@highflame/overwatch-v2 2.0.0-internal.1

package/dist/hooks/claudecode/hooks.json.template

@@ -0,0 +1,20 @@
+{
+  "UserPromptSubmit": [
+    {
+      "command": "~/.overwatch/universal-hook.sh claudecode UserPromptSubmit",
+      "timeout": 10000
+    }
+  ],
+  "PreToolUse": [
+    {
+      "command": "~/.overwatch/universal-hook.sh claudecode PreToolUse",
+      "timeout": 10000
+    }
+  ],
+  "PostToolUse": [
+    {
+      "command": "~/.overwatch/universal-hook.sh claudecode PostToolUse",
+      "timeout": 5000
+    }
+  ]
+}

package/dist/hooks/cursor/hooks.json.template

@@ -0,0 +1,62 @@
+{
+  "beforeSubmitPrompt": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor beforeSubmitPrompt",
+      "timeout": 10000
+    }
+  ],
+  "beforeShellExecution": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor beforeShellExecution",
+      "timeout": 10000
+    }
+  ],
+  "beforeMCPExecution": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor beforeMCPExecution",
+      "timeout": 10000
+    }
+  ],
+  "beforeReadFile": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor beforeReadFile",
+      "timeout": 10000
+    }
+  ],
+  "afterShellExecution": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor afterShellExecution",
+      "timeout": 5000
+    }
+  ],
+  "afterMCPExecution": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor afterMCPExecution",
+      "timeout": 5000
+    }
+  ],
+  "afterFileEdit": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor afterFileEdit",
+      "timeout": 5000
+    }
+  ],
+  "afterAgentResponse": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor afterAgentResponse",
+      "timeout": 5000
+    }
+  ],
+  "afterAgentThought": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor afterAgentThought",
+      "timeout": 5000
+    }
+  ],
+  "stop": [
+    {
+      "command": "~/.overwatch/universal-hook.sh cursor stop",
+      "timeout": 5000
+    }
+  ]
+}

package/dist/hooks/universal-hook.ps1

@@ -0,0 +1,118 @@
+# Overwatch Universal Hook Adapter (PowerShell)
+# This script handles communication between AI tools and the Guardian daemon.
+# Usage: pwsh -NoProfile -File universal-hook.ps1 <source> <event> [default_json]
+#
+# Input: JSON payload via stdin
+# Output: JSON response to stdout
+
+param(
+    [Parameter(Mandatory=$true, Position=0)]
+    [string]$IdeSource,
+
+    [Parameter(Mandatory=$true, Position=1)]
+    [string]$HookEvent,
+
+    [Parameter(Position=2)]
+    [string]$DefaultResponse = "{}"
+)
+
+$ErrorActionPreference = "SilentlyContinue"
+
+function Try-AutoStartDaemon {
+    $lockDir = Join-Path $env:USERPROFILE ".overwatch" "daemon.lock.d"
+
+    # Check if overwatch is on PATH
+    $overwatch = Get-Command "overwatch" -ErrorAction SilentlyContinue
+    if (-not $overwatch) { return }
+
+    # Clear stale lock first so we can start the daemon in this invocation
+    if (Test-Path $lockDir) {
+        $lockAge = (Get-Date) - (Get-Item $lockDir).LastWriteTime
+        if ($lockAge.TotalSeconds -gt 30) {
+            Remove-Item $lockDir -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    if (-not (Test-Path $lockDir)) {
+        # Create lock directory atomically
+        try {
+            [System.IO.Directory]::CreateDirectory($lockDir) | Out-Null
+            # Fire-and-forget: start daemon in background
+            Start-Process -FilePath "overwatch" -ArgumentList "start","--hook" `
+                -WindowStyle Hidden -PassThru | Out-Null
+        } catch {
+            # Another process grabbed the lock — ignore
+        }
+    }
+}
+
+# 1. Read guardian port from discovery file, default to 17580
+$portFile = Join-Path $env:USERPROFILE ".overwatch" "guardian_port"
+$guardianPort = 17580
+if (Test-Path $portFile) {
+    $portStr = (Get-Content $portFile -Raw -ErrorAction SilentlyContinue).Trim()
+    $parsed = 0
+    if ([int]::TryParse($portStr, [ref]$parsed)) {
+        $guardianPort = $parsed
+    }
+}
+
+$baseUrl = "http://127.0.0.1:$guardianPort"
+$endpoint = "$baseUrl/hook/$IdeSource/$HookEvent"
+
+# 2. Read payload from stdin with timeout
+# Use OpenStandardInput() instead of [Console]::In — PowerShell's host can
+# redirect Console.In when launched with -File, causing piped stdin to be lost.
+# OpenStandardInput() bypasses the host and reads the raw OS stdin stream.
+# Wrap in a Task with 5s timeout to prevent blocking the IDE if the pipe isn't closed.
+$payload = ""
+try {
+    $stream = [System.Console]::OpenStandardInput()
+    $reader = [System.IO.StreamReader]::new($stream, [System.Text.Encoding]::UTF8)
+    $task = $reader.ReadToEndAsync()
+    if ($task.Wait(5000)) {
+        $payload = $task.Result
+    }
+    $reader.Dispose()
+} catch {
+    $payload = ""
+}
+if ([string]::IsNullOrWhiteSpace($payload)) {
+    $payload = "{}"
+}
+
+# 3. Cross-IDE dedup: skip if Cursor is firing a non-cursor hook
+if ($IdeSource -ne "cursor" -and $payload -match '"cursor_version"') {
+    Write-Output $DefaultResponse
+    exit 0
+}
+
+# 4. Health check & forward payload
+try {
+    $healthResponse = Invoke-WebRequest -Uri "$baseUrl/health" `
+        -Method GET -TimeoutSec 1 -UseBasicParsing -ErrorAction Stop
+    $healthy = $healthResponse.StatusCode -eq 200
+} catch {
+    $healthy = $false
+}
+
+$responseBody = $DefaultResponse
+if ($healthy) {
+    try {
+        $response = Invoke-WebRequest -Uri $endpoint `
+            -Method POST `
+            -Body $payload `
+            -ContentType "application/json" `
+            -TimeoutSec 10 `
+            -UseBasicParsing `
+            -ErrorAction Stop
+        $responseBody = $response.Content
+    } catch {
+        # keep default
+    }
+} else {
+    Try-AutoStartDaemon
+}
+
+# 5. Pass-through: every supported agent reads stdout JSON.
+Write-Output $responseBody

package/dist/hooks/universal-hook.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Overwatch Universal Hook Adapter
+# This script handles communication between AI tools and the Guardian daemon.
+# Usage: ./universal-hook.sh <source> <event> <default_json>
+
+set -euo pipefail
+
+IDE_SOURCE=$1
+HOOK_EVENT=$2
+DEFAULT_RESPONSE=${3:-"{}"}
+
+# Auto-start daemon in background if not running (fire-and-forget)
+try_auto_start() {
+    local LOCK_DIR="$HOME/.overwatch/daemon.lock.d"
+    if command -v overwatch >/dev/null 2>&1; then
+        # Use mkdir as an atomic lock — only one process can succeed
+        if mkdir "$LOCK_DIR" 2>/dev/null; then
+            nohup overwatch start --hook >/dev/null 2>&1 &
+        else
+            # Lock exists — check if it's stale (older than 30s)
+            local LOCK_AGE=$(( $(date +%s) - $(stat -f %m "$LOCK_DIR" 2>/dev/null || stat -c %Y "$LOCK_DIR" 2>/dev/null || echo 0) ))
+            if [ "$LOCK_AGE" -gt 30 ]; then
+                rmdir "$LOCK_DIR" 2>/dev/null || true
+            fi
+        fi
+    fi
+}
+
+# Read guardian port from discovery file, default to static port 17580
+GUARDIAN_PORT_FILE="$HOME/.overwatch/guardian_port"
+GUARDIAN_PORT=$(cat "$GUARDIAN_PORT_FILE" 2>/dev/null || echo "17580")
+ENDPOINT="http://127.0.0.1:${GUARDIAN_PORT}/hook/${IDE_SOURCE}/${HOOK_EVENT}"
+
+# 2. Read payload from stdin (needed for dedup check and forwarding)
+PAYLOAD=$(cat)
+
+# 3. Cross-IDE dedup: skip if Cursor is firing a non-cursor hook.
+#    Cursor picks up hooks from other IDEs (e.g. ~/.claude/settings.json) and fires them,
+#    causing duplicate processing. Detect this via cursor_version in the payload.
+if [ "$IDE_SOURCE" != "cursor" ] && echo "$PAYLOAD" | grep -q '"cursor_version"'; then
+    echo "$DEFAULT_RESPONSE"
+    exit 0
+fi
+
+# 4. Health Check & Forward Payload
+# We use a 1s timeout for the health check to avoid hanging if the daemon is dead.
+if curl -s -f -m 1 "http://127.0.0.1:${GUARDIAN_PORT}/health" >/dev/null 2>&1; then
+    # Forward payload to daemon and capture response
+    # Use a 10s timeout for processing
+    RESPONSE=$(echo "$PAYLOAD" | curl -s -m 10 -X POST "$ENDPOINT" \
+        -H "Content-Type: application/json" \
+        -d @- 2>/dev/null || echo "$DEFAULT_RESPONSE")
+else
+    # Daemon is unreachable — try to auto-start it
+    try_auto_start
+    RESPONSE="$DEFAULT_RESPONSE"
+fi
+
+# 5. Pass-through: every supported agent reads stdout JSON.
+echo "$RESPONSE"

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @highflame/overwatch-v2
+ *
+ * Security validation module for Overwatch extensions
+ */
+export { GuardianModule } from "./module";
+export * from "./types";