@costrict/csc 4.0.1

package/dist/chunk-ye7fmmc4.js

@@ -0,0 +1,95 @@
+// @bun
+import {
+  BASH_TOOL_NAME,
+  getAllowRules,
+  getAskRules,
+  getDenyRules,
+  init_permissions,
+  init_toolName,
+  permissionRuleSourceDisplayString
+} from "./chunk-97kwfkef.js";
+import {
+  __esm
+} from "./chunk-qp2qdcda.js";
+
+// src/utils/permissions/shadowedRuleDetection.ts
+function isSharedSettingSource(source) {
+  return source === "projectSettings" || source === "policySettings" || source === "command";
+}
+function formatSource(source) {
+  return permissionRuleSourceDisplayString(source);
+}
+function generateFixSuggestion(shadowType, shadowingRule, shadowedRule) {
+  const shadowingSource = formatSource(shadowingRule.source);
+  const shadowedSource = formatSource(shadowedRule.source);
+  const toolName = shadowingRule.ruleValue.toolName;
+  if (shadowType === "deny") {
+    return `Remove the "${toolName}" deny rule from ${shadowingSource}, or remove the specific allow rule from ${shadowedSource}`;
+  }
+  return `Remove the "${toolName}" ask rule from ${shadowingSource}, or remove the specific allow rule from ${shadowedSource}`;
+}
+function isAllowRuleShadowedByAskRule(allowRule, askRules, options) {
+  const { toolName, ruleContent } = allowRule.ruleValue;
+  if (ruleContent === undefined) {
+    return { shadowed: false };
+  }
+  const shadowingAskRule = askRules.find((askRule) => askRule.ruleValue.toolName === toolName && askRule.ruleValue.ruleContent === undefined);
+  if (!shadowingAskRule) {
+    return { shadowed: false };
+  }
+  if (toolName === BASH_TOOL_NAME && options.sandboxAutoAllowEnabled) {
+    if (!isSharedSettingSource(shadowingAskRule.source)) {
+      return { shadowed: false };
+    }
+  }
+  return { shadowed: true, shadowedBy: shadowingAskRule, shadowType: "ask" };
+}
+function isAllowRuleShadowedByDenyRule(allowRule, denyRules) {
+  const { toolName, ruleContent } = allowRule.ruleValue;
+  if (ruleContent === undefined) {
+    return { shadowed: false };
+  }
+  const shadowingDenyRule = denyRules.find((denyRule) => denyRule.ruleValue.toolName === toolName && denyRule.ruleValue.ruleContent === undefined);
+  if (!shadowingDenyRule) {
+    return { shadowed: false };
+  }
+  return { shadowed: true, shadowedBy: shadowingDenyRule, shadowType: "deny" };
+}
+function detectUnreachableRules(context, options) {
+  const unreachable = [];
+  const allowRules = getAllowRules(context);
+  const askRules = getAskRules(context);
+  const denyRules = getDenyRules(context);
+  for (const allowRule of allowRules) {
+    const denyResult = isAllowRuleShadowedByDenyRule(allowRule, denyRules);
+    if (denyResult.shadowed) {
+      const shadowSource = formatSource(denyResult.shadowedBy.source);
+      unreachable.push({
+        rule: allowRule,
+        reason: `Blocked by "${denyResult.shadowedBy.ruleValue.toolName}" deny rule (from ${shadowSource})`,
+        shadowedBy: denyResult.shadowedBy,
+        shadowType: "deny",
+        fix: generateFixSuggestion("deny", denyResult.shadowedBy, allowRule)
+      });
+      continue;
+    }
+    const askResult = isAllowRuleShadowedByAskRule(allowRule, askRules, options);
+    if (askResult.shadowed) {
+      const shadowSource = formatSource(askResult.shadowedBy.source);
+      unreachable.push({
+        rule: allowRule,
+        reason: `Shadowed by "${askResult.shadowedBy.ruleValue.toolName}" ask rule (from ${shadowSource})`,
+        shadowedBy: askResult.shadowedBy,
+        shadowType: "ask",
+        fix: generateFixSuggestion("ask", askResult.shadowedBy, allowRule)
+      });
+    }
+  }
+  return unreachable;
+}
+var init_shadowedRuleDetection = __esm(() => {
+  init_toolName();
+  init_permissions();
+});
+
+export { detectUnreachableRules, init_shadowedRuleDetection };

package/dist/chunk-ygj29dpk.js

@@ -0,0 +1,100 @@
+// @bun
+import {
+  __esm
+} from "./chunk-qp2qdcda.js";
+
+// src/costrict/provider/oauth-params.ts
+import { createRequire } from "module";
+function getVersion() {
+  try {
+    if (typeof MACRO !== "undefined" && "4.0.1")
+      return "4.0.1";
+  } catch {}
+  try {
+    const require2 = createRequire(import.meta.url);
+    const pkg = require2("../../../package.json");
+    return pkg.version;
+  } catch {
+    return "1.0.0";
+  }
+}
+function buildOAuthParams(includeMachineCode, machineId, state) {
+  const params = [];
+  if (includeMachineCode) {
+    if (!machineId)
+      throw new Error("machineId is required when includeMachineCode is true");
+    params.push(["machine_code", machineId]);
+  }
+  if (state) {
+    params.push(["state", state]);
+  }
+  params.push(["provider", "casdoor"], ["plugin_version", COSTRICT_PLUGIN_VERSION], ["vscode_version", COSTRICT_PLUGIN_VERSION], ["uri_scheme", "costrict-cli"]);
+  return params;
+}
+var COSTRICT_PLUGIN_VERSION;
+var init_oauth_params = __esm(() => {
+  COSTRICT_PLUGIN_VERSION = `costrict-cli-${getVersion()}`;
+});
+
+// src/costrict/provider/token.ts
+function parseJWT(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3)
+    throw new Error("Invalid JWT format");
+  const decoded = Buffer.from(parts[1], "base64url").toString("utf-8");
+  return JSON.parse(decoded);
+}
+function extractExpiryFromJWT(token) {
+  try {
+    const payload = parseJWT(token);
+    return payload.exp ? payload.exp * 1000 : 0;
+  } catch {
+    return 0;
+  }
+}
+function isCoStrictTokenValid(credentials) {
+  const now = Date.now();
+  const bufferMs = 30 * 60 * 1000;
+  if (credentials.expiry_date) {
+    return now < credentials.expiry_date - bufferMs;
+  }
+  if (credentials.refresh_token) {
+    try {
+      const payload = parseJWT(credentials.refresh_token);
+      if (payload.exp)
+        return payload.exp * 1000 > now;
+    } catch {}
+  }
+  try {
+    const payload = parseJWT(credentials.access_token);
+    if (payload.exp)
+      return now < payload.exp * 1000 - bufferMs;
+  } catch {}
+  return false;
+}
+async function refreshCoStrictToken(params) {
+  const queryParams = buildOAuthParams(false, undefined, params.state);
+  const queryString = queryParams.map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
+  const url = `${params.baseUrl}/oidc-auth/api/v1/plugin/login/token?${queryString}`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${params.refreshToken}`,
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(response.status === 400 || response.status === 401 ? `Refresh token is invalid or expired (${response.status}): ${body}` : `Token refresh failed with status ${response.status}: ${body}`);
+  }
+  const data = await response.json();
+  if (!data.access_token || !data.refresh_token) {
+    throw new Error("Token refresh response is missing required fields");
+  }
+  return data;
+}
+var init_token = __esm(() => {
+  init_oauth_params();
+});
+
+export { buildOAuthParams, init_oauth_params, parseJWT, extractExpiryFromJWT, isCoStrictTokenValid, refreshCoStrictToken, init_token };

package/dist/chunk-yj2t6a2t.js

@@ -0,0 +1,216 @@
+// @bun
+import"./chunk-z6e5jp2w.js";
+import"./chunk-4g3v8y12.js";
+import"./chunk-7739pg2c.js";
+import"./chunk-qp2qdcda.js";
+
+// src/daemon/main.ts
+import { spawn } from "child_process";
+import { resolve } from "path";
+var EXIT_CODE_PERMANENT = 78;
+var BACKOFF_INITIAL_MS = 2000;
+var BACKOFF_CAP_MS = 120000;
+var BACKOFF_MULTIPLIER = 2;
+var MAX_RAPID_FAILURES = 5;
+async function daemonMain(args) {
+  const subcommand = args[0] || "start";
+  switch (subcommand) {
+    case "start":
+      await runSupervisor(args.slice(1));
+      break;
+    case "status":
+      console.log("daemon status: not yet implemented (requires IPC)");
+      break;
+    case "stop":
+      console.log("daemon stop: not yet implemented (requires PID file)");
+      break;
+    case "--help":
+    case "-h":
+      printHelp();
+      break;
+    default:
+      console.error(`Unknown daemon subcommand: ${subcommand}`);
+      printHelp();
+      process.exitCode = 1;
+  }
+}
+function printHelp() {
+  console.log(`
+CoStrict Daemon \u2014 persistent background supervisor
+
+USAGE
+  claude daemon [subcommand] [options]
+
+SUBCOMMANDS
+  start       Start the daemon supervisor (default)
+  status      Show worker status
+  stop        Stop the daemon
+
+OPTIONS
+  --dir <path>              Working directory (default: current)
+  --spawn-mode <mode>       Worker spawn mode: same-dir | worktree (default: same-dir)
+  --capacity <N>            Max concurrent sessions per worker (default: 4)
+  --permission-mode <mode>  Permission mode for spawned sessions
+  --sandbox                 Enable sandbox mode
+  --name <name>             Session name
+  -h, --help                Show this help
+`);
+}
+function parseSupervisorArgs(args) {
+  const result = {};
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--dir" && i + 1 < args.length) {
+      result.dir = resolve(args[++i]);
+    } else if (arg.startsWith("--dir=")) {
+      result.dir = resolve(arg.slice("--dir=".length));
+    } else if (arg === "--spawn-mode" && i + 1 < args.length) {
+      result.spawnMode = args[++i];
+    } else if (arg.startsWith("--spawn-mode=")) {
+      result.spawnMode = arg.slice("--spawn-mode=".length);
+    } else if (arg === "--capacity" && i + 1 < args.length) {
+      result.capacity = args[++i];
+    } else if (arg.startsWith("--capacity=")) {
+      result.capacity = arg.slice("--capacity=".length);
+    } else if (arg === "--permission-mode" && i + 1 < args.length) {
+      result.permissionMode = args[++i];
+    } else if (arg.startsWith("--permission-mode=")) {
+      result.permissionMode = arg.slice("--permission-mode=".length);
+    } else if (arg === "--sandbox") {
+      result.sandbox = "1";
+    } else if (arg === "--name" && i + 1 < args.length) {
+      result.name = args[++i];
+    } else if (arg.startsWith("--name=")) {
+      result.name = arg.slice("--name=".length);
+    }
+  }
+  return result;
+}
+async function runSupervisor(args) {
+  const config = parseSupervisorArgs(args);
+  const dir = config.dir || resolve(".");
+  console.log(`[daemon] supervisor starting in ${dir}`);
+  const workers = [
+    {
+      kind: "remoteControl",
+      process: null,
+      backoffMs: BACKOFF_INITIAL_MS,
+      failureCount: 0,
+      parked: false,
+      lastStartTime: 0
+    }
+  ];
+  const controller = new AbortController;
+  const shutdown = () => {
+    console.log("[daemon] supervisor shutting down...");
+    controller.abort();
+    for (const w of workers) {
+      if (w.process && !w.process.killed) {
+        w.process.kill("SIGTERM");
+      }
+    }
+  };
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+  for (const worker of workers) {
+    if (!controller.signal.aborted) {
+      spawnWorker(worker, dir, config, controller.signal);
+    }
+  }
+  await new Promise((resolve2) => {
+    if (controller.signal.aborted) {
+      resolve2();
+      return;
+    }
+    controller.signal.addEventListener("abort", () => resolve2(), { once: true });
+  });
+  await Promise.all(workers.filter((w) => w.process && !w.process.killed).map((w) => new Promise((resolve2) => {
+    if (!w.process) {
+      resolve2();
+      return;
+    }
+    w.process.on("exit", () => resolve2());
+    setTimeout(() => {
+      if (w.process && !w.process.killed) {
+        w.process.kill("SIGKILL");
+      }
+      resolve2();
+    }, 30000);
+  })));
+  console.log("[daemon] supervisor stopped");
+}
+function spawnWorker(worker, dir, config, signal) {
+  if (signal.aborted || worker.parked)
+    return;
+  worker.lastStartTime = Date.now();
+  const env = {
+    ...process.env,
+    DAEMON_WORKER_DIR: dir,
+    DAEMON_WORKER_NAME: config.name,
+    DAEMON_WORKER_SPAWN_MODE: config.spawnMode || "same-dir",
+    DAEMON_WORKER_CAPACITY: config.capacity || "4",
+    DAEMON_WORKER_PERMISSION: config.permissionMode,
+    DAEMON_WORKER_SANDBOX: config.sandbox || "0",
+    DAEMON_WORKER_CREATE_SESSION: "1",
+    CLAUDE_CODE_SESSION_KIND: "daemon-worker"
+  };
+  const execArgs = [
+    ...process.execArgv,
+    process.argv[1],
+    `--daemon-worker=${worker.kind}`
+  ];
+  console.log(`[daemon] spawning worker '${worker.kind}'`);
+  const child = spawn(process.execPath, execArgs, {
+    env,
+    cwd: dir,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  worker.process = child;
+  child.stdout?.on("data", (data) => {
+    const lines = data.toString().trimEnd().split(`
+`);
+    for (const line of lines) {
+      console.log(`  ${line}`);
+    }
+  });
+  child.stderr?.on("data", (data) => {
+    const lines = data.toString().trimEnd().split(`
+`);
+    for (const line of lines) {
+      console.error(`  ${line}`);
+    }
+  });
+  child.on("exit", (code, sig) => {
+    worker.process = null;
+    if (signal.aborted) {
+      return;
+    }
+    if (code === EXIT_CODE_PERMANENT) {
+      console.error(`[daemon] worker '${worker.kind}' exited with permanent error \u2014 parking`);
+      worker.parked = true;
+      return;
+    }
+    const runDuration = Date.now() - worker.lastStartTime;
+    if (runDuration < 1e4) {
+      worker.failureCount++;
+      if (worker.failureCount >= MAX_RAPID_FAILURES) {
+        console.error(`[daemon] worker '${worker.kind}' failed ${worker.failureCount} times rapidly \u2014 parking`);
+        worker.parked = true;
+        return;
+      }
+    } else {
+      worker.failureCount = 0;
+      worker.backoffMs = BACKOFF_INITIAL_MS;
+    }
+    console.log(`[daemon] worker '${worker.kind}' exited (code=${code}, signal=${sig}), restarting in ${worker.backoffMs}ms`);
+    setTimeout(() => {
+      if (!signal.aborted && !worker.parked) {
+        spawnWorker(worker, dir, config, signal);
+      }
+    }, worker.backoffMs);
+    worker.backoffMs = Math.min(worker.backoffMs * BACKOFF_MULTIPLIER, BACKOFF_CAP_MS);
+  });
+}
+export {
+  daemonMain
+};