@datagusto/cli 0.0.0-stage → 0.1.0

package/vendor/kiro/dist/monitoring.js

@@ -0,0 +1,66 @@
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Monitoring-mode resolution
+// ---------------------------------------------------------------------------
+//
+// Two independent switches can turn enforcement off:
+//
+//   - the plugin's own `monitorOnly` config (a local staging-rollout knob), and
+//   - the platform's per-agent monitoring mode, surfaced by the server as
+//     `monitoring_mode_enabled` on /sessions/alignment and /sessions/validate
+//     responses.
+//
+// Either one being true means a verdict (deny / ask / block / inject) is
+// logged but not enforced. The platform value is resolved per request:
+// the validate response of the current call wins, then the value most
+// recently reported by any alignment / validate response for this session
+// (kept in session state), then false — older servers that omit the field
+// behave as before.
+//
+// The platform value never changes fail-closed handling of API errors: the
+// server's monitoring mode only says whether *verdicts* are enforced, and
+// an errored request carries no verdict (and no flag) to begin with.
+/**
+ * Read `monitoring_mode_enabled` from an API response body. Returns undefined
+ * when the field is absent or not a boolean so callers can fall back to the
+ * value cached in session state.
+ */
+export function readMonitoringFlag(data) {
+    if (data && typeof data === "object") {
+        const v = data.monitoring_mode_enabled;
+        if (typeof v === "boolean")
+            return v;
+    }
+    return undefined;
+}
+/**
+ * Combine the plugin's `monitorOnly` config with the platform's monitoring
+ * mode. `responseFlag` is the value from the current request's response (or
+ * undefined when that response has none), `stateFlag` the value cached from
+ * alignment (null when never seen).
+ */
+export function resolveMonitoring(pluginMonitorOnly, responseFlag, stateFlag) {
+    const platformEnabled = typeof responseFlag === "boolean" ? responseFlag : stateFlag === true;
+    const plugin = pluginMonitorOnly === true;
+    let source;
+    if (plugin && platformEnabled)
+        source = "plugin+platform";
+    else if (plugin)
+        source = "plugin";
+    else if (platformEnabled)
+        source = "platform";
+    return { active: plugin || platformEnabled, source, platformEnabled };
+}
+/** Human-readable label for log lines, e.g. "platform monitoring mode". */
+export function describeMonitoring(decision) {
+    switch (decision.source) {
+        case "plugin":
+            return "plugin monitorOnly";
+        case "platform":
+            return "platform monitoring mode";
+        case "plugin+platform":
+            return "plugin monitorOnly + platform monitoring mode";
+        default:
+            return "enforcing";
+    }
+}
+//# sourceMappingURL=monitoring.js.map

package/vendor/kiro/dist/state.js

@@ -0,0 +1,71 @@
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Persisted Per-Session State
+// ---------------------------------------------------------------------------
+//
+// OpenClaw's plugin keeps state in memory inside one long-running process
+// and has to detect session boundaries itself (see the OpenClaw plugin's
+// `onNewTurn`). Claude Code hooks are the opposite: every invocation is a
+// brand-new process that exits after handling one event, but each payload
+// already carries a stable `session_id` for the lifetime of the
+// conversation. So instead of an in-memory class with manual session-change
+// detection, state is a small JSON blob on disk, namespaced by that
+// session_id — no reset hook is needed because a new session simply reads
+// and writes its own file.
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const EMPTY_STATE = {
+    sessionId: null,
+    registeredToolsHash: null,
+    lastUserInstructionHash: null,
+    lastPreToolUseCheck: null,
+    monitoringModeEnabled: null,
+    monitoringNoticeShown: false,
+};
+const STATE_DIR = join(tmpdir(), "datagusto-safety-plugin");
+function statePath(claudeSessionId) {
+    return join(STATE_DIR, `${claudeSessionId}.json`);
+}
+/** Load this Claude Code session's state, or an empty one if none exists yet. */
+export function loadState(claudeSessionId) {
+    try {
+        const raw = readFileSync(statePath(claudeSessionId), "utf8");
+        return { ...EMPTY_STATE, ...JSON.parse(raw) };
+    }
+    catch {
+        return { ...EMPTY_STATE };
+    }
+}
+/** Persist this Claude Code session's state for the next hook invocation. */
+export function saveState(claudeSessionId, state) {
+    mkdirSync(STATE_DIR, { recursive: true });
+    writeFileSync(statePath(claudeSessionId), JSON.stringify(state), "utf8");
+}
+/**
+ * Re-read the state file, apply `mutate` to the fresh copy, and write it back.
+ *
+ * Claude Code can run several hook processes for one session concurrently
+ * (parallel tool calls), and each handler awaits HTTP round-trips between
+ * its initial loadState() and any save. Writing back that stale snapshot
+ * would clobber fields another process persisted in the meantime, so
+ * handlers that only need to update a few fields after their awaits use
+ * this instead of saveState(). The read-modify-write is still unlocked —
+ * the window is the microseconds between the read and the write rather
+ * than the whole HTTP round-trip — which is adequate for these hints.
+ */
+export function mutateState(claudeSessionId, mutate) {
+    const fresh = loadState(claudeSessionId);
+    mutate(fresh);
+    saveState(claudeSessionId, fresh);
+    return fresh;
+}
+/** Remove this Claude Code session's state file (called from SessionEnd). */
+export function deleteState(claudeSessionId) {
+    try {
+        rmSync(statePath(claudeSessionId), { force: true });
+    }
+    catch {
+        // Best-effort cleanup — a failure here should never block SessionEnd.
+    }
+}
+//# sourceMappingURL=state.js.map

package/vendor/kiro/dist/types.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Type Definitions
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=types.js.map

package/vendor/kiro/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "datagusto-safety-plugin-kiro",
+  "version": "1.0.0",
+  "description": "Datagusto safety validation plugin for Kiro IDE",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "test": "npm run build && node --test tests/*.test.mjs"
+  },
+  "files": [
+    "dist/",
+    "src/",
+    ".kiro/hooks/",
+    "README.md"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^6.0.3"
+  }
+}

package/vendor/manifest.json

@@ -0,0 +1,42 @@
+{
+  "version": 1,
+  "sourceCommit": "2d11c9f",
+  "plugins": {
+    "claude_code": {
+      "pluginVersion": "1.0.0",
+      "files": {
+        ".claude-plugin/plugin.json": "62621afc1dfc683bcf4afdac43d6efea0ec85e55b66c7e69a85a0fe708f9f991",
+        "README.md": "465c4c2b4aa1ba0e5a9b05573460168f67edda21977a9343f981f08ebb85999a",
+        "dist/api-client.js": "22f46fc31fc61aa6e9c4219032b41a321ce324630fb8235cc2572797b73d29da",
+        "dist/builtin-tools.generated.js": "870422c2a4403627486e48834fdae6ea5a1cd63dbfe707fa4db613a87028c214",
+        "dist/extractors.js": "58c40eaad7e755b723f4f924ba56b2f37affbe42c6389bca369a62fb1c4fd1ac",
+        "dist/index.js": "f0439bc13cc48d98037d013860b95b3ace49939c2ee2ff9f78b5d81c4bddad64",
+        "dist/monitoring.js": "81e82124624e0deca9d11472c9ba4cd3ac7b2711b55fa10c45c22bd25f95a9d7",
+        "dist/state.js": "66e724266b61fa73760a597d9ca328dd6fc31c7dfe2fb9370c764fadb20b190c",
+        "dist/types.js": "a76a10af480d422f5f301cfc7d91a02db1d87695fcbf6d7475063faeb82f76a8",
+        "hooks/hooks.json": "d50d298053754ddc6076d84fd94a35fe9c56468f5e9870a625edac6fbac65df9",
+        "package.json": "a00fc1f5ff39648223a4fc517cda118216694074b40b8e25bbf1a11af051bce7"
+      }
+    },
+    "kiro": {
+      "pluginVersion": "1.0.0",
+      "files": {
+        ".kiro/agents/kiro_default.json": "f5cccf42d4f1a4b1a2268685ac74bae0b1068bf18dea7ff4965518a6c7b8d770",
+        ".kiro/hooks/datagusto-post-tool-use.json": "58dacc6b875e733d63fd13f0f47cb2385eecea1ec29b076f71e8b9d137676258",
+        ".kiro/hooks/datagusto-pre-tool-use.json": "2597f6eb980d1f17f11f7a2b74faeeca69511345d5cfcd420266a8c165b6da93",
+        ".kiro/hooks/datagusto-session-start.json": "992697cb2504e5527b26400c7aebe7e41f80d410bc0150520503897f6ff33a27",
+        ".kiro/hooks/datagusto-stop.json": "f416a77d84fd74d97af8fba7b08161bc39d963fe1e4bfa86f9ed49589a16ae51",
+        ".kiro/hooks/datagusto-user-prompt-submit.json": "752b562e871b19996ec0c63e90d43fdaec9930ed0871db32a95e4cd849c7237a",
+        "dist/api-client.js": "22f46fc31fc61aa6e9c4219032b41a321ce324630fb8235cc2572797b73d29da",
+        "dist/builtin-tools.generated.js": "d13ae530ed33a55ec2e7d04c2f78e3b34505f68a952ecdb30a979cb9e26b3493",
+        "dist/engine.js": "db0fca121485a6065c6626b4c3b114f06bd9cc8b374fad2d63f6c39565a4e891",
+        "dist/extractors.js": "58c40eaad7e755b723f4f924ba56b2f37affbe42c6389bca369a62fb1c4fd1ac",
+        "dist/index.js": "116d7d3e15e6fea78e830d2a6c9a101fe93207e4e6e37329c68086043f4fac64",
+        "dist/monitoring.js": "81e82124624e0deca9d11472c9ba4cd3ac7b2711b55fa10c45c22bd25f95a9d7",
+        "dist/state.js": "66e724266b61fa73760a597d9ca328dd6fc31c7dfe2fb9370c764fadb20b190c",
+        "dist/types.js": "a76a10af480d422f5f301cfc7d91a02db1d87695fcbf6d7475063faeb82f76a8",
+        "package.json": "a0e6d2748fec919edbdb446f3e7b1184843a4e25d76230d0ff955951466e4f36"
+      }
+    }
+  }
+}