@kylecheng3146/agent-ops 0.1.3 → 0.1.5

package/dist/packages/cli/src/commands/uninstall.js

@@ -1,6 +1,7 @@
 import { applyUninstallPlan, createUninstallPlan } from "../../../../runtime/src/install/uninstall.js";
 import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
+import { toPublicUninstallPlan } from "../public-plan.js";
 function formatUninstallPlan(plan) {
     return formatOperationPlan({
         title: "Uninstall plan",
@@ -13,14 +14,14 @@ function formatUninstallPlan(plan) {
                     `Harness: ${plan.manifest.harness}`
                 ])
         ],
-        operations: plan.operations
+        operations: toPublicUninstallPlan(plan).operations
     });
 }
 function uninstallError(code, message, plan) {
     return {
         code,
         status: "error",
-        data: { applied: false, plan, message },
+        data: { applied: false, plan: toPublicUninstallPlan(plan), message },
         errors: [{ code, message }]
     };
 }
@@ -29,14 +30,14 @@ export async function runUninstallCommand(options) {
     if (!plan.installed) {
         return okEnvelope("UNINSTALL_NOT_INSTALLED", {
             applied: false,
-            plan,
+            plan: toPublicUninstallPlan(plan),
             message: "No managed installation exists."
         });
     }
     if (options.args.dryRun) {
         return okEnvelope("UNINSTALL_PLAN_READY", {
             applied: false,
-            plan,
+            plan: toPublicUninstallPlan(plan),
             message: "Uninstall plan calculated; no files were changed.",
             text: formatUninstallPlan(plan)
         });
@@ -51,7 +52,7 @@ export async function runUninstallCommand(options) {
     await applyUninstallPlan(options.root, plan);
     return okEnvelope("UNINSTALL_APPLIED", {
         applied: true,
-        plan,
+        plan: toPublicUninstallPlan(plan),
         message: "Managed installation content was removed."
     });
 }

package/dist/packages/cli/src/commands/update.js

@@ -1,25 +1,27 @@
 import { applyUpdatePlan, createUpdatePlan } from "../../../../runtime/src/install/update.js";
 import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
+import { toPublicUpdatePlan } from "../public-plan.js";
 export function formatUpdatePlan(plan) {
     return formatOperationPlan({
         title: "Update plan",
         metadata: [
             `Target version: ${plan.targetVersion}`,
+            `Harness: ${plan.installation.harness.join(", ")}`,
             `Schema migrations: ${plan.migrationSteps.length === 0
                 ? "none"
                 : plan.migrationSteps
                     .map(({ fromVersion, toVersion }) => `${fromVersion} -> ${toVersion}`)
                     .join(", ")}`
         ],
-        operations: plan.installation.operations
+        operations: toPublicUpdatePlan(plan).installation.operations
     });
 }
 function updateError(code, message, plan) {
     return {
         code,
         status: "error",
-        data: { applied: false, plan, message },
+        data: { applied: false, plan: toPublicUpdatePlan(plan), message },
         errors: [{ code, message }]
     };
 }
@@ -27,6 +29,9 @@ export async function runUpdateCommand(options) {
     const plan = await createUpdatePlan({
         root: options.root,
         adapters: options.adapters,
+        ...(options.args.harness === undefined
+            ? {}
+            : { harness: options.args.harness }),
         ...(options.registry === undefined
             ? {}
             : { registry: options.registry }),
@@ -35,12 +40,15 @@ export async function runUpdateCommand(options) {
             : { targetVersion: options.targetVersion }),
         ...(options.hookRuntimePath === undefined
             ? {}
-            : { hookRuntimePath: options.hookRuntimePath })
+            : { hookRuntimePath: options.hookRuntimePath }),
+        ...((options.hookTargets ?? options.args.hookTargets) === undefined
+            ? {}
+            : { hookTargets: options.hookTargets ?? options.args.hookTargets })
     });
     if (options.args.dryRun) {
         return okEnvelope("UPDATE_PLAN_READY", {
             applied: false,
-            plan,
+            plan: toPublicUpdatePlan(plan),
             message: "Update plan calculated; no files were changed.",
             text: formatUpdatePlan(plan)
         });
@@ -55,7 +63,7 @@ export async function runUpdateCommand(options) {
     await applyUpdatePlan(options.root, plan);
     return okEnvelope("UPDATE_APPLIED", {
         applied: true,
-        plan,
+        plan: toPublicUpdatePlan(plan),
         message: `Managed installation updated to ${plan.targetVersion}.`
     });
 }

package/dist/packages/cli/src/context.js

@@ -1,16 +1,22 @@
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
+import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { loadConfigFile } from "../../../runtime/src/config/load.js";
 import { mergeConfigLayers } from "../../../runtime/src/config/merge.js";
-import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
 import { calculateTrustBinding, FileTrustStore } from "../../../runtime/src/security/trust.js";
 export const DEFAULT_CONFIG = {
-    schemaVersion: 1,
+    schemaVersion: 2,
     profiles: [],
     verification: { commands: [] },
+    features: {
+        stopVerification: {
+            enabled: false
+        }
+    },
     pathMappings: [],
     securityExceptions: []
 };
@@ -91,7 +97,7 @@ export async function repositoryTrust(root, config, cliVersion) {
         const binding = await calculateTrustBinding({
             repositoryPath: root,
             remoteUrl: repositoryRemoteUrl(root),
-            configHash: sha256(JSON.stringify(config)),
+            configHash: calculateConfigHash(config),
             runtimeHash: sha256(cliVersion)
         });
         return (await new FileTrustStore(state.trustStore, state.anchorDirectory).status(binding)).status;

package/dist/packages/cli/src/hook-process.js

@@ -1,7 +1,15 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
+import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
+import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
+import { STOP_VERIFICATION_ENV, StopVerificationService } from "../../../runtime/src/hooks/stop-service.js";
+import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
 import { runHookCommand, HOOK_EVENTS } from "./commands/hook.js";
 import { loadEffectiveConfig, repositoryTrust } from "./context.js";
-const HARNESSES = new Set(["codex", "claude"]);
+const HARNESSES = new Set(HARNESS_IDS);
 const MAX_HOOK_INPUT_BYTES = 1024 * 1024;
+const execFile = promisify(execFileCallback);
 async function readStdin(stream) {
     const chunks = [];
     let total = 0;
@@ -17,28 +25,122 @@ async function readStdin(stream) {
     }
     return Buffer.concat(chunks, total).toString("utf8");
 }
+function parseInput(source) {
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+}
+function defaultGitRunner(root) {
+    return {
+        run: async (args) => {
+            try {
+                const result = await execFile("git", [...args], {
+                    cwd: root,
+                    encoding: "buffer"
+                });
+                return {
+                    exitCode: 0,
+                    stdout: result.stdout
+                };
+            }
+            catch (error) {
+                const failure = error;
+                return {
+                    exitCode: failure.status ?? 1,
+                    stdout: failure.stdout ?? new Uint8Array()
+                };
+            }
+        }
+    };
+}
+function stopVerificationOptions(input) {
+    const nativeRecursion = input.harness === "claude" &&
+        claudeStopRecursionMarker(input.rawInput);
+    const recursionActive = nativeRecursion || process.env[STOP_VERIFICATION_ENV] === "1";
+    const configHash = calculateConfigHash(input.config);
+    return {
+        confirmedConfig: true,
+        trusted: input.trusted,
+        scopeMapped: true,
+        recursionMarker: recursionActive,
+        configHash,
+        verify: async () => await new StopVerificationService({
+            root: input.root,
+            config: input.config,
+            trusted: input.trusted,
+            gitRunner: input.gitRunner,
+            processRunner: input.processRunner,
+            recursionActive,
+            configHash
+        }).verify()
+    };
+}
+function shouldBuildStopVerification(harness, event, config, rawInput) {
+    if (event !== "Stop" || !config.features.stopVerification.enabled) {
+        return false;
+    }
+    let normalized;
+    try {
+        normalized = harnessDescriptor(harness).runtime.normalizeInput(rawInput);
+    }
+    catch {
+        return false;
+    }
+    if (normalized.event !== "stop") {
+        return false;
+    }
+    return harnessDescriptor(harness).control.registrations.some(({ capability, support }) => capability === "optional-stop-verify" && support !== "unsupported");
+}
 /**
  * Runs one hook invocation. Always resolves to exit code 0: a hook that
  * cannot answer must never block the harness it advises.
  */
-export async function runHookProcess(argv, io, cliVersion) {
+export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
     const [harness, event] = argv;
     if (harness === undefined ||
         !HARNESSES.has(harness) ||
         event === undefined ||
         !HOOK_EVENTS.includes(event)) {
-        io.writeStderr("Usage: agent-ops hook <codex|claude> <SessionStart|PreToolUse|Stop>\n");
+        io.writeStderr(`Usage: agent-ops hook <${HARNESS_IDS.join("|")}> <SessionStart|PreToolUse|Stop>\n`);
         return 0;
     }
     try {
-        const root = process.cwd();
-        const config = (await loadEffectiveConfig(root, "project")).config;
+        const root = dependencies.root ?? process.cwd();
+        const config = dependencies.loadConfig === undefined
+            ? (await loadEffectiveConfig(root, "project")).config
+            : await dependencies.loadConfig(root);
+        const trustStatus = dependencies.trust === undefined
+            ? await repositoryTrust(root, config, cliVersion)
+            : await dependencies.trust(root, config, cliVersion);
+        const rawInput = await readStdin(io.stdin);
+        const parsedInput = parseInput(rawInput);
+        const trusted = trustStatus === "TRUSTED";
+        const gitRunner = dependencies.gitRunner ?? defaultGitRunner(root);
+        const processRunner = dependencies.processRunner ?? new NodeVerificationProcessRunner();
+        const stopVerification = shouldBuildStopVerification(harness, event, config, parsedInput)
+            ? stopVerificationOptions({
+                harness: harness,
+                rawInput: parsedInput,
+                root,
+                config,
+                trusted,
+                gitRunner,
+                processRunner
+            })
+            : undefined;
         const output = await runHookCommand({
             harness: harness,
             event: event,
-            stdin: await readStdin(io.stdin),
+            stdin: rawInput,
             config,
-            trusted: (await repositoryTrust(root, config, cliVersion)) === "TRUSTED"
+            trusted,
+            ...(dependencies.advisory === undefined
+                ? {}
+                : { advisory: dependencies.advisory }),
+            ...(stopVerification === undefined ? {} : { stopVerification })
         });
         if (output.stdout.length > 0) {
             io.writeStdout(output.stdout);

package/dist/packages/cli/src/plan-output.js

@@ -18,10 +18,15 @@ export function formatOperationPlan(options) {
     for (const operation of options.operations) {
         lines.push(`- ${operation.kind} ${escapeTerminalText(operation.path)}`, `  expected: ${operation.expectedHash ?? "<absent>"}`);
         if (operation.kind === "write") {
-            lines.push("  content:", ...operation.content
-                .replace(/\n$/u, "")
-                .split("\n")
-                .map((line) => `    ${escapeTerminalText(line)}`));
+            if ("contentHash" in operation) {
+                lines.push(`  content: <opaque ${escapeTerminalText(operation.contentHash)}>`, `  summary: ${escapeTerminalText(operation.summary)}`);
+            }
+            else {
+                lines.push("  content:", ...operation.content
+                    .replace(/\n$/u, "")
+                    .split("\n")
+                    .map((line) => `    ${escapeTerminalText(line)}`));
+            }
         }
     }
     return `${lines.join("\n")}\n`;

package/dist/packages/cli/src/public-plan.js

@@ -0,0 +1,62 @@
+import { redactSecrets } from "../../../runtime/src/security/redact.js";
+import { sha256 } from "../../../runtime/src/fs/hash.js";
+const OPAQUE_SUMMARY = "Opaque managed settings content withheld.";
+function publicPath(path) {
+    return redactSecrets(path);
+}
+export function disclosureOf(operation) {
+    return operation.disclosure ?? "full";
+}
+export function toPublicOperation(operation) {
+    const path = publicPath(operation.path);
+    if (operation.kind === "remove") {
+        return {
+            kind: "remove",
+            path,
+            expectedHash: operation.expectedHash
+        };
+    }
+    if (disclosureOf(operation) === "opaque") {
+        return {
+            kind: "write",
+            path,
+            expectedHash: operation.expectedHash,
+            contentHash: sha256(operation.content),
+            summary: redactSecrets(OPAQUE_SUMMARY)
+        };
+    }
+    return {
+        kind: "write",
+        path,
+        expectedHash: operation.expectedHash,
+        content: operation.content
+    };
+}
+export function toPublicOperations(operations) {
+    return operations.map(toPublicOperation);
+}
+export function toPublicInstallPlan(plan) {
+    return {
+        scope: plan.scope,
+        harness: plan.harness,
+        profiles: plan.profiles,
+        capabilities: plan.capabilities,
+        manifest: plan.manifest,
+        operations: toPublicOperations(plan.operations)
+    };
+}
+export function toPublicUpdatePlan(plan) {
+    return {
+        targetVersion: plan.targetVersion,
+        migrationSteps: plan.migrationSteps,
+        installation: toPublicInstallPlan(plan.installation)
+    };
+}
+export function toPublicUninstallPlan(plan) {
+    return {
+        installed: plan.installed,
+        manifest: plan.manifest,
+        manifestHash: plan.manifestHash,
+        operations: toPublicOperations(plan.operations)
+    };
+}

package/dist/packages/cli/src/ui.js

@@ -1,5 +1,5 @@
 // figlet "agent-ops" -f Standard, trimmed of trailing blank lines/columns.
-const BANNER = [
+export const BANNER = [
     "                         _",
     "   __ _  __ _  ___ _ __ | |_       ___  _ __  ___ ",
     "  / _\` |/ _\` |/ _ \\ '_ \\| __|____ / _ \\| '_ \\/ __|",
@@ -75,6 +75,247 @@ async function typedFallback(question, io, defaultValue) {
         readline.close();
     }
 }
+async function typedChoice(question, choices, io, defaultIndex) {
+    const { createInterface } = await import("node:readline/promises");
+    const readline = createInterface({ input: io.input, output: io.output });
+    try {
+        const options = choices
+            .map((choice, index) => `${index + 1}: ${choice.label}`)
+            .join(", ");
+        const answer = (await readline.question(`${question} [${options}]: `)).trim();
+        if (answer === "") {
+            return choices[defaultIndex].value;
+        }
+        const index = Number.parseInt(answer, 10) - 1;
+        if (Number.isInteger(index) && choices[index] !== undefined) {
+            return choices[index].value;
+        }
+        const match = choices.find((choice) => choice.label.toLowerCase() === answer.toLowerCase());
+        return match?.value ?? choices[defaultIndex].value;
+    }
+    finally {
+        readline.close();
+    }
+}
+function renderChoices(outputLike, question, choices, selected, vertical = false, selectAll = false, selectAllLabel = "Select all", selectAllDescription, focusedIndex = 0) {
+    const renderChoice = (choice, active, focused) => {
+        const label = `${active ? DOT_ON : DOT_OFF} ${choice.label}`;
+        const cursor = focused ? "❯ " : "  ";
+        const renderedLabel = active
+            ? bold(outputLike, green(outputLike, label))
+            : dim(outputLike, label);
+        const lines = [
+            vertical
+                ? `${dim(outputLike, RAIL)}  ${cursor}${renderedLabel}`
+                : `${cursor}${renderedLabel}`
+        ];
+        if (vertical && choice.description !== undefined) {
+            lines.push(`${dim(outputLike, RAIL)}    ${dim(outputLike, choice.description)}`);
+        }
+        return lines;
+    };
+    const allActive = selectAll && selected.size === choices.length;
+    const renderedChoices = [
+        ...(selectAll
+            ? renderChoice({
+                label: selectAllLabel,
+                value: undefined,
+                description: selectAllDescription
+            }, allActive, selectAll && focusedIndex === 0)
+            : []),
+        ...choices.flatMap((choice, index) => {
+            const active = selected.has(index);
+            const focused = (selectAll ? index + 1 : index) === focusedIndex;
+            return renderChoice(choice, active, focused);
+        })
+    ];
+    const rendered = vertical
+        ? renderedChoices
+        : [`${dim(outputLike, RAIL)}  ${renderedChoices.join(" / ")}`];
+    return [
+        `${bold(outputLike, DIAMOND)}  ${question}`,
+        ...rendered
+    ].join("\n");
+}
+function assertChoices(choices) {
+    if (choices.length === 0) {
+        throw new Error("At least one selector choice is required.");
+    }
+}
+/** Single-value selector for interactive wizard choices. */
+export async function selectOption(question, choices, io, defaultIndex = 0) {
+    assertChoices(choices);
+    const initialIndex = Math.min(Math.max(defaultIndex, 0), choices.length - 1);
+    if (typeof io.input.setRawMode !== "function" ||
+        io.input.isTTY !== true) {
+        return await typedChoice(question, choices, io, initialIndex);
+    }
+    const outputLike = {
+        isTTY: true,
+        columns: io.output.columns,
+        write: (value) => io.output.write(value)
+    };
+    const { emitKeypressEvents } = await import("node:readline");
+    emitKeypressEvents(io.input);
+    io.input.setRawMode(true);
+    io.input.resume();
+    let index = initialIndex;
+    let rendered = renderChoices(outputLike, question, choices, new Set([index]), false, false, "Select all", undefined, index);
+    io.output.write(`${rendered}\n`);
+    return await new Promise((resolve) => {
+        const cleanup = () => {
+            io.input.setRawMode?.(false);
+            io.input.pause();
+            io.input.removeListener("keypress", onKeypress);
+        };
+        const redraw = () => {
+            eraseLines((value) => io.output.write(value), rendered.split("\n").length);
+            rendered = renderChoices(outputLike, question, choices, new Set([index]), false, false, "Select all", undefined, index);
+            io.output.write(`${rendered}\n`);
+        };
+        const move = (delta) => {
+            index = (index + delta + choices.length) % choices.length;
+            redraw();
+        };
+        const onKeypress = (_chunk, key) => {
+            if (key?.ctrl === true && key.name === "c") {
+                cleanup();
+                process.exit(130);
+            }
+            if (key?.name === "up" ||
+                key?.name === "left" ||
+                key?.name === "h") {
+                move(-1);
+                return;
+            }
+            if (key?.name === "down" ||
+                key?.name === "right" ||
+                key?.name === "tab" ||
+                key?.name === "l") {
+                move(1);
+                return;
+            }
+            if (key?.name === "home") {
+                index = 0;
+                redraw();
+                return;
+            }
+            if (key?.name === "end") {
+                index = choices.length - 1;
+                redraw();
+                return;
+            }
+            if (key?.name === "return" || key?.name === "space") {
+                cleanup();
+                resolve(choices[index].value);
+            }
+        };
+        io.input.on("keypress", onKeypress);
+    });
+}
+/** Multi-value selector. Space toggles a choice; Enter confirms. */
+export async function selectOptions(question, choices, io, defaultValues = [], options = {}) {
+    assertChoices(choices);
+    const defaultIndexes = new Set(choices.flatMap((choice, index) => defaultValues.includes(choice.value) ? [index] : []));
+    if (defaultIndexes.size === 0 && options.selectAll !== true) {
+        defaultIndexes.add(0);
+    }
+    if (typeof io.input.setRawMode !== "function" ||
+        io.input.isTTY !== true) {
+        const value = await typedChoice(question, choices, io, 0);
+        return [value];
+    }
+    const selectAll = options.selectAll === true;
+    const choiceCount = choices.length + (selectAll ? 1 : 0);
+    const outputLike = {
+        isTTY: true,
+        columns: io.output.columns,
+        write: (value) => io.output.write(value)
+    };
+    const { emitKeypressEvents } = await import("node:readline");
+    emitKeypressEvents(io.input);
+    io.input.setRawMode(true);
+    io.input.resume();
+    let index = 0;
+    const selected = new Set(defaultIndexes);
+    let selectionHintShown = false;
+    let rendered = renderChoices(outputLike, question, choices, selected, true, selectAll, options.selectAllLabel, options.selectAllDescription, index);
+    io.output.write(`${rendered}\n`);
+    return await new Promise((resolve) => {
+        const cleanup = () => {
+            io.input.setRawMode?.(false);
+            io.input.pause();
+            io.input.removeListener("keypress", onKeypress);
+        };
+        const redraw = () => {
+            eraseLines((value) => io.output.write(value), rendered.split("\n").length);
+            selectionHintShown = false;
+            rendered = renderChoices(outputLike, question, choices, selected, true, selectAll, options.selectAllLabel, options.selectAllDescription, index);
+            io.output.write(`${rendered}\n`);
+        };
+        const move = (delta) => {
+            index = (index + delta + choiceCount) % choiceCount;
+            redraw();
+        };
+        const onKeypress = (_chunk, key) => {
+            if (key?.ctrl === true && key.name === "c") {
+                cleanup();
+                process.exit(130);
+            }
+            if (key?.name === "up" || key?.name === "left") {
+                move(-1);
+                return;
+            }
+            if (key?.name === "down" ||
+                key?.name === "right" ||
+                key?.name === "tab") {
+                move(1);
+                return;
+            }
+            if (key?.name === "space") {
+                if (selectAll && index === 0) {
+                    if (selected.size === choices.length) {
+                        selected.clear();
+                        selected.add(0);
+                    }
+                    else {
+                        choices.forEach((_choice, choiceIndex) => {
+                            selected.add(choiceIndex);
+                        });
+                    }
+                }
+                else {
+                    const choiceIndex = selectAll ? index - 1 : index;
+                    if (selected.has(choiceIndex)) {
+                        if (selected.size > 1) {
+                            selected.delete(choiceIndex);
+                        }
+                    }
+                    else {
+                        selected.add(choiceIndex);
+                    }
+                }
+                redraw();
+                return;
+            }
+            if (key?.name === "return") {
+                if (selected.size === 0) {
+                    if (!selectionHintShown) {
+                        rendered = `${rendered}\n${dim(outputLike, `${RAIL}  Choose at least one option with Space.`)}`;
+                        selectionHintShown = true;
+                        io.output.write(`${rendered}\n`);
+                    }
+                    return;
+                }
+                cleanup();
+                resolve(choices
+                    .filter((_choice, choiceIndex) => selected.has(choiceIndex))
+                    .map((choice) => choice.value));
+            }
+        };
+        io.input.on("keypress", onKeypress);
+    });
+}
 /**
  * Arrow-key Yes/No selector. Falls back to a typed y/N prompt when stdin
  * cannot enter raw mode (piped input, or a stub stream in tests), so the

package/dist/packages/cli/src/version.js

@@ -1,3 +1,3 @@
 // Single source of the published CLI version. Release preparation updates
 // this constant; bin.ts and the hook entry both read it from here.
-export const CLI_VERSION = "0.1.3";
+export const CLI_VERSION = "0.1.5";