@cybedefend/vibedefend 1.1.1 → 1.1.2

package/dist/hook-runner.js

@@ -6237,21 +6237,50 @@ function makeViolationsBuffer(opts = {}) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
-        records.push(JSON.parse(trimmed));
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed.projectId === "string" && parsed.projectId) {
+          records.push(parsed);
+        }
       } catch {
       }
     }
-    if (records.length === 0) return;
-    const BATCH_SIZE = 100;
-    try {
-      for (let i = 0; i < records.length; i += BATCH_SIZE) {
-        const batch = records.slice(i, i + BATCH_SIZE);
-        await postFn(ctx, batch);
-      }
+    if (records.length === 0) {
       try {
         writeFileSync4(bufferFile, "", "utf8");
       } catch {
       }
+      return;
+    }
+    const groups = /* @__PURE__ */ new Map();
+    for (const r of records) {
+      const arr = groups.get(r.projectId);
+      if (arr) arr.push(r);
+      else groups.set(r.projectId, [r]);
+    }
+    const BATCH_SIZE = 100;
+    const failed = [];
+    for (const [projectId, group] of groups) {
+      let groupFailed = false;
+      for (let i = 0; i < group.length; i += BATCH_SIZE) {
+        const batch = group.slice(i, i + BATCH_SIZE);
+        try {
+          await postFn(ctx, projectId, batch);
+        } catch {
+          groupFailed = true;
+          break;
+        }
+      }
+      if (groupFailed) {
+        failed.push(...group);
+      }
+    }
+    try {
+      if (failed.length === 0) {
+        writeFileSync4(bufferFile, "", "utf8");
+      } else {
+        const serialised = failed.map((r) => JSON.stringify(r)).join("\n") + "\n";
+        writeFileSync4(bufferFile, serialised, "utf8");
+      }
     } catch {
     }
   }
@@ -6598,36 +6627,60 @@ async function runPreToolUseGuard() {
       apiBaseResolved
     });
     const buffer = makeViolationsBuffer();
-    process.once("beforeExit", () => {
-      buffer.flushViolations(
-        { projectId, token, apiBaseResolved },
-        async (ctx, batch) => {
-          const f = globalThis.fetch;
-          const url = `${ctx.apiBaseResolved}/project/${encodeURIComponent(ctx.projectId)}/action-guards/violations`;
-          await f(url, {
-            method: "POST",
-            headers: {
-              Authorization: `Bearer ${ctx.token}`,
-              "Content-Type": "application/json"
-            },
-            body: JSON.stringify({ violations: batch }),
-            signal: AbortSignal.timeout(5e3)
-          });
-        }
-      ).catch(() => {
-      });
-    });
-    return await runPreToolUseGuardWith({
+    const exitCode = await runPreToolUseGuardWith({
       stdinEnvelope: envelope,
       projectContext,
       rulesOutcome,
       evaluateFn: evaluate,
       bufferViolationFn: buffer.bufferViolation.bind(buffer)
     });
+    try {
+      await buffer.flushViolations(
+        { token, apiBaseResolved },
+        makeGuardViolationsPostFn()
+      );
+    } catch {
+    }
+    return exitCode;
   } catch {
     return 0;
   }
 }
+function makeGuardViolationsPostFn() {
+  return async (ctx, projectId, batch) => {
+    const url = `${ctx.apiBaseResolved}/project/${encodeURIComponent(projectId)}/action-guards/violations`;
+    const resp = await globalThis.fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${ctx.token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ violations: batch.map(toApiViolation) }),
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!resp.ok) {
+      throw new Error(
+        `POST /action-guards/violations rejected by gateway: ${resp.status}`
+      );
+    }
+  };
+}
+function toApiViolation(r) {
+  const out = {
+    rule_id: r.ruleId,
+    agent: r.agent,
+    tool: r.tool,
+    outcome: r.outcome,
+    // Backend enforces max_length=256 on target_summary — clamp here so a
+    // verbose redactor output never costs us the whole batch.
+    target_summary: (r.targetSummary ?? "").slice(0, 256),
+    target_hash: r.targetHash
+  };
+  if (r.sessionId) {
+    out.session_id = r.sessionId;
+  }
+  return out;
+}
 
 // src/hooks/runtime/index.ts
 async function main() {

package/dist/hooks/runtime/guard-violations-buffer.js

@@ -3,8 +3,7 @@
  *
  * Violations (deny/warn outcomes) are appended as JSON lines to a local
  * buffer file (`~/.cybedefend/guards-violations-buffer.jsonl`) and flushed
- * to the gateway on demand (typically on hook process exit via
- * `process.on('beforeExit')`).
+ * to the gateway on demand by the hook before it returns.
  *
  * Why JSONL + append semantics?
  *  - Append to a file is atomic at the OS level for small writes.
@@ -13,6 +12,17 @@
  *  - The hook NEVER blocks on the audit write — `bufferViolation` is
  *    synchronous (sync appendFileSync with minimal data).
  *
+ * Per-project semantics:
+ *  - Each buffered record carries its own `projectId`. When the buffer is
+ *    flushed, records are grouped by `projectId` and each group is POSTed
+ *    to its own project's endpoint. This is required because a developer
+ *    may switch projects between hook invocations, and the user's Logto
+ *    token (same across all their projects) can authorise calls to any
+ *    project the Permify policy allows.
+ *  - On partial failure (e.g. permission denied for one project, success
+ *    for another) only the failed groups are kept in the buffer; the
+ *    successful ones are purged.
+ *
  * Violation semantics:
  *  - `deny`  → outcome = 'denied'
  *  - `warn`  → outcome = 'warned'
@@ -53,7 +63,7 @@ export function makeViolationsBuffer(opts = {}) {
             content = readFileSync(bufferFile, 'utf8').trim();
         }
         catch {
-            return; // can't read — skip
+            return;
         }
         if (!content)
             return;
@@ -63,30 +73,70 @@ export function makeViolationsBuffer(opts = {}) {
             if (!trimmed)
                 continue;
             try {
-                records.push(JSON.parse(trimmed));
+                const parsed = JSON.parse(trimmed);
+                // Drop records that pre-date the projectId field or are malformed
+                // beyond recovery — keeping them would block the flush forever
+                // since they cannot be addressed to a project.
+                if (typeof parsed.projectId === 'string' && parsed.projectId) {
+                    records.push(parsed);
+                }
             }
             catch {
-                // Corrupt line — skip it
+                // Corrupt line — drop it
             }
         }
-        if (records.length === 0)
+        if (records.length === 0) {
+            // Nothing salvageable — clear the file so corrupt content doesn't
+            // grow unboundedly.
+            try {
+                writeFileSync(bufferFile, '', 'utf8');
+            }
+            catch {
+                // Best-effort
+            }
             return;
+        }
+        // Group by projectId, preserving original insertion order within each group.
+        const groups = new Map();
+        for (const r of records) {
+            const arr = groups.get(r.projectId);
+            if (arr)
+                arr.push(r);
+            else
+                groups.set(r.projectId, [r]);
+        }
         const BATCH_SIZE = 100;
-        try {
-            for (let i = 0; i < records.length; i += BATCH_SIZE) {
-                const batch = records.slice(i, i + BATCH_SIZE);
-                await postFn(ctx, batch);
+        const failed = [];
+        for (const [projectId, group] of groups) {
+            let groupFailed = false;
+            for (let i = 0; i < group.length; i += BATCH_SIZE) {
+                const batch = group.slice(i, i + BATCH_SIZE);
+                try {
+                    await postFn(ctx, projectId, batch);
+                }
+                catch {
+                    groupFailed = true;
+                    break;
+                }
             }
-            // Truncate on success
-            try {
+            if (groupFailed) {
+                failed.push(...group);
+            }
+        }
+        // Rewrite the file with only the failed groups (or wipe it on full success).
+        try {
+            if (failed.length === 0) {
                 writeFileSync(bufferFile, '', 'utf8');
             }
-            catch {
-                // Best-effort truncate
+            else {
+                const serialised = failed.map((r) => JSON.stringify(r)).join('\n') + '\n';
+                writeFileSync(bufferFile, serialised, 'utf8');
             }
         }
         catch {
-            // POST failed — preserve buffer for next flush attempt
+            // Best-effort — if we can't rewrite, the worst case is that successful
+            // groups are re-flushed on the next attempt (the API push is idempotent
+            // at the (project_id, rule_id, target_hash, session_id) level).
         }
     }
     return { bufferViolation, flushViolations };

package/dist/hooks/runtime/guard-violations-buffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-violations-buffer.js","sourceRoot":"","sources":["../../../src/hooks/runtime/guard-violations-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CACrC,OAAO,EAAE,EACT,aAAa,EACb,gCAAgC,CACjC,CAAC;AA2CF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAE1D,SAAS,eAAe,CAAC,GAAe,EAAE,CAAY;QACpD,MAAM,MAAM,GAAoB;YAC9B,GAAG,CAAC;YACJ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,GAAa,EACb,MAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,oBAAoB;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC/C,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,sBAAsB;YACtB,IAAI,CAAC;gBACH,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"guard-violations-buffer.js","sourceRoot":"","sources":["../../../src/hooks/runtime/guard-violations-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CACrC,OAAO,EAAE,EACT,aAAa,EACb,gCAAgC,CACjC,CAAC;AAgDF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAE1D,SAAS,eAAe,CAAC,GAAe,EAAE,CAAY;QACpD,MAAM,MAAM,GAAoB;YAC9B,GAAG,CAAC;YACJ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,GAAa,EACb,MAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B,CAAC;gBAC/D,kEAAkE;gBAClE,+DAA+D;gBAC/D,+CAA+C;gBAC/C,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBAC7D,OAAO,CAAC,IAAI,CAAC,MAAyB,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,kEAAkE;YAClE,oBAAoB;YACpB,IAAI,CAAC;gBACH,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,MAAM,GAAsB,EAAE,CAAC;QAErC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACxC,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,IAAI,CAAC;oBACnB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACzD,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,wEAAwE;YACxE,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cybedefend/vibedefend",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "VibeDefend — one-shot installer for CybeDefend's MCP server and Claude Code / Cursor / Codex / Windsurf hooks (for AI coding agents).",
   "type": "module",
   "bin": {