@datagusto/cli 0.0.0-stage → 0.1.0

package/vendor/kiro/dist/index.js

@@ -0,0 +1,735 @@
+#!/usr/bin/env node
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Kiro CLI Hook Entry Point
+// ---------------------------------------------------------------------------
+//
+// Kiro CLI, like Claude Code, spawns this script as a fresh process for each
+// hook event and writes one JSON payload to stdin — same payload shape as
+// Claude Code's (hook_event_name, session_id, tool_name, tool_input,
+// tool_response, prompt, source). The difference is entirely in how the
+// decision is communicated back: Kiro CLI has no stdout-JSON decision
+// channel, only a process exit code plus stderr text:
+//
+//   - exit 0                → allow, nothing printed
+//   - exit 2 + stderr text  → block, stderr holds the human-readable reason
+//   - "ask" (severity medium + injected instruction) has no dialog to show in
+//     Kiro CLI, so it degrades to a hard block (exit 2) — there is no softer
+//     option available.
+//   - monitoring mode always logs the would-be verdict via dbg but never emits
+//     a block. Two switches turn it on: the plugin's own `monitorOnly` config,
+//     and the platform's per-agent `monitoring_mode_enabled` flag returned on
+//     alignment / validate responses. The platform flag governs VERDICTS only —
+//     it never relaxes the error paths below, since an unvalidated call is not
+//     a call the platform judged safe.
+//   - fail-closed emits exit 2 on a Datagusto API error, exactly like a
+//     policy block, EXCEPT the one deliberate exception: missing
+//     serverUrl/apiKey exits 1 (warn-and-allow) so a broken config can never
+//     hard-block every tool call in the session.
+//
+// Incoming events are matched against `hook_event_name` on the stdin payload,
+// which Kiro spells differently from the hook file's `trigger` field — see the
+// "Hook event normalization" section below. Anything that still doesn't
+// resolve to a known event is treated as unvalidatable, not as safe.
+//
+// PostToolUse enforcement here is exit-2 + stderr only — Kiro CLI has no
+// confirmed mechanism analogous to Claude Code's `updatedToolOutput` rewrite,
+// so a blocked tool result cannot be suppressed/replaced, only flagged.
+import { readFileSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DatagustoApiClient } from "./api-client.js";
+import { buildToolDefinitions, detectEngine } from "./engine.js";
+import { extractBlockReason, extractPhase, hashPayload, isClaudeCodeCommand, normalizeEvaluateResponse, serializeToolResult, } from "./extractors.js";
+import { describeMonitoring, readMonitoringFlag, resolveMonitoring, } from "./monitoring.js";
+import { deleteState, loadState, mutateState, saveState } from "./state.js";
+/**
+ * Middleware self-declaration of the agent framework, sent on every
+ * alignment and validation request. Mirrors the Claude Code plugin's
+ * `AGENT_TYPE` constant; the Datagusto server uses this to select the
+ * matching AgentProfile once a Kiro-specific profile is configured.
+ */
+const AGENT_TYPE = "kiro";
+// Env var overrides use the DATAGUSTO_SAFETY_* prefix and take precedence
+// over kiro.json values. This remains the config path for the dev workflow
+// of piping synthetic stdin payloads straight into dist/index.js without a
+// CLI host.
+const ENV_PREFIX = "DATAGUSTO_SAFETY_";
+function envStr(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    return v && v.length > 0 ? v : undefined;
+}
+function envNum(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    if (v === undefined || v === "")
+        return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+}
+function envBool(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    if (v === undefined)
+        return undefined;
+    const lower = v.toLowerCase();
+    if (["true", "1", "yes"].includes(lower))
+        return true;
+    if (["false", "0", "no"].includes(lower))
+        return false;
+    return undefined;
+}
+/**
+ * Load plugin config from kiro.json (resolved next to this script's compiled
+ * location, or overridden via DATAGUSTO_SAFETY_CONFIG_PATH) with
+ * DATAGUSTO_SAFETY_* env vars taking priority over the file. Unlike Claude
+ * Code, there is no plugin-host userConfig layer (no CLAUDE_PLUGIN_OPTION_*
+ * equivalent) — env vars + file config is the whole story here.
+ */
+function loadConfig() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const configPath = envStr("CONFIG_PATH") ?? join(here, "..", "kiro.json");
+    let fileConfig = {};
+    try {
+        fileConfig = JSON.parse(readFileSync(configPath, "utf8"));
+    }
+    catch {
+        // No config file on disk — rely entirely on env vars.
+    }
+    return {
+        serverUrl: envStr("SERVER_URL") ?? fileConfig.serverUrl ?? "",
+        apiKey: envStr("API_KEY") ?? fileConfig.apiKey ?? "",
+        timeoutMs: envNum("TIMEOUT_MS") ?? fileConfig.timeoutMs ?? 30_000,
+        failClosed: envBool("FAIL_CLOSED") ?? fileConfig.failClosed ?? true,
+        verbose: envBool("VERBOSE") ?? fileConfig.verbose ?? false,
+        monitorOnly: envBool("MONITOR_ONLY") ?? fileConfig.monitorOnly ?? false,
+        allowUncategorizedTools: envBool("ALLOW_UNCATEGORIZED_TOOLS") ?? fileConfig.allowUncategorizedTools ?? true,
+    };
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+// ---------------------------------------------------------------------------
+// Decision adapter — the only piece that differs from Claude Code's index.
+// Kiro CLI has no stdout-JSON decision channel: the whole verdict is exit
+// code + stderr text.
+// ---------------------------------------------------------------------------
+const EXIT_ALLOW = 0;
+const EXIT_BLOCK = 2;
+/**
+ * Write to a stdio fd SYNCHRONOUSLY.
+ *
+ * Every write in this file is followed, sooner or later, by `process.exit()`.
+ * That combination is unsafe with `process.stdout`/`process.stderr`: when the
+ * host spawns this hook with piped stdio (which is exactly how Kiro captures
+ * our output), those streams are ASYNCHRONOUS on POSIX, and `process.exit()`
+ * abandons whatever is still buffered. Measured on this codebase: a 70 KB
+ * stderr write followed by `process.exit(2)` arrives truncated at the 64 KB
+ * pipe buffer, silently losing the tail.
+ *
+ * That matters because a block reason is assembled from user-authored
+ * guardrail messages joined together (see `extractBlockReason`), so its length
+ * is not bounded by anything we control. `writeSync` bypasses the stream
+ * buffer entirely, so the text is in the pipe before we exit.
+ *
+ * Handles short writes, a full pipe (EAGAIN), and a reader that has already
+ * gone away (EPIPE). Falls back to the stream API rather than throwing: a
+ * logging failure must never become an enforcement failure.
+ */
+function writeFdSync(fd, text) {
+    const buf = Buffer.from(text, "utf8");
+    let offset = 0;
+    while (offset < buf.length) {
+        try {
+            offset += writeSync(fd, buf, offset);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "EAGAIN")
+                continue; // pipe momentarily full — retry
+            if (code === "EPIPE")
+                return; // reader closed — nothing to deliver
+            (fd === 2 ? process.stderr : process.stdout).write(buf.subarray(offset));
+            return;
+        }
+    }
+}
+/** Synchronous stderr write. Use instead of `process.stderr.write`. */
+function writeErr(text) {
+    writeFdSync(2, text);
+}
+/**
+ * Allow. Kiro CLI's contract for this is exit 0 with nothing printed, which
+ * is simply `process.exitCode`'s default — this function is a no-op, kept
+ * as an explicit call site for symmetry/readability with emitBlock/emitInject.
+ */
+function emitAllow() {
+    // Nothing to do; process.exitCode defaults to EXIT_ALLOW (0).
+}
+/**
+ * Block. Kiro CLI's contract is exit 2 with the human-readable reason on
+ * stderr. This is the ONLY exit code that means "block" — never use exit 1
+ * (reserved for the deliberate fail-open on missing config in main()) or any
+ * other non-zero code here.
+ *
+ * The reason is written synchronously: it is the agent's only explanation of
+ * why the call was denied, and losing it to a buffer flush would leave a
+ * correct block that nobody can act on.
+ */
+function emitBlock(reason) {
+    writeErr(reason + "\n");
+    process.exitCode = EXIT_BLOCK;
+}
+/**
+ * Best-effort context injection (PostToolUse "inject" case). Kiro CLI has no
+ * confirmed additionalContext-equivalent channel, so this writes the note to
+ * stdout and leaves the exit code untouched — an injection never blocks.
+ */
+function emitInject(note) {
+    writeFdSync(1, note + "\n");
+}
+/**
+ * User-facing notice that does NOT change the verdict.
+ *
+ * Claude Code has to smuggle this through the hook output's `systemMessage`
+ * field, because it only shows hook stderr on a non-zero exit and a hook may
+ * write just one JSON document. Kiro CLI has neither constraint: stderr is a
+ * free-form side channel, so the notice is simply written when it happens.
+ * Deliberately leaves process.exitCode untouched — a notice must never turn an
+ * allow into a block.
+ */
+function emitNotice(text) {
+    writeErr(text + "\n");
+}
+/**
+ * Keyed by the normalized form (lowercased, separators stripped) so that
+ * "preToolUse", "PreToolUse", "pre_tool_use" and "pre-tool-use" all resolve to
+ * the same canonical event.
+ */
+const HOOK_EVENT_ALIASES = {
+    sessionstart: "SessionStart",
+    agentspawn: "SessionStart", // CLI 2.x name for what 3.0 calls SessionStart
+    userpromptsubmit: "UserPromptSubmit",
+    pretooluse: "PreToolUse",
+    posttooluse: "PostToolUse",
+    stop: "Stop",
+};
+function normalizeHookEvent(value) {
+    if (typeof value !== "string")
+        return null;
+    const key = value.trim().toLowerCase().replace(/[\s_-]/g, "");
+    return HOOK_EVENT_ALIASES[key] ?? null;
+}
+/**
+ * True when the payload carries tool context. This is what decides how an
+ * unrecognized event name is handled: an unknown TOOL event is a call we were
+ * invoked to vet and could not, so it must fail closed; an unknown lifecycle
+ * event gates no tool call and is safe to pass through.
+ */
+function hasToolContext(payload) {
+    return typeof payload.tool_name === "string" && payload.tool_name.length > 0;
+}
+/**
+ * Terminal handler for an event name the alias table doesn't know.
+ *
+ * This is the branch that used to be a bare `emitAllow()`. Passing an
+ * unrecognized tool event through is indistinguishable from having no
+ * guardrail at all, so when the payload carries a tool call we block instead
+ * — loudly, naming the event, so the alias table can be extended rather than
+ * the failure being absorbed silently. Honors failClosed/monitorOnly like
+ * every other enforcement path.
+ */
+function handleUnrecognizedEvent(rawEventName, payload, cfg, dbg) {
+    if (!hasToolContext(payload)) {
+        dbg(`Unrecognized non-tool hook event '${rawEventName}'; no tool call to gate, allowing.`);
+        emitAllow();
+        return;
+    }
+    const toolName = String(payload.tool_name);
+    if (cfg.failClosed && !cfg.monitorOnly) {
+        emitBlock(`Datagusto safety: unrecognized hook event '${rawEventName}' carrying tool '${toolName}'. ` +
+            "The call could not be validated, so it was blocked. " +
+            "Add this event to the plugin's alias table if it is legitimate.");
+    }
+    else {
+        dbg(`[MONITOR] Unrecognized tool event '${rawEventName}' for '${toolName}' not blocked ` +
+            `(failClosed=${cfg.failClosed}, monitorOnly=${cfg.monitorOnly}).`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Monitoring mode
+//
+// Two independent switches turn enforcement off: the plugin's own
+// `monitorOnly` config, and the platform's per-agent monitoring mode
+// (`monitoring_mode_enabled`, returned on alignment / validate responses).
+// Either being true means a verdict is logged but not enforced.
+//
+// The distinction that matters for a fail-closed plugin: the platform flag
+// governs VERDICTS ONLY. It never relaxes the error paths (API failure,
+// exception, empty stdin, unrecognized tool event), because those carry no
+// verdict to begin with — an unvalidated call is not a call the platform
+// judged safe. Only the operator's own `monitorOnly` relaxes those.
+// ---------------------------------------------------------------------------
+const PLATFORM_MONITORING_NOTICE = "[datagusto] Platform monitoring mode is enabled for this agent: " +
+    "guardrail verdicts are recorded but not enforced.";
+/**
+ * Resolve whether verdicts are enforced for this hook invocation.
+ *
+ * The platform value comes from the current response when it carries the flag,
+ * else from the value most recently cached for this session, else false (older
+ * servers omit it and keep their previous behaviour). Bookkeeping is written
+ * through mutateState() against a freshly re-read state rather than the
+ * caller's snapshot, because Kiro can run hook processes for one session
+ * concurrently and each handler awaits HTTP round-trips before saving.
+ *
+ * The first time the platform flag is seen true in a session, a notice is
+ * written to stderr regardless of `verbose` — the operator should know
+ * enforcement is off. Best-effort: whether Kiro surfaces stderr on a zero exit
+ * is unconfirmed, so this is a diagnostic, not a guarantee.
+ */
+function resolveMonitoringForHook(cfg, sessionId, state, response, dbg) {
+    const flag = readMonitoringFlag(response);
+    let showNotice = false;
+    const fresh = mutateState(sessionId, (s) => {
+        if (flag !== undefined)
+            s.monitoringModeEnabled = flag;
+        const platformEnabled = typeof flag === "boolean" ? flag : s.monitoringModeEnabled === true;
+        if (platformEnabled && !s.monitoringNoticeShown) {
+            s.monitoringNoticeShown = true;
+            showNotice = true;
+        }
+    });
+    state.monitoringModeEnabled = fresh.monitoringModeEnabled;
+    state.monitoringNoticeShown = fresh.monitoringNoticeShown;
+    const decision = resolveMonitoring(cfg.monitorOnly, flag, fresh.monitoringModeEnabled);
+    if (showNotice)
+        emitNotice(PLATFORM_MONITORING_NOTICE);
+    if (decision.active)
+        dbg(`Monitoring mode active (${describeMonitoring(decision)}).`);
+    return decision;
+}
+// ---------------------------------------------------------------------------
+// SessionStart — eager tool registration
+//
+// Decouples tool-catalog registration from the first UserPromptSubmit so a
+// session that never sends a real instruction still has its tools
+// registered. SessionStart has no blocking semantics — this handler never
+// needs to emit a decision.
+// ---------------------------------------------------------------------------
+async function handleSessionStart(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    // The catalog is the running engine's, so its hash differs per engine.
+    const { engine } = detectEngine(payload);
+    const tools = buildToolDefinitions(engine);
+    const toolsHash = hashPayload({ tools });
+    if (toolsHash !== state.registeredToolsHash) {
+        dbg(`SessionStart (source=${payload.source}): registering ${tools.length} built-in tools (engine ${engine})...`);
+        const res = await client.registerTools(tools);
+        dbg(`Register result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok)
+            state.registeredToolsHash = toolsHash;
+    }
+    else {
+        dbg(`SessionStart (source=${payload.source}): tools hash unchanged, skipping registration.`);
+    }
+    saveState(payload.session_id, state);
+}
+// ---------------------------------------------------------------------------
+// Stop — state cleanup (Kiro CLI's equivalent of Claude Code's SessionEnd)
+// ---------------------------------------------------------------------------
+async function handleStop(payload, client, cfg, dbg) {
+    dbg(`Stop: deleting state for session ${payload.session_id}`);
+    deleteState(payload.session_id);
+}
+// ---------------------------------------------------------------------------
+// UserPromptSubmit — tool registration + alignment
+// ---------------------------------------------------------------------------
+async function handleUserPromptSubmit(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const { engine } = detectEngine(payload);
+    const tools = buildToolDefinitions(engine);
+    const toolsHash = hashPayload({ tools });
+    if (toolsHash !== state.registeredToolsHash) {
+        dbg(`Registering ${tools.length} built-in tools (engine ${engine})...`);
+        const res = await client.registerTools(tools);
+        dbg(`Register result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok)
+            state.registeredToolsHash = toolsHash;
+    }
+    else {
+        dbg("Tools hash unchanged, skipping registration.");
+    }
+    if (!isClaudeCodeCommand(payload.prompt)) {
+        const instrHash = hashPayload(payload.prompt);
+        if (instrHash !== state.lastUserInstructionHash) {
+            dbg("Sending alignment...");
+            const res = await client.postAlignment(payload.prompt, state.sessionId, AGENT_TYPE);
+            dbg(`Alignment result: ok=${res.ok}, status=${res.status}`);
+            if (res.ok && res.data) {
+                const data = res.data;
+                if (typeof data.session_id === "string" && data.session_id) {
+                    state.sessionId = data.session_id;
+                }
+                state.lastUserInstructionHash = instrHash;
+                // Cache the platform monitoring flag for later hooks: /guardrails/evaluate
+                // never carries it, and a PreToolUse whose validate call is skipped
+                // (no session yet) would otherwise have nothing to read.
+                resolveMonitoringForHook(cfg, payload.session_id, state, data, dbg);
+            }
+        }
+        else {
+            dbg("Instruction hash unchanged, skipping alignment.");
+        }
+    }
+    else {
+        dbg("Prompt is a slash command / bash-mode shortcut, skipping alignment.");
+    }
+    saveState(payload.session_id, state);
+}
+// ---------------------------------------------------------------------------
+// PreToolUse — on_start validation
+// ---------------------------------------------------------------------------
+async function handlePreToolUse(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const input = (payload.tool_input ?? {});
+    // 1. Alignment/session validation (intent-judge). Session-scoped: only runs
+    //    once alignment has produced a session_id. Absence isn't fatal on its own
+    //    — the assigned-guardrail evaluate below is agent-scoped and still runs.
+    let alignmentRaw = null;
+    let alignmentError = false;
+    if (state.sessionId) {
+        const res = await client.postValidate({
+            session_id: state.sessionId,
+            process_name: payload.tool_name,
+            process_type: "tool",
+            timing: "on_start",
+            input,
+            agent_type: AGENT_TYPE,
+        });
+        dbg(`Validate on_start result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok && res.data)
+            alignmentRaw = res.data;
+        else if (!res.ok)
+            alignmentError = true;
+    }
+    else {
+        dbg("No sessionId; skipping alignment validate, relying on assigned-guardrail evaluate.");
+    }
+    // 2. Assigned (dashboard-authored) guardrail evaluation — the only path that
+    //    fires the agent's assigned rules. Agent-scoped via API key, no session.
+    const evalRes = await client.evaluateGuardrails({
+        process_name: payload.tool_name,
+        process_type: "tool",
+        timing: "on_start",
+        context: { input },
+    });
+    dbg(`Evaluate on_start result: ok=${evalRes.ok}, status=${evalRes.status}`);
+    let evaluateRaw = null;
+    let evaluate = null;
+    let evaluateError = false;
+    if (evalRes.ok && evalRes.data) {
+        evaluateRaw = evalRes.data;
+        evaluate = normalizeEvaluateResponse(evalRes.data);
+    }
+    else if (!evalRes.ok) {
+        evaluateError = true;
+    }
+    // Effective monitoring for this call. /guardrails/evaluate carries no flag,
+    // so the validate response (or the cached alignment value) decides.
+    const monitoring = resolveMonitoringForHook(cfg, payload.session_id, state, alignmentRaw, dbg);
+    // 3. Fail-closed: if either layer errored and we can't be sure, block.
+    //    Only the operator's own monitorOnly relaxes this — the platform flag
+    //    governs verdicts, and an errored request produced no verdict.
+    if ((alignmentError || evaluateError) && cfg.failClosed) {
+        if (!cfg.monitorOnly) {
+            emitBlock("Datagusto safety: validation API error.");
+        }
+        else {
+            dbg(`[MONITOR] Deny skipped (plugin monitorOnly, API error): ${payload.tool_name}`);
+        }
+        return;
+    }
+    // 4. Merge (block-wins). A false from either layer blocks — except the
+    //    alignment layer's "uncategorized_tool" default-deny, which (when
+    //    allowUncategorizedTools is on) is downgraded to allow if the
+    //    assigned-guardrail evaluation explicitly allowed the call. Real intent
+    //    violations (phase v2:<Tool>:N) are never downgraded.
+    let alignmentProceed = alignmentRaw?.should_proceed !== false;
+    const evaluateProceed = evaluate?.should_proceed !== false;
+    if (!alignmentProceed &&
+        cfg.allowUncategorizedTools &&
+        evaluate !== null &&
+        evaluateProceed &&
+        alignmentRaw !== null &&
+        extractPhase(alignmentRaw) === "uncategorized_tool") {
+        dbg(`on_start uncategorized-deny downgraded to allow (assigned rules allowed): ${payload.tool_name}`);
+        alignmentProceed = true;
+    }
+    const shouldProceed = alignmentProceed && evaluateProceed;
+    // Prefer alignment's severity/instruction, then the assigned-guardrail's.
+    const alignmentExt = alignmentRaw;
+    const severity = alignmentExt?.severity ?? evaluate?.severity;
+    const injectedInstruction = alignmentExt?.injected_instruction ?? evaluate?.injected_instruction;
+    // Cache the merged verdict for state-shape parity with Claude Code (Kiro
+    // has no PermissionRequest event to consume it, but state.ts is shared and
+    // this keeps the persisted shape consistent).
+    state.lastPreToolUseCheck = {
+        inputHash: hashPayload({ tool_name: payload.tool_name, tool_input: payload.tool_input }),
+        shouldProceed,
+        severity,
+    };
+    saveState(payload.session_id, state);
+    if (!shouldProceed) {
+        // Attribute the block to whichever layer denied (assigned rule first — its
+        // message is user-authored and more specific — then alignment).
+        const blockerRaw = (evaluate?.should_proceed === false ? evaluateRaw : null) ??
+            (alignmentProceed ? null : alignmentRaw);
+        const reason = blockerRaw ? extractBlockReason(blockerRaw) : "policy violation";
+        const phase = (blockerRaw ? extractPhase(blockerRaw) : undefined) ?? "unknown";
+        dbg(`on_start BLOCKED (phase=${phase}): ${payload.tool_name} — ${reason}`);
+        if (!monitoring.active) {
+            emitBlock(`Guardrail blocked tool '${payload.tool_name}' [phase: ${phase}]. ${reason}`);
+        }
+        else {
+            dbg(`[MONITOR] Deny skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else if (severity === "medium" && injectedInstruction) {
+        // LOCKED DECISION: Kiro CLI has no approval-dialog mechanism, so an
+        // "ask" verdict degrades to a hard block — there is no softer option.
+        dbg(`on_start ASK->BLOCK (no dialog in Kiro CLI): ${payload.tool_name}`);
+        if (!monitoring.active) {
+            emitBlock(injectedInstruction);
+        }
+        else {
+            dbg(`[MONITOR] Ask/Block skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else {
+        const meta = alignmentRaw?.metadata;
+        if (meta?.bypassed_by_framework_routine) {
+            dbg(`on_start BYPASSED (framework_routine): ${payload.tool_name} (matched=${meta.matched_pattern_id ?? "?"})`);
+        }
+        else {
+            dbg(`on_start ALLOWED: ${payload.tool_name}`);
+        }
+        emitAllow();
+    }
+}
+// ---------------------------------------------------------------------------
+// PostToolUse — on_end validation
+//
+// Kiro CLI enforcement here is exit-2 + stderr only: there is no confirmed
+// mechanism analogous to Claude Code's `updatedToolOutput` rewrite, so a
+// blocked tool result can be flagged but not suppressed/replaced.
+// ---------------------------------------------------------------------------
+async function handlePostToolUse(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const input = (payload.tool_input ?? {});
+    // Both backends require `output` to be an object on on_end (the alignment
+    // path 422s on strings; /guardrails/evaluate 400s when it's absent, as on a
+    // failed tool with no response). Wrap non-dict outputs as { result } — which
+    // also makes string outputs addressable by `output.result` field paths.
+    const rawOutput = serializeToolResult(payload.tool_response);
+    const output = rawOutput !== null && typeof rawOutput === "object"
+        ? rawOutput
+        : { result: rawOutput ?? null };
+    // 1. Alignment/session on_end validation (session-scoped, optional).
+    let alignmentRaw = null;
+    let alignmentError = false;
+    if (state.sessionId) {
+        const res = await client.postValidate({
+            session_id: state.sessionId,
+            process_name: payload.tool_name,
+            process_type: "tool",
+            timing: "on_end",
+            input,
+            output,
+            agent_type: AGENT_TYPE,
+        });
+        dbg(`Validate on_end result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok && res.data)
+            alignmentRaw = res.data;
+        else if (!res.ok)
+            alignmentError = true;
+    }
+    else {
+        dbg("No sessionId; skipping alignment on_end, relying on assigned-guardrail evaluate.");
+    }
+    // 2. Assigned-guardrail evaluation on_end — the path that fires output rules.
+    const evalRes = await client.evaluateGuardrails({
+        process_name: payload.tool_name,
+        process_type: "tool",
+        timing: "on_end",
+        context: { input, output },
+    });
+    dbg(`Evaluate on_end result: ok=${evalRes.ok}, status=${evalRes.status}`);
+    let evaluateRaw = null;
+    let evaluate = null;
+    let evaluateError = false;
+    if (evalRes.ok && evalRes.data) {
+        evaluateRaw = evalRes.data;
+        evaluate = normalizeEvaluateResponse(evalRes.data);
+    }
+    else if (!evalRes.ok) {
+        evaluateError = true;
+    }
+    // Effective monitoring for this call (see handlePreToolUse).
+    const monitoring = resolveMonitoringForHook(cfg, payload.session_id, state, alignmentRaw, dbg);
+    // 3. Fail-closed: block on any validation error. As on_start, only the
+    //    plugin's own monitorOnly relaxes this, never the platform flag.
+    if ((alignmentError || evaluateError) && cfg.failClosed) {
+        if (!cfg.monitorOnly) {
+            emitBlock("Datagusto validation API error.");
+        }
+        else {
+            dbg(`[MONITOR] Block skipped (plugin monitorOnly, API error): ${payload.tool_name}`);
+        }
+        return;
+    }
+    // 4. Merge (block-wins), with the same uncategorized-tool downgrade as
+    //    on_start (see handlePreToolUse).
+    let alignmentProceed = alignmentRaw?.should_proceed !== false;
+    const evaluateProceed = evaluate?.should_proceed !== false;
+    if (!alignmentProceed &&
+        cfg.allowUncategorizedTools &&
+        evaluate !== null &&
+        evaluateProceed &&
+        alignmentRaw !== null &&
+        extractPhase(alignmentRaw) === "uncategorized_tool") {
+        dbg(`on_end uncategorized-deny downgraded to allow (assigned rules allowed): ${payload.tool_name}`);
+        alignmentProceed = true;
+    }
+    const shouldProceed = alignmentProceed && evaluateProceed;
+    const alignmentExt = alignmentRaw;
+    const injectedInstruction = alignmentExt?.injected_instruction ?? evaluate?.injected_instruction;
+    if (!shouldProceed) {
+        const blockerRaw = (evaluate?.should_proceed === false ? evaluateRaw : null) ??
+            (alignmentProceed ? null : alignmentRaw);
+        const reason = blockerRaw ? extractBlockReason(blockerRaw) : "policy violation";
+        const phase = (blockerRaw ? extractPhase(blockerRaw) : undefined) ?? "unknown";
+        dbg(`on_end BLOCKED (phase=${phase}): ${payload.tool_name} — ${reason}`);
+        if (!monitoring.active) {
+            emitBlock(`Guardrail flagged tool '${payload.tool_name}' output [phase: ${phase}]. ${reason}`);
+        }
+        else {
+            dbg(`[MONITOR] Block skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else if (injectedInstruction) {
+        const phase = (evaluate?.injected_instruction && evaluateRaw ? extractPhase(evaluateRaw) : undefined) ??
+            (alignmentRaw ? extractPhase(alignmentRaw) : undefined) ??
+            "post-check";
+        dbg(`on_end INJECT (phase=${phase}): ${payload.tool_name} — "${injectedInstruction.substring(0, 100)}"`);
+        if (!monitoring.active) {
+            emitInject(`[Datagusto safety note — ${phase}]: ${injectedInstruction}`);
+        }
+        else {
+            dbg(`[MONITOR] Injection skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else {
+        const meta = alignmentRaw?.metadata;
+        if (meta?.bypassed_by_framework_routine) {
+            dbg(`on_end BYPASSED (framework_routine): ${payload.tool_name} (matched=${meta.matched_pattern_id ?? "?"})`);
+        }
+        else {
+            dbg(`on_end ALLOWED: ${payload.tool_name}`);
+        }
+        emitAllow();
+    }
+}
+async function main() {
+    const raw = await readStdin();
+    const cfg = loadConfig();
+    const dbg = (msg) => {
+        if (cfg.verbose)
+            writeErr(`[datagusto] ${msg}\n`);
+    };
+    // Checked BEFORE the empty-stdin guard below: a misconfigured plugin must
+    // take the documented fail-open path rather than the fail-closed one.
+    if (!cfg.serverUrl || !cfg.apiKey) {
+        writeErr("[datagusto] serverUrl and apiKey are required " +
+            "(via kiro.json or DATAGUSTO_SAFETY_SERVER_URL / DATAGUSTO_SAFETY_API_KEY). " +
+            "Plugin disabled for this invocation.\n");
+        // DELIBERATE non-blocking fail-open on misconfiguration: exit 1 warns and
+        // allows, per the Kiro CLI contract (exit 1 is not the block code — that's
+        // exit 2). A broken config must never hard-block every tool call.
+        process.exit(1);
+    }
+    // Empty stdin means we have zero context: we cannot tell whether this
+    // invocation is gating a tool call or not. Previously this allowed (exit 0),
+    // which turns any surface that doesn't deliver a stdin payload into a silent
+    // bypass of the guardrail. Treat it as unvalidatable and fail closed; set
+    // monitorOnly or failClosed=false to opt out.
+    if (raw.trim() === "") {
+        if (cfg.failClosed && !cfg.monitorOnly) {
+            emitBlock("Datagusto safety: hook invoked with empty stdin, so no tool call could be validated. " +
+                "This surface may not deliver hook payloads on stdin.");
+        }
+        else {
+            writeErr("[datagusto] empty stdin; nothing to validate.\n");
+        }
+        process.exit(process.exitCode ?? EXIT_ALLOW);
+    }
+    // Malformed JSON throws here and is caught by the fatal handler, which exits
+    // 2 (fail-closed) — the correct outcome for a payload we cannot read.
+    const payload = JSON.parse(raw);
+    const rawEventName = typeof payload.hook_event_name === "string" && payload.hook_event_name.length > 0
+        ? payload.hook_event_name
+        : "<missing>";
+    const event = normalizeHookEvent(payload.hook_event_name);
+    const client = new DatagustoApiClient(cfg.serverUrl, cfg.apiKey, cfg.timeoutMs ?? 30_000);
+    dbg(`=== ${rawEventName} (canonical: ${event ?? "UNRECOGNIZED"}) START === ` +
+        `session=${String(payload.session_id ?? "<none>")}`);
+    const detected = detectEngine(payload);
+    dbg(detected.recognized
+        ? `Kiro engine: ${detected.engine}`
+        : `Kiro engine: not recognizable from this payload, assuming ${detected.engine} (the default engine)`);
+    try {
+        switch (event) {
+            case "SessionStart":
+                await handleSessionStart(payload, client, cfg, dbg);
+                break;
+            case "UserPromptSubmit":
+                await handleUserPromptSubmit(payload, client, cfg, dbg);
+                break;
+            case "PreToolUse":
+                await handlePreToolUse(payload, client, cfg, dbg);
+                break;
+            case "PostToolUse":
+                await handlePostToolUse(payload, client, cfg, dbg);
+                break;
+            case "Stop":
+                await handleStop(payload, client, cfg, dbg);
+                break;
+            default:
+                handleUnrecognizedEvent(rawEventName, payload, cfg, dbg);
+        }
+    }
+    catch (err) {
+        dbg(`EXCEPTION: ${err instanceof Error ? err.stack : err}`);
+        if (cfg.failClosed && !cfg.monitorOnly) {
+            // hasToolContext covers the case where the event name never resolved:
+            // an exception while handling a payload that carries a tool call still
+            // has to fail closed, not fall through to allow.
+            if (event === "PreToolUse" || event === "PostToolUse" || hasToolContext(payload)) {
+                emitBlock("Datagusto safety: validation failed.");
+            }
+        }
+    }
+    dbg(`=== ${rawEventName} END ===`);
+    // Do not force exit(0) unconditionally: process.exitCode already carries the
+    // real decision (emitBlock sets it to EXIT_BLOCK), so exiting with that value
+    // preserves the verdict. Note this does NOT flush the stdio streams — that is
+    // why every message this process emits goes through writeFdSync, which has
+    // already reached the pipe by the time we get here.
+    process.exit(process.exitCode ?? EXIT_ALLOW);
+}
+main().catch((err) => {
+    // Stack traces are the longest thing this process writes, so the synchronous
+    // path matters most here.
+    writeErr(`[datagusto] fatal: ${err instanceof Error ? err.stack : err}\n`);
+    process.exit(2); // fatal = fail-closed
+});
+//# sourceMappingURL=index.js.map