@interlok/cli 0.0.0-stage → 1.3.0

package/dist/hook.js

@@ -0,0 +1,578 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { canonical } from "./canonical.js";
+/**
+ * Seconds each agent's config gives the hook. Gemini CLI and GitHub Copilot let a call through when
+ * a hook times out, so the wait for a person is always capped well inside this.
+ */
+export const HOOK_TIMEOUT_S = 120;
+export const MAX_WAIT_S = HOOK_TIMEOUT_S - 20;
+const SHELL = "^Bash$";
+/** Built-in rules: the actions that leave the worktree and are hard to take back. */
+export const DEFAULT_RULES = [
+    {
+        id: "git.push_protected",
+        label: "Push to a protected branch, or a force push",
+        match: String.raw `\bgit\s+push\b(?=[^;&|]*(?:[\s:+](?:main|master|production|release)(?:\s|$|[;&|])|\s(?:-f|--force(?:-with-lease)?|--mirror|--delete|-d)\b))`,
+    },
+    { id: "github.pr_merge", label: "Merge a pull request", match: String.raw `\bgh\s+pr\s+merge\b` },
+    {
+        id: "deploy.production",
+        label: "Production deploy",
+        match: String.raw `\b(?:vercel\b[^;&|]*\s--prod\b|vercel\s+promote\b|netlify\s+deploy\b[^;&|]*--prod\b|fly(?:ctl)?\s+deploy\b|railway\s+up\b|gcloud\s+(?:run|app)\s+deploy\b|aws\s+cloudformation\s+deploy\b|heroku\s+(?:releases:rollback|ps:scale)\b)`,
+    },
+    {
+        id: "infra.apply",
+        label: "Infrastructure change",
+        match: String.raw `\b(?:terraform\s+(?:apply|destroy|import|state\s+rm)\b|tofu\s+(?:apply|destroy)\b|pulumi\s+(?:up|destroy)\b|kubectl\s+(?:apply|delete|replace|patch|scale|rollout\s+restart|drain)\b|helm\s+(?:install|upgrade|uninstall|rollback)\b)`,
+    },
+    {
+        id: "db.migrate",
+        label: "Database migration or destructive SQL",
+        match: String.raw `\b(?:supabase\s+db\s+(?:push|reset)\b|prisma\s+(?:migrate\s+(?:deploy|reset)|db\s+push)\b|drizzle-kit\s+(?:push|migrate)\b|rails\s+db:(?:migrate|drop|reset)\b|alembic\s+upgrade\b|(?:drop|truncate)\s+(?:table|database|schema)\b|delete\s+from\s+\w+\s*(?:;|$))`,
+    },
+    {
+        id: "package.publish",
+        label: "Publish a package or image",
+        match: String.raw `\b(?:(?:npm|pnpm|bun)\s+publish\b|yarn\s+npm\s+publish\b|cargo\s+publish\b|twine\s+upload\b|gem\s+push\b|docker\s+push\b|gh\s+release\s+create\b)`,
+    },
+    {
+        id: "secrets.change",
+        label: "Change secrets or environment variables",
+        match: String.raw `\b(?:gh\s+secret\s+(?:set|delete)\b|vercel\s+env\s+(?:add|rm|remove)\b|aws\s+secretsmanager\s+(?:put|delete|update)|doppler\s+secrets\s+(?:set|delete)\b|fly\s+secrets\s+(?:set|unset)\b)`,
+    },
+    {
+        id: "fs.destructive",
+        label: "Delete outside the project",
+        match: String.raw `\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+(?:-[a-zA-Z]+\s+)*(?:/|~|\$HOME)(?:\s|/?\*?$|;)`,
+    },
+    {
+        id: "mcp.write",
+        label: "An MCP tool that changes something",
+        // Orchestration inside the developer's own machine (Paradev workspaces, terminals, tasks) and
+        // file edits through a filesystem server stay ungated; standing automations do not.
+        tool: String.raw `^(?!mcp__(?:superset|paradev)__(?:workspaces|agents|terminals|tasks|pages|hosts|projects)_)(?!mcp__filesystem__)mcp__(?!interlok)[^_].*__(?:[a-z0-9_]*_)?(?:create|update|delete|remove|send|merge|deploy|publish|refund|charge|transfer|drop|write|push|post|cancel|revoke|grant)(?:_[a-z0-9_]*)?$`,
+    },
+];
+/** Read the agent's stdin payload into one shape. Returns null for anything the hook ignores. */
+export function parseCall(agent, raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const cwd = String(raw.cwd ?? raw.workspace_roots?.[0] ?? process.cwd());
+    if (agent === "cursor") {
+        const session = String(raw.conversation_id ?? raw.generation_id ?? "cursor");
+        if (raw.hook_event_name === "beforeMCPExecution") {
+            let input = raw.tool_input;
+            if (typeof input === "string") {
+                try {
+                    input = JSON.parse(input);
+                }
+                catch {
+                    /* keep the string */
+                }
+            }
+            const server = String(raw.mcp_server_name ?? "server").replace(/[^A-Za-z0-9_-]/g, "_");
+            return { agent, tool: `mcp__${server}__${raw.tool_name ?? "tool"}`, input, session, cwd };
+        }
+        // beforeShellExecution (stdio MCP events also carry `command`, handled above).
+        if (typeof raw.command === "string") {
+            const command = raw.command;
+            return { agent, tool: "Bash", input: command, command, session, cwd };
+        }
+        return null;
+    }
+    if (agent === "gemini") {
+        const session = String(raw.session_id ?? "gemini");
+        const name = String(raw.tool_name ?? "");
+        const ti = raw.tool_input ?? {};
+        if (name === "run_shell_command" && typeof ti.command === "string") {
+            const command = ti.command;
+            return { agent, tool: "Bash", input: command, command, session, cwd };
+        }
+        if (name.startsWith("mcp_")) {
+            // Gemini names MCP tools mcp_<server>_<tool>; the context says where the split is.
+            const ctx = raw.mcp_context ?? {};
+            const server = String(ctx.server_name ?? "gemini").replace(/[^A-Za-z0-9_-]/g, "_");
+            const t = String(ctx.tool_name ?? name.slice(4));
+            return { agent, tool: `mcp__${server}__${t}`, input: ti, session, cwd };
+        }
+        return null;
+    }
+    // Claude Code, Codex and GitHub Copilot (whose PascalCase PreToolUse payload uses Claude's
+    // field names and reports shell commands as "Bash").
+    const tool = String(raw.tool_name ?? "");
+    const session = String(raw.session_id ?? raw.turn_id ?? "session");
+    let ti = raw.tool_input ?? {};
+    if (typeof ti === "string") {
+        try {
+            ti = JSON.parse(ti);
+        }
+        catch {
+            ti = { command: ti };
+        }
+    }
+    if (/^(?:Bash|shell|exec_command|local_shell|powershell)$/i.test(tool)) {
+        const cmd = Array.isArray(ti.command)
+            ? ti.command.join(" ")
+            : String(ti.command ?? ti.cmd ?? "");
+        // Codex may wrap the line as ["bash", "-lc", "<line>"].
+        const command = cmd.replace(/^(?:ba|z)?sh\s+-l?c\s+/, "");
+        return { agent, tool: "Bash", input: command, command, session, cwd };
+    }
+    if (tool.startsWith("mcp__"))
+        return { agent, tool, input: ti, session, cwd };
+    return null;
+}
+const compiled = new Map();
+const re = (s) => {
+    let r = compiled.get(s);
+    if (!r)
+        compiled.set(s, (r = new RegExp(s, "i")));
+    return r;
+};
+/** The first rule a call matches, or null. Pure: no network, no file access. */
+export function matchRule(policy, call) {
+    const rules = [...(policy.rules ?? []), ...(policy.defaults === false ? [] : DEFAULT_RULES)];
+    const text = call.command ?? (typeof call.input === "string" ? call.input : canonical(call.input ?? null));
+    for (const r of rules) {
+        if (!re(r.tool ?? SHELL).test(call.tool))
+            continue;
+        if (r.match && !re(r.match).test(text))
+            continue;
+        if (r.unless && re(r.unless).test(text))
+            continue;
+        return r;
+    }
+    return null;
+}
+/** Strip credentials from a command line before an approver (and Interlok) sees it. */
+export function scrub(s) {
+    return s
+        .replace(/(\w+:\/\/)[^\s/@:]+:[^\s/@]+@/g, "$1***:***@")
+        .replace(/\b(sk_(?:live|test)_|rk_(?:live|test)_|ghp_|gho_|ghs_|github_pat_|xox[abpr]-|ilk_|sk-|AKIA|ASIA|glpat-|npm_|sset_wh_|sk_live_)[A-Za-z0-9_\-./+=]{6,}/g, "$1***")
+        .replace(/(authorization:\s*(?:bearer|basic)\s+)\S+/gi, "$1***")
+        .replace(/\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|CREDENTIALS?)[A-Z0-9_]*=)("[^"]*"|'[^']*'|\S+)/g, "$1***")
+        .replace(/(--?(?:password|passwd|token|secret|api-key|apikey|key)[= ])("[^"]*"|'[^']*'|\S+)/gi, "$1***");
+}
+export const payloadHash = (call) => createHash("sha256")
+    .update(canonical({ tool: call.tool, input: call.input ?? null }))
+    .digest("hex");
+/** What the agent receives on stdout. `null` means print nothing (allow). */
+export function render(agent, v) {
+    if (agent === "cursor") {
+        // Cursor treats a missing or invalid answer from a permission hook as a block: always answer.
+        return JSON.stringify(v.allow
+            ? { permission: "allow" }
+            : { permission: "deny", user_message: v.reason, agent_message: v.reason });
+    }
+    if (agent === "gemini")
+        return v.allow ? null : JSON.stringify({ decision: "deny", reason: v.reason });
+    if (agent === "copilot")
+        // "{}" is "no decision": the normal permission flow continues. A deny also exits 2 (see exitCode).
+        return JSON.stringify(v.allow ? {} : { permissionDecision: "deny", permissionDecisionReason: v.reason });
+    if (v.allow)
+        return null; // Claude Code: normal permission flow. Codex: allow is the empty answer.
+    return JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: v.reason,
+        },
+    });
+}
+/**
+ * Process exit code for a verdict. Copilot denies a tool call on any non-zero exit, whatever stdout
+ * says, so a refusal exits 2 there as well; every other agent reads the JSON and exits 0.
+ */
+export function exitCode(agent, v) {
+    return agent === "copilot" && !v.allow ? 2 : 0;
+}
+/**
+ * GitHub Copilot also runs the hooks in a repository's .claude/settings.json, with its own payload
+ * (no transcript_path, an ISO timestamp). When the repository has Interlok's Copilot hook too, the
+ * Claude entry steps aside so one tool call opens one request, not two.
+ */
+export function deferToCopilotHook(agent, raw, copilotHookInRepo) {
+    return (agent === "claude" &&
+        copilotHookInRepo &&
+        !!raw &&
+        raw.transcript_path === undefined &&
+        typeof raw.timestamp === "string");
+}
+const STATE_TTL_MS = 7 * 24 * 3600_000;
+async function readState(file) {
+    try {
+        const s = JSON.parse(await readFile(file, "utf8"));
+        const cutoff = Date.now() - STATE_TTL_MS;
+        for (const k of Object.keys(s))
+            if (!(s[k].at > cutoff))
+                delete s[k];
+        return s;
+    }
+    catch {
+        return {};
+    }
+}
+async function writeState(file, s) {
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    await writeFile(tmp, JSON.stringify(s), { mode: 0o600 });
+    await rename(tmp, file);
+}
+function heldReason(a, rule) {
+    const tag = a.hold?.tag_number ? ` (tag ${a.hold.tag_number})` : "";
+    return (`Interlok is holding this for a person${tag}: ${rule.label ?? rule.id}.` +
+        (a.console_url ? ` Approvers decide at ${a.console_url}.` : "") +
+        " Do not run it another way or work around the hold. Continue with other work and retry this exact command later; it runs once a person approves.");
+}
+function closedReason(a) {
+    const tag = a.hold?.tag_number ? ` (tag ${a.hold.tag_number})` : "";
+    if (a.status === "denied") {
+        const who = (a.determinations ?? []).map((d) => d.by).join(", ") || "a person";
+        const note = (a.determinations ?? []).find((d) => d.note)?.note;
+        return `Denied by ${who}${tag}. Do not run this command.${note ? ` Reason: ${note}` : ""}`;
+    }
+    return `No approval${tag}: the request ${a.status}. Do not run this command. Ask again only if the user wants it.`;
+}
+/** Decide one call. Every path that is not a person's approval returns a refusal. */
+export async function decide(call, policy, deps) {
+    const rule = matchRule(policy, call);
+    if (!rule)
+        return { allow: true };
+    if (!deps.key)
+        return {
+            allow: false,
+            reason: `Interlok policy "${rule.id}" needs a person's approval, and INTERLOK_API_KEY is not set, so this command is blocked. Set the key (approvals:write scope) and retry.`,
+        };
+    const f = deps.fetch ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
+    const call_ = async (path, init = {}) => {
+        const r = await f(`${deps.api}${path}`, {
+            ...init,
+            headers: { "content-type": "application/json", authorization: `Bearer ${deps.key}` },
+            signal: AbortSignal.timeout(20_000),
+        });
+        const body = await r.json().catch(() => ({}));
+        if (!r.ok)
+            throw Object.assign(new Error(body?.error ?? `HTTP ${r.status}`), { status: r.status });
+        return body;
+    };
+    const hash = payloadHash(call);
+    const sessionKey = createHash("sha256").update(call.session).digest("hex").slice(0, 32);
+    const file = join(deps.stateDir, `${sessionKey}.json`);
+    const slot = `${rule.id}:${hash}`;
+    try {
+        const state = await readState(file);
+        let entry = state[slot];
+        let a;
+        if (entry?.id) {
+            a = await call_(`/api/v1/approvals/${encodeURIComponent(entry.id)}`);
+        }
+        else {
+            entry = entry ?? { idem: randomUUID(), at: Date.now() };
+            state[slot] = entry;
+            await writeState(file, state); // before the POST, so a crash retries the same request
+            const hashOnly = policy.summary === "hash-only";
+            const what = call.command !== undefined
+                ? hashOnly
+                    ? `command sha256:${hash.slice(0, 16)}…`
+                    : scrub(call.command).slice(0, 380)
+                : `${call.tool}${hashOnly ? "" : ` ${scrub(canonical(call.input ?? null)).slice(0, 300)}`}`;
+            a = await call_("/api/v1/approvals", {
+                method: "POST",
+                body: JSON.stringify({
+                    action: `hook.${rule.id}`.slice(0, 120),
+                    summary: `${rule.label ?? rule.id}: ${what}`.slice(0, 500),
+                    payload_hash: hash,
+                    agent: { name: deps.agentName },
+                    environment: policy.environment ?? "production",
+                    approvers_required: rule.approvers,
+                    idempotency_key: entry.idem,
+                    context: { agent: call.agent, rule: rule.id, ...(deps.context ?? {}) },
+                }),
+            });
+            entry.id = a.id;
+            await writeState(file, state);
+        }
+        const deadline = now() + deps.waitSeconds * 1000;
+        while (a.status === "held" && now() < deadline) {
+            await sleep(2000);
+            a = await call_(`/api/v1/approvals/${encodeURIComponent(a.id)}`);
+        }
+        if (a.status === "held")
+            return { allow: false, reason: heldReason(a, rule) };
+        // Approved, denied or expired: this approval is spent either way.
+        delete state[slot];
+        await writeState(file, state);
+        if (a.status === "approved")
+            return { allow: true };
+        return { allow: false, reason: closedReason(a) };
+    }
+    catch (e) {
+        const status = e.status;
+        if (status === undefined && deps.failOpen)
+            return { allow: true };
+        return {
+            allow: false,
+            reason: status === undefined
+                ? `Interlok could not be reached (${e.message}), and "${rule.id}" needs a person's approval, so this command is blocked.`
+                : `Interlok refused the approval request (${status}: ${e.message}). "${rule.id}" needs a person's approval, so this command is blocked.`,
+        };
+    }
+}
+/* -------------------------------------- policy file -------------------------------------- */
+/** Nearest .interlok/policy.json walking up from `dir` (stops at the filesystem root). */
+export async function loadPolicy(dir) {
+    let d = resolve(dir);
+    for (;;) {
+        const f = join(d, ".interlok", "policy.json");
+        if (existsSync(f)) {
+            const p = JSON.parse(await readFile(f, "utf8"));
+            for (const r of p.rules ?? []) {
+                if (!r.id)
+                    throw new Error(`${f}: every rule needs an id`);
+                for (const k of ["tool", "match", "unless"])
+                    if (r[k])
+                        new RegExp(r[k]);
+            }
+            return { policy: p, file: f };
+        }
+        const up = dirname(d);
+        if (up === d)
+            return { policy: {}, file: null };
+        d = up;
+    }
+}
+export const DEFAULT_POLICY_FILE = {
+    version: 1,
+    defaults: true,
+    environment: "production",
+    wait: 90,
+    summary: "command",
+    rules: [],
+};
+/* ---------------------------------------- init ---------------------------------------- */
+const MARK = "interlok hook";
+const hookCmd = (agent, bin) => `${bin} hook --agent ${agent}`;
+export const COPILOT_HOOK_FILE = join(".github", "hooks", "interlok.json");
+/** Merge Interlok's hook into each agent's project config. Idempotent; never removes entries. */
+export async function init(dir, agents, bin) {
+    const wrote = [];
+    const json = async (f) => {
+        try {
+            return JSON.parse(await readFile(f, "utf8"));
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return {};
+            throw new Error(`${f} is not valid JSON; fix it and run init again`);
+        }
+    };
+    const save = async (f, v) => {
+        await mkdir(dirname(f), { recursive: true });
+        await writeFile(f, `${JSON.stringify(v, null, 2)}\n`);
+        wrote.push(f);
+    };
+    const has = (list) => JSON.stringify(list ?? []).includes(MARK) ||
+        JSON.stringify(list ?? []).includes("@interlok/cli hook");
+    const policyFile = join(dir, ".interlok", "policy.json");
+    if (!existsSync(policyFile))
+        await save(policyFile, DEFAULT_POLICY_FILE);
+    for (const agent of agents) {
+        if (agent === "claude" || agent === "codex") {
+            const f = join(dir, agent === "claude" ? ".claude/settings.json" : ".codex/hooks.json");
+            const c = await json(f);
+            c.hooks ??= {};
+            c.hooks.PreToolUse ??= [];
+            if (!has(c.hooks.PreToolUse)) {
+                c.hooks.PreToolUse.push({
+                    matcher: agent === "claude" ? "Bash|mcp__.*" : "^Bash$|^mcp__",
+                    hooks: [{ type: "command", command: hookCmd(agent, bin), timeout: HOOK_TIMEOUT_S }],
+                });
+                await save(f, c);
+            }
+        }
+        else if (agent === "gemini") {
+            const f = join(dir, ".gemini/settings.json");
+            const c = await json(f);
+            c.hooks ??= {};
+            c.hooks.BeforeTool ??= [];
+            if (!has(c.hooks.BeforeTool)) {
+                c.hooks.BeforeTool.push({
+                    matcher: "^(run_shell_command|mcp_.*)$",
+                    hooks: [
+                        {
+                            name: "interlok",
+                            type: "command",
+                            command: hookCmd("gemini", bin),
+                            timeout: HOOK_TIMEOUT_S * 1000, // milliseconds; a timed-out hook lets the call run
+                        },
+                    ],
+                });
+                await save(f, c);
+            }
+        }
+        else if (agent === "copilot") {
+            // Its own file: the Copilot cloud agent reads only .github/hooks/*.json.
+            const f = join(dir, COPILOT_HOOK_FILE);
+            const c = await json(f);
+            c.version ??= 1;
+            c.hooks ??= {};
+            c.hooks.PreToolUse ??= [];
+            if (!has(c.hooks.PreToolUse)) {
+                c.hooks.PreToolUse.push({
+                    type: "command",
+                    bash: hookCmd("copilot", bin),
+                    powershell: hookCmd("copilot", bin),
+                    timeoutSec: HOOK_TIMEOUT_S,
+                });
+                await save(f, c);
+            }
+        }
+        else {
+            const f = join(dir, ".cursor/hooks.json");
+            const c = await json(f);
+            c.version ??= 1;
+            c.hooks ??= {};
+            for (const ev of ["beforeShellExecution", "beforeMCPExecution"]) {
+                c.hooks[ev] ??= [];
+                if (!has(c.hooks[ev])) {
+                    c.hooks[ev].push({
+                        command: hookCmd("cursor", bin),
+                        timeout: HOOK_TIMEOUT_S,
+                        failClosed: true,
+                    });
+                    await save(f, c);
+                }
+            }
+        }
+    }
+    return wrote;
+}
+/* ----------------------------------------- CLI ----------------------------------------- */
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString("utf8");
+}
+const AGENTS = ["claude", "codex", "cursor", "gemini", "copilot"];
+export async function hookCommand(args, value, has) {
+    const sub = args[0] && !args[0].startsWith("-") ? args[0] : "run";
+    if (sub === "init") {
+        const want = value("--agent") ?? "all";
+        const agents = want === "all" ? AGENTS : want.split(",");
+        for (const a of agents)
+            if (!AGENTS.includes(a))
+                throw new Error(`unknown agent ${a}`);
+        const bin = has("--npx") ? "npx -y @interlok/cli" : "interlok";
+        const wrote = await init(resolve(value("--dir") ?? "."), agents, bin);
+        console.log(wrote.length ? `Wrote:\n  ${wrote.join("\n  ")}` : "Already set up; nothing to change.");
+        console.log(`\nNext: set INTERLOK_API_KEY (approvals:write) in the agent's environment${bin === "interlok" ? ", and install the CLI globally (npm i -g @interlok/cli) so each check starts fast" : ""}.\nTry a rule without running anything: interlok hook test "git push origin main"`);
+        return;
+    }
+    if (sub === "test") {
+        const command = args
+            .slice(1)
+            .filter((a) => !a.startsWith("--"))
+            .join(" ");
+        const { policy, file } = await loadPolicy(value("--dir") ?? process.cwd());
+        const rule = matchRule(policy, {
+            agent: "claude",
+            tool: "Bash",
+            input: command,
+            command,
+            session: "test",
+            cwd: ".",
+        });
+        console.log(rule
+            ? `HELD by ${rule.id} (${rule.label ?? ""}). A person must approve it.`
+            : "ALLOWED. No rule matches; nothing leaves this machine.");
+        console.log(`policy: ${file ?? "built-in defaults"}`);
+        console.log(`shown to the approver: ${scrub(command)}`);
+        return;
+    }
+    // sub === "run": called by the agent with the hook payload on stdin.
+    const agent = (value("--agent") ?? "claude");
+    if (!AGENTS.includes(agent))
+        throw new Error(`--agent must be one of ${AGENTS.join(", ")}`);
+    const text = await readStdin();
+    let raw = null;
+    try {
+        raw = JSON.parse(text || "null");
+    }
+    catch {
+        // Something we cannot read could be anything: refuse rather than guess.
+        return answer(agent, {
+            allow: false,
+            reason: "Interlok hook could not read the tool call; blocked.",
+        });
+    }
+    const call = parseCall(agent, raw);
+    if (!call)
+        return answer(agent, { allow: true });
+    if (deferToCopilotHook(agent, raw, await copilotHookIn(call.cwd)))
+        return answer(agent, { allow: true });
+    let verdict;
+    try {
+        const { policy } = await loadPolicy(call.cwd);
+        const ws = process.env.SUPERSET_WORKSPACE_NAME ?? process.env.PARADEV_WORKSPACE_NAME;
+        verdict = await decide(call, policy, {
+            api: (process.env.INTERLOK_URL ?? value("--api") ?? "https://interlok.io").replace(/\/$/, ""),
+            key: process.env.INTERLOK_API_KEY ?? "",
+            agentName: value("--agent-name") ?? process.env.INTERLOK_AGENT ?? `${agent}@${basename(call.cwd)}`,
+            // Never longer than the agent gives the hook: some agents run the call when a hook times out.
+            waitSeconds: Math.min(Number(value("--wait") ?? policy.wait ?? 90) || 0, MAX_WAIT_S),
+            failOpen: has("--fail-open"),
+            stateDir: process.env.INTERLOK_HOOK_STATE ??
+                join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "interlok", "hook"),
+            context: {
+                project: basename(call.cwd),
+                host: hostname().slice(0, 120),
+                ...(ws ? { workspace: ws.slice(0, 200) } : {}),
+            },
+        });
+    }
+    catch (e) {
+        // A broken policy file must not open the gate.
+        verdict = {
+            allow: false,
+            reason: `Interlok hook error: ${e.message}. Blocked until fixed.`,
+        };
+    }
+    answer(agent, verdict);
+}
+function answer(agent, v) {
+    const out = render(agent, v);
+    if (out)
+        process.stdout.write(out);
+    if (!v.allow)
+        process.stderr.write(`${v.reason}\n`);
+    process.exitCode = exitCode(agent, v);
+}
+/** Whether the repository holding `dir` has Interlok's Copilot hook file. */
+async function copilotHookIn(dir) {
+    let d = resolve(dir);
+    for (;;) {
+        const f = join(d, COPILOT_HOOK_FILE);
+        if (existsSync(f)) {
+            try {
+                const t = await readFile(f, "utf8");
+                return t.includes(MARK) || t.includes("@interlok/cli hook");
+            }
+            catch {
+                return false;
+            }
+        }
+        if (existsSync(join(d, ".git")))
+            return false;
+        const up = dirname(d);
+        if (up === d)
+            return false;
+        d = up;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};