@event4u/agent-config 17.2.1 → 17.4.0

package/dist/hooks/code_graph_refresh.chunk.cjs

@@ -0,0 +1,443 @@
+#!/usr/bin/env tsx
+const __acChunkMetaUrl = require('node:url').pathToFileURL(__filename).href; const __acChunkMeta = { url: __acChunkMetaUrl, dirname: __dirname, filename: __filename };
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/scripts/hooks/code_graph_refresh_hook.ts
+var code_graph_refresh_hook_exports = {};
+__export(code_graph_refresh_hook_exports, {
+  REFRESH_ARGS: () => REFRESH_ARGS,
+  main: () => main,
+  refreshFor: () => refreshFor,
+  repoRoot: () => repoRoot,
+  resolveCli: () => resolveCli
+});
+module.exports = __toCommonJS(code_graph_refresh_hook_exports);
+var import_node_child_process = require("node:child_process");
+var fs5 = __toESM(require("node:fs"), 1);
+var path5 = __toESM(require("node:path"), 1);
+var import_node_url = require("node:url");
+
+// src/scripts/_lib/spawn_env.ts
+var DENY_EXACT = /* @__PURE__ */ new Set([
+  // dynamic loader
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FRAMEWORK_PATH",
+  "GCONV_PATH",
+  // git command-injection
+  "GIT_EXTERNAL_DIFF",
+  "GIT_SSH",
+  "GIT_SSH_COMMAND",
+  "GIT_PROXY_COMMAND",
+  "GIT_PAGER",
+  "PAGER",
+  // git config-injection: GIT_ALTERNATE_OBJECT_DIRECTORIES can point git at
+  // attacker-controlled object stores; the GIT_CONFIG* family is handled by
+  // prefix below (it is a general arbitrary-config-injection primitive).
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  // git path-redirection: GIT_DIR / GIT_INDEX_FILE / GIT_NAMESPACE point a
+  // child's git at an attacker-controlled repo, index file, or ref namespace
+  // — ordinary git ops then read and write attacker state (low severity,
+  // same family as GIT_ALTERNATE_OBJECT_DIRECTORIES above).
+  "GIT_DIR",
+  "GIT_INDEX_FILE",
+  "GIT_NAMESPACE",
+  // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
+  // redirecting any network fetch the child performs (CWE-427-adjacent).
+  "HOSTALIASES",
+  // runtime auto-exec hooks
+  "NODE_OPTIONS",
+  "BASH_ENV",
+  "ENV",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PYTHONINSPECT",
+  "PERL5OPT",
+  "PERL5LIB",
+  "RUBYOPT",
+  // shell field-splitting
+  "IFS"
+]);
+function isDeniedByFamily(name) {
+  if (name.startsWith("LD_") || name.startsWith("DYLD_")) return true;
+  if (name.startsWith("GIT_") && name.endsWith("_COMMAND")) return true;
+  if (name === "GIT_CONFIG" || name.startsWith("GIT_CONFIG_")) return true;
+  return false;
+}
+function hardenedSpawnEnv(overrides = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value === void 0) continue;
+    if (DENY_EXACT.has(key)) continue;
+    if (isDeniedByFamily(key)) continue;
+    out[key] = value;
+  }
+  for (const [key, value] of Object.entries(overrides)) {
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/scripts/code_graph/refresh_cli.ts
+var fs = __toESM(require("node:fs"), 1);
+var path = __toESM(require("node:path"), 1);
+var CAPABILITY_FILE = "src/scripts/code_graph/refresh_lock.ts";
+function resolveCli(root, envPath = process.env["PATH"] ?? "") {
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(root);
+  } catch {
+    return null;
+  }
+  const inside = (p) => {
+    const rel = path.relative(realRoot, p);
+    return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+  };
+  for (const dir of envPath.split(path.delimiter)) {
+    if (!path.isAbsolute(dir)) continue;
+    const candidate = path.join(dir, "agent-config");
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      const real = fs.realpathSync(candidate);
+      if (fs.statSync(real).isFile() && !inside(real) && !inside(path.resolve(dir))) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function cliPackage(cli) {
+  try {
+    for (let dir = path.dirname(fs.realpathSync(cli)); dir !== path.dirname(dir); dir = path.dirname(dir)) {
+      const file = path.join(dir, "package.json");
+      if (!fs.existsSync(file)) continue;
+      const pkg = JSON.parse(fs.readFileSync(file, "utf-8"));
+      if (pkg.name === "@event4u/agent-config") return { root: dir, version: pkg.version ?? "?" };
+    }
+  } catch {
+  }
+  return null;
+}
+function cliIsCapable(cli) {
+  const pkg = cliPackage(cli);
+  return pkg !== null && fs.existsSync(path.join(pkg.root, CAPABILITY_FILE));
+}
+function usableCli(root, envPath) {
+  const cli = resolveCli(root, envPath);
+  if (cli === null) return { reason: "no-cli" };
+  return cliIsCapable(cli) ? { cli } : { reason: "cli-too-old", cli };
+}
+
+// src/scripts/code_graph/graph_home.ts
+var fs2 = __toESM(require("node:fs"), 1);
+var path3 = __toESM(require("node:path"), 1);
+
+// src/scripts/_lib/user_global_paths.ts
+var path2 = __toESM(require("node:path"), 1);
+var DEFAULT_EVENT4U_ROOT_RELATIVE = path2.join(".event4u", "agent-config");
+var LEGACY_XDG_ROOT_RELATIVE = path2.join(".config", "agent-config");
+
+// src/scripts/code_graph/graph_home.ts
+var STATE_DIR_REL = path3.join("agents", "runtime", "state");
+var NATIVE_CACHE_REL = path3.join(STATE_DIR_REL, "code-graph-v1.json");
+var MAP_DIR_REL = path3.join("agents", "map");
+var LOCK_REL = path3.join(STATE_DIR_REL, "code-graph-refresh.lock");
+var AUTO_REFRESH_REL = path3.join(STATE_DIR_REL, "code-graph-auto-refresh.json");
+function hasProjectHome(root) {
+  return fs2.existsSync(path3.join(root, "agents")) || fs2.existsSync(path3.join(root, ".agent-settings.yml"));
+}
+function projectHome(root) {
+  return {
+    kind: "project",
+    root,
+    dir: path3.join(root, "agents"),
+    stateDir: path3.join(root, STATE_DIR_REL),
+    cachePath: path3.join(root, NATIVE_CACHE_REL),
+    mapDir: path3.join(root, MAP_DIR_REL),
+    lockPath: path3.join(root, LOCK_REL),
+    autoRefreshPath: path3.join(root, AUTO_REFRESH_REL),
+    repoId: null,
+    instance: null
+  };
+}
+
+// src/scripts/code_graph/refresh_lock.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os = __toESM(require("node:os"), 1);
+var path4 = __toESM(require("node:path"), 1);
+var STALE_LOCK_MS = 5 * 60 * 1e3;
+var MAX_LOCK_AGE_MS = 30 * 60 * 1e3;
+var ownerPath = (lock) => `${lock}.owner.json`;
+function recordRefreshIn(stateDir, rec) {
+  try {
+    fs3.writeFileSync(path4.join(stateDir, `code-graph-refresh.${rec.by}.json`), JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...rec }));
+  } catch {
+  }
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+var errno = (e) => e.code;
+function readOwner(lock) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(ownerPath(lock), "utf-8");
+  } catch (e) {
+    return errno(e) === "ENOENT" ? "none" : "unreadable";
+  }
+  try {
+    const o = JSON.parse(raw);
+    if (typeof o.pid === "number" && typeof o.started_at === "number" && typeof o.nonce === "string") return o;
+  } catch {
+  }
+  return "none";
+}
+function isStale(lock, now = Date.now()) {
+  const owner = readOwner(lock);
+  if (owner === "unreadable") return false;
+  if (owner !== "none") {
+    if (owner.host !== os.hostname()) return now - owner.started_at > MAX_LOCK_AGE_MS;
+    return !pidAlive(owner.pid);
+  }
+  try {
+    return now - fs3.statSync(lock).mtimeMs > STALE_LOCK_MS;
+  } catch (e) {
+    return errno(e) === "ENOENT";
+  }
+}
+
+// src/scripts/hooks/exit_codes.ts
+var EXIT_ALLOW = 0;
+var EXIT_BLOCK = 1;
+var EXIT_WARN = 2;
+var EXIT_ERROR = 3;
+var EXIT_CODES = Object.freeze([
+  Object.freeze({
+    code: EXIT_ALLOW,
+    name: "allow",
+    meaning: "no objection; the dispatcher passes the call through",
+    owner: "every concern \u2014 the default verdict",
+    authorizedBy: "nothing; allowing needs no authority"
+  }),
+  Object.freeze({
+    code: EXIT_BLOCK,
+    name: "block",
+    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
+    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
+    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
+  }),
+  Object.freeze({
+    code: EXIT_WARN,
+    name: "warn",
+    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
+    owner: "any concern",
+    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
+  }),
+  Object.freeze({
+    code: EXIT_ERROR,
+    name: "error",
+    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
+    owner: "no concern emits this on purpose; the runtime does",
+    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
+  })
+]);
+
+// src/scripts/hooks/hook_stdin.ts
+var tty = __toESM(require("node:tty"), 1);
+
+// src/scripts/_lib/stdin.ts
+var fs4 = __toESM(require("node:fs"), 1);
+var CHUNK = 64 * 1024;
+var RETRY_SLEEP_MS = 5;
+var MAX_RETRIES = 2e3;
+function _sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function readStdinText(fd = 0, opts = {}) {
+  const chunks = [];
+  const buf = Buffer.alloc(CHUNK);
+  let retries = 0;
+  let got_any = false;
+  const first_byte_deadline = opts.firstByteTimeoutMs === void 0 ? null : Date.now() + opts.firstByteTimeoutMs;
+  for (; ; ) {
+    let read;
+    try {
+      read = fs4.readSync(fd, buf, 0, CHUNK, null);
+      retries = 0;
+    } catch (exc) {
+      const code = exc.code;
+      if (code === "EAGAIN") {
+        if (!got_any && first_byte_deadline !== null && Date.now() >= first_byte_deadline) {
+          return "";
+        }
+        retries += 1;
+        if (retries > MAX_RETRIES) {
+          throw new Error(
+            `readStdinText: stdin stayed unreadable across ${String(MAX_RETRIES)} retries (~${String(MAX_RETRIES * RETRY_SLEEP_MS / 1e3)}s). Refusing to report an empty read as empty input.`
+          );
+        }
+        _sleepSync(RETRY_SLEEP_MS);
+        continue;
+      }
+      if (code === "EOF") break;
+      throw exc;
+    }
+    if (read === 0) break;
+    got_any = true;
+    chunks.push(Buffer.from(buf.subarray(0, read)));
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
+// src/scripts/hooks/hook_stdin.ts
+var OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("agent-config.hookStdinOverride");
+function host() {
+  return globalThis;
+}
+var HOOK_FIRST_BYTE_TIMEOUT_MS = 25;
+function readFd0ToEnd() {
+  void process.stdin;
+  return readStdinText(0, { firstByteTimeoutMs: HOOK_FIRST_BYTE_TIMEOUT_MS });
+}
+function readHookStdin() {
+  const override = host()[OVERRIDE_KEY];
+  if (override !== null && override !== void 0) return override;
+  try {
+    if (tty.isatty(0)) return "";
+    return readFd0ToEnd();
+  } catch {
+    return "";
+  }
+}
+
+// src/scripts/hooks/state_io.ts
+var REPLAY_ENV_VAR = "AGENT_CONFIG_REPLAY";
+function is_replay_mode() {
+  return (process.env[REPLAY_ENV_VAR] ?? "").trim() === "1";
+}
+
+// src/scripts/hooks/code_graph_refresh_hook.ts
+var REFRESH_ARGS = ["code-graph", "refresh", "--single-flight", "--map", "--budget-seconds", "60"];
+function repoRoot(start) {
+  let dir;
+  try {
+    dir = fs5.realpathSync(start);
+  } catch {
+    return null;
+  }
+  for (; ; ) {
+    try {
+      fs5.lstatSync(path5.join(dir, ".git"));
+      return dir;
+    } catch (e) {
+      if (e.code !== "ENOENT") return null;
+    }
+    const up = path5.dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+function anyTracked(root, rels) {
+  try {
+    const out = (0, import_node_child_process.execFileSync)("git", ["-C", root, "ls-files", "--", ...rels], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env: hardenedSpawnEnv()
+    });
+    return out.trim() !== "";
+  } catch {
+    return true;
+  }
+}
+function refreshFor(cwd, spawnFn = import_node_child_process.spawn) {
+  if (process.env["AGENT_CONFIG_CODE_GRAPH_REFRESH"] === "off") return "disabled";
+  if (process.platform === "win32") return "unsupported";
+  if (is_replay_mode()) return "replay";
+  const root = repoRoot(cwd);
+  if (root === null || !hasProjectHome(root)) return "not-opted-in";
+  const home = projectHome(root);
+  if (!fs5.existsSync(home.autoRefreshPath)) return "not-opted-in";
+  if (anyTracked(root, [home.autoRefreshPath, home.cachePath].map((p) => path5.relative(root, p)))) return "tracked";
+  const done = (outcome, detail) => {
+    recordRefreshIn(home.stateDir, { by: "session-start", outcome, detail });
+    return outcome;
+  };
+  if (!fs5.existsSync(home.cachePath)) return done("no-cache");
+  const lock = home.lockPath;
+  if (fs5.existsSync(lock) && !isStale(lock)) return done("locked");
+  const verdict = usableCli(root);
+  if ("reason" in verdict) return done(verdict.reason, verdict.cli);
+  const child = spawnFn(verdict.cli, [...REFRESH_ARGS, "--root", root], {
+    cwd: root,
+    detached: true,
+    stdio: "ignore",
+    env: hardenedSpawnEnv()
+  });
+  child.on("error", () => {
+  });
+  child.unref();
+  return done("spawned", verdict.cli);
+}
+function main() {
+  try {
+    const raw = readHookStdin();
+    const envelope = raw.trim() ? JSON.parse(raw) : {};
+    const cwd = typeof envelope["cwd"] === "string" && envelope["cwd"] ? envelope["cwd"] : process.cwd();
+    refreshFor(cwd);
+  } catch {
+  }
+  return EXIT_ALLOW;
+}
+function isCliEntry() {
+  if (true) return false;
+  if (process.argv[1] === void 0) return false;
+  if (__acChunkMetaUrl === (0, import_node_url.pathToFileURL)(path5.resolve(process.argv[1])).href) return true;
+  try {
+    return fs5.realpathSync((0, import_node_url.fileURLToPath)(__acChunkMetaUrl)) === fs5.realpathSync(path5.resolve(process.argv[1]));
+  } catch {
+    return false;
+  }
+}
+if (isCliEntry()) process.exit(main());
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REFRESH_ARGS,
+  main,
+  refreshFor,
+  repoRoot,
+  resolveCli
+});

package/dist/hooks/code_graph_refresh.chunk.cjs.sha256

@@ -0,0 +1 @@
+fdef0100152bef370980295f03f85f4c6ea3bab4376cecda0c83479b6c97ed4b  code_graph_refresh.chunk.cjs