@datagusto/cli 0.0.0-stage → 0.1.0

package/vendor/claude_code/dist/index.js

@@ -0,0 +1,695 @@
+#!/usr/bin/env node
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - Claude Code Hook Entry Point
+// ---------------------------------------------------------------------------
+//
+// Claude Code does not load a plugin into a long-running process the way
+// OpenClaw does. Instead, it spawns this script as a fresh process for each
+// hook event, writes one JSON payload to stdin, and reads the decision back
+// from stdout / the process exit code. There is no `register(api)` call and
+// no event emitter to subscribe to — `main()` below is the entire plugin,
+// dispatching on `hook_event_name` once per invocation.
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DatagustoApiClient } from "./api-client.js";
+import { buildBuiltinToolDefinitions, extractBlockReason, extractPhase, hashPayload, isClaudeCodeCommand, normalizeEvaluateResponse, serializeToolResult, } from "./extractors.js";
+import { describeMonitoring, readMonitoringFlag, resolveMonitoring, } from "./monitoring.js";
+import { deleteState, loadState, mutateState } from "./state.js";
+/**
+ * Middleware self-declaration of the agent framework, sent on every
+ * alignment and validation request. Mirrors the OpenClaw plugin's
+ * `AGENT_TYPE` constant; the Datagusto server uses this to select the
+ * matching AgentProfile once a Claude-Code-specific profile is configured.
+ */
+const AGENT_TYPE = "claude_code";
+// Env var overrides use the DATAGUSTO_SAFETY_* prefix and take precedence
+// over claude-code.json values, exactly like the OpenClaw plugin. This
+// remains the config path for the dev workflow of piping synthetic stdin
+// payloads straight into dist/index.js without a plugin host.
+const ENV_PREFIX = "DATAGUSTO_SAFETY_";
+function envStr(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    return v && v.length > 0 ? v : undefined;
+}
+function envNum(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    if (v === undefined || v === "")
+        return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+}
+function envBool(suffix) {
+    const v = process.env[ENV_PREFIX + suffix];
+    if (v === undefined)
+        return undefined;
+    const lower = v.toLowerCase();
+    if (["true", "1", "yes"].includes(lower))
+        return true;
+    if (["false", "0", "no"].includes(lower))
+        return false;
+    return undefined;
+}
+// CLAUDE_PLUGIN_OPTION_* is exported by the Claude Code plugin host when this
+// plugin is loaded via .claude-plugin/plugin.json's userConfig. It takes
+// top priority over DATAGUSTO_SAFETY_*/claude-code.json, which stay as the
+// fallback for the no-plugin-host dev workflow.
+const PLUGIN_OPTION_PREFIX = "CLAUDE_PLUGIN_OPTION_";
+function pluginOptionStr(suffix) {
+    const v = process.env[PLUGIN_OPTION_PREFIX + suffix];
+    return v && v.length > 0 ? v : undefined;
+}
+function pluginOptionNum(suffix) {
+    const v = process.env[PLUGIN_OPTION_PREFIX + suffix];
+    if (v === undefined || v === "")
+        return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+}
+function pluginOptionBool(suffix) {
+    const v = process.env[PLUGIN_OPTION_PREFIX + suffix];
+    if (v === undefined)
+        return undefined;
+    const lower = v.toLowerCase();
+    if (["true", "1", "yes"].includes(lower))
+        return true;
+    if (["false", "0", "no"].includes(lower))
+        return false;
+    return undefined;
+}
+/**
+ * Load plugin config from claude-code.json (resolved next to this script's
+ * compiled location, or overridden via DATAGUSTO_SAFETY_CONFIG_PATH) with
+ * CLAUDE_PLUGIN_OPTION_* taking top priority, then DATAGUSTO_SAFETY_* env
+ * vars, then the file.
+ */
+function loadConfig() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const configPath = envStr("CONFIG_PATH") ?? join(here, "..", "claude-code.json");
+    let fileConfig = {};
+    try {
+        fileConfig = JSON.parse(readFileSync(configPath, "utf8"));
+    }
+    catch {
+        // No config file on disk — rely entirely on env vars.
+    }
+    return {
+        serverUrl: pluginOptionStr("SERVER_URL") ?? envStr("SERVER_URL") ?? fileConfig.serverUrl ?? "",
+        apiKey: pluginOptionStr("API_KEY") ?? envStr("API_KEY") ?? fileConfig.apiKey ?? "",
+        timeoutMs: pluginOptionNum("TIMEOUT_MS") ?? envNum("TIMEOUT_MS") ?? fileConfig.timeoutMs ?? 30_000,
+        failClosed: pluginOptionBool("FAIL_CLOSED") ?? envBool("FAIL_CLOSED") ?? fileConfig.failClosed ?? true,
+        verbose: pluginOptionBool("VERBOSE") ?? envBool("VERBOSE") ?? fileConfig.verbose ?? false,
+        monitorOnly: pluginOptionBool("MONITOR_ONLY") ?? envBool("MONITOR_ONLY") ?? fileConfig.monitorOnly ?? false,
+        autoApproveVettedPermissions: pluginOptionBool("AUTO_APPROVE_VETTED_PERMISSIONS") ??
+            envBool("AUTO_APPROVE_VETTED_PERMISSIONS") ??
+            fileConfig.autoApproveVettedPermissions ??
+            false,
+        allowUncategorizedTools: pluginOptionBool("ALLOW_UNCATEGORIZED_TOOLS") ??
+            envBool("ALLOW_UNCATEGORIZED_TOOLS") ??
+            fileConfig.allowUncategorizedTools ??
+            true,
+    };
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+// A user-facing warning queued by resolveMonitoringForHook and flushed with
+// whatever JSON this process writes to stdout. Claude Code shows hook stderr
+// only on a non-zero exit, so a notice must ride on the hook output's
+// `systemMessage` field (common to every hook event) to reach the user. A
+// hook writes at most one JSON document, so the notice is merged into the
+// decision rather than emitted on its own — see writeDecision / main().
+let pendingSystemMessage;
+// Guards the one-document-per-process invariant: a second write would
+// concatenate two JSON objects on stdout, which Claude Code rejects.
+let decisionWritten = false;
+function writeDecision(decision) {
+    if (decisionWritten) {
+        process.stderr.write("[datagusto] BUG: a hook decision was already written; ignoring a second one.\n");
+        return;
+    }
+    decisionWritten = true;
+    const out = { ...decision };
+    if (pendingSystemMessage) {
+        out.systemMessage = pendingSystemMessage;
+        pendingSystemMessage = undefined;
+    }
+    process.stdout.write(JSON.stringify(out));
+}
+/** Write a bare `{ systemMessage }` when no decision consumed the notice. */
+function flushPendingSystemMessage() {
+    if (!pendingSystemMessage || decisionWritten)
+        return;
+    decisionWritten = true;
+    process.stdout.write(JSON.stringify({ systemMessage: pendingSystemMessage }));
+    pendingSystemMessage = undefined;
+}
+function denyPreToolUse(reason) {
+    writeDecision({
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: reason,
+        },
+    });
+}
+function askPreToolUse(reason) {
+    writeDecision({
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "ask",
+            permissionDecisionReason: reason,
+        },
+    });
+}
+/**
+ * Blocks a PostToolUse/PostToolUseFailure result and replaces the tool's
+ * recorded output via `updatedToolOutput` (`hookSpecificOutput`), so a
+ * blocked call's real output never reaches the model — not just feedback
+ * alongside it. `summary` is the underlying reason text with no wrapper
+ * sentence; this builds both the top-level `reason` and the replacement
+ * output text from it independently, so neither repeats the other's framing.
+ */
+function blockPostToolUseWithRewrite(toolName, summary, phase, hookEventName) {
+    writeDecision({
+        decision: "block",
+        reason: `Guardrail flagged tool '${toolName}' output [phase: ${phase}]. ${summary}`,
+        hookSpecificOutput: {
+            hookEventName,
+            updatedToolOutput: `[BLOCKED] Output of '${toolName}' was suppressed by Datagusto [phase: ${phase}]. ${summary}`,
+        },
+    });
+}
+function injectPostToolUseContext(note, hookEventName) {
+    writeDecision({
+        hookSpecificOutput: {
+            hookEventName,
+            additionalContext: note,
+        },
+    });
+}
+const PLATFORM_MONITORING_NOTICE = "[datagusto] Platform monitoring mode is enabled for this agent: " +
+    "guardrail verdicts are recorded but not enforced.";
+/**
+ * Single place that decides whether verdicts are enforced for this hook.
+ *
+ * Effective monitoring = plugin `monitorOnly` OR the platform's per-agent
+ * `monitoring_mode_enabled`, where the platform value is taken from the
+ * current response when it carries the flag, else from the value most
+ * recently reported by any alignment / validate response for this session
+ * (kept in the state file), else false.
+ *
+ * The cached flag and the once-per-session notice bookkeeping are persisted
+ * here through mutateState(), i.e. against a freshly re-read state rather
+ * than the caller's possibly stale snapshot, and the caller's `state` is
+ * synced from that fresh copy. The first time the platform flag is seen as
+ * true in a session, a user-facing notice is queued as the hook output's
+ * `systemMessage` (regardless of `verbose`). Fail-closed handling of API
+ * errors deliberately does not go through this helper — the platform value
+ * governs verdict enforcement only.
+ */
+function resolveMonitoringForHook(cfg, claudeSessionId, state, response, dbg) {
+    const flag = readMonitoringFlag(response);
+    let showNotice = false;
+    const fresh = mutateState(claudeSessionId, (s) => {
+        if (flag !== undefined)
+            s.monitoringModeEnabled = flag;
+        const platformEnabled = typeof flag === "boolean" ? flag : s.monitoringModeEnabled === true;
+        if (platformEnabled && !s.monitoringNoticeShown) {
+            s.monitoringNoticeShown = true;
+            showNotice = true;
+        }
+    });
+    state.monitoringModeEnabled = fresh.monitoringModeEnabled;
+    state.monitoringNoticeShown = fresh.monitoringNoticeShown;
+    const decision = resolveMonitoring(cfg.monitorOnly, flag, fresh.monitoringModeEnabled);
+    if (showNotice)
+        pendingSystemMessage = PLATFORM_MONITORING_NOTICE;
+    if (decision.active)
+        dbg(`Monitoring mode active (${describeMonitoring(decision)}).`);
+    return decision;
+}
+// ---------------------------------------------------------------------------
+// SessionStart — eager tool registration
+//
+// Decouples tool-catalog registration from the first UserPromptSubmit so a
+// session that never sends a real instruction (e.g. only ever runs slash
+// commands) still has its tools registered. SessionStart has no blocking
+// semantics, only additionalContext — this handler never needs to emit one.
+// ---------------------------------------------------------------------------
+async function handleSessionStart(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const tools = buildBuiltinToolDefinitions();
+    const toolsHash = hashPayload({ tools });
+    if (toolsHash !== state.registeredToolsHash) {
+        dbg(`SessionStart (source=${payload.source}): registering ${tools.length} built-in tools...`);
+        const res = await client.registerTools(tools);
+        dbg(`Register result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok)
+            state.registeredToolsHash = toolsHash;
+    }
+    else {
+        dbg(`SessionStart (source=${payload.source}): tools hash unchanged, skipping registration.`);
+    }
+    // Persist only this handler's field; a resumed session may already have
+    // other hooks running against the same state file.
+    mutateState(payload.session_id, (s) => {
+        s.registeredToolsHash = state.registeredToolsHash;
+    });
+}
+// ---------------------------------------------------------------------------
+// SessionEnd — state cleanup
+// ---------------------------------------------------------------------------
+async function handleSessionEnd(payload, client, cfg, dbg) {
+    dbg(`SessionEnd: deleting state for session ${payload.session_id}`);
+    deleteState(payload.session_id);
+}
+// ---------------------------------------------------------------------------
+// UserPromptSubmit — tool registration + alignment
+//
+// Folds OpenClaw's two hooks (`before_agent_start` reset + `llm_input`
+// register/align) into one: Claude Code fires this once per user turn and
+// hands over the raw prompt directly, so there's no historyMessages to scan
+// and no separate reset step (state is already namespaced by session_id).
+// Tool registration is also covered by SessionStart now; this hash-gated
+// check stays as a cheap defense-in-depth fallback.
+// ---------------------------------------------------------------------------
+async function handleUserPromptSubmit(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const tools = buildBuiltinToolDefinitions();
+    const toolsHash = hashPayload({ tools });
+    if (toolsHash !== state.registeredToolsHash) {
+        dbg(`Registering ${tools.length} built-in tools...`);
+        const res = await client.registerTools(tools);
+        dbg(`Register result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok)
+            state.registeredToolsHash = toolsHash;
+    }
+    else {
+        dbg("Tools hash unchanged, skipping registration.");
+    }
+    if (!isClaudeCodeCommand(payload.prompt)) {
+        const instrHash = hashPayload(payload.prompt);
+        if (instrHash !== state.lastUserInstructionHash) {
+            dbg("Sending alignment...");
+            const res = await client.postAlignment(payload.prompt, state.sessionId, AGENT_TYPE);
+            dbg(`Alignment result: ok=${res.ok}, status=${res.status}`);
+            if (res.ok && res.data) {
+                const data = res.data;
+                if (typeof data.session_id === "string" && data.session_id) {
+                    state.sessionId = data.session_id;
+                }
+                state.lastUserInstructionHash = instrHash;
+                // Cache the platform monitoring flag for hooks whose own response
+                // has none (PermissionRequest, evaluate-only paths).
+                resolveMonitoringForHook(cfg, payload.session_id, state, data, dbg);
+            }
+        }
+        else {
+            dbg("Instruction hash unchanged, skipping alignment.");
+        }
+    }
+    else {
+        dbg("Prompt is a slash command / bash-mode shortcut, skipping alignment.");
+    }
+    // Persist only the fields this handler owns (the monitoring fields were
+    // already written by resolveMonitoringForHook), never the stale snapshot.
+    mutateState(payload.session_id, (s) => {
+        s.registeredToolsHash = state.registeredToolsHash;
+        s.sessionId = state.sessionId;
+        s.lastUserInstructionHash = state.lastUserInstructionHash;
+    });
+}
+// ---------------------------------------------------------------------------
+// PreToolUse — on_start validation
+// ---------------------------------------------------------------------------
+async function handlePreToolUse(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const input = (payload.tool_input ?? {});
+    // 1. Alignment/session validation (intent-judge). Session-scoped: only runs
+    //    once alignment has produced a session_id. Absence isn't fatal on its own
+    //    — the assigned-guardrail evaluate below is agent-scoped and still runs.
+    let alignmentRaw = null;
+    let alignmentError = false;
+    if (state.sessionId) {
+        const res = await client.postValidate({
+            session_id: state.sessionId,
+            process_name: payload.tool_name,
+            process_type: "tool",
+            timing: "on_start",
+            input,
+            agent_type: AGENT_TYPE,
+        });
+        dbg(`Validate on_start result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok && res.data)
+            alignmentRaw = res.data;
+        else if (!res.ok)
+            alignmentError = true;
+    }
+    else {
+        dbg("No sessionId; skipping alignment validate, relying on assigned-guardrail evaluate.");
+    }
+    // 2. Assigned (dashboard-authored) guardrail evaluation — the only path that
+    //    fires the agent's assigned rules. Agent-scoped via API key, no session.
+    const evalRes = await client.evaluateGuardrails({
+        process_name: payload.tool_name,
+        process_type: "tool",
+        timing: "on_start",
+        context: { input },
+    });
+    dbg(`Evaluate on_start result: ok=${evalRes.ok}, status=${evalRes.status}`);
+    let evaluateRaw = null;
+    let evaluate = null;
+    let evaluateError = false;
+    if (evalRes.ok && evalRes.data) {
+        evaluateRaw = evalRes.data;
+        evaluate = normalizeEvaluateResponse(evalRes.data);
+    }
+    else if (!evalRes.ok) {
+        evaluateError = true;
+    }
+    // Effective monitoring mode for this call. /guardrails/evaluate carries no
+    // flag, so the validate response (or the cached alignment value) decides.
+    const monitoring = resolveMonitoringForHook(cfg, payload.session_id, state, alignmentRaw, dbg);
+    // 3. Fail-closed: if either layer errored and we can't be sure, deny.
+    //    Only the plugin's own monitorOnly relaxes this — the platform's
+    //    monitoring mode governs verdicts, not error handling.
+    if ((alignmentError || evaluateError) && cfg.failClosed) {
+        if (!cfg.monitorOnly) {
+            denyPreToolUse("Datagusto safety: validation API error.");
+        }
+        else {
+            dbg(`[MONITOR] Deny skipped (plugin monitorOnly, API error): ${payload.tool_name}`);
+        }
+        return;
+    }
+    // 4. Merge (block-wins). A false from either layer blocks — except the
+    //    alignment layer's "uncategorized_tool" default-deny, which (when
+    //    allowUncategorizedTools is on) is downgraded to allow if the
+    //    assigned-guardrail evaluation explicitly allowed the call. Real intent
+    //    violations (phase v2:<Tool>:N) are never downgraded.
+    let alignmentProceed = alignmentRaw?.should_proceed !== false;
+    const evaluateProceed = evaluate?.should_proceed !== false;
+    if (!alignmentProceed &&
+        cfg.allowUncategorizedTools &&
+        evaluate !== null &&
+        evaluateProceed &&
+        alignmentRaw !== null &&
+        extractPhase(alignmentRaw) === "uncategorized_tool") {
+        dbg(`on_start uncategorized-deny downgraded to allow (assigned rules allowed): ${payload.tool_name}`);
+        alignmentProceed = true;
+    }
+    const shouldProceed = alignmentProceed && evaluateProceed;
+    // Prefer alignment's severity/instruction, then the assigned-guardrail's.
+    const alignmentExt = alignmentRaw;
+    const severity = alignmentExt?.severity ?? evaluate?.severity;
+    const injectedInstruction = alignmentExt?.injected_instruction ?? evaluate?.injected_instruction;
+    // Cache the merged verdict for a subsequent PermissionRequest auto-resolve.
+    // Written through mutateState so a parallel hook's fields survive.
+    const lastPreToolUseCheck = {
+        inputHash: hashPayload({ tool_name: payload.tool_name, tool_input: payload.tool_input }),
+        shouldProceed,
+        severity,
+    };
+    mutateState(payload.session_id, (s) => {
+        s.lastPreToolUseCheck = lastPreToolUseCheck;
+    });
+    if (!shouldProceed) {
+        // Attribute the block to whichever layer denied (assigned rule first — its
+        // message is user-authored and more specific — then alignment).
+        const blockerRaw = (evaluate?.should_proceed === false ? evaluateRaw : null) ??
+            (alignmentProceed ? null : alignmentRaw);
+        const reason = blockerRaw ? extractBlockReason(blockerRaw) : "policy violation";
+        const phase = (blockerRaw ? extractPhase(blockerRaw) : undefined) ?? "unknown";
+        dbg(`on_start BLOCKED (phase=${phase}): ${payload.tool_name} — ${reason}`);
+        if (!monitoring.active) {
+            denyPreToolUse(`Guardrail blocked tool '${payload.tool_name}' [phase: ${phase}]. ${reason}`);
+        }
+        else {
+            dbg(`[MONITOR] Deny skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else if (severity === "medium" && injectedInstruction) {
+        dbg(`on_start ASK: ${payload.tool_name} — requesting approval`);
+        if (!monitoring.active) {
+            askPreToolUse(injectedInstruction);
+        }
+        else {
+            dbg(`[MONITOR] Ask skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else {
+        const meta = alignmentRaw?.metadata;
+        if (meta?.bypassed_by_framework_routine) {
+            dbg(`on_start BYPASSED (framework_routine): ${payload.tool_name} (matched=${meta.matched_pattern_id ?? "?"})`);
+        }
+        else {
+            dbg(`on_start ALLOWED: ${payload.tool_name}`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// PermissionRequest — auto-resolve Claude Code's native permission dialog
+// when Datagusto already vetted this exact call during PreToolUse.
+//
+// Fires only when PreToolUse passed the call through with no explicit
+// decision AND Claude Code's own permission_mode would otherwise prompt the
+// user. Never overrides an explicit PreToolUse "ask" (severity medium) — the
+// whole point of that verdict is to surface the dialog with our injected
+// instruction; auto-answering it would defeat the point. Off by default —
+// gated behind cfg.autoApproveVettedPermissions.
+// ---------------------------------------------------------------------------
+async function handlePermissionRequest(payload, client, cfg, dbg) {
+    if (!cfg.autoApproveVettedPermissions) {
+        dbg("PermissionRequest: auto-approve disabled, leaving native dialog as-is.");
+        return;
+    }
+    const state = loadState(payload.session_id);
+    const inputHash = hashPayload({ tool_name: payload.tool_name, tool_input: payload.tool_input });
+    const cached = state.lastPreToolUseCheck;
+    if (!cached || cached.inputHash !== inputHash) {
+        dbg("PermissionRequest: no matching cached PreToolUse verdict, leaving native dialog as-is.");
+        return;
+    }
+    if (cached.severity === "medium") {
+        dbg("PermissionRequest: cached verdict was an explicit ask, not auto-resolving.");
+        return;
+    }
+    const behavior = cached.shouldProceed ? "allow" : "deny";
+    // No API call here, so the platform flag comes from the value PreToolUse
+    // cached in state for this session.
+    const monitoring = resolveMonitoring(cfg.monitorOnly, undefined, state.monitoringModeEnabled);
+    if (monitoring.active) {
+        dbg(`[MONITOR] Auto-${behavior} skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        return;
+    }
+    dbg(`PermissionRequest: auto-${behavior === "allow" ? "allowing" : "denying"} ${payload.tool_name} (already vetted by PreToolUse).`);
+    writeDecision({
+        hookSpecificOutput: {
+            hookEventName: "PermissionRequest",
+            decision: { behavior },
+        },
+    });
+}
+// ---------------------------------------------------------------------------
+// PostToolUse / PostToolUseFailure — on_end validation
+//
+// Both events share the same payload shape and validation logic; only the
+// echoed `hookEventName` differs. A blocked result now replaces the tool's
+// recorded output via `updatedToolOutput`, not just feedback alongside it.
+// ---------------------------------------------------------------------------
+async function handlePostToolUse(payload, client, cfg, dbg) {
+    const state = loadState(payload.session_id);
+    const input = (payload.tool_input ?? {});
+    // Both backends require `output` to be an object on on_end (the alignment
+    // path 422s on strings; /guardrails/evaluate 400s when it's absent, as on a
+    // failed tool with no response). Wrap non-dict outputs as { result } — which
+    // also makes string outputs addressable by `output.result` field paths.
+    const rawOutput = serializeToolResult(payload.tool_response);
+    const output = rawOutput !== null && typeof rawOutput === "object"
+        ? rawOutput
+        : { result: rawOutput ?? null };
+    // 1. Alignment/session on_end validation (session-scoped, optional).
+    let alignmentRaw = null;
+    let alignmentError = false;
+    if (state.sessionId) {
+        const res = await client.postValidate({
+            session_id: state.sessionId,
+            process_name: payload.tool_name,
+            process_type: "tool",
+            timing: "on_end",
+            input,
+            output,
+            agent_type: AGENT_TYPE,
+        });
+        dbg(`Validate on_end result: ok=${res.ok}, status=${res.status}`);
+        if (res.ok && res.data)
+            alignmentRaw = res.data;
+        else if (!res.ok)
+            alignmentError = true;
+    }
+    else {
+        dbg("No sessionId; skipping alignment on_end, relying on assigned-guardrail evaluate.");
+    }
+    // 2. Assigned-guardrail evaluation on_end — the path that fires output rules.
+    const evalRes = await client.evaluateGuardrails({
+        process_name: payload.tool_name,
+        process_type: "tool",
+        timing: "on_end",
+        context: { input, output },
+    });
+    dbg(`Evaluate on_end result: ok=${evalRes.ok}, status=${evalRes.status}`);
+    let evaluateRaw = null;
+    let evaluate = null;
+    let evaluateError = false;
+    if (evalRes.ok && evalRes.data) {
+        evaluateRaw = evalRes.data;
+        evaluate = normalizeEvaluateResponse(evalRes.data);
+    }
+    else if (!evalRes.ok) {
+        evaluateError = true;
+    }
+    // Effective monitoring mode for this call (see handlePreToolUse).
+    const monitoring = resolveMonitoringForHook(cfg, payload.session_id, state, alignmentRaw, dbg);
+    // 3. Fail-closed: suppress the output on any validation error. Only the
+    //    plugin's own monitorOnly relaxes this, never the platform flag.
+    if ((alignmentError || evaluateError) && cfg.failClosed) {
+        if (!cfg.monitorOnly) {
+            blockPostToolUseWithRewrite(payload.tool_name, "Datagusto validation API error.", "api-error", payload.hook_event_name);
+        }
+        else {
+            dbg(`[MONITOR] Block skipped (plugin monitorOnly, API error): ${payload.tool_name}`);
+        }
+        return;
+    }
+    // 4. Merge (block-wins), with the same uncategorized-tool downgrade as
+    //    on_start (see handlePreToolUse).
+    let alignmentProceed = alignmentRaw?.should_proceed !== false;
+    const evaluateProceed = evaluate?.should_proceed !== false;
+    if (!alignmentProceed &&
+        cfg.allowUncategorizedTools &&
+        evaluate !== null &&
+        evaluateProceed &&
+        alignmentRaw !== null &&
+        extractPhase(alignmentRaw) === "uncategorized_tool") {
+        dbg(`on_end uncategorized-deny downgraded to allow (assigned rules allowed): ${payload.tool_name}`);
+        alignmentProceed = true;
+    }
+    const shouldProceed = alignmentProceed && evaluateProceed;
+    const alignmentExt = alignmentRaw;
+    const injectedInstruction = alignmentExt?.injected_instruction ?? evaluate?.injected_instruction;
+    if (!shouldProceed) {
+        const blockerRaw = (evaluate?.should_proceed === false ? evaluateRaw : null) ??
+            (alignmentProceed ? null : alignmentRaw);
+        const reason = blockerRaw ? extractBlockReason(blockerRaw) : "policy violation";
+        const phase = (blockerRaw ? extractPhase(blockerRaw) : undefined) ?? "unknown";
+        dbg(`on_end BLOCKED (phase=${phase}): ${payload.tool_name} — ${reason}`);
+        if (!monitoring.active) {
+            blockPostToolUseWithRewrite(payload.tool_name, reason, phase, payload.hook_event_name);
+        }
+        else {
+            dbg(`[MONITOR] Block skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else if (injectedInstruction) {
+        const phase = (evaluate?.injected_instruction && evaluateRaw ? extractPhase(evaluateRaw) : undefined) ??
+            (alignmentRaw ? extractPhase(alignmentRaw) : undefined) ??
+            "post-check";
+        dbg(`on_end INJECT (phase=${phase}): ${payload.tool_name} — "${injectedInstruction.substring(0, 100)}"`);
+        if (!monitoring.active) {
+            injectPostToolUseContext(`[Datagusto safety note — ${phase}]: ${injectedInstruction}`, payload.hook_event_name);
+        }
+        else {
+            dbg(`[MONITOR] Injection skipped (${describeMonitoring(monitoring)}): ${payload.tool_name}`);
+        }
+    }
+    else {
+        const meta = alignmentRaw?.metadata;
+        if (meta?.bypassed_by_framework_routine) {
+            dbg(`on_end BYPASSED (framework_routine): ${payload.tool_name} (matched=${meta.matched_pattern_id ?? "?"})`);
+        }
+        else {
+            dbg(`on_end ALLOWED: ${payload.tool_name}`);
+        }
+    }
+}
+async function main() {
+    const raw = await readStdin();
+    const payload = JSON.parse(raw);
+    const cfg = loadConfig();
+    const dbg = (msg) => {
+        if (cfg.verbose)
+            process.stderr.write(`[datagusto] ${msg}\n`);
+    };
+    if (!cfg.serverUrl || !cfg.apiKey) {
+        // Missing config never blocks: a user locked out of every tool couldn't
+        // use the agent to troubleshoot. Warn instead, and say how to fix it.
+        const warning = "Datagusto safety plugin isn't configured (no server URL or API key), so tool calls are NOT being checked. " +
+            "Run `dg setup claude-code` to connect it, or `dg remove claude-code` to uninstall it. " +
+            "Config is read from claude-code.json, DATAGUSTO_SAFETY_SERVER_URL / DATAGUSTO_SAFETY_API_KEY, or the plugin's userConfig.";
+        if (payload.hook_event_name === "SessionStart") {
+            // stderr is only shown on a non-zero exit, and exit 1 on SessionStart
+            // would look like a crash; systemMessage shows it once per session.
+            pendingSystemMessage = warning;
+            flushPendingSystemMessage();
+            process.exit(0);
+        }
+        process.stderr.write(`[datagusto] ${warning}\n`);
+        process.exit(1); // non-blocking: the tool call proceeds.
+    }
+    const client = new DatagustoApiClient(cfg.serverUrl, cfg.apiKey, cfg.timeoutMs ?? 30_000);
+    dbg(`=== ${payload.hook_event_name} START === session=${payload.session_id}`);
+    try {
+        switch (payload.hook_event_name) {
+            case "SessionStart":
+                await handleSessionStart(payload, client, cfg, dbg);
+                break;
+            case "UserPromptSubmit":
+                await handleUserPromptSubmit(payload, client, cfg, dbg);
+                break;
+            case "PreToolUse":
+                await handlePreToolUse(payload, client, cfg, dbg);
+                break;
+            case "PermissionRequest":
+                await handlePermissionRequest(payload, client, cfg, dbg);
+                break;
+            case "PostToolUse":
+                await handlePostToolUse(payload, client, cfg, dbg);
+                break;
+            case "PostToolUseFailure":
+                await handlePostToolUse(payload, client, cfg, dbg);
+                break;
+            case "SessionEnd":
+                await handleSessionEnd(payload, client, cfg, dbg);
+                break;
+            default:
+                dbg(`Unhandled hook_event_name '${payload.hook_event_name}', ignoring.`);
+        }
+    }
+    catch (err) {
+        dbg(`EXCEPTION: ${err instanceof Error ? err.stack : err}`);
+        // Fail-closed on exceptions: relaxed by the plugin's monitorOnly only.
+        if (cfg.failClosed && !cfg.monitorOnly) {
+            if (payload.hook_event_name === "PreToolUse") {
+                denyPreToolUse("Datagusto safety: validation failed.");
+            }
+            else if (payload.hook_event_name === "PostToolUse" || payload.hook_event_name === "PostToolUseFailure") {
+                const p = payload;
+                blockPostToolUseWithRewrite(p.tool_name, "Datagusto safety: validation failed.", "exception", p.hook_event_name);
+            }
+        }
+    }
+    // Allow paths write no decision; make sure a queued notice still reaches
+    // the user as a standalone `{ systemMessage }` document.
+    flushPendingSystemMessage();
+    dbg(`=== ${payload.hook_event_name} END ===`);
+    process.exit(0);
+}
+main().catch((err) => {
+    process.stderr.write(`[datagusto] fatal: ${err instanceof Error ? err.stack : err}\n`);
+    process.exit(2);
+});
+//# sourceMappingURL=index.js.map