@guardion/guardion 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +202 -0
- package/dist/bin/cli.d.ts.map +1 -0
- package/dist/bin/cli.js +590 -0
- package/dist/bin/cli.js.map +1 -0
- package/dist/connectors/claude-code/hooks/enforce.cjs +58 -0
- package/dist/connectors/claude-code/hooks/guardion-hook.cjs +355 -0
- package/dist/connectors/claude-code/hooks/tool-scanner.cjs +272 -0
- package/dist/connectors/claude-code/src/collect.d.ts +5 -0
- package/dist/connectors/claude-code/src/collect.d.ts.map +1 -0
- package/dist/connectors/claude-code/src/collect.js +17 -0
- package/dist/connectors/claude-code/src/collect.js.map +1 -0
- package/dist/{installer.d.ts → connectors/claude-code/src/installer.d.ts} +2 -1
- package/dist/connectors/claude-code/src/installer.d.ts.map +1 -0
- package/dist/connectors/claude-code/src/installer.js +190 -0
- package/dist/connectors/claude-code/src/installer.js.map +1 -0
- package/dist/connectors/claude-code/src/scanner.d.ts.map +1 -0
- package/dist/{scanner.js → connectors/claude-code/src/scanner.js} +1 -1
- package/dist/connectors/claude-code/src/scanner.js.map +1 -0
- package/dist/core/config.d.ts +239 -0
- package/dist/core/config.d.ts.map +1 -0
- package/dist/core/config.js +154 -0
- package/dist/core/config.js.map +1 -0
- package/dist/{constants.d.ts → core/constants.d.ts} +8 -3
- package/dist/core/constants.d.ts.map +1 -0
- package/dist/core/constants.js +54 -0
- package/dist/core/constants.js.map +1 -0
- package/dist/core/discover.d.ts +36 -0
- package/dist/core/discover.d.ts.map +1 -0
- package/dist/core/discover.js +154 -0
- package/dist/core/discover.js.map +1 -0
- package/dist/core/fingerprint.cjs +84 -0
- package/dist/core/inventory.d.ts +35 -0
- package/dist/core/inventory.d.ts.map +1 -0
- package/dist/core/inventory.js +69 -0
- package/dist/core/inventory.js.map +1 -0
- package/dist/core/keychain.d.ts.map +1 -0
- package/dist/{keychain.js → core/keychain.js} +53 -15
- package/dist/core/keychain.js.map +1 -0
- package/dist/core/mcp/guard-client.cjs +86 -0
- package/dist/core/mcp/interceptor.cjs +238 -0
- package/dist/core/mcp/jsonrpc.cjs +194 -0
- package/dist/core/mcp/transport/http-server-side.cjs +89 -0
- package/dist/core/mcp/transport/http-upstream.cjs +111 -0
- package/dist/core/mcp/transport/http_forward.cjs +40 -0
- package/dist/core/mcp/transport/http_input.cjs +46 -0
- package/dist/core/mcp/transport/http_reverse.cjs +33 -0
- package/dist/core/mcp/transport/index.cjs +32 -0
- package/dist/core/mcp/transport/sse_bridge.cjs +101 -0
- package/dist/core/mcp/transport/stdio.cjs +60 -0
- package/dist/core/mcp-interpose.cjs +141 -0
- package/dist/core/mcp-protect.d.ts +69 -0
- package/dist/core/mcp-protect.d.ts.map +1 -0
- package/dist/core/mcp-protect.js +205 -0
- package/dist/core/mcp-protect.js.map +1 -0
- package/dist/core/mcp-scan.d.ts +40 -0
- package/dist/core/mcp-scan.d.ts.map +1 -0
- package/dist/core/mcp-scan.js +201 -0
- package/dist/core/mcp-scan.js.map +1 -0
- package/dist/core/mock-server.d.ts.map +1 -0
- package/dist/{mock-server.js → core/mock-server.js} +60 -4
- package/dist/core/mock-server.js.map +1 -0
- package/package.json +9 -10
- package/config.yaml.example +0 -26
- package/dist/cli.d.ts.map +0 -1
- package/dist/cli.js +0 -289
- package/dist/cli.js.map +0 -1
- package/dist/config.d.ts +0 -28
- package/dist/config.d.ts.map +0 -1
- package/dist/config.js +0 -63
- package/dist/config.js.map +0 -1
- package/dist/constants.d.ts.map +0 -1
- package/dist/constants.js +0 -44
- package/dist/constants.js.map +0 -1
- package/dist/installer.d.ts.map +0 -1
- package/dist/installer.js +0 -137
- package/dist/installer.js.map +0 -1
- package/dist/keychain.d.ts.map +0 -1
- package/dist/keychain.js.map +0 -1
- package/dist/mock-server.d.ts.map +0 -1
- package/dist/mock-server.js.map +0 -1
- package/dist/scanner.d.ts.map +0 -1
- package/dist/scanner.js.map +0 -1
- package/hooks/guardion-hook.cjs +0 -202
- /package/dist/{cli.d.ts → bin/cli.d.ts} +0 -0
- /package/dist/{scanner.d.ts → connectors/claude-code/src/scanner.d.ts} +0 -0
- /package/dist/{keychain.d.ts → core/keychain.d.ts} +0 -0
- /package/{hooks → dist/core}/metadata.cjs +0 -0
- /package/dist/{mock-server.d.ts → core/mock-server.d.ts} +0 -0
package/dist/mock-server.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"mock-server.js","sourceRoot":"","sources":["../src/mock-server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAQ,OAAO,CAAC;AAE5B,MAAM,YAAY,GAAI,IAAI,CAAC;AAC3B,MAAM,WAAW,GAAK,kBAAkB,CAAC,CAAG,yCAAyC;AACrF,MAAM,WAAW,GAAK,SAAS,CAAC;AAahC,IAAI,MAAM,GAAI,CAAC,CAAC;AAChB,MAAM,IAAI,GAAe,EAAE,CAAC;AAE5B,SAAS,EAAE,KAAK,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEhE,SAAS,MAAM,CACb,MAAc,EACd,CAAS,EACT,MAAc,EACd,WAAmB,EACnB,IAAa,EACb,OAAgC,EAAE;IAElC,MAAM,KAAK,GAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,YAAY;IACjD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,8EAA8E;IAE9E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAE9E,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,KAAK,GAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAM,GAAG,CAAC,IAA+B,CAAC;QACpD,MAAM,KAAK,GAAK,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACxE,MAAM,IAAI,GAAM,IAAI,CAAC,SAAS,CAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAElE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAEvH,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAqC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7G,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM;YAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtH,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,QAAmC,CAAC;YACnD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE;YACzD,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAE9E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,YAAY,EAAE,CAAC;QACnB,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE;YAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,eAA0B,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/F,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAE9E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuED,CAAC;AACT,CAAC"}
|
package/dist/scanner.d.ts.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,KAAK,CAAC,EAAO,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAK,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAK,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,GAAG,CAAC,EAAM,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAU,MAAM,CAAC;IAC7B,QAAQ,EAAc,cAAc,GAAG,IAAI,CAAC;IAC5C,mBAAmB,EAAG,OAAO,CAAC;IAC9B,UAAU,EAAY,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMpE;AAED,wBAAgB,IAAI,IAAI,UAAU,CAejC"}
|
package/dist/scanner.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAQ,SAAS,CAAC;AAG3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AA0BtD,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAmB,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,MAAM,YAAY,GAAG,oBAAoB,CAAC;IAC1C,MAAM,QAAQ,GAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,UAAU,GAAK;QACnB,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC;KAChC,CAAC;IAEF,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,OAAO,CACjC,QAAQ,EAAE,GAAG,EAAE,aAAa;QAC5B,QAAQ,EAAE,GAAG,EAAE,gBAAgB;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC3D,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC;AACrE,CAAC"}
|
package/hooks/guardion-hook.cjs
DELETED
|
@@ -1,202 +0,0 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
/**
|
|
3
|
-
* Guardion Claude Code hook — monitoring-only event forwarder.
|
|
4
|
-
*
|
|
5
|
-
* Reads hook event JSON from stdin, resolves config + token, posts to Guard API.
|
|
6
|
-
* Always exits 0 — never blocks Claude Code.
|
|
7
|
-
*
|
|
8
|
-
* Config (in priority order):
|
|
9
|
-
* ~/.guardion/config.json written by `npx guardion init`
|
|
10
|
-
* GUARDION_API_URL env override for CI / testing
|
|
11
|
-
* GUARDION_POLICY env override for CI / testing
|
|
12
|
-
*
|
|
13
|
-
* Token (first match wins):
|
|
14
|
-
* GUARDION_TOKEN env CI / testing
|
|
15
|
-
* macOS Keychain service=guardion, account=token
|
|
16
|
-
* /etc/guardion/token enterprise MDM, root-owned
|
|
17
|
-
* ~/.guardion/token user-level fallback
|
|
18
|
-
*/
|
|
19
|
-
'use strict';
|
|
20
|
-
|
|
21
|
-
const fs = require('fs');
|
|
22
|
-
const path = require('path');
|
|
23
|
-
const os = require('os');
|
|
24
|
-
const http = require('http');
|
|
25
|
-
const https = require('https');
|
|
26
|
-
const { execFileSync } = require('child_process');
|
|
27
|
-
|
|
28
|
-
// ── Constants ────────────────────────────────────────────────────────────────
|
|
29
|
-
|
|
30
|
-
const HOOK_TIMEOUT_MS = 3000;
|
|
31
|
-
const KEYCHAIN_TIMEOUT = 1000;
|
|
32
|
-
const GUARDION_DIR = path.join(os.homedir(), '.guardion');
|
|
33
|
-
const CONFIG_JSON_PATH = path.join(GUARDION_DIR, 'config.json');
|
|
34
|
-
const SESSION_DIR = path.join(GUARDION_DIR, 'sessions');
|
|
35
|
-
const CURRENT_SESSION = path.join(GUARDION_DIR, 'current-session');
|
|
36
|
-
const HOOK_EVENTS_PATH = '/v1/hooks/events';
|
|
37
|
-
|
|
38
|
-
// ── Config ───────────────────────────────────────────────────────────────────
|
|
39
|
-
|
|
40
|
-
function loadConfig() {
|
|
41
|
-
try {
|
|
42
|
-
return JSON.parse(fs.readFileSync(CONFIG_JSON_PATH, 'utf8'));
|
|
43
|
-
} catch {
|
|
44
|
-
return {
|
|
45
|
-
api_url: process.env.GUARDION_API_URL || 'https://api.guardion.ai',
|
|
46
|
-
policy: process.env.GUARDION_POLICY || '',
|
|
47
|
-
application: process.env.GUARDION_APPLICATION || 'claude-code',
|
|
48
|
-
tier: process.env.GUARDION_TIER || 'hooks',
|
|
49
|
-
};
|
|
50
|
-
}
|
|
51
|
-
}
|
|
52
|
-
|
|
53
|
-
// ── Token ────────────────────────────────────────────────────────────────────
|
|
54
|
-
|
|
55
|
-
function resolveToken() {
|
|
56
|
-
if (process.env.GUARDION_TOKEN) return process.env.GUARDION_TOKEN.trim();
|
|
57
|
-
|
|
58
|
-
if (process.platform === 'darwin') {
|
|
59
|
-
try {
|
|
60
|
-
const t = execFileSync(
|
|
61
|
-
'security',
|
|
62
|
-
['find-generic-password', '-s', 'guardion', '-a', 'token', '-w'],
|
|
63
|
-
{ timeout: KEYCHAIN_TIMEOUT, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
|
|
64
|
-
).trim();
|
|
65
|
-
if (t) return t;
|
|
66
|
-
} catch { /* not in keychain */ }
|
|
67
|
-
}
|
|
68
|
-
|
|
69
|
-
for (const p of ['/etc/guardion/token', path.join(GUARDION_DIR, 'token')]) {
|
|
70
|
-
try {
|
|
71
|
-
const t = fs.readFileSync(p, 'utf8').trim();
|
|
72
|
-
if (t) return t;
|
|
73
|
-
} catch { /* file absent */ }
|
|
74
|
-
}
|
|
75
|
-
|
|
76
|
-
return '';
|
|
77
|
-
}
|
|
78
|
-
|
|
79
|
-
// ── Session persistence ───────────────────────────────────────────────────────
|
|
80
|
-
|
|
81
|
-
function writeCurrentSession(sessionId) {
|
|
82
|
-
try {
|
|
83
|
-
fs.mkdirSync(GUARDION_DIR, { recursive: true });
|
|
84
|
-
const tmp = CURRENT_SESSION + '.tmp';
|
|
85
|
-
fs.writeFileSync(tmp, sessionId, 'utf8');
|
|
86
|
-
fs.renameSync(tmp, CURRENT_SESSION);
|
|
87
|
-
} catch { /* non-critical */ }
|
|
88
|
-
}
|
|
89
|
-
|
|
90
|
-
function readCurrentSession() {
|
|
91
|
-
try { return fs.readFileSync(CURRENT_SESSION, 'utf8').trim(); } catch { return ''; }
|
|
92
|
-
}
|
|
93
|
-
|
|
94
|
-
function deleteCurrentSession() {
|
|
95
|
-
try { fs.unlinkSync(CURRENT_SESSION); } catch { /* already gone */ }
|
|
96
|
-
}
|
|
97
|
-
|
|
98
|
-
function writeSessionMeta(sessionId, meta) {
|
|
99
|
-
try {
|
|
100
|
-
fs.mkdirSync(SESSION_DIR, { recursive: true });
|
|
101
|
-
fs.writeFileSync(
|
|
102
|
-
path.join(SESSION_DIR, `${sessionId}.json`),
|
|
103
|
-
JSON.stringify(meta, null, 2),
|
|
104
|
-
'utf8'
|
|
105
|
-
);
|
|
106
|
-
} catch { /* non-critical */ }
|
|
107
|
-
}
|
|
108
|
-
|
|
109
|
-
function deleteSessionMeta(sessionId) {
|
|
110
|
-
if (!sessionId) return;
|
|
111
|
-
try { fs.unlinkSync(path.join(SESSION_DIR, `${sessionId}.json`)); } catch { /* gone */ }
|
|
112
|
-
}
|
|
113
|
-
|
|
114
|
-
// ── HTTP POST ─────────────────────────────────────────────────────────────────
|
|
115
|
-
|
|
116
|
-
function postEvent(apiUrl, token, payload) {
|
|
117
|
-
return new Promise((resolve) => {
|
|
118
|
-
let url;
|
|
119
|
-
try { url = new URL(HOOK_EVENTS_PATH, apiUrl); } catch {
|
|
120
|
-
return resolve();
|
|
121
|
-
}
|
|
122
|
-
const transport = url.protocol === 'https:' ? https : http;
|
|
123
|
-
const body = JSON.stringify(payload);
|
|
124
|
-
|
|
125
|
-
const req = transport.request(
|
|
126
|
-
{
|
|
127
|
-
hostname: url.hostname,
|
|
128
|
-
port: url.port || (url.protocol === 'https:' ? 443 : 80),
|
|
129
|
-
path: url.pathname + url.search,
|
|
130
|
-
method: 'POST',
|
|
131
|
-
headers: {
|
|
132
|
-
'Content-Type': 'application/json',
|
|
133
|
-
'Authorization': `Bearer ${token}`,
|
|
134
|
-
'Content-Length': Buffer.byteLength(body),
|
|
135
|
-
},
|
|
136
|
-
timeout: HOOK_TIMEOUT_MS,
|
|
137
|
-
},
|
|
138
|
-
(res) => { res.resume(); res.on('end', resolve); }
|
|
139
|
-
);
|
|
140
|
-
|
|
141
|
-
req.on('error', resolve);
|
|
142
|
-
req.on('timeout', () => { req.destroy(); resolve(); });
|
|
143
|
-
req.write(body);
|
|
144
|
-
req.end();
|
|
145
|
-
});
|
|
146
|
-
}
|
|
147
|
-
|
|
148
|
-
// ── Metadata ──────────────────────────────────────────────────────────────────
|
|
149
|
-
|
|
150
|
-
function collectMetadata(payload) {
|
|
151
|
-
try {
|
|
152
|
-
const { collectMetadata: collect } = require('./metadata.cjs');
|
|
153
|
-
return collect(payload);
|
|
154
|
-
} catch {
|
|
155
|
-
return { session_id: payload.session_id || null, cwd: payload.cwd || process.cwd() };
|
|
156
|
-
}
|
|
157
|
-
}
|
|
158
|
-
|
|
159
|
-
// ── Main ──────────────────────────────────────────────────────────────────────
|
|
160
|
-
|
|
161
|
-
// Safety: hard exit after timeout regardless of network state
|
|
162
|
-
setTimeout(() => process.exit(0), HOOK_TIMEOUT_MS + 1500);
|
|
163
|
-
|
|
164
|
-
let rawInput = '';
|
|
165
|
-
process.stdin.setEncoding('utf8');
|
|
166
|
-
process.stdin.on('data', (chunk) => { rawInput += chunk; });
|
|
167
|
-
process.stdin.on('end', async () => {
|
|
168
|
-
let payload;
|
|
169
|
-
try { payload = JSON.parse(rawInput); } catch { return process.exit(0); }
|
|
170
|
-
|
|
171
|
-
const config = loadConfig();
|
|
172
|
-
const token = resolveToken();
|
|
173
|
-
if (!token) return process.exit(0);
|
|
174
|
-
|
|
175
|
-
const event = payload.hook_event_name || payload.event || '';
|
|
176
|
-
|
|
177
|
-
// Enrich payload with config context
|
|
178
|
-
if (config.policy) payload.policy = config.policy;
|
|
179
|
-
if (config.application) payload.application = config.application;
|
|
180
|
-
|
|
181
|
-
if (event === 'SessionStart') {
|
|
182
|
-
const meta = collectMetadata(payload);
|
|
183
|
-
const sessionId = payload.session_id || meta.session_id || `gs-${Date.now()}`;
|
|
184
|
-
|
|
185
|
-
payload.trace_id = sessionId;
|
|
186
|
-
payload.metadata = meta;
|
|
187
|
-
|
|
188
|
-
writeCurrentSession(sessionId);
|
|
189
|
-
writeSessionMeta(sessionId, meta);
|
|
190
|
-
} else if (event === 'SessionEnd') {
|
|
191
|
-
const sessionId = payload.session_id || readCurrentSession();
|
|
192
|
-
payload.trace_id = sessionId;
|
|
193
|
-
deleteCurrentSession();
|
|
194
|
-
deleteSessionMeta(sessionId);
|
|
195
|
-
} else {
|
|
196
|
-
const traceId = process.env.GUARDION_TRACE_ID || readCurrentSession();
|
|
197
|
-
if (traceId) payload.trace_id = traceId;
|
|
198
|
-
}
|
|
199
|
-
|
|
200
|
-
await postEvent(config.api_url, token, payload);
|
|
201
|
-
process.exit(0);
|
|
202
|
-
});
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|