatformCommand: selectedCommand(handler, platform),\n\t\tstatusMessage: handler.config.statusMessage,\n\t\ttimeout: normalizedTimeout(handler.config.timeout),\n\t\ttype: \"command\",\n\t};\n\tconst identity: { [key: string]: JsonValue | undefined } = {\n\t\tevent: handler.event,\n\t\thook,\n\t\tmatcher: handler.matcher,\n\t\tsourceKeyHash: sourceKeyHash(handler.source),\n\t};\n\treturn `sha256:${sha256Hex(JSON.stringify(canonicalJson(identity)))}`;\n}\n\nexport function isCommandHookTrusted(\n\thandler: ExecutableHookHandler,\n\tstate: HookTrustState,\n\toptions: HookTrustOptions = {},\n): boolean {\n\tconst record = buildStatefulHookTrustRecord(handler, state, options);\n\treturn record.executable;\n}\n\nexport function listHookTrustRecords(\n\thandlers: readonly ExecutableHookHandler[],\n\tstate: HookTrustState,\n\toptions: HookTrustOptions = {},\n): readonly HookTrustRecord[] {\n\treturn handlers.map((handler) => buildStatefulHookTrustRecord(handler, state, options));\n}\n\nexport function filterExecutableTrustedHooks(\n\thandlers: readonly ExecutableHookHandler[],\n\tstate: HookTrustState,\n\toptions: HookTrustOptions = {},\n): readonly ExecutableHookHandler[] {\n\treturn handlers.filter((handler) => buildStatefulHookTrustRecord(handler, state, options).executable);\n}\n\nexport function readHookTrustStateJson(input: string | undefined): HookTrustState {\n\tif (input === undefined || input.trim() === \"\") {\n\t\treturn emptyHookTrustState();\n\t}\n\ttry {\n\t\treturn parseHookTrustState(JSON.parse(input));\n\t} catch (error) {\n\t\tif (error instanceof Error) {\n\t\t\treturn emptyHookTrustState();\n\t\t}\n\t\treturn emptyHookTrustState();\n\t}\n}\n\nexport function hookTrustStorageScope(\n\thandler: ExecutableHookHandler,\n\toptions: HookTrustStorageOptions,\n): HookTrustStorageScope | undefined {\n\tif (handler.source.scope === \"project\") {\n\t\treturn options.projectTrusted ? \"project\" : undefined;\n\t}\n\treturn \"global\";\n}\n\nfunction buildStatefulHookTrustRecord(\n\thandler: ExecutableHookHandler,\n\tstate: HookTrustState,\n\toptions: HookTrustOptions,\n): HookTrustRecord {\n\tconst base = buildHookTrustRecord(handler, options);\n\tconst entry = state.hooks[base.id];\n\tconst enabled = entry?.enabled ?? true;\n\tconst trusted = entry?.trustedHash === base.currentHash;\n\treturn {\n\t\t...base,\n\t\tenabled,\n\t\ttrusted,\n\t\texecutable: enabled && trusted,\n\t\t...(entry === undefined ? {} : { entry }),\n\t};\n}\n\nfunction parseHookTrustState(input: unknown): HookTrustState {\n\tif (!isRecord(input) || input.version !== HOOK_STATE_VERSION || !isRecord(input.hooks)) {\n\t\treturn emptyHookTrustState();\n\t}\n\n\tconst hooks: Record<string, HookTrustEntry> = {};\n\tfor (const [id, entry] of Object.entries(input.hooks)) {\n\t\tconst parsed = parseHookTrustEntry(entry);\n\t\tif (parsed !== undefined) {\n\t\t\thooks[id] = parsed;\n\t\t}\n\t}\n\treturn { version: HOOK_STATE_VERSION, hooks };\n}\n\nfunction parseHookTrustEntry(input: unknown): HookTrustEntry | undefined {\n\tif (!isRecord(input)) {\n\t\treturn undefined;\n\t}\n\tconst enabled = input.enabled;\n\tconst trustedHash = input.trustedHash;\n\tconst scope = input.scope;\n\tconst sourcePath = input.sourcePath;\n\tconst matcher = input.matcher;\n\tconst commandPreview = input.commandPreview;\n\tconst updatedAt = input.updatedAt;\n\tif (\n\t\ttypeof enabled !== \"boolean\" ||\n\t\t(trustedHash !== undefined && typeof trustedHash !== \"string\") ||\n\t\t!isHookSourceScope(scope) ||\n\t\ttypeof sourcePath !== \"string\" ||\n\t\t(matcher !== undefined && typeof matcher !== \"string\") ||\n\t\ttypeof commandPreview !== \"string\" ||\n\t\ttypeof updatedAt !== \"string\"\n\t) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tenabled,\n\t\t...(trustedHash === undefined ? {} : { trustedHash }),\n\t\tscope,\n\t\tsourcePath,\n\t\t...(matcher === undefined ? {} : { matcher }),\n\t\tcommandPreview,\n\t\tupdatedAt,\n\t};\n}\n\nfunction selectedCommand(handler: ExecutableHookHandler, platform: HookTrustPlatform): string {\n\tif (platform === \"win32\" && handler.config.commandWindows !== undefined) {\n\t\treturn handler.config.commandWindows;\n\t}\n\treturn handler.config.command;\n}\n\nfunction normalizedTimeout(timeout: number | undefined): number {\n\tif (timeout === undefined) {\n\t\treturn DEFAULT_HOOK_TIMEOUT_SECONDS;\n\t}\n\tif (!isValidHookTimeoutSeconds(timeout)) {\n\t\tthrow new Error(\"Invalid command hook timeout reached trust hashing.\");\n\t}\n\treturn timeout;\n}\n\nfunction sourceKeyHash(source: HookSourceMetadata): string {\n\treturn sha256Hex(\n\t\t[source.scope, source.sourcePath, source.pluginRoot ?? \"\", source.manifestPath ?? \"\"].join(\"\\0\"),\n\t).slice(0, 12);\n}\n\nfunction sha256Hex(value: string): string {\n\treturn createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nfunction canonicalJson(value: JsonValue): JsonValue {\n\tif (Array.isArray(value)) {\n\t\treturn value.map(canonicalJson);\n\t}\n\tif (!isJsonRecord(value)) {\n\t\treturn value;\n\t}\n\tconst result: { [key: string]: JsonValue } = {};\n\tfor (const key of Object.keys(value).sort()) {\n\t\tconst child = value[key];\n\t\tif (child !== undefined) {\n\t\t\tresult[key] = canonicalJson(child);\n\t\t}\n\t}\n\treturn result;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isJsonRecord(value: JsonValue): value is { readonly [key: string]: JsonValue | undefined } {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isHookSourceScope(value: unknown): value is HookSourceScope {\n\treturn (\n\t\tvalue === \"global\" ||\n\t\tvalue === \"project\" ||\n\t\tvalue === \"plugin\" ||\n\t\tvalue === \"runtime\" ||\n\t\tvalue === \"cli\" ||\n\t\tvalue === \"managed\"\n\t);\n}\n"]}

package/dist/core/extensions/builtin/hooks/types.d.ts

@@ -0,0 +1,134 @@
+export declare const SUPPORTED_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "UserPromptSubmit", "SessionStart", "PreCompact", "PostCompact", "Stop"];
+export declare const UNSUPPORTED_KNOWN_HOOK_EVENTS: readonly ["PermissionRequest", "PermissionDenied", "SubagentStart", "SubagentStop", "Notification", "Setup", "UserPromptExpansion", "PostToolUseFailure", "PostToolBatch", "TaskCreated", "TaskCompleted", "StopFailure", "TeammateIdle", "InstructionsLoaded", "ConfigChange", "CwdChanged", "FileChanged", "WorktreeCreate", "WorktreeRemove", "MessageDisplay", "SessionEnd", "Elicitation", "ElicitationResult"];
+export declare const UNSUPPORTED_HANDLER_TYPES: readonly ["prompt", "agent", "http", "mcp_tool"];
+export type SupportedHookEvent = (typeof SUPPORTED_HOOK_EVENTS)[number];
+export type UnsupportedKnownHookEvent = (typeof UNSUPPORTED_KNOWN_HOOK_EVENTS)[number];
+export type HookSourceScope = "global" | "project" | "plugin" | "runtime" | "cli" | "managed";
+export type HookDiscoveryTiming = "pre-session" | "runtime";
+export type HookSourceMetadata = {
+    readonly scope: HookSourceScope;
+    readonly sourcePath: string;
+    readonly displayOrder: number;
+    readonly discoveredAt: HookDiscoveryTiming;
+    readonly pluginRoot?: string;
+    readonly manifestPath?: string;
+};
+export type CommandHookConfig = {
+    readonly type: "command";
+    readonly command: string;
+    readonly commandWindows?: string;
+    readonly timeout?: number;
+    readonly statusMessage?: string;
+};
+export type ExecutableHookHandler = {
+    readonly event: SupportedHookEvent;
+    readonly matcher?: string;
+    readonly groupIndex: number;
+    readonly handlerIndex: number;
+    readonly config: CommandHookConfig;
+    readonly source: HookSourceMetadata;
+};
+export type HookDiagnosticCode = "invalid_root" | "invalid_hooks" | "invalid_event_config" | "invalid_matcher" | "invalid_handler_group" | "invalid_handler_list" | "invalid_handler" | "invalid_command" | "invalid_command_windows" | "invalid_command_target" | "missing_command_target" | "invalid_timeout" | "invalid_status_message" | "unknown_event" | "unsupported_event" | "unsupported_field" | "unsupported_handler_type" | "unsupported_async_handler" | "unsupported_command_variant";
+export type HookDiagnostic = {
+    readonly code: HookDiagnosticCode;
+    readonly severity: "error" | "warning";
+    readonly message: string;
+    readonly path: string;
+    readonly source: HookSourceMetadata;
+    readonly event?: string;
+};
+export type ParsedHookConfig = {
+    readonly executableHandlers: readonly ExecutableHookHandler[];
+    readonly diagnostics: readonly HookDiagnostic[];
+};
+export type HookTrustEntry = {
+    readonly enabled: boolean;
+    readonly trustedHash?: string;
+    readonly scope: HookSourceScope;
+    readonly sourcePath: string;
+    readonly matcher?: string;
+    readonly commandPreview: string;
+    readonly updatedAt: string;
+};
+export type HookTrustState = {
+    readonly version: 1;
+    readonly hooks: Readonly<Record<string, HookTrustEntry>>;
+};
+export type HookRuntimeState = {
+    readonly parsed: ParsedHookConfig;
+    readonly trust: HookTrustState;
+};
+export type HookInputWire = {
+    readonly event: "SessionStart";
+    readonly sessionId: string;
+    readonly cwd: string;
+    readonly hook_event_name?: "SessionStart";
+    readonly reason?: string;
+    readonly session_id?: string;
+    readonly transcript_path?: string;
+} | {
+    readonly event: "UserPromptSubmit";
+    readonly prompt: string;
+    readonly cwd: string;
+    readonly session_id?: string;
+    readonly permission_mode?: string;
+    readonly transcript_path?: string;
+} | {
+    readonly event: "PreToolUse";
+    readonly toolName: string;
+    readonly toolInput: unknown;
+    readonly cwd: string;
+    readonly session_id?: string;
+    readonly hook_event_name?: "PreToolUse";
+    readonly tool_name?: string;
+    readonly tool_input?: unknown;
+    readonly tool_use_id?: string;
+} | {
+    readonly event: "PostToolUse";
+    readonly toolName: string;
+    readonly toolInput: unknown;
+    readonly toolOutput: unknown;
+    readonly cwd: string;
+    readonly session_id?: string;
+    readonly hook_event_name?: "PostToolUse";
+    readonly tool_name?: string;
+    readonly tool_input?: unknown;
+    readonly tool_response?: unknown;
+    readonly tool_use_id?: string;
+} | {
+    readonly event: "PreCompact";
+    readonly reason: string;
+    readonly cwd: string;
+    readonly custom_instructions?: string;
+    readonly hook_event_name?: "PreCompact";
+    readonly request_id?: string;
+    readonly session_id?: string;
+    readonly transcript_path?: string;
+    readonly will_retry?: boolean;
+} | {
+    readonly event: "PostCompact";
+    readonly reason: string;
+    readonly cwd: string;
+    readonly accepted?: boolean;
+    readonly hook_event_name?: "PostCompact";
+    readonly request_id?: string;
+    readonly session_id?: string;
+    readonly transcript_path?: string;
+    readonly will_retry?: boolean;
+} | {
+    readonly event: "Stop";
+    readonly stopReason?: string;
+    readonly cwd: string;
+    readonly hook_event_name?: "Stop";
+    readonly session_id?: string;
+    readonly transcript_path?: string;
+};
+export type HookOutputWire = {
+    readonly decision?: "approve" | "block" | "deny" | "ask";
+    readonly reason?: string;
+    readonly additionalContext?: string;
+    readonly updatedInput?: unknown;
+    readonly updatedToolOutput?: unknown;
+    readonly continue?: boolean;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/core/extensions/builtin/hooks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/hooks/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,YACjC,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,MAAM,CACG,CAAC;AAEX,eAAO,MAAM,6BAA6B,YACzC,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,mBAAmB,CACV,CAAC;AAEX,eAAO,MAAM,yBAAyB,YAAI,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACvF,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;AAC9F,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,SAAS,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAAG;IAChC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC3B,cAAc,GACd,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,wBAAwB,GACxB,iBAAiB,GACjB,wBAAwB,GACxB,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,2BAA2B,GAC3B,6BAA6B,CAAC;AAEjC,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,aAAa,GACtB;IACA,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACjC,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACjC,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC7B,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC7B,GACD;IACA,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEL,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC"}

package/dist/core/extensions/builtin/hooks/types.js

@@ -0,0 +1,36 @@
+export const SUPPORTED_HOOK_EVENTS = [
+    "PreToolUse",
+    "PostToolUse",
+    "UserPromptSubmit",
+    "SessionStart",
+    "PreCompact",
+    "PostCompact",
+    "Stop",
+];
+export const UNSUPPORTED_KNOWN_HOOK_EVENTS = [
+    "PermissionRequest",
+    "PermissionDenied",
+    "SubagentStart",
+    "SubagentStop",
+    "Notification",
+    "Setup",
+    "UserPromptExpansion",
+    "PostToolUseFailure",
+    "PostToolBatch",
+    "TaskCreated",
+    "TaskCompleted",
+    "StopFailure",
+    "TeammateIdle",
+    "InstructionsLoaded",
+    "ConfigChange",
+    "CwdChanged",
+    "FileChanged",
+    "WorktreeCreate",
+    "WorktreeRemove",
+    "MessageDisplay",
+    "SessionEnd",
+    "Elicitation",
+    "ElicitationResult",
+];
+export const UNSUPPORTED_HANDLER_TYPES = ["prompt", "agent", "http", "mcp_tool"];
+//# sourceMappingURL=types.js.map

package/dist/core/extensions/builtin/hooks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/hooks/types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,cAAc;IACd,YAAY;IACZ,aAAa;IACb,MAAM;CACG,CAAC;AAEX,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC5C,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,cAAc;IACd,OAAO;IACP,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,eAAe;IACf,aAAa;IACb,cAAc;IACd,oBAAoB;IACpB,cAAc;IACd,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,mBAAmB;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC","sourcesContent":["export const SUPPORTED_HOOK_EVENTS = [\n\t\"PreToolUse\",\n\t\"PostToolUse\",\n\t\"UserPromptSubmit\",\n\t\"SessionStart\",\n\t\"PreCompact\",\n\t\"PostCompact\",\n\t\"Stop\",\n] as const;\n\nexport const UNSUPPORTED_KNOWN_HOOK_EVENTS = [\n\t\"PermissionRequest\",\n\t\"PermissionDenied\",\n\t\"SubagentStart\",\n\t\"SubagentStop\",\n\t\"Notification\",\n\t\"Setup\",\n\t\"UserPromptExpansion\",\n\t\"PostToolUseFailure\",\n\t\"PostToolBatch\",\n\t\"TaskCreated\",\n\t\"TaskCompleted\",\n\t\"StopFailure\",\n\t\"TeammateIdle\",\n\t\"InstructionsLoaded\",\n\t\"ConfigChange\",\n\t\"CwdChanged\",\n\t\"FileChanged\",\n\t\"WorktreeCreate\",\n\t\"WorktreeRemove\",\n\t\"MessageDisplay\",\n\t\"SessionEnd\",\n\t\"Elicitation\",\n\t\"ElicitationResult\",\n] as const;\n\nexport const UNSUPPORTED_HANDLER_TYPES = [\"prompt\", \"agent\", \"http\", \"mcp_tool\"] as const;\n\nexport type SupportedHookEvent = (typeof SUPPORTED_HOOK_EVENTS)[number];\nexport type UnsupportedKnownHookEvent = (typeof UNSUPPORTED_KNOWN_HOOK_EVENTS)[number];\nexport type HookSourceScope = \"global\" | \"project\" | \"plugin\" | \"runtime\" | \"cli\" | \"managed\";\nexport type HookDiscoveryTiming = \"pre-session\" | \"runtime\";\n\nexport type HookSourceMetadata = {\n\treadonly scope: HookSourceScope;\n\treadonly sourcePath: string;\n\treadonly displayOrder: number;\n\treadonly discoveredAt: HookDiscoveryTiming;\n\treadonly pluginRoot?: string;\n\treadonly manifestPath?: string;\n};\n\nexport type CommandHookConfig = {\n\treadonly type: \"command\";\n\treadonly command: string;\n\treadonly commandWindows?: string;\n\treadonly timeout?: number;\n\treadonly statusMessage?: string;\n};\n\nexport type ExecutableHookHandler = {\n\treadonly event: SupportedHookEvent;\n\treadonly matcher?: string;\n\treadonly groupIndex: number;\n\treadonly handlerIndex: number;\n\treadonly config: CommandHookConfig;\n\treadonly source: HookSourceMetadata;\n};\n\nexport type HookDiagnosticCode =\n\t| \"invalid_root\"\n\t| \"invalid_hooks\"\n\t| \"invalid_event_config\"\n\t| \"invalid_matcher\"\n\t| \"invalid_handler_group\"\n\t| \"invalid_handler_list\"\n\t| \"invalid_handler\"\n\t| \"invalid_command\"\n\t| \"invalid_command_windows\"\n\t| \"invalid_command_target\"\n\t| \"missing_command_target\"\n\t| \"invalid_timeout\"\n\t| \"invalid_status_message\"\n\t| \"unknown_event\"\n\t| \"unsupported_event\"\n\t| \"unsupported_field\"\n\t| \"unsupported_handler_type\"\n\t| \"unsupported_async_handler\"\n\t| \"unsupported_command_variant\";\n\nexport type HookDiagnostic = {\n\treadonly code: HookDiagnosticCode;\n\treadonly severity: \"error\" | \"warning\";\n\treadonly message: string;\n\treadonly path: string;\n\treadonly source: HookSourceMetadata;\n\treadonly event?: string;\n};\n\nexport type ParsedHookConfig = {\n\treadonly executableHandlers: readonly ExecutableHookHandler[];\n\treadonly diagnostics: readonly HookDiagnostic[];\n};\n\nexport type HookTrustEntry = {\n\treadonly enabled: boolean;\n\treadonly trustedHash?: string;\n\treadonly scope: HookSourceScope;\n\treadonly sourcePath: string;\n\treadonly matcher?: string;\n\treadonly commandPreview: string;\n\treadonly updatedAt: string;\n};\n\nexport type HookTrustState = {\n\treadonly version: 1;\n\treadonly hooks: Readonly<Record<string, HookTrustEntry>>;\n};\n\nexport type HookRuntimeState = {\n\treadonly parsed: ParsedHookConfig;\n\treadonly trust: HookTrustState;\n};\n\nexport type HookInputWire =\n\t| {\n\t\t\treadonly event: \"SessionStart\";\n\t\t\treadonly sessionId: string;\n\t\t\treadonly cwd: string;\n\t\t\treadonly hook_event_name?: \"SessionStart\";\n\t\t\treadonly reason?: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly transcript_path?: string;\n\t  }\n\t| {\n\t\t\treadonly event: \"UserPromptSubmit\";\n\t\t\treadonly prompt: string;\n\t\t\treadonly cwd: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly permission_mode?: string;\n\t\t\treadonly transcript_path?: string;\n\t  }\n\t| {\n\t\t\treadonly event: \"PreToolUse\";\n\t\t\treadonly toolName: string;\n\t\t\treadonly toolInput: unknown;\n\t\t\treadonly cwd: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly hook_event_name?: \"PreToolUse\";\n\t\t\treadonly tool_name?: string;\n\t\t\treadonly tool_input?: unknown;\n\t\t\treadonly tool_use_id?: string;\n\t  }\n\t| {\n\t\t\treadonly event: \"PostToolUse\";\n\t\t\treadonly toolName: string;\n\t\t\treadonly toolInput: unknown;\n\t\t\treadonly toolOutput: unknown;\n\t\t\treadonly cwd: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly hook_event_name?: \"PostToolUse\";\n\t\t\treadonly tool_name?: string;\n\t\t\treadonly tool_input?: unknown;\n\t\t\treadonly tool_response?: unknown;\n\t\t\treadonly tool_use_id?: string;\n\t  }\n\t| {\n\t\t\treadonly event: \"PreCompact\";\n\t\t\treadonly reason: string;\n\t\t\treadonly cwd: string;\n\t\t\treadonly custom_instructions?: string;\n\t\t\treadonly hook_event_name?: \"PreCompact\";\n\t\t\treadonly request_id?: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly transcript_path?: string;\n\t\t\treadonly will_retry?: boolean;\n\t  }\n\t| {\n\t\t\treadonly event: \"PostCompact\";\n\t\t\treadonly reason: string;\n\t\t\treadonly cwd: string;\n\t\t\treadonly accepted?: boolean;\n\t\t\treadonly hook_event_name?: \"PostCompact\";\n\t\t\treadonly request_id?: string;\n\t\t\treadonly session_id?: string;\n\t\t\treadonly transcript_path?: string;\n\t\t\treadonly will_retry?: boolean;\n\t  }\n\t| {\n\t\t\treadonly event: \"Stop\";\n\t\t\treadonly stopReason?: string;\n\t\t\treadonly cwd: string;\n\t\t\treadonly hook_event_name?: \"Stop\";\n\t\t\treadonly session_id?: string;\n\t\t\treadonly transcript_path?: string;\n\t  };\n\nexport type HookOutputWire = {\n\treadonly decision?: \"approve\" | \"block\" | \"deny\" | \"ask\";\n\treadonly reason?: string;\n\treadonly additionalContext?: string;\n\treadonly updatedInput?: unknown;\n\treadonly updatedToolOutput?: unknown;\n\treadonly continue?: boolean;\n};\n"]}

package/dist/core/extensions/builtin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD,OAAO,aAAa,MAAM,WAAW,CAAC;AACtC,OAAO,cAAc,MAAM,YAAY,CAAC;AASxC,OAAO,wBAAwB,MAAM,wBAAwB,CAAC;AAO9D,OAAO,YAAY,MAAM,UAAU,CAAC;AAIpC,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,gBAAgB,CAAC;CAC1B;AAED,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAU,CAAC;AAEhG,eAAO,MAAM,+BAA+B;;;;;CAKoC,CAAC;AAEjF,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EAqBtD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD,OAAO,aAAa,MAAM,WAAW,CAAC;AACtC,OAAO,cAAc,MAAM,YAAY,CAAC;AAUxC,OAAO,wBAAwB,MAAM,wBAAwB,CAAC;AAO9D,OAAO,YAAY,MAAM,UAAU,CAAC;AAIpC,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,gBAAgB,CAAC;CAC1B;AAED,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAU,CAAC;AAEhG,eAAO,MAAM,+BAA+B;;;;;CAKoC,CAAC;AAEjF,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EAsBtD,CAAC"}

package/dist/core/extensions/builtin/index.js

@@ -7,6 +7,7 @@ import filesExtension from "./files.js";
 import goalExtension from "./goal/index.js";
 import gptApplyPatchExtension from "./gpt-apply-patch/index.js";
 import historySearchExtension from "./history-search/index.js";
+import hooksExtension from "./hooks/index.js";
 import nestedAgentsMdExtension from "./nested-agents-md/index.js";
 import openaiWebSearchExtension from "./openai-web-search/index.js";
 import permissionSystemExtension from "./permission-system/index.js";
@@ -30,6 +31,7 @@ export const globalDefaultExtensionFactories = {
     tps: tpsExtension,
 };
 export const builtinExtensions = [
+    { id: "hooks", factory: hooksExtension },
     { id: "permission-system", factory: permissionSystemExtension },
     { id: "gpt-apply-patch", factory: gptApplyPatchExtension },
     { id: "prompt-preset", factory: promptPresetExtension },