@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/hooks/runtime/session-writes.js

@@ -0,0 +1,232 @@
+/**
+ * Level 1 — per-session write memory for the Action Guards.
+ *
+ * A file the agent WROTE earlier this session and then EXECUTES later
+ * (`bash cleanup.sh`, `./x`, `python x.py`, `npm run cleanup`) is a strong
+ * write-then-run signal: the Write hook never reads file CONTENT, so a script
+ * the agent authored is invisible to the regex evaluator until it runs. This
+ * module keeps a small on-disk memory of the paths an agent has written in a
+ * session so the guard can flag executing one.
+ *
+ * It CONSUMES write-target paths (e.g. the output of `shell-writes.ts` for a
+ * Bash envelope, or the single path of an Edit/Write/MultiEdit envelope). It
+ * does NOT extract them itself.
+ *
+ * Mirrors the repo's on-disk JSON tracker pattern (see `judge-cache.ts` and
+ * `defaultSessionTracker` in `user-prompt-submit.ts`):
+ *   - stored under `CYBEDEFEND_BASELINE_DIR` / `~/.cybedefend`;
+ *   - best-effort — a missing / corrupt file reads as empty, and every FS/JSON
+ *     error is swallowed (never throws, never blocks the hot path);
+ *   - bounded — at most `maxPaths` newest paths per session, and entries older
+ *     than `ttlMs` are pruned on read and on write;
+ *   - atomic-ish write (temp file + rename).
+ *
+ * Keyed by `sessionId`. No `sessionId` → `record` is a no-op and reads are
+ * empty / false (we can't attribute a write to a conversation we can't name).
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, posix } from 'node:path';
+/** Default cap on remembered paths per session — newest kept, oldest dropped. */
+export const DEFAULT_MAX_PATHS = 500;
+/** Default time-to-live for a remembered write: a few hours (one work session). */
+export const DEFAULT_SESSION_WRITES_TTL_MS = 4 * 60 * 60 * 1000;
+/** Basename of the on-disk store. */
+export const SESSION_WRITES_FILE = 'guards-session-writes.json';
+/** A lock older than this was left by a dead hook and is broken. */
+const LOCK_STALE_MS = 2_000;
+/** Longest a hook waits for the lock before writing without it (as before). */
+const LOCK_WAIT_MS = 500;
+function sleepMs(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Run `fn` holding an exclusive lock: a directory, since `mkdir` is atomic.
+ * Concurrent hooks (parallel tool calls, several sessions) each read, modify
+ * and rewrite the whole file, so without it the last rename erases the others.
+ */
+function withLock(lockDir, fn) {
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let held = false;
+    while (!held) {
+        try {
+            mkdirSync(lockDir);
+            held = true;
+        }
+        catch {
+            try {
+                if (Date.now() - statSync(lockDir).mtimeMs > LOCK_STALE_MS) {
+                    rmdirSync(lockDir);
+                    continue;
+                }
+            }
+            catch {
+                continue; // released meanwhile: try again at once
+            }
+            if (Date.now() >= deadline)
+                break;
+            sleepMs(2);
+        }
+    }
+    try {
+        fn();
+    }
+    finally {
+        if (held) {
+            try {
+                rmdirSync(lockDir);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+}
+/** Default store directory — read at call time so env changes are honoured. */
+function defaultDir() {
+    return process.env.CYBEDEFEND_BASELINE_DIR ?? join(homedir(), '.cybedefend');
+}
+/**
+ * Lexical normalization: resolve `.` / `..`, collapse duplicate slashes, drop a
+ * trailing slash. Posix semantics (agents and the guard deal in posix-style
+ * absolute paths on the host the hook runs on). Relative paths are normalized
+ * lexically but kept relative — the caller is expected to pass absolute paths.
+ */
+function normalizePath(p) {
+    if (typeof p !== 'string')
+        return '';
+    const trimmed = p.trim();
+    if (trimmed.length === 0)
+        return '';
+    let n = posix.normalize(trimmed);
+    if (n.length > 1 && n.endsWith('/'))
+        n = n.slice(0, -1);
+    return n;
+}
+function isUsable(p) {
+    return typeof p === 'string' && p.trim().length > 0;
+}
+/** Narrow unknown JSON into a well-typed store, discarding anything malformed. */
+function coerce(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return {};
+    const out = {};
+    for (const [sessionId, value] of Object.entries(raw)) {
+        if (typeof value !== 'object' || value === null)
+            continue;
+        const paths = value.paths;
+        if (!Array.isArray(paths))
+            continue;
+        const entries = [];
+        for (const item of paths) {
+            if (typeof item !== 'object' || item === null)
+                continue;
+            const path = item.path;
+            const at = item.at;
+            if (typeof path === 'string' && typeof at === 'number' && Number.isFinite(at)) {
+                entries.push({ path, at });
+            }
+        }
+        out[sessionId] = { paths: entries };
+    }
+    return out;
+}
+export function makeSessionWritesStore(opts = {}) {
+    const dir = opts.dir ?? defaultDir();
+    const file = join(dir, SESSION_WRITES_FILE);
+    const now = opts.now ?? (() => Date.now());
+    const maxPaths = typeof opts.maxPaths === 'number' && opts.maxPaths > 0
+        ? Math.floor(opts.maxPaths)
+        : DEFAULT_MAX_PATHS;
+    const ttlMs = typeof opts.ttlMs === 'number' && opts.ttlMs > 0
+        ? opts.ttlMs
+        : DEFAULT_SESSION_WRITES_TTL_MS;
+    function readAll() {
+        if (!existsSync(file))
+            return {};
+        try {
+            return coerce(JSON.parse(readFileSync(file, 'utf8')));
+        }
+        catch {
+            return {}; // missing / corrupt → treat as empty, never throw
+        }
+    }
+    /** Drop expired entries (and emptied sessions). Returns a fresh store. */
+    function pruneExpired(all, t) {
+        const out = {};
+        for (const [sessionId, entry] of Object.entries(all)) {
+            const live = entry.paths.filter((e) => t - e.at <= ttlMs);
+            if (live.length > 0)
+                out[sessionId] = { paths: live };
+        }
+        return out;
+    }
+    function writeAll(all) {
+        try {
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            const tmp = `${file}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify(all), 'utf8');
+            renameSync(tmp, file);
+        }
+        catch {
+            // Best-effort — never block the hook on an I/O error.
+        }
+    }
+    function record(sessionId, paths) {
+        if (!isUsable(sessionId))
+            return; // no session → nothing to attribute
+        if (!Array.isArray(paths))
+            return;
+        const usable = paths.filter(isUsable);
+        if (usable.length === 0)
+            return;
+        try {
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            withLock(`${file}.lock`, () => {
+                const t = now();
+                const all = pruneExpired(readAll(), t);
+                const entry = all[sessionId] ?? { paths: [] };
+                for (const given of usable) {
+                    const norm = normalizePath(given);
+                    // Dedupe by normalized form, keeping the freshest occurrence last
+                    // (so slicing from the end keeps the newest).
+                    entry.paths = entry.paths.filter((e) => normalizePath(e.path) !== norm);
+                    entry.paths.push({ path: given, at: t });
+                }
+                if (entry.paths.length > maxPaths) {
+                    entry.paths = entry.paths.slice(-maxPaths); // keep newest
+                }
+                all[sessionId] = entry;
+                writeAll(all);
+            });
+        }
+        catch {
+            // Best-effort — swallow everything.
+        }
+    }
+    /** Live (non-expired) entries for a session, without persisting the prune. */
+    function liveEntries(sessionId) {
+        const t = now();
+        const entry = readAll()[sessionId];
+        if (!entry)
+            return [];
+        return entry.paths.filter((e) => t - e.at <= ttlMs);
+    }
+    function wasWritten(sessionId, path) {
+        if (!isUsable(sessionId) || !isUsable(path))
+            return false;
+        const norm = normalizePath(path);
+        if (norm.length === 0)
+            return false;
+        return liveEntries(sessionId).some((e) => normalizePath(e.path) === norm);
+    }
+    function writtenThisSession(sessionId) {
+        if (!isUsable(sessionId))
+            return [];
+        return liveEntries(sessionId).map((e) => e.path);
+    }
+    return { record, wasWritten, writtenThisSession };
+}
+//# sourceMappingURL=session-writes.js.map

package/dist/hooks/runtime/session-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-writes.js","sourceRoot":"","sources":["../../../src/hooks/runtime/session-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAExC,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhE,qCAAqC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAoChE,oEAAoE;AACpE,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,+EAA+E;AAC/E,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,OAAe,EAAE,EAAc;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;IAC3C,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC3D,SAAS,CAAC,OAAO,CAAC,CAAC;oBACnB,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,wCAAwC;YACpD,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;YAClC,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,EAAE,EAAE,CAAC;IACP,CAAC;YAAS,CAAC;QACT,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAChF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YACxD,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;YAC/C,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;YACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,iBAAiB,CAAC;IACxB,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,6BAA6B,CAAC;IAEpC,SAAS,OAAO;QACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,kDAAkD;QAC/D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,SAAS,YAAY,CAAC,GAAe,EAAE,CAAS;QAC9C,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,QAAQ,CAAC,GAAe;QAC/B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAChD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,SAA6B,EAAE,KAAe;QAC5D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,oCAAoC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEhC,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,QAAQ,CAAC,GAAG,IAAI,OAAO,EAAE,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gBAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;oBAClC,kEAAkE;oBAClE,8CAA8C;oBAC9C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;oBACxE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;oBAClC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;gBAC5D,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,SAAS,WAAW,CAAC,SAAiB;QACpC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;IACtD,CAAC;IAED,SAAS,UAAU,CAAC,SAA6B,EAAE,IAAY;QAC7D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,kBAAkB,CAAC,SAA6B;QACvD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AACpD,CAAC"}

package/dist/hooks/runtime/sniff.js

@@ -7,10 +7,12 @@
  *
  * Schema cheat sheet:
  *   - Windsurf:    `.agent_action_name` + `.tool_info.{file_path, edits}`
- *   - VS Code:     `.hookEventName` (camelCase field) + `.tool_input.…`
+ *   - VS Code:     `.hook_event_name` with PascalCase value + an ISO-8601
+ *                  `.timestamp` (both its harnesses); older builds sent a
+ *                  camelCase `.hookEventName` field
  *   - Cursor:      `.hook_event_name` with **camelCase** value (`preToolUse`)
- *   - Codex:       `.hook_event_name` with PascalCase value + `tool_name`
- *                  `apply_patch` carrying a unified diff in `tool_input.patch`
+ *   - Codex:       `.hook_event_name` with PascalCase value + `turn_id`, or
+ *                  `tool_name` `apply_patch` carrying a unified diff
  *   - Claude Code: `.hook_event_name` with PascalCase value (default fallback)
  */
 import { homedir } from 'node:os';
@@ -104,11 +106,23 @@ export function sniff(input) {
             // commands, so tool_name alone cannot tell them apart there — Codex's
             // envelope carries a `turn_id` (its documented extension), Claude
             // Code's does not (observed on Codex 0.142 / Claude Code 2.1.267).
+            //
+            // VS Code Copilot, configured with PascalCase events (our
+            // `~/.copilot/hooks/cybedefend.json`), sends this same snake_case shape
+            // and even Claude tool names — but always with an ISO-8601
+            // `timestamp`, a field neither Claude Code nor Codex sends. Its
+            // output contract differs (see emit.ts), so it must not pass as
+            // Claude Code.
             const toolName = typeof input.tool_name === 'string' ? input.tool_name : '';
-            client =
-                toolName === 'apply_patch' || 'turn_id' in input
-                    ? 'codex'
-                    : 'claude-code';
+            if (toolName === 'apply_patch' || 'turn_id' in input) {
+                client = 'codex';
+            }
+            else if (hasIsoTimestamp(input)) {
+                client = 'vscode';
+            }
+            else {
+                client = 'claude-code';
+            }
         }
         return extractToolInputShape(input, client);
     }
@@ -122,6 +136,11 @@ export function sniff(input) {
         raw: input,
     };
 }
+/** VS Code's snake_case payloads carry `timestamp` as an ISO-8601 string. */
+function hasIsoTimestamp(input) {
+    return (typeof input.timestamp === 'string' &&
+        /^\d{4}-\d{2}-\d{2}T/.test(input.timestamp));
+}
 /**
  * Shared extraction for the Claude-Code-shaped families (Cursor / Codex /
  * Claude Code / VS Code Copilot). Pulls `tool_name` + `tool_input.*`,

package/dist/hooks/runtime/sniff.js.map

@@ -1 +1 @@
-{"version":3,"file":"sniff.js","sourceRoot":"","sources":["../../../src/hooks/runtime/sniff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAc;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAC9B,KAAiD;IAEjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,yCAAyC;AACzC,SAAS,iBAAiB,CACxB,KAAiD;IAEjD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,KAA8B;IAClD,wEAAwE;IACxE,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACvC,MAAM,QAAQ,GAAI,KAAK,CAAC,SAAqC,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,iBAAiB,CAClC,QAAQ,CAAC,KAAmD,CAC7D,CAAC;QACF,IAAI,QAAQ,GAAG,MAAM,CAAC;QACtB,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAChE,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACrE,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACrC,UAAU;YACV,GAAG,EAAE,KAAK;SACX,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,eAAe,IAAI,KAAK,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,MAAgB,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,qDAAqD;YACrD,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM;gBACJ,QAAQ,KAAK,aAAa,IAAI,SAAS,IAAI,KAAK;oBAC9C,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,aAAa,CAAC;QACtB,CAAC;QACD,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAA8B,EAC9B,MAAgB;IAEhB,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAI,KAAK,CAAC,UAAsC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ,GACV,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,OAAO,GACX,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,UAAU,GAAG,OAAO,CAAC;YACrB,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACpB,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAC3B,CAAC;YACF,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,UAAU;gBACR,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM;QACR,KAAK,MAAM;YACT,UAAU;gBACR,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM;QACR,KAAK,WAAW;YACd,UAAU,GAAG,uBAAuB,CAClC,SAAS,CAAC,KAAmD,CAC9D,CAAC;YACF,MAAM;QACR,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,KAAK,GACT,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;gBACjC,CAAC,CAAC,SAAS,CAAC,KAAK;gBACjB,CAAC,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;oBACrC,CAAC,CAAC,SAAS,CAAC,OAAO;oBACnB,CAAC,CAAC,EAAE,CAAC;YACX,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM;QACR,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,QAAQ;YAAE,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjE,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ;QAAE,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"sniff.js","sourceRoot":"","sources":["../../../src/hooks/runtime/sniff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAc;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAC9B,KAAiD;IAEjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,yCAAyC;AACzC,SAAS,iBAAiB,CACxB,KAAiD;IAEjD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,KAA8B;IAClD,wEAAwE;IACxE,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACvC,MAAM,QAAQ,GAAI,KAAK,CAAC,SAAqC,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,iBAAiB,CAClC,QAAQ,CAAC,KAAmD,CAC7D,CAAC;QACF,IAAI,QAAQ,GAAG,MAAM,CAAC;QACtB,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAChE,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACrE,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACrC,UAAU;YACV,GAAG,EAAE,KAAK;SACX,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,4DAA4D;IAC5D,IAAI,eAAe,IAAI,KAAK,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,IAAI,iBAAiB,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,MAAgB,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,qDAAqD;YACrD,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,EAAE;YACF,0DAA0D;YAC1D,wEAAwE;YACxE,2DAA2D;YAC3D,gEAAgE;YAChE,gEAAgE;YAChE,eAAe;YACf,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,QAAQ,KAAK,aAAa,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACrD,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC;iBAAM,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,aAAa,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAA8B;IACrD,OAAO,CACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAA8B,EAC9B,MAAgB;IAEhB,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAI,KAAK,CAAC,UAAsC,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ,GACV,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,OAAO,GACX,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,UAAU,GAAG,OAAO,CAAC;YACrB,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACpB,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAC3B,CAAC;YACF,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,UAAU;gBACR,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM;QACR,KAAK,MAAM;YACT,UAAU;gBACR,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM;QACR,KAAK,WAAW;YACd,UAAU,GAAG,uBAAuB,CAClC,SAAS,CAAC,KAAmD,CAC9D,CAAC;YACF,MAAM;QACR,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,KAAK,GACT,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;gBACjC,CAAC,CAAC,SAAS,CAAC,KAAK;gBACjB,CAAC,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;oBACrC,CAAC,CAAC,SAAS,CAAC,OAAO;oBACnB,CAAC,CAAC,EAAE,CAAC;YACX,UAAU,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,QAAQ;gBAAE,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM;QACR,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,QAAQ;YAAE,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjE,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ;QAAE,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC3E,CAAC"}

package/dist/hooks/runtime/target-resolve.js

@@ -0,0 +1,336 @@
+/**
+ * Level 0 — disk resolution of ONE raw target path into the set of REAL
+ * candidate paths it may resolve to.
+ *
+ * Why this exists (hardening SPEC, "Measured gaps"): the Action Guards
+ * evaluator matches a file path as a LITERAL STRING. That is blind to two
+ * trivially evasive shapes:
+ *
+ *   - a shell glob — `cat .en?`, `cat config/*.json` — never literally equals
+ *     `.env`, so the sensitive-file rule does not fire;
+ *   - a symlink — `app.py -> /proc/self/environ`, or a link whose name is
+ *     innocuous but whose target is `.env` — reads the secret while the rule
+ *     only ever sees `app.py`.
+ *
+ * The PreToolUse hook runs LOCALLY on the developer machine, so disk access is
+ * allowed here. This module turns a raw path (as written in a tool envelope or
+ * a command argument) into every real path it may touch, so the integrator can
+ * run the file rules against each one:
+ *
+ *   - a leading `~` / `~/` is expanded to `homeDir`;
+ *   - glob metacharacters (`*`, `?`, `[…]`) are expanded against the REAL
+ *     filesystem relative to `cwd`, BOUNDED (at most `maxMatches` results and a
+ *     capped number of directory reads); on the cap it stops and returns what
+ *     it found plus the original (lexically-normalized) pattern;
+ *   - every existing result is `realpath()`-ed to follow symlinks; BOTH the
+ *     lexical path and its realpath target are returned when they differ, so a
+ *     symlink to `.env` yields the `.env` realpath too;
+ *   - a path that does NOT exist still contributes its lexically-resolved form
+ *     (absolute, cwd-joined, `~`-expanded, `.`/`..` collapsed) so rules still
+ *     fire on a not-yet-existing target;
+ *   - the lexically-normalized input itself is ALWAYS included (deduped), so
+ *     the caller never loses the original.
+ *
+ * Design rules (match the rest of the hardening work):
+ *   - NEVER THROWS. A symlink loop, a permission error, an ENOENT — all are
+ *     swallowed and the function returns best-effort. Blindness must fail
+ *     toward "return more candidates", never toward a silent allow.
+ *   - BOUNDED TIME. No unbounded recursion: the directory walk is an explicit
+ *     queue with a readdir budget, a depth cap, and a visited-realpath set that
+ *     breaks symlink cycles.
+ *   - INJECTABLE FS. All disk access goes through a minimal `FsLike` passed via
+ *     `opts.fs` (defaulting to `node:fs`), so tests drive a fake in-memory FS
+ *     and never touch the real disk.
+ */
+import { existsSync as nodeExistsSync, readdirSync as nodeReaddirSync, realpathSync as nodeRealpathSync, statSync as nodeStatSync, lstatSync as nodeLstatSync, } from 'node:fs';
+import { matchGlob } from '../../guards-evaluator/glob.js';
+/** Default: bind `node:fs` into the narrow `FsLike` shape. */
+const DEFAULT_FS = {
+    existsSync: (p) => nodeExistsSync(p),
+    readdirSync: (p) => nodeReaddirSync(p),
+    realpathSync: (p) => nodeRealpathSync(p),
+    statSync: (p) => nodeStatSync(p),
+    lstatSync: (p) => nodeLstatSync(p),
+};
+const DEFAULT_MAX_MATCHES = 64;
+/** Max directories descended through for a `**` segment. */
+const MAX_DIR_DEPTH = 16;
+// ---------------------------------------------------------------------------
+// Pure path helpers (no I/O)
+// ---------------------------------------------------------------------------
+/** Windows backslashes → forward slashes, consistent with glob.ts. */
+function normSep(s) {
+    return s.replace(/\\/g, '/');
+}
+/** Expand a leading `~` / `~/` only; a `~` elsewhere is left untouched. */
+function expandTilde(p, homeDir) {
+    if (p === '~')
+        return homeDir;
+    if (p.startsWith('~/'))
+        return homeDir + p.slice(1);
+    return p;
+}
+function isAbsolute(p) {
+    return p.startsWith('/');
+}
+/**
+ * Collapse `.`, `..`, empty and duplicate segments WITHOUT touching glob
+ * metacharacters (they live inside a segment, never equal `.`/`..`/'').
+ * Assumes `/`-separated input.
+ */
+function collapse(p) {
+    const abs = isAbsolute(p);
+    const out = [];
+    for (const part of p.split('/')) {
+        if (part === '' || part === '.')
+            continue;
+        if (part === '..') {
+            if (out.length > 0 && out[out.length - 1] !== '..')
+                out.pop();
+            else if (!abs)
+                out.push('..');
+            // For an absolute path, a leading `..` is dropped (cannot go above root).
+            continue;
+        }
+        out.push(part);
+    }
+    const joined = out.join('/');
+    if (abs)
+        return '/' + joined;
+    return joined === '' ? '.' : joined;
+}
+/**
+ * Absolute, `~`-expanded, cwd-joined, `.`/`..`-collapsed form of `raw`. Glob
+ * metacharacters survive untouched (so it doubles as the absolute pattern for
+ * glob expansion).
+ */
+function lexicalResolve(raw, cwd, homeDir) {
+    let p = expandTilde(normSep(raw), homeDir);
+    if (!isAbsolute(p)) {
+        const base = cwd === '' ? '/' : cwd;
+        p = base + '/' + p;
+    }
+    return collapse(p);
+}
+function joinPath(dir, name) {
+    return dir === '/' ? '/' + name : dir + '/' + name;
+}
+/**
+ * A pattern is a glob only for `*` / `?`, or a BALANCED `[…]` character class.
+ * A lone `[` with no closing `]` (and no `*`/`?`) is a literal path.
+ */
+function hasGlobMeta(p) {
+    return /[*?]/.test(p) || /\[[^/\]]*\]/.test(p);
+}
+function dedupe(xs) {
+    return [...new Set(xs.filter((x) => x.length > 0))];
+}
+// ---------------------------------------------------------------------------
+// Safe FS wrappers — every one swallows errors (never throw on the hot path)
+// ---------------------------------------------------------------------------
+function safeExists(fs, p) {
+    try {
+        return fs.existsSync(p);
+    }
+    catch {
+        return false;
+    }
+}
+function safeReaddir(fs, p) {
+    try {
+        const r = fs.readdirSync(p);
+        return Array.isArray(r) ? r : [];
+    }
+    catch {
+        return [];
+    }
+}
+function safeIsDir(fs, p) {
+    try {
+        return fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function safeIsSymlink(fs, p) {
+    try {
+        return fs.lstatSync(p).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** Realpath, normalized; on any failure returns the input unchanged. */
+function safeRealpath(fs, p) {
+    try {
+        const r = fs.realpathSync(p);
+        return typeof r === 'string' && r.length > 0 ? normSep(r) : p;
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Push `lexPath` and, when it exists (or is a symlink) and its realpath
+ * differs, the realpath target too.
+ */
+function pushWithReal(out, fs, lexPath) {
+    out.push(lexPath);
+    if (safeExists(fs, lexPath) || safeIsSymlink(fs, lexPath)) {
+        const real = safeRealpath(fs, lexPath);
+        if (real !== lexPath)
+            out.push(real);
+    }
+}
+/**
+ * All directories reachable from `starts` (inclusive of `starts` themselves),
+ * for a `**` segment. Explicit BFS — bounded by the readdir budget, a depth
+ * cap, and a visited-realpath set that breaks symlink cycles.
+ */
+function collectDescendants(fs, starts, state) {
+    const result = [];
+    const visited = new Set();
+    const queue = starts.map((d) => ({
+        dir: d,
+        depth: 0,
+    }));
+    while (queue.length > 0) {
+        if (state.readdirBudget <= 0) {
+            state.capped = true;
+            break;
+        }
+        const { dir, depth } = queue.shift();
+        const canonical = safeRealpath(fs, dir);
+        if (visited.has(canonical))
+            continue; // cycle / already seen
+        visited.add(canonical);
+        result.push(dir);
+        if (depth >= MAX_DIR_DEPTH)
+            continue;
+        state.readdirBudget--;
+        for (const name of safeReaddir(fs, dir)) {
+            const child = joinPath(dir, name);
+            if (safeIsDir(fs, child))
+                queue.push({ dir: child, depth: depth + 1 });
+        }
+    }
+    return result;
+}
+/**
+ * Expand an absolute `/`-separated glob pattern into existing matches, walking
+ * one path segment at a time. Bounded: stops at `maxMatches` matches or once
+ * the readdir budget is spent, flagging `capped`.
+ */
+function expandGlob(fs, absPattern, homeDir, maxMatches) {
+    const matches = [];
+    // Budget scales with the match cap but stays bounded for tiny caps.
+    const state = {
+        readdirBudget: Math.max(256, maxMatches * 8),
+        capped: false,
+    };
+    const addMatch = (p) => {
+        if (matches.length >= maxMatches) {
+            state.capped = true;
+            return;
+        }
+        matches.push(p);
+    };
+    const segs = absPattern.split('/').filter((s) => s.length > 0);
+    let frontier = ['/'];
+    for (let s = 0; s < segs.length; s++) {
+        if (state.capped || state.readdirBudget <= 0) {
+            state.capped = true;
+            break;
+        }
+        const seg = segs[s];
+        const isLast = s === segs.length - 1;
+        if (seg === '**') {
+            const dirs = collectDescendants(fs, frontier, state);
+            if (isLast)
+                for (const d of dirs)
+                    addMatch(d);
+            frontier = dirs;
+            continue;
+        }
+        const next = [];
+        const glob = hasGlobMeta(seg);
+        for (const dir of frontier) {
+            if (state.capped || state.readdirBudget <= 0) {
+                state.capped = true;
+                break;
+            }
+            if (glob) {
+                state.readdirBudget--;
+                for (const name of safeReaddir(fs, dir)) {
+                    if (!matchGlob(seg, name, { homeDir }))
+                        continue;
+                    const child = joinPath(dir, name);
+                    if (isLast) {
+                        addMatch(child);
+                        if (state.capped)
+                            break;
+                    }
+                    else if (safeIsDir(fs, child)) {
+                        next.push(child);
+                    }
+                }
+            }
+            else {
+                // A literal segment: no readdir needed, just probe the one path.
+                const child = joinPath(dir, seg);
+                if (isLast) {
+                    if (safeExists(fs, child) || safeIsSymlink(fs, child))
+                        addMatch(child);
+                }
+                else if (safeIsDir(fs, child)) {
+                    next.push(child);
+                }
+            }
+        }
+        frontier = next;
+    }
+    return { matches, capped: state.capped };
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+/**
+ * Resolve ONE raw path into every real candidate path it may touch. Pure of
+ * exceptions; bounded in time. The first element is always the
+ * lexically-normalized input; it is followed by glob matches and symlink
+ * realpath targets, deduped in first-seen order.
+ */
+export function resolveCandidatePaths(rawPath, opts) {
+    const out = [];
+    try {
+        if (typeof rawPath !== 'string' || rawPath.length === 0)
+            return [];
+        const fs = opts.fs ?? DEFAULT_FS;
+        const homeDir = normSep(opts.homeDir ?? '');
+        const cwd = normSep(opts.cwd ?? '');
+        const maxMatches = typeof opts.maxMatches === 'number' && opts.maxMatches > 0
+            ? Math.floor(opts.maxMatches)
+            : DEFAULT_MAX_MATCHES;
+        // Always include the lexically-normalized input (also the glob pattern
+        // itself when the raw path globs). This is the "plus the original pattern"
+        // the SPEC requires on a cap, and the caller's guaranteed fallback.
+        const lexInput = lexicalResolve(rawPath, cwd, homeDir);
+        out.push(lexInput);
+        if (hasGlobMeta(rawPath)) {
+            const { matches } = expandGlob(fs, lexInput, homeDir, maxMatches);
+            for (const m of matches)
+                pushWithReal(out, fs, m);
+        }
+        else {
+            // Non-glob: add the realpath target when the lexical path is a symlink
+            // (or exists and its canonical form differs).
+            pushWithReal(out, fs, lexInput);
+        }
+    }
+    catch {
+        // Never throw: return whatever was gathered (at least the lexical input).
+    }
+    return dedupe(out);
+}
+//# sourceMappingURL=target-resolve.js.map