@coworker-jp/aidr 0.0.1

package/src/templates.mjs

@@ -0,0 +1,759 @@
+// SOURCE: docker/user-frontend/src/lib/scanner-templates.ts
+// ESM port of the scanner hook templates. Keep in sync with the TS source.
+// Templates are byte-identical to the canonical .{agent}/ files in ai-scanner
+// repo (Claude / Cursor / Windsurf / Kiro) — only the access key value differs.
+
+import { buildClaudeSettings, buildGeminiSettings } from "./merge.mjs";
+
+export function getSettingsJson(accessKey, scope = "project") {
+  return JSON.stringify(buildClaudeSettings(accessKey, scope), null, 2) + "\n";
+}
+
+// start_scanner.sh — parameterized by the verify endpoint (prod / dev).
+// `agentType` is currently unused inside the script (endpoint-info has moved
+// to schedule-only invocation via aidr --scheduled), but the parameter
+// is kept for signature stability with callers and the wider TS template.
+// eslint-disable-next-line no-unused-vars
+export function getStartScannerSh(downloadBase = "https://pytd2jd5p7.execute-api.ap-northeast-1.amazonaws.com/download", agentType = "claude-code") {
+  return `#!/bin/bash
+# SessionStart hook: Setup ai-scanner for the current platform
+# - Linux (x86_64 / aarch64): download native binary from S3
+# - macOS (arm64 / Apple Silicon): download native binary from S3 (ad-hoc signed)
+# - Binary is unsigned by 3rd party dev cert — quarantine xattr is stripped after download
+# - Fail-open: never block Claude Code startup
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+BIN_DIR="$(dirname "$BIN")"
+PULL_STAMP="$HOME/.claude/.ai-scanner-last-pull"
+PULL_INTERVAL=300
+DOWNLOAD_BASE="${downloadBase}"
+
+mkdir -p "$BIN_DIR" "$HOME/.claude/quarantine" "$HOME/.claude/ai-scanner"
+
+# macOS has no base \`timeout\` (it's in GNU coreutils). Shim it so hooks work
+# on fresh Macs without brew install coreutils.
+if ! command -v timeout >/dev/null 2>&1; then
+    if command -v gtimeout >/dev/null 2>&1; then
+        timeout() { gtimeout "$@"; }
+    else
+        timeout() { shift; "$@"; }
+    fi
+fi
+
+# Generic throttle: true (0) if stamp missing or older than PULL_INTERVAL
+should_check_update() {
+    [ ! -f "$PULL_STAMP" ] && return 0
+    local last=$(cat "$PULL_STAMP" 2>/dev/null || echo 0)
+    [ $(($(date +%s) - last)) -ge "$PULL_INTERVAL" ]
+}
+
+# Download binary from $1 to $BIN, strip quarantine (macOS), chmod +x.
+# Uses curl's native --max-time so no external \`timeout\` dependency.
+# Access key is required by the /download endpoint.
+download_binary() {
+    local url="$1"
+    local tmp=$(mktemp "\${BIN_DIR}/ai-scanner.XXXXXX")
+    local auth_args=()
+    if [ -n "\${AI_SCANNER_ACCESS_KEY:-}" ]; then
+        auth_args=(-H "x-access-key: \${AI_SCANNER_ACCESS_KEY}")
+    fi
+    if curl -sfL --max-time 60 "\${auth_args[@]}" -o "$tmp" "$url" 2>/dev/null; then
+        chmod +x "$tmp"
+        # macOS: strip Gatekeeper quarantine so unsigned binary can execute
+        # (no-op on Linux where xattr isn't typically present)
+        xattr -d com.apple.quarantine "$tmp" 2>/dev/null || true
+        mv -f "$tmp" "$BIN"
+        return 0
+    fi
+    rm -f "$tmp"
+    return 1
+}
+
+OS=$(uname -s)
+ARCH=$(uname -m)
+
+case "$OS" in
+    Linux)
+        case "$ARCH" in
+            x86_64)         PLATFORM_SLUG="linux-x86_64" ;;
+            aarch64|arm64)  PLATFORM_SLUG="linux-aarch64" ;;
+            *)
+                echo "Warning: Unsupported Linux architecture: $ARCH (expected x86_64 or aarch64)" >&2
+                exit 0
+                ;;
+        esac
+        ;;
+    Darwin)
+        case "$ARCH" in
+            arm64) PLATFORM_SLUG="darwin-aarch64" ;;
+            x86_64)
+                echo "Warning: ai-scanner does not support Intel Mac (x86_64). Apple Silicon required." >&2
+                exit 0
+                ;;
+            *)
+                echo "Warning: Unsupported macOS architecture: $ARCH" >&2
+                exit 0
+                ;;
+        esac
+        ;;
+    *)
+        echo "Warning: Unsupported OS for ai-scanner: $OS" >&2
+        exit 0
+        ;;
+esac
+
+# Binary missing → fetch it
+if [ ! -x "$BIN" ]; then
+    if download_binary "\${DOWNLOAD_BASE}/\${PLATFORM_SLUG}"; then
+        echo "ai-scanner binary installed (\${PLATFORM_SLUG})" >&2
+    else
+        echo "Warning: Failed to download ai-scanner binary from \${DOWNLOAD_BASE}/\${PLATFORM_SLUG}" >&2
+    fi
+    exit 0
+fi
+
+# Binary exists — throttled self-update check
+if should_check_update; then
+    "$BIN" update 2>/dev/null || true
+    date +%s > "$PULL_STAMP"
+fi
+
+exit 0
+`;
+}
+
+export const STOP_SCANNER_SH = `#!/bin/bash
+# Stop hook: intentionally does nothing.
+# Container stays running for next session startup speed.
+exit 0
+`;
+
+// Wraps every ai-scanner invocation in a timeout so a hung binary cannot
+// indefinitely block the editor. Exit 124 from GNU `timeout` means "timed
+// out" — we map that to 0 (fail-open), matching the project-wide policy
+// that hook failures never block user work.
+//
+// Portability: Linux ships `timeout` in coreutils; Homebrew macOS exposes
+// it as `gtimeout`; a bare macOS (no coreutils) has neither, in which case
+// we exec without a timeout. This keeps the editor-level timeout as the
+// only safety net on that platform, which is acceptable — installing
+// coreutils is the documented remedy.
+//
+// Default 30s: the v1.4.x scanner's cold-start path does rules-decrypt +
+// advisory_client DDB round-trip + YARA + Quarantine (typosquat + registry
+// metadata) + Semgrep, measured ~8.5s on admin@coworker.co.jp's Linux box
+// with a warm cache — cold-start + slow network can push that past 12s and
+// exhaust the previous default, causing a known-malicious file to slip
+// through as a false-negative (timeout → 124 → fail-open 0). 30s is
+// generous enough to absorb cold-start variance while still bounding a
+// truly hung scanner. AI_SCANNER_HOOK_TIMEOUT (seconds) lets operators
+// tune further per-environment.
+const SCAN_HELPERS = `run_scanner() {
+  if command -v timeout >/dev/null 2>&1; then
+    timeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT:-30}" "$BIN" "$@"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT:-30}" "$BIN" "$@"
+  else
+    "$BIN" "$@"
+  fi
+  local rc=$?
+  [ $rc -eq 124 ] && return 0
+  return $rc
+}`;
+
+export const SCAN_BASH_SH = `#!/bin/bash
+# PostToolUse hook for Bash: Scan command output.
+# Thin Claude Code adapter — Rust handles cap, detection log, actor resolution.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+INPUT=$(cat)
+COMMAND=$(jq -r '.tool_input.command // ""' <<<"$INPUT")
+jq -r '.tool_response // ""' <<<"$INPUT" \\
+  | run_scanner scan bash-output --command "$COMMAND"
+`;
+
+export const SCAN_BASH_INPUT_SH = `#!/bin/bash
+# PreToolUse hook for Bash: Scan command before execution.
+# Thin Claude Code adapter — Rust handles cap, detection log, actor resolution.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+CONTENT=$(jq -r '.tool_input.command // ""')
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+
+printf '%s' "$CONTENT" | run_scanner scan bash-input
+`;
+
+export const SCAN_EDIT_SH = `#!/bin/bash
+# PreToolUse hook for Edit/MultiEdit: Scan new content before write.
+# Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
+# Only the Edit-vs-MultiEdit content extraction is Claude Code specific.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+TOOL_NAME=$(jq -r '.tool_name // "unknown"' <<<"$INPUT")
+
+case "$TOOL_NAME" in
+  Edit)       CONTENT=$(jq -r '.tool_input.new_string // ""' <<<"$INPUT") ;;
+  MultiEdit)  CONTENT=$(jq -r '[.tool_input.edits[]?.new_string // ""] | join("\\n")' <<<"$INPUT") ;;
+  *)          CONTENT=$(jq -r '.tool_input.new_string // .tool_input.content // ""' <<<"$INPUT") ;;
+esac
+
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+
+printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
+`;
+
+export const SCAN_READ_SH = `#!/bin/bash
+# PostToolUse hook for Read: Scan file content Claude just read.
+# Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+
+# tool_response is an object: {type, file: {filePath, content, ...}}.
+jq -r '.tool_response.file.content // .tool_response // ""' <<<"$INPUT" \\
+  | run_scanner scan read-output --file "$FILE_PATH"
+`;
+
+export const SCAN_EDIT_OUTPUT_SH = `#!/bin/bash
+# PostToolUse hook for Edit/MultiEdit/Write: Scan final file content.
+# Thin Claude Code adapter — Rust handles cap, exclude dirs, detection log.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+
+# tool_response for Edit/Write: {filePath, content, ...} or nested {file: {content}}.
+jq -r '.tool_response.file.content // .tool_response.content // .tool_response // ""' <<<"$INPUT" \\
+  | run_scanner scan edit-output --file "$FILE_PATH"
+`;
+
+export const SCAN_READ_INPUT_SH = `#!/bin/bash
+# PreToolUse hook for Read: Scan file content before Claude reads it.
+# This is a thin Claude Code adapter — all scanning logic lives in the Rust
+# binary, including actor resolution, exclude-dir filtering, content cap, and
+# detection-log writing.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+FILE_PATH=$(jq -r '.tool_input.file_path // ""')
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+
+# Rust reads the file itself (no need to pipe content). Exit code 2 = detection.
+run_scanner scan read-input --file "$FILE_PATH" </dev/null
+`;
+
+export const SCAN_WEBFETCH_SH = `#!/bin/bash
+# PreToolUse hook for WebFetch: Scan URL before Claude fetches it.
+# Thin Claude Code adapter — Rust handles phishing scoring + YARA + detection log.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+URL=$(jq -r '.tool_input.url // ""')
+[ -z "$URL" ] || [ "$URL" = "null" ] && exit 0
+
+run_scanner scan webfetch --url "$URL" </dev/null
+`;
+
+export const SCAN_WEBSEARCH_SH = `#!/bin/bash
+# PostToolUse hook for WebSearch: Scan search results for phishing URLs.
+# Thin Claude Code adapter — Rust handles cap, phishing scoring, detection log.
+BIN="\${AI_SCANNER_BIN:-$HOME/.claude/bin/ai-scanner}"
+[ ! -x "$BIN" ] && exit 0
+
+export AI_SCANNER_DETECTION_LOG="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs/detections.log"
+
+${SCAN_HELPERS}
+
+jq -r '.tool_response // ""' | run_scanner scan websearch`;
+
+export const LOG_WEB_URLS_SH = `#!/bin/bash
+# Log URLs from WebSearch and WebFetch tool calls
+# Hook input is received via stdin as JSON
+
+LOG_DIR="\${CLAUDE_PROJECT_DIR:-.}/.claude/logs"
+LOG_FILE="$LOG_DIR/web_urls.log"
+
+mkdir -p "$LOG_DIR"
+
+INPUT=$(cat)
+
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // "unknown"')
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+if [ "$TOOL_NAME" = "WebSearch" ]; then
+  QUERY=$(echo "$INPUT" | jq -r '.tool_input.query // "unknown"')
+  echo "\${TIMESTAMP} [WebSearch] query=\\"\${QUERY}\\"" >> "$LOG_FILE"
+elif [ "$TOOL_NAME" = "WebFetch" ]; then
+  URL=$(echo "$INPUT" | jq -r '.tool_input.url // "unknown"')
+  echo "\${TIMESTAMP} [WebFetch] url=\\"\${URL}\\"" >> "$LOG_FILE"
+fi
+
+exit 0
+`;
+
+// env.sh shared by Cursor/Windsurf/Kiro/Codex (byte-identical to canonical,
+// only the access key value differs).
+//
+// Exposes a `run_scanner` bash function that every hook adapter uses to
+// invoke the scanner binary under a timeout. A hung scanner must never
+// stall the editor's tool call (fail-open is the project policy).
+export function agentEnvSh(accessKey, agentDir) {
+  return `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+export AI_SCANNER_BIN="\${AI_SCANNER_BIN:-$HOME/${agentDir}/bin/ai-scanner}"
+export AI_SCANNER_ACCESS_KEY="${accessKey}"
+export AI_SCANNER_LEVEL="\${AI_SCANNER_LEVEL:-high}"
+export AI_SCANNER_EXCLUDE_DIRS="\${AI_SCANNER_EXCLUDE_DIRS:-}"
+export AI_SCANNER_QUARANTINE_DAYS="\${AI_SCANNER_QUARANTINE_DAYS:-3}"
+export AI_SCANNER_QUARANTINE_MODE="\${AI_SCANNER_QUARANTINE_MODE:-scan}"
+export AI_SCANNER_EXFIL_MODE="\${AI_SCANNER_EXFIL_MODE:-on}"
+export AI_SCANNER_WEBFETCH_YARA_THRESHOLD="\${AI_SCANNER_WEBFETCH_YARA_THRESHOLD:-50}"
+export AI_SCANNER_HOOK_TIMEOUT="\${AI_SCANNER_HOOK_TIMEOUT:-30}"
+export AI_SCANNER_DETECTION_LOG="\${AI_SCANNER_DETECTION_LOG:-$SCRIPT_DIR/../logs/detections.log}"
+export CLAUDE_PROJECT_DIR="\${CLAUDE_PROJECT_DIR:-.}"
+
+# Wraps "$AI_SCANNER_BIN \$*" in an optional timeout. Exit 124 from GNU
+# \`timeout\` (timed out) is mapped to 0 so a hung scanner never blocks the
+# tool call. Bare macOS (no coreutils) falls through without a timeout —
+# install coreutils (\`brew install coreutils\`) to get the safety net.
+run_scanner() {
+  if command -v timeout >/dev/null 2>&1; then
+    timeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_SCANNER_BIN}" "$@"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT}" "\${AI_SCANNER_BIN}" "$@"
+  else
+    "\${AI_SCANNER_BIN}" "$@"
+  fi
+  local rc=$?
+  [ $rc -eq 124 ] && return 0
+  return $rc
+}
+`;
+}
+
+// ── Cursor ────────────────────────────────────────────────────────────
+// hooks.json shape moved to merge.mjs (buildCursorHooksJson) so cursor.mjs can
+// merge with any user-edited existing hooks.json instead of overwriting.
+
+export function getCursorSessionInitSh(accessKey) {
+  return `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+cat > /dev/null
+bash "$SCRIPT_DIR/start_scanner.sh" 2>/dev/null || true
+cat <<EOF
+{"env":{"AI_SCANNER_BIN":"\${AI_SCANNER_BIN}","AI_SCANNER_ACCESS_KEY":"${accessKey}","AI_SCANNER_LEVEL":"high"}}
+EOF
+`;
+}
+
+export const CURSOR_PRE_SHELL_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+jq -r '.tool_input.command // ""' | run_scanner scan bash-input
+`;
+
+export const CURSOR_PRE_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+FILE_PATH=$(jq -r '.tool_input.file_path // ""')
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+run_scanner scan read-input --file "$FILE_PATH" </dev/null
+`;
+
+export const CURSOR_PRE_EDIT_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+TOOL_NAME=$(jq -r '.tool_name // "unknown"' <<<"$INPUT")
+case "$TOOL_NAME" in
+  Edit)       CONTENT=$(jq -r '.tool_input.new_string // ""' <<<"$INPUT") ;;
+  MultiEdit)  CONTENT=$(jq -r '[.tool_input.edits[]?.new_string // ""] | join("\\n")' <<<"$INPUT") ;;
+  *)          CONTENT=$(jq -r '.tool_input.new_string // .tool_input.content // ""' <<<"$INPUT") ;;
+esac
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
+`;
+
+export const CURSOR_POST_SHELL_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+COMMAND=$(jq -r '.tool_output // ""' <<<"$INPUT" | head -1 && jq -r '.tool_input.command // ""' <<<"$INPUT")
+jq -r '.tool_output // ""' <<<"$INPUT" | run_scanner scan bash-output --command "$(jq -r '.tool_input.command // ""' <<<"$INPUT")"
+`;
+
+export const CURSOR_POST_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+jq -r '.tool_output // ""' <<<"$INPUT" | run_scanner scan read-output --file "$FILE_PATH"
+`;
+
+export const CURSOR_POST_WRITE_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+[ ! -f "$FILE_PATH" ] && exit 0
+run_scanner scan edit-output --file "$FILE_PATH" < "$FILE_PATH"
+`;
+
+// ── Windsurf ─────────────────────────────────────────────────────────
+// hooks.json shape moved to merge.mjs (buildWindsurfHooksJson).
+
+export const WINDSURF_ENSURE_SCANNER_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"
+LOCK_FILE="/tmp/.ai-scanner-ensure.lock"
+if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then
+    return 0 2>/dev/null || true
+fi
+(
+    flock -w 120 200 || exit 0
+    if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then exit 0; fi
+    bash "$SCRIPT_DIR/start_scanner.sh"
+) 200>"$LOCK_FILE"
+return 0 2>/dev/null || true
+`;
+
+export const WINDSURF_PRE_COMMAND_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/ensure_scanner.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+CONTENT=$(jq -r '.tool_info.command_line // ""')
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+printf '%s' "$CONTENT" | run_scanner scan bash-input
+`;
+
+export const WINDSURF_PRE_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/ensure_scanner.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+FILE_PATH=$(jq -r '.tool_info.file_path // ""')
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+run_scanner scan read-input --file "$FILE_PATH" </dev/null
+`;
+
+export const WINDSURF_PRE_WRITE_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/ensure_scanner.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_info.file_path // ""' <<<"$INPUT")
+CONTENT=$(jq -r '[.tool_info.edits[]?.new_string // ""] | join("\\n")' <<<"$INPUT")
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
+`;
+
+export const WINDSURF_POST_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/ensure_scanner.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+FILE_PATH=$(jq -r '.tool_info.file_path // ""')
+[ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ] && exit 0
+run_scanner scan read-output --file "$FILE_PATH" < "$FILE_PATH"
+`;
+
+export const WINDSURF_POST_WRITE_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/ensure_scanner.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+FILE_PATH=$(jq -r '.tool_info.file_path // ""')
+[ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ] && exit 0
+run_scanner scan edit-output --file "$FILE_PATH" < "$FILE_PATH"
+`;
+
+// ── Kiro ─────────────────────────────────────────────────────────────
+export function getKiroAgentJson(scope = "project", absHome = "") {
+  const p = scope === "user" ? `${absHome}/.kiro/coworker-ai` : ".kiro/coworker-ai";
+  // timeout_ms is Kiro's native field. Default is 30000ms (30s); explicitly
+  // pin to 15000ms so a stalled scanner is killed by the editor in time,
+  // and 60000ms for agentSpawn to give the binary fetch room. The
+  // shell-side run_scanner cap (12s) fires first under normal conditions.
+  return JSON.stringify({
+    name: "ai-scanner",
+    description: "CoWorker AIDR security scanner",
+    tools: ["*"],
+    hooks: {
+      agentSpawn: [{ command: `${p}/start.sh`, timeout_ms: 60000 }],
+      preToolUse: [
+        { matcher: "shell", command: `${p}/pre_shell.sh`, timeout_ms: 15000 },
+        { matcher: "read", command: `${p}/pre_read.sh`, timeout_ms: 15000 },
+        { matcher: "write", command: `${p}/pre_write.sh`, timeout_ms: 15000 },
+      ],
+      postToolUse: [
+        { matcher: "shell", command: `${p}/post_shell.sh`, timeout_ms: 15000 },
+        { matcher: "read", command: `${p}/post_read.sh`, timeout_ms: 15000 },
+        { matcher: "write", command: `${p}/post_write.sh`, timeout_ms: 15000 },
+      ],
+    },
+  }, null, 2);
+}
+
+export const KIRO_START_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+exec "$SCRIPT_DIR/start_scanner.sh"
+`;
+
+export const KIRO_PRE_SHELL_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+jq -r '.tool_input.command // ""' | run_scanner scan bash-input
+`;
+
+export const KIRO_PRE_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.operations[0].path // ""')
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+run_scanner scan read-input --file "$FILE_PATH" </dev/null
+`;
+
+export const KIRO_PRE_WRITE_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT")
+CONTENT=$(jq -r '.tool_input.new_string // .tool_input.new_str // .tool_input.file_text // .tool_input.content // ""' <<<"$INPUT")
+[ -z "$CONTENT" ] || [ "$CONTENT" = "null" ] && exit 0
+printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FILE_PATH"
+`;
+
+export const KIRO_POST_SHELL_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+COMMAND=$(jq -r '.tool_input.command // ""' <<<"$INPUT")
+RESPONSE=$(jq -r '.tool_response | if type=="object" then (.result[0].stdout // tostring) else . end' <<<"$INPUT")
+printf '%s' "$RESPONSE" | run_scanner scan bash-output --command "$COMMAND"
+`;
+
+export const KIRO_POST_READ_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.operations[0].path // ""' <<<"$INPUT")
+[ -z "$FILE_PATH" ] || [ "$FILE_PATH" = "null" ] && exit 0
+RESPONSE=$(jq -r '.tool_response | if type=="object" then (.result | if type=="array" then join("\\n") else tostring end) else . end' <<<"$INPUT")
+printf '%s' "$RESPONSE" | run_scanner scan read-output --file "$FILE_PATH"
+`;
+
+export const KIRO_POST_WRITE_SH = `#!/bin/bash
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+FILE_PATH=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT")
+RESPONSE=$(jq -r '.tool_response | if type=="object" then (.result | if type=="array" then join("\\n") else tostring end) else . end' <<<"$INPUT")
+printf '%s' "$RESPONSE" | run_scanner scan edit-output --file "$FILE_PATH"
+`;
+
+// ── Gemini / Codex ────────────────────────────────────────────────────
+// Thin wrappers that shell out to ai-scanner via generic bash-input scan.
+
+export function getGeminiSettingsJson(accessKey, binary) {
+  return JSON.stringify(buildGeminiSettings(accessKey, binary), null, 2) + "\n";
+}
+
+export function getGeminiPreHookSh(binary) {
+  return `#!/bin/bash
+# Gemini CLI BeforeTool hook wrapper.
+# Doesn't source env.sh (Gemini binds the binary path at install time), so
+# the run_scanner timeout helper is inlined here. See agentEnvSh for the
+# canonical version and the rationale for fail-open on exit 124.
+BIN="${binary}"
+[ ! -x "$BIN" ] && exit 0
+
+run_scanner() {
+  if command -v timeout >/dev/null 2>&1; then
+    timeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT:-30}" "$BIN" "$@"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout --kill-after=2s "\${AI_SCANNER_HOOK_TIMEOUT:-30}" "$BIN" "$@"
+  else
+    "$BIN" "$@"
+  fi
+  local rc=$?
+  [ $rc -eq 124 ] && return 0
+  return $rc
+}
+
+INPUT=$(cat)
+TOOL=$(jq -r '.tool_name // ""' <<<"$INPUT" 2>/dev/null || echo "")
+case "$TOOL" in
+  shell|run_shell_command)
+    CMD=$(jq -r '.tool_input.command // .tool_input.cmd // ""' <<<"$INPUT" 2>/dev/null)
+    [ -z "$CMD" ] && exit 0
+    printf '%s' "$CMD" | run_scanner scan bash-input
+    ;;
+  read_file|read)
+    FP=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT" 2>/dev/null)
+    [ -z "$FP" ] && exit 0
+    run_scanner scan read-input --file "$FP" </dev/null
+    ;;
+  write_file|edit|replace)
+    FP=$(jq -r '.tool_input.file_path // .tool_input.path // ""' <<<"$INPUT" 2>/dev/null)
+    CONTENT=$(jq -r '.tool_input.content // .tool_input.new_string // ""' <<<"$INPUT" 2>/dev/null)
+    [ -z "$CONTENT" ] && exit 0
+    printf '%s' "$CONTENT" | run_scanner scan edit-input --file "$FP"
+    ;;
+  *) exit 0 ;;
+esac
+`;
+}
+
+// ── Codex CLI ────────────────────────────────────────────────────────
+// Codex only emits Bash tool events today (spec: https://developers.openai.com/codex/hooks).
+// We wire three hooks:
+//   - SessionStart (startup|resume) → ensures scanner binary is present & healthy
+//   - PreToolUse   (Bash)           → scan command before execution, return block JSON on detection
+//   - PostToolUse  (Bash)           → scan output, return feedback JSON on detection
+// hooks.json shape lives in merge.mjs (buildCodexHooksJson).
+
+export const CODEX_SESSION_INIT_SH = `#!/bin/bash
+# Codex SessionStart: guarantee binary is ready before the first tool runs.
+# flock prevents two concurrent sessions from racing on the download.
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+cat > /dev/null   # drain stdin so Codex doesn't block on a write
+BIN="$AI_SCANNER_BIN"
+LOCK_FILE="/tmp/.ai-scanner-codex-init.lock"
+if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then
+  exit 0
+fi
+(
+  flock -w 120 200 || exit 0
+  if [ -x "$BIN" ] && timeout 2 "$BIN" health >/dev/null 2>&1; then exit 0; fi
+  bash "$SCRIPT_DIR/start_scanner.sh" 2>/dev/null || true
+) 200>"$LOCK_FILE"
+exit 0
+`;
+
+export const CODEX_PRE_SHELL_SH = `#!/bin/bash
+# Codex PreToolUse Bash hook: scan command and return block JSON to Codex.
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+CMD=$(jq -r '.tool_input.command // ""' <<<"$INPUT" 2>/dev/null)
+[ -z "$CMD" ] || [ "$CMD" = "null" ] && exit 0
+SCAN_STDOUT="$(mktemp)"
+SCAN_STDERR="$(mktemp)"
+cleanup() {
+  rm -f "$SCAN_STDOUT" "$SCAN_STDERR"
+}
+trap cleanup EXIT
+
+printf '%s' "$CMD" | run_scanner scan bash-input >"$SCAN_STDOUT" 2>"$SCAN_STDERR"
+RC=$?
+[ "$RC" -eq 0 ] && exit 0
+[ "$RC" -ne 2 ] && exit 0
+
+REASON="$(jq -r '.message // empty' <"$SCAN_STDOUT" 2>/dev/null)"
+[ -n "$REASON" ] || REASON="$(cat "$SCAN_STDERR" 2>/dev/null)"
+[ -n "$REASON" ] || REASON="AIDR blocked the Bash command."
+
+jq -cn \
+  --arg reason "$REASON" \
+  '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$reason}}'
+`;
+
+export const CODEX_POST_SHELL_SH = `#!/bin/bash
+# Codex PostToolUse Bash hook: scan command output and return feedback JSON.
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]:-$0}")" && pwd)"
+source "$SCRIPT_DIR/env.sh"
+BIN="$AI_SCANNER_BIN"; [ ! -x "$BIN" ] && exit 0
+export AI_SCANNER_DETECTION_LOG
+INPUT=$(cat)
+CMD=$(jq -r '.tool_input.command // ""' <<<"$INPUT" 2>/dev/null)
+OUTPUT=$(jq -r '.tool_response.output // .tool_output // ""' <<<"$INPUT" 2>/dev/null)
+[ -z "$OUTPUT" ] || [ "$OUTPUT" = "null" ] && exit 0
+SCAN_STDOUT="$(mktemp)"
+SCAN_STDERR="$(mktemp)"
+cleanup() {
+  rm -f "$SCAN_STDOUT" "$SCAN_STDERR"
+}
+trap cleanup EXIT
+
+printf '%s' "$OUTPUT" | run_scanner scan bash-output --command "$CMD" >"$SCAN_STDOUT" 2>"$SCAN_STDERR"
+RC=$?
+[ "$RC" -eq 0 ] && exit 0
+[ "$RC" -ne 2 ] && exit 0
+
+REASON="$(jq -r '.message // empty' <"$SCAN_STDOUT" 2>/dev/null)"
+[ -n "$REASON" ] || REASON="$(cat "$SCAN_STDERR" 2>/dev/null)"
+[ -n "$REASON" ] || REASON="AIDR found risky Bash output."
+
+jq -cn --arg reason "$REASON" '{decision:"block",reason:$reason}'
+`;