@fml-inc/fml 0.7.0 → 0.8.0-rc.2

package/dist/hook-handler.js

@@ -0,0 +1,440 @@
+#!/usr/bin/env node
+import {
+  hookCaptureIsDisabled
+} from "./chunk-ENW2GJNO.js";
+import {
+  getActiveHookDestinationBinding
+} from "./chunk-DZKYW327.js";
+import {
+  HOOK_TARGETS,
+  SHELL_TOOL_NAMES,
+  createHookInboxEntry,
+  hookInboxDeliveryPayload,
+  normalizeObserverHookCapture,
+  persistHookInboxEntry,
+  readObserverAuthToken
+} from "./chunk-56TPYMNK.js";
+import {
+  resolveRepositoryRootFromCwd,
+  resolveRepositorySlugFromCwd
+} from "./chunk-7V7G7NVF.js";
+import {
+  FML_HOOK_CONTEXT_STATE_DIR,
+  FML_HOOK_INBOX_DIR,
+  FML_OBSERVER_AUTH_TOKEN_FILE,
+  FML_OBSERVER_ENDPOINT_FILE,
+  getValidToken
+} from "./chunk-A6HAEVJX.js";
+import "./chunk-MLKGABMK.js";
+
+// src/hooks/handler.ts
+import fs2 from "fs";
+
+// src/hooks/context.ts
+import { createHash } from "crypto";
+import fs from "fs";
+import path from "path";
+var HOOK_CONTEXT_ENDPOINT = "/v1/panopticon/hook-context";
+var HOOK_CONTEXT_TIMEOUT_MS = 2e3;
+var MAX_ADDITIONAL_CONTEXT_CHARS = 4e3;
+var MAX_PROMPT_CHARS = 2e4;
+var STATE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "apply_patch",
+  "edit",
+  "multiedit",
+  "notebookedit",
+  "write",
+  "write_file"
+]);
+var READ_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "read_file"]);
+function sameDestination(left, right) {
+  return left.environment === right.environment && left.targetUrl === right.targetUrl && left.destinationIdentity === right.destinationIdentity;
+}
+function markerPath(stateDir, kind, value) {
+  const digest = createHash("sha256").update(value).digest("hex");
+  return path.join(stateDir, kind, digest);
+}
+function ensureMarkerDirectory(filePath) {
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isSubsequentUserPrompt(sessionId, eventSyncId, stateDir = FML_HOOK_CONTEXT_STATE_DIR) {
+  const filePath = markerPath(stateDir, "prompt", sessionId);
+  if (!ensureMarkerDirectory(filePath)) return false;
+  try {
+    fs.writeFileSync(filePath, eventSyncId, { flag: "wx", mode: 384 });
+    return false;
+  } catch (error) {
+    if (error.code !== "EEXIST") return false;
+    try {
+      return fs.readFileSync(filePath, "utf8") !== eventSyncId;
+    } catch {
+      return false;
+    }
+  }
+}
+function pathContextWasEmitted(sessionId, filePath, stateDir) {
+  try {
+    return fs.existsSync(
+      markerPath(stateDir, "path", `${sessionId}:${filePath}`)
+    );
+  } catch {
+    return true;
+  }
+}
+function claimPathContext(sessionId, filePath, stateDir) {
+  const claim = markerPath(stateDir, "path", `${sessionId}:${filePath}`);
+  if (!ensureMarkerDirectory(claim)) return false;
+  try {
+    fs.writeFileSync(claim, "", { flag: "wx", mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pruneOldMarkers(directory, nowMs) {
+  if ((nowMs + process.pid) % 256 !== 0) return;
+  for (const kind of ["prompt", "path"]) {
+    const markerDirectory = path.join(directory, kind);
+    let names;
+    try {
+      names = fs.readdirSync(markerDirectory).slice(0, 1e3);
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      const filePath = path.join(markerDirectory, name);
+      try {
+        if (nowMs - fs.statSync(filePath).mtimeMs > STATE_MAX_AGE_MS) {
+          fs.rmSync(filePath, { force: true });
+        }
+      } catch {
+      }
+    }
+  }
+}
+function canonicalFilePath(filePath, cwd, repositoryRoot) {
+  const windows = [filePath, cwd, repositoryRoot].some(
+    (value) => value !== void 0 && value !== null && /^[A-Za-z]:[\\/]/.test(value)
+  );
+  const pathApi = windows ? path.win32 : path.posix;
+  const normalized = pathApi.normalize(filePath);
+  const resolved = pathApi.isAbsolute(normalized) ? normalized : cwd && pathApi.isAbsolute(cwd) ? pathApi.resolve(cwd, normalized) : normalized;
+  if (repositoryRoot && pathApi.isAbsolute(resolved)) {
+    const relative2 = pathApi.relative(
+      pathApi.normalize(repositoryRoot),
+      resolved
+    );
+    if (relative2 && relative2 !== ".." && !relative2.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative2)) {
+      return relative2.replace(/\\/g, "/");
+    }
+  }
+  if (!pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/^[.][\\/]/, "").replace(/\\/g, "/");
+  }
+  if (!cwd || pathApi.isAbsolute(cwd) !== pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/\\/g, "/");
+  }
+  const relative = pathApi.relative(pathApi.normalize(cwd), resolved);
+  if (relative && relative !== ".." && !relative.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative)) {
+    return relative.replace(/\\/g, "/");
+  }
+  return resolved.replace(/\\/g, "/");
+}
+function buildServerHookContextRequest(target2, event, stateDir = FML_HOOK_CONTEXT_STATE_DIR, repositoryRoot = null) {
+  if (target2 !== "claude" && target2 !== "codex") return null;
+  if (!event.repository) return null;
+  const markerSessionId = `${target2}:${event.sessionId}`;
+  const base = {
+    repository: event.repository,
+    sessionId: event.sessionId,
+    nowMs: event.timestampMs
+  };
+  if (event.eventType === "SessionStart") {
+    return { ...base, eventType: "SessionStart" };
+  }
+  if (event.eventType === "UserPromptSubmit" && event.userPrompt) {
+    if (!isSubsequentUserPrompt(markerSessionId, event.syncId, stateDir)) {
+      return null;
+    }
+    return {
+      ...base,
+      eventType: "UserPromptSubmit",
+      prompt: event.userPrompt.slice(0, MAX_PROMPT_CHARS)
+    };
+  }
+  if (event.eventType !== "PreToolUse" || !event.toolName) {
+    return null;
+  }
+  const toolName = event.toolName.toLowerCase();
+  const fileOperation = EDIT_TOOL_NAMES.has(toolName) ? "edit" : READ_TOOL_NAMES.has(toolName) || SHELL_TOOL_NAMES.has(toolName) ? "read" : null;
+  if (!fileOperation) return null;
+  if (!event.filePath) return null;
+  const filePath = canonicalFilePath(event.filePath, event.cwd, repositoryRoot);
+  if (pathContextWasEmitted(
+    markerSessionId,
+    `${event.repository}:${filePath}`,
+    stateDir
+  )) {
+    return null;
+  }
+  return { ...base, eventType: "PreToolUse", filePath, fileOperation };
+}
+function hookOutput(request, additionalContext) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: request.eventType,
+      additionalContext
+    }
+  };
+}
+async function requestServerHookContext(target2, event, destination, opts = {}) {
+  const deadlineSignal = AbortSignal.timeout(
+    opts.timeoutMs ?? HOOK_CONTEXT_TIMEOUT_MS
+  );
+  const stateDir = opts.stateDir ?? FML_HOOK_CONTEXT_STATE_DIR;
+  pruneOldMarkers(stateDir, Date.now());
+  const repositoryRoot = event.eventType === "PreToolUse" && event.cwd ? (opts.resolveRepositoryRoot ?? ((cwd) => resolveRepositoryRootFromCwd(cwd, 250)))(event.cwd) : null;
+  const request = buildServerHookContextRequest(
+    target2,
+    event,
+    stateDir,
+    repositoryRoot
+  );
+  if (!request) return {};
+  try {
+    const token = await getValidToken({
+      env: destination.environment,
+      signal: deadlineSignal
+    });
+    if (!token) return {};
+    const currentDestination = getActiveHookDestinationBinding();
+    if (!currentDestination || !sameDestination(destination, currentDestination)) {
+      return {};
+    }
+    const response = await (opts.fetch ?? fetch)(
+      `${destination.targetUrl.replace(/\/+$/, "")}${HOOK_CONTEXT_ENDPOINT}`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: token.startsWith("Bearer ") ? token : `Bearer ${token}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(request),
+        signal: deadlineSignal
+      }
+    );
+    if (!response.ok) return {};
+    const body = await response.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) return {};
+    const additionalContext = body.additionalContext;
+    if (request.eventType === "PreToolUse" && request.filePath && additionalContext === null) {
+      claimPathContext(
+        `${target2}:${request.sessionId}`,
+        `${request.repository}:${request.filePath}`,
+        stateDir
+      );
+      return {};
+    }
+    if (typeof additionalContext !== "string" || additionalContext.length === 0 || additionalContext.length > MAX_ADDITIONAL_CONTEXT_CHARS) {
+      return {};
+    }
+    if (request.eventType === "PreToolUse" && request.filePath && !claimPathContext(
+      `${target2}:${request.sessionId}`,
+      `${request.repository}:${request.filePath}`,
+      stateDir
+    )) {
+      return {};
+    }
+    return hookOutput(request, additionalContext);
+  } catch {
+    return {};
+  }
+}
+
+// src/hooks/handler.ts
+var MAX_HOOK_STDIN_BYTES = 4 * 1024 * 1024;
+var HOOK_REQUEST_TIMEOUT_MS = 500;
+var HOOK_STDIN_TIMEOUT_MS = 5e3;
+var HOOK_REPO_RESOLUTION_TIMEOUT_MS = 250;
+function parseHookTarget(value) {
+  return HOOK_TARGETS.includes(value) ? value : null;
+}
+function observerEndpoint(endpointFile) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(endpointFile, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const record = parsed;
+    if (record.host !== "127.0.0.1" && record.host !== "::1" && record.host !== "localhost" || typeof record.port !== "number" || !Number.isInteger(record.port) || record.port <= 0 || record.port > 65535) {
+      return null;
+    }
+    return { host: record.host, port: record.port };
+  } catch {
+    return null;
+  }
+}
+async function readBoundedInput(input, timeoutMs) {
+  return await new Promise((resolve) => {
+    const chunks = [];
+    let totalBytes = 0;
+    let oversized = false;
+    let settled = false;
+    const swallowLateError = () => {
+    };
+    const cleanup = () => {
+      clearTimeout(timer);
+      input.off("data", onData);
+      input.off("end", onEnd);
+      input.off("close", onClose);
+      input.off("error", onError);
+    };
+    const finish = (value, drain = false) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (drain) {
+        input.on("error", swallowLateError);
+        input.resume();
+        const unref = input.unref;
+        unref?.call(input);
+      }
+      resolve(value);
+    };
+    const onData = (chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      totalBytes += bytes.byteLength;
+      if (totalBytes > MAX_HOOK_STDIN_BYTES) {
+        oversized = true;
+        chunks.length = 0;
+        return;
+      }
+      if (!oversized) chunks.push(bytes);
+    };
+    const onEnd = () => {
+      finish(oversized ? null : Buffer.concat(chunks, totalBytes));
+    };
+    const onClose = () => finish(null);
+    const onError = () => finish(null);
+    const timer = setTimeout(() => finish(null, true), timeoutMs);
+    input.on("data", onData);
+    input.once("end", onEnd);
+    input.once("close", onClose);
+    input.once("error", onError);
+    input.resume();
+  });
+}
+async function processHookHandler(target2, opts, includeContext) {
+  const input = opts.input ?? process.stdin;
+  const bytes = await readBoundedInput(
+    input,
+    opts.inputTimeoutMs ?? HOOK_STDIN_TIMEOUT_MS
+  );
+  if (!bytes || bytes.byteLength === 0) return { captured: false, output: {} };
+  let payload;
+  try {
+    payload = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    return { captured: false, output: {} };
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { captured: false, output: {} };
+  }
+  if (hookCaptureIsDisabled(opts.captureDisabledFile)) {
+    return { captured: false, output: {} };
+  }
+  const cwd = opts.cwd ?? process.cwd();
+  const hookRequest = {
+    target: target2,
+    payload,
+    cwd
+  };
+  let event = normalizeObserverHookCapture(hookRequest);
+  if (event?.cwd) {
+    try {
+      const repository = (opts.resolveRepository ?? ((directory) => resolveRepositorySlugFromCwd(
+        directory,
+        HOOK_REPO_RESOLUTION_TIMEOUT_MS
+      )))(event.cwd);
+      if (repository) event = { ...event, repository };
+    } catch {
+    }
+  }
+  const inboxDir = opts.inboxDir ?? FML_HOOK_INBOX_DIR;
+  let inboxEntry;
+  let persisted = false;
+  let destination = null;
+  if (event) {
+    try {
+      destination = getActiveHookDestinationBinding();
+    } catch {
+    }
+    inboxEntry = createHookInboxEntry(
+      hookRequest,
+      event,
+      destination ?? void 0
+    );
+    try {
+      persistHookInboxEntry(inboxEntry, inboxDir, opts.inboxLimits);
+      persisted = true;
+    } catch {
+    }
+  }
+  const contextPromise = includeContext && event && destination ? opts.requestContext ? opts.requestContext(target2, event, destination) : requestServerHookContext(target2, event, destination, {
+    ...opts.contextFetch ? { fetch: opts.contextFetch } : {},
+    ...opts.contextTimeoutMs === void 0 ? {} : { timeoutMs: opts.contextTimeoutMs },
+    ...opts.contextStateDir ? { stateDir: opts.contextStateDir } : {}
+  }) : Promise.resolve({});
+  const endpoint = observerEndpoint(
+    opts.endpointFile ?? FML_OBSERVER_ENDPOINT_FILE
+  );
+  const authToken = readObserverAuthToken(
+    opts.authTokenFile ?? FML_OBSERVER_AUTH_TOKEN_FILE
+  );
+  const deliveryPromise = (async () => {
+    if (!endpoint || !authToken) return persisted;
+    const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
+    const fetchRequest = opts.fetch ?? fetch;
+    try {
+      const response = await fetchRequest(
+        `http://${host}:${endpoint.port}/hooks`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${authToken}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(
+            inboxEntry ? hookInboxDeliveryPayload(inboxEntry) : hookRequest
+          ),
+          signal: AbortSignal.timeout(
+            opts.timeoutMs ?? HOOK_REQUEST_TIMEOUT_MS
+          )
+        }
+      );
+      await response.arrayBuffer();
+      return response.ok || persisted;
+    } catch {
+      return persisted;
+    }
+  })();
+  const [captured, output2] = await Promise.all([
+    deliveryPromise,
+    contextPromise.catch(() => ({}))
+  ]);
+  return { captured, output: output2 };
+}
+async function runHookHandlerForOutput(target2, opts = {}) {
+  return (await processHookHandler(target2, opts, true)).output;
+}
+
+// src/hook-handler.ts
+var target = parseHookTarget(process.argv[2]);
+var output = target ? await runHookHandlerForOutput(target).catch(() => ({})) : {};
+process.stdout.write(JSON.stringify(output));