@memnox/interceptors 0.1.1

package/dist/index.js

@@ -0,0 +1,1123 @@
+// src/tool-hook.constants.ts
+var ENV_POLICIES = "MEMNOX_POLICIES";
+var ENV_AGENT_NAME = "MEMNOX_AGENT_NAME";
+var ENV_AGENT_ROLE = "MEMNOX_AGENT_ROLE";
+var POLICY_PATH_SEPARATOR = ",";
+var DEFAULT_AGENT_NAME = "claude-code";
+var EGRESS_ACTIONS = ["http.request", "data.export"];
+var EGRESS_DEFAULT_PORT = 8888;
+var EGRESS_MAX_BODY_BYTES = 1e6;
+
+// src/hook-authorizer.ts
+import { DECISION_EFFECT, describeEgress, inspectEgress } from "@memnox/core";
+var HookAuthorizer = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async authorize(request) {
+    const leaking = this.egress(request);
+    if (leaking !== null) return leaking;
+    const local = this.locally(request);
+    if (local !== null && local.effect === DECISION_EFFECT.DENY) {
+      return local;
+    }
+    return local ?? { effect: DECISION_EFFECT.ALLOW, reason: "no rules configured" };
+  }
+  // Nothing is modified: silently stripping a payload is a bug nobody can audit.
+  egress(request) {
+    if (!EGRESS_ACTIONS.includes(request.action)) return null;
+    const fields = request.arguments;
+    if (fields === void 0) return null;
+    const inspection = inspectEgress({
+      ...request.target === void 0 ? {} : { destination: request.target },
+      fields
+    });
+    if (inspection.findings.length === 0) return null;
+    return {
+      effect: DECISION_EFFECT.DENY,
+      reason: describeEgress(inspection),
+      alternative: {
+        action: request.action,
+        note: "send the request without that field, or reference the value by name"
+      }
+    };
+  }
+  /** Null when no policy files were configured, which leaves the runtime as the gate. */
+  locally(request) {
+    const gate = this.deps.gate;
+    if (gate === void 0) return null;
+    const verdict = gate.evaluate(request);
+    const rule = verdict.matchedPolicies[0];
+    return {
+      effect: verdict.effect,
+      reason: verdict.reason,
+      ...rule === void 0 ? {} : { rule: rule.name },
+      ...verdict.alternative === void 0 ? {} : { alternative: verdict.alternative }
+    };
+  }
+};
+
+// src/hook-config.ts
+import { join } from "path";
+import { readPolicyRegistry } from "@memnox/core";
+var CONFIG_DIR = ".memnox";
+var REGISTRY_FILE = "policies.json";
+async function readHookConfig(env, homeDir) {
+  const configured = env[ENV_POLICIES];
+  return {
+    policyFiles: configured === void 0 || configured.trim().length === 0 ? await readPolicyRegistry(join(homeDir, CONFIG_DIR, REGISTRY_FILE)) : splitPaths(configured),
+    ...pick("agentName", env[ENV_AGENT_NAME]),
+    ...pick("agentRole", env[ENV_AGENT_ROLE])
+  };
+}
+function splitPaths(value) {
+  return value.split(POLICY_PATH_SEPARATOR).map((path) => path.trim()).filter((path) => path.length > 0);
+}
+function pick(key, value) {
+  if (value === void 0 || value.length === 0) return {};
+  return { [key]: value };
+}
+
+// src/hook-gate-loader.ts
+import { homedir } from "os";
+import {
+  LocalGate,
+  SESSION_VAR,
+  SessionTasks,
+  overlaysInForce,
+  stateFactsInForce
+} from "@memnox/core";
+async function loadHookGate(config, home = homedir(), now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  if (config.policyFiles.length === 0) return null;
+  const overlays = await overlaysInForce(home);
+  const sessionId = process.env[SESSION_VAR];
+  const task = sessionId === void 0 ? null : await new SessionTasks(home).read(sessionId);
+  return LocalGate.fromFiles(config.policyFiles, {
+    agentName: config.agentName ?? DEFAULT_AGENT_NAME,
+    ...config.agentRole === void 0 ? {} : { agentRole: config.agentRole },
+    task,
+    stateFacts: stateFactsInForce(overlays, now())
+  });
+}
+
+// src/shell-seam.ts
+import {
+  DECISION_EFFECT as DECISION_EFFECT2,
+  digest,
+  isAllowed as holdAllowed,
+  leasePathFor,
+  leaseScopeFor,
+  proceeds,
+  resolveShellLine,
+  takesLease
+} from "@memnox/core";
+var SHELL_ACTION = "shell.execute";
+var SHELL_EXIT_OK = 0;
+var SHELL_EXIT_WITHHELD = 77;
+var SEVERITY = {
+  [DECISION_EFFECT2.ALLOW]: 0,
+  [DECISION_EFFECT2.ASK]: 1,
+  [DECISION_EFFECT2.DENY]: 2
+};
+function worse(a, b) {
+  return (SEVERITY[b.effect] ?? 0) > (SEVERITY[a.effect] ?? 0) ? b : a;
+}
+var ShellSeam = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async gate(command) {
+    if (command.length === 0) {
+      return { message: "no command to run", exitCode: SHELL_EXIT_WITHHELD };
+    }
+    const line = command.join(" ");
+    let verdict = await this.deps.authorizer.authorize(
+      this.requestFor(SHELL_ACTION, line)
+    );
+    for (const resolved of resolveShellLine(line, this.deps.env ?? {}).actions) {
+      if (resolved.action === SHELL_ACTION) continue;
+      const request = this.requestFor(resolved.action, resolved.target ?? line);
+      verdict = worse(verdict, await this.deps.authorizer.authorize(request));
+    }
+    if (verdict.effect === DECISION_EFFECT2.ASK) {
+      const answered = await this.askAbout(line, verdict);
+      if (answered !== null) return answered;
+    } else if (verdict.effect !== DECISION_EFFECT2.ALLOW) {
+      return { message: describe(verdict), exitCode: SHELL_EXIT_WITHHELD };
+    }
+    const held = await this.claim(line);
+    if (held !== null) return held;
+    return { run: command, exitCode: SHELL_EXIT_OK };
+  }
+  /**
+   * Puts an ASK to a person. Null when it was allowed and the line may proceed.
+   *
+   * Withheld rather than run when nobody answers: a walk-away must not become a yes,
+   * and a timeout is said differently from a refusal so the two read differently.
+   */
+  async askAbout(line, verdict) {
+    const hold = this.deps.hold;
+    if (hold === void 0) {
+      return {
+        message: `${describe(verdict)}
+Nobody could be asked, so it was withheld. Run the agent under "memnox run".`,
+        exitCode: SHELL_EXIT_WITHHELD
+      };
+    }
+    const result = await hold.hold({
+      sessionId: this.deps.sessionId ?? "ses_local",
+      agent: "an agent",
+      operation: SHELL_ACTION,
+      fingerprint: digest(line),
+      reason: verdict.reason,
+      command: line
+    });
+    if (holdAllowed(result)) return null;
+    return { message: describe(verdict), exitCode: SHELL_EXIT_WITHHELD };
+  }
+  /**
+   * Takes the paths this line writes, or answers with who is already on them. Reads
+   * never reach the register: `takesLease` decides that here, so there is no path
+   * through this seam that can make a reader wait.
+   */
+  async claim(line) {
+    const leases = this.deps.leases;
+    if (leases === void 0) return null;
+    for (const resolved of resolveShellLine(line, this.deps.env ?? {}).actions) {
+      if (!takesLease(String(resolved.class))) continue;
+      const path = leasePathFor(
+        resolved.target,
+        leases.repositoryRoot,
+        this.deps.workingDirectory ?? leases.repositoryRoot
+      );
+      if (path === null) continue;
+      const scope = leaseScopeFor(path, leases.isDirectory);
+      const verdict = await leases.gate.claim(
+        scope,
+        leases.holder,
+        `${resolved.action} ${resolved.target ?? ""}`.trim()
+      );
+      if (proceeds(verdict)) continue;
+      return {
+        message: verdict.message ?? `${scope} is held by another agent.`,
+        exitCode: SHELL_EXIT_WITHHELD
+      };
+    }
+    return null;
+  }
+  requestFor(action, target) {
+    return {
+      action,
+      target,
+      // LOCAL ONLY. The SDK strips this before anything reaches the runtime.
+      arguments: { command: target },
+      ...this.deps.sessionId === void 0 ? {} : { sessionId: this.deps.sessionId },
+      ...this.deps.workingDirectory === void 0 ? {} : { workingDirectory: this.deps.workingDirectory }
+    };
+  }
+};
+function describe(verdict) {
+  const parts = [verdict.reason];
+  if (verdict.alternative !== void 0) {
+    const target = verdict.alternative.resource === void 0 ? "" : ` ${verdict.alternative.resource}`;
+    parts.push(
+      `Instead: ${verdict.alternative.action}${target} \u2014 ${verdict.alternative.note}`
+    );
+  }
+  if (verdict.approvalId !== void 0) {
+    parts.push(`Ask a person: memnox approvals resolve ${verdict.approvalId} --by <you>`);
+  }
+  if (verdict.decisionId !== void 0)
+    parts.push(`Why: memnox why ${verdict.decisionId}`);
+  return parts.join(" ");
+}
+
+// src/shell-invocation.ts
+import { basename } from "path";
+var SHELL_MODE = {
+  /** `-c "<line>"`: the POSIX contract, and the only form an agent actually uses. */
+  COMMAND: "command",
+  /** `-- cmd args`: how a person or a test drives the wrapper directly. */
+  ARGV: "argv",
+  /** No command at all. Hand the terminal to the real shell rather than refuse it. */
+  INTERACTIVE: "interactive"
+};
+function commandFlag(argument) {
+  return /^-[a-z]*c$/.test(argument);
+}
+function shellInvocation(argv) {
+  const separator = argv.indexOf("--");
+  if (separator !== -1) {
+    return { mode: SHELL_MODE.ARGV, argv: [...argv.slice(separator + 1)], flags: [] };
+  }
+  const flags = [];
+  for (const [index, argument] of argv.entries()) {
+    if (commandFlag(argument)) {
+      const line = argv[index + 1];
+      if (line === void 0) break;
+      return { mode: SHELL_MODE.COMMAND, line, flags };
+    }
+    if (argument.startsWith("-")) {
+      flags.push(argument);
+      continue;
+    }
+    return { mode: SHELL_MODE.ARGV, argv: [...argv.slice(index)], flags };
+  }
+  return { mode: SHELL_MODE.INTERACTIVE, flags };
+}
+var REAL_SHELL_VAR = "MEMNOX_REAL_SHELL";
+var FALLBACK_SHELL = "/bin/sh";
+function realShell(env, self) {
+  const named = env[REAL_SHELL_VAR];
+  if (named !== void 0 && named !== "" && basename(named) !== basename(self)) {
+    return named;
+  }
+  const inherited = env["SHELL"];
+  if (inherited !== void 0 && inherited !== "" && basename(inherited) !== basename(self)) {
+    return inherited;
+  }
+  return FALLBACK_SHELL;
+}
+
+// src/git-credential-seam.ts
+import { DECISION_EFFECT as DECISION_EFFECT3 } from "@memnox/core";
+var GIT_CREDENTIAL_ACTION = "git.credential";
+var QUIT = "quit=1\n";
+var GitCredentialSeam = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async gate(input) {
+    const fields = parseGitInput(input);
+    const target = remoteOf(fields);
+    const request = {
+      action: GIT_CREDENTIAL_ACTION,
+      ...target === void 0 ? {} : { target },
+      // LOCAL ONLY, and it never contains the credential — git has not issued one yet.
+      arguments: { ...fields },
+      ...this.deps.sessionId === void 0 ? {} : { sessionId: this.deps.sessionId }
+    };
+    const verdict = await this.deps.authorizer.authorize(request);
+    if (verdict.effect === DECISION_EFFECT3.ALLOW) return { stdout: "" };
+    const where = target === void 0 ? "this remote" : target;
+    if (verdict.unreachable === true) {
+      return {
+        stdout: "",
+        message: `could not rule on ${where} \u2014 the runtime is unreachable, so git was left alone. A denied remote is reachable until it is back.`
+      };
+    }
+    return {
+      stdout: QUIT,
+      message: `no credential for ${where}: ${verdict.reason}`
+    };
+  }
+};
+function parseGitInput(input) {
+  const fields = {};
+  for (const line of input.split("\n")) {
+    if (line.length === 0) continue;
+    const separator = line.indexOf("=");
+    if (separator <= 0) continue;
+    const key = line.slice(0, separator).trim();
+    if (key === "password" || key === "credential") continue;
+    fields[key] = line.slice(separator + 1).trim();
+  }
+  return fields;
+}
+function remoteOf(fields) {
+  const host = fields["host"];
+  if (host === void 0 || host.length === 0) return void 0;
+  const protocol = fields["protocol"] ?? "https";
+  const path = fields["path"];
+  return `${protocol}://${host}${path === void 0 ? "" : `/${path}`}`;
+}
+
+// src/egress-seam.ts
+import {
+  DECISION_EFFECT as DECISION_EFFECT4,
+  describeEgress as describeEgress2,
+  digest as digest2,
+  inspectEgress as inspectEgress2,
+  isAllowed as holdAllowed2
+} from "@memnox/core";
+var EGRESS_REQUEST_ACTION = "http.request";
+var EGRESS_CONNECT_ACTION = "http.connect";
+var EGRESS_BLIND_SPOTS = [
+  "the payload inside an HTTPS tunnel \u2014 the destination is gated, the body is not",
+  "any connection that does not go through this proxy",
+  "a protocol that is not HTTP or CONNECT"
+];
+var CARRIED_HEADERS = [
+  "authorization",
+  "cookie",
+  "x-api-key",
+  "proxy-authorization"
+];
+var EgressSeam = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  async gateRequest(attempt) {
+    const fields = fieldsOf(attempt);
+    const inspection = inspectEgress2({ destination: attempt.url, fields });
+    if (inspection.findings.length > 0) {
+      return { allowed: false, message: describeEgress2(inspection) };
+    }
+    return this.rule({
+      action: EGRESS_REQUEST_ACTION,
+      target: attempt.url,
+      arguments: fields,
+      ...this.deps.sessionId === void 0 ? {} : { sessionId: this.deps.sessionId }
+    });
+  }
+  /**
+   * All that is knowable about a tunnel is where it goes. Ruling on the destination and
+   * saying plainly that the body is unseen beats pretending to inspect it.
+   */
+  async gateConnect(authority) {
+    return this.rule({
+      action: EGRESS_CONNECT_ACTION,
+      target: authority,
+      ...this.deps.sessionId === void 0 ? {} : { sessionId: this.deps.sessionId }
+    });
+  }
+  async rule(request) {
+    const verdict = await this.deps.authorizer.authorize(request);
+    if (verdict.effect === DECISION_EFFECT4.ALLOW) return { allowed: true };
+    if (verdict.effect === DECISION_EFFECT4.ASK) {
+      const asked = await this.ask(request, verdict);
+      if (asked === null) return { allowed: true };
+      return asked;
+    }
+    return { allowed: false, message: describe2(verdict) };
+  }
+  /**
+   * Puts an ask to a person. Null when it was allowed and the request may go.
+   *
+   * Without this an `ask` rule refused the request outright and told the reader "you
+   * chose to be asked about this" while nobody had been asked — the rule's own words
+   * arguing with what had just happened to them.
+   */
+  async ask(request, verdict) {
+    const hold = this.deps.hold;
+    if (hold === void 0) {
+      return {
+        allowed: false,
+        message: `${describe2(verdict)} Nobody could be asked, so it did not go.`
+      };
+    }
+    const result = await hold.hold({
+      sessionId: this.deps.sessionId ?? "ses_local",
+      agent: "an agent",
+      operation: request.action,
+      fingerprint: digest2(`${request.action}:${request.target ?? ""}`),
+      reason: verdict.reason,
+      ...request.target === void 0 ? {} : { target: request.target }
+    });
+    return holdAllowed2(result) ? null : { allowed: false, message: describe2(verdict) };
+  }
+};
+function fieldsOf(attempt) {
+  const fields = { method: attempt.method, url: attempt.url };
+  for (const name of CARRIED_HEADERS) {
+    const value = attempt.headers === void 0 ? void 0 : attempt.headers[name];
+    if (value !== void 0 && value.length > 0) fields[name] = value;
+  }
+  if (attempt.body !== void 0 && attempt.body.length > 0)
+    fields["body"] = attempt.body;
+  return fields;
+}
+function describe2(verdict) {
+  const parts = [verdict.reason];
+  if (verdict.alternative !== void 0) {
+    const target = verdict.alternative.resource === void 0 ? "" : ` ${verdict.alternative.resource}`;
+    parts.push(
+      `Instead: ${verdict.alternative.action}${target} \u2014 ${verdict.alternative.note}`
+    );
+  }
+  if (verdict.approvalId !== void 0) {
+    parts.push(`Ask a person: memnox approvals resolve ${verdict.approvalId} --by <you>`);
+  }
+  if (verdict.decisionId !== void 0) {
+    parts.push(`Why: memnox why ${verdict.decisionId}`);
+  }
+  return parts.join(" ");
+}
+
+// src/interceptor.ts
+import { basename as basename2, delimiter, join as join2 } from "path";
+import {
+  DECISION_EFFECT as DECISION_EFFECT5,
+  describeHold,
+  digest as digest3,
+  evidenceFor,
+  HOLD_OUTCOME,
+  isAllowed as holdAllowed3,
+  MEMNOX_HOME,
+  refusalShapeFor,
+  renderEvidence,
+  resolveAction
+} from "@memnox/core";
+var INTERCEPTOR_DIR = "bin";
+function interceptorDirFor(home) {
+  return join2(home, MEMNOX_HOME, INTERCEPTOR_DIR);
+}
+function realPath(path, home) {
+  const ours = interceptorDirFor(home);
+  return path.split(delimiter).filter((entry) => entry !== "" && entry !== ours).join(delimiter);
+}
+var INTERCEPT_BINARY = "memnox-intercept";
+function invokedFor(argv) {
+  const binary = argv[2];
+  if (binary === void 0 || basename2(binary) === INTERCEPT_BINARY) return null;
+  return { binary: basename2(binary), args: [...argv.slice(3)] };
+}
+async function ruleOnCommand(binary, args, deps) {
+  const verdict = verdictFor(binary, args, deps.env ?? {});
+  const argsDigest = digest3(args.join(" "));
+  const base = {
+    allowed: true,
+    binary,
+    args: [...args],
+    action: verdict.action,
+    class: verdict.class,
+    argsDigest,
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  };
+  const gate = deps.gate;
+  if (gate === void 0) return base;
+  const decision = gate.evaluate({
+    action: verdict.action,
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  });
+  if (decision.effect === DECISION_EFFECT5.ALLOW) return base;
+  const shown = renderEvidence(
+    evidenceFor({
+      matched: decision.matchedPolicies,
+      moment: (/* @__PURE__ */ new Date()).toISOString(),
+      ...deps.overlays === void 0 ? {} : { overlays: deps.overlays }
+    })
+  );
+  const matched = decision.matchedPolicies[0];
+  const decided = {
+    reason: decision.reason,
+    ...matched === void 0 ? {} : { rule: { name: matched.name, layer: "project", file: "policy" } }
+  };
+  if (decision.effect === DECISION_EFFECT5.ASK) {
+    const held = await askPerson(
+      verdict,
+      decision.reason,
+      shown,
+      [binary, ...args],
+      deps
+    );
+    if (held === null) return { ...base, ...decided };
+    if (typeof held !== "string") {
+      return {
+        ...base,
+        ...decided,
+        allowed: false,
+        edited: held.edited,
+        message: held.message
+      };
+    }
+    return { ...base, ...decided, allowed: false, message: held };
+  }
+  return {
+    ...base,
+    ...decided,
+    allowed: false,
+    message: [refusal(verdict, decision), ...shown].join("\n")
+  };
+}
+async function askPerson(verdict, reason, evidence, command, deps) {
+  const hold = deps.hold;
+  const request = {
+    sessionId: deps.sessionId ?? "ses_local",
+    agent: deps.agent ?? "an agent",
+    operation: verdict.action,
+    fingerprint: digest3(`${verdict.action}:${verdict.target ?? ""}`),
+    reason,
+    evidence,
+    command: command.join(" "),
+    ...verdict.target === void 0 ? {} : { target: verdict.target }
+  };
+  if (hold === void 0) {
+    return `${reason}
+Nobody could be asked, so it was denied. Run the agent under "memnox run".`;
+  }
+  const result = await hold.hold(request);
+  if (holdAllowed3(result)) return null;
+  if (result.outcome === HOLD_OUTCOME.EDITED && result.edited !== void 0) {
+    return { message: describeHold(result, request), edited: result.edited };
+  }
+  return describeHold(result, request);
+}
+function refusal(verdict, decision) {
+  const alternative = decision.alternative;
+  const instead = alternative === void 0 ? "" : `
+Instead: ${alternative.action}${alternative.resource === void 0 ? "" : ` ${alternative.resource}`} \u2014 ${alternative.note}`;
+  const { guidance } = refusalShapeFor(DECISION_EFFECT5.DENY, decision.reason);
+  return `Denied by Memnox: ${decision.reason}
+(${verdict.because})${instead}
+${guidance}`;
+}
+function resolveReal(binary, path, exists) {
+  if (basename2(binary) === INTERCEPT_BINARY) return null;
+  for (const entry of path.split(delimiter)) {
+    if (entry === "") continue;
+    const candidate = join2(entry, binary);
+    if (basename2(candidate) === INTERCEPT_BINARY) continue;
+    if (exists(candidate)) return candidate;
+  }
+  return null;
+}
+function verdictFor(binary, args, env = {}) {
+  const resolved = resolveAction(binary, args, env);
+  return {
+    action: resolved.action,
+    class: resolved.class,
+    because: resolved.because,
+    ...resolved.target === void 0 ? {} : { target: resolved.target }
+  };
+}
+
+// src/interceptor-install.ts
+import { existsSync } from "fs";
+import { chmod, mkdir, readdir, rm, writeFile } from "fs/promises";
+import { join as join3 } from "path";
+import { interceptableBinaries } from "@memnox/core";
+function scriptFor(binary, interceptBinary) {
+  return [
+    "#!/bin/sh",
+    `# Memnox interceptor for ${binary}. Remove this file, or run "memnox uninstall", to undo.`,
+    `exec "${interceptBinary}" "${binary}" "$@"`,
+    ""
+  ].join("\n");
+}
+async function installInterceptors(home, interceptBinary, seams = {}) {
+  const directory = interceptorDirFor(home);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const path = realPath(seams.path ?? process.env["PATH"] ?? "", home);
+  const exists = seams.exists ?? existsSync;
+  const installed = [];
+  const absent = [];
+  for (const binary of interceptableBinaries()) {
+    if (resolveReal(binary, path, exists) === null) {
+      absent.push(binary);
+      continue;
+    }
+    const scriptPath = join3(directory, binary);
+    await writeFile(scriptPath, scriptFor(binary, interceptBinary), {
+      encoding: "utf8",
+      mode: 448
+    });
+    await chmod(scriptPath, 448);
+    installed.push(binary);
+  }
+  return {
+    directory,
+    installed,
+    absent,
+    pathLine: `export PATH="${directory}:$PATH"`
+  };
+}
+async function removeInterceptors(home) {
+  const directory = interceptorDirFor(home);
+  let names;
+  try {
+    names = await readdir(directory);
+  } catch {
+    return [];
+  }
+  for (const name of names) await rm(join3(directory, name), { force: true });
+  await rm(directory, { recursive: true, force: true });
+  return names;
+}
+
+// src/git-hooks.ts
+import { mkdir as mkdir2, readFile, rm as rm2, writeFile as writeFile2, chmod as chmod2 } from "fs/promises";
+import { join as join4 } from "path";
+var HOOKS = ["pre-push", "pre-commit"];
+var HOOK_MARKER = "# installed by memnox";
+var HOOK_ACTIONS = {
+  "pre-push": "git.push-force",
+  "pre-commit": "git.commit"
+};
+function bodyFor(hook, binary) {
+  const action = HOOK_ACTIONS[hook];
+  const lines = [
+    "#!/bin/sh",
+    HOOK_MARKER,
+    '# Remove this file, or run "memnox uninstall", to undo.',
+    "",
+    `MEMNOX="${binary}"`,
+    'command -v "$MEMNOX" >/dev/null 2>&1 || MEMNOX=memnox',
+    ""
+  ];
+  if (hook === "pre-push") {
+    lines.push(
+      "# Only a force push. git names no flag, so it is read off the refs it is given:",
+      "# a remote tip that is not an ancestor of the local one is history being rewritten.",
+      "forced=0",
+      "while read -r _local_ref local_sha _remote_ref remote_sha; do",
+      '  [ -z "$remote_sha" ] && continue',
+      '  case "$remote_sha" in *[!0]*) ;; *) continue ;; esac',
+      '  git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null || forced=1',
+      "done",
+      '[ "$forced" = "0" ] && exit 0',
+      ""
+    );
+  }
+  lines.push(
+    `"$MEMNOX" policy test "${action}" >/dev/null 2>&1`,
+    "status=$?",
+    '[ "$status" = "0" ] && exit 0',
+    "",
+    "# 126 and 127 are the shell saying it never ran: not found, or found and not",
+    "# runnable because its interpreter is missing. A hook that ruled on nothing must",
+    "# not block, or installing Memnox and then opening a shell without it on PATH \u2014",
+    '# which is every shell, after "npx memnox" \u2014 would stop every commit in the repo.',
+    'if [ "$status" = "127" ] || [ "$status" = "126" ]; then',
+    '  echo "memnox: could not run here, so this hook ruled on nothing" >&2',
+    "  exit 0",
+    "fi",
+    "",
+    "# Non-zero from Memnox itself stops the operation, which is the point of a hook.",
+    `"$MEMNOX" policy test "${action}" >&2`,
+    "exit 1",
+    ""
+  );
+  return lines.join("\n");
+}
+function defaultBinary() {
+  const [, script] = process.argv;
+  return script === void 0 || script === "" ? "memnox" : script;
+}
+async function existingHook(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function installGitHooks(repoDir, binary = defaultBinary()) {
+  const hooksDir = join4(repoDir, ".git", "hooks");
+  await mkdir2(hooksDir, { recursive: true });
+  const report = { installed: [], skipped: [] };
+  for (const hook of HOOKS) {
+    const path = join4(hooksDir, hook);
+    const existing = await existingHook(path);
+    if (existing !== null && !existing.includes(HOOK_MARKER)) {
+      report.skipped.push({ hook, because: "a hook is already there and is not ours" });
+      continue;
+    }
+    await writeFile2(path, bodyFor(hook, binary), { encoding: "utf8", mode: 493 });
+    await chmod2(path, 493);
+    report.installed.push(hook);
+  }
+  return report;
+}
+async function removeGitHooks(repoDir) {
+  const hooksDir = join4(repoDir, ".git", "hooks");
+  const removed = [];
+  for (const hook of HOOKS) {
+    const path = join4(hooksDir, hook);
+    const existing = await existingHook(path);
+    if (existing === null || !existing.includes(HOOK_MARKER)) continue;
+    await rm2(path, { force: true });
+    removed.push(hook);
+  }
+  return removed;
+}
+
+// src/daemon-client.ts
+import { connect } from "net";
+import {
+  DAEMON_METHOD,
+  decodeResponse,
+  encode,
+  LineReader,
+  socketPathFor
+} from "@memnox/core";
+var DAEMON_TIMEOUT_MS = 250;
+function askDaemon(home, options) {
+  return speak(home, options.timeoutMs, {
+    id: 1,
+    method: DAEMON_METHOD.EVALUATE,
+    action: options.action,
+    ...options.target === void 0 ? {} : { target: options.target },
+    ...options.sessionId === void 0 ? {} : { sessionId: options.sessionId }
+  });
+}
+function reportToDaemon(home, options) {
+  return speak(home, options.timeoutMs, {
+    id: 1,
+    method: DAEMON_METHOD.RECORD,
+    action: options.action,
+    ...options.target === void 0 ? {} : { target: options.target },
+    ...options.sessionId === void 0 ? {} : { sessionId: options.sessionId },
+    ...options.exitCode === void 0 ? {} : { exitCode: options.exitCode },
+    ...options.outOfScope === void 0 ? {} : { outOfScope: options.outOfScope },
+    ...options.costUsd === void 0 ? {} : { costUsd: options.costUsd }
+  });
+}
+function askStatus(home, sessionId, timeoutMs) {
+  return speak(home, timeoutMs, {
+    id: 1,
+    method: DAEMON_METHOD.STATUS,
+    sessionId
+  });
+}
+function speak(home, timeout, message) {
+  const path = socketPathFor(home);
+  const timeoutMs = timeout ?? DAEMON_TIMEOUT_MS;
+  return new Promise((resolve2) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve2(value);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    timer.unref?.();
+    const socket = connect(path, () => {
+      socket.write(encode(message));
+    });
+    const reader = new LineReader();
+    socket.setEncoding("utf8");
+    socket.on("data", (chunk) => {
+      for (const line of reader.push(chunk)) finish(decodeResponse(line));
+    });
+    socket.on("error", () => finish(null));
+  });
+}
+
+// src/browser-seam.ts
+import {
+  BrowserHosts,
+  DECISION_EFFECT as DECISION_EFFECT6,
+  describeHold as describeHold2,
+  digest as digest4,
+  isAllowed as holdAllowed4,
+  navigationHost
+} from "@memnox/core";
+var BROWSER_ACTION = "browser.navigate";
+var BrowserSeam = class {
+  constructor(deps = {}) {
+    this.deps = deps;
+    this.hosts = deps.hosts ?? new BrowserHosts();
+  }
+  deps;
+  hosts;
+  async navigate(url) {
+    const host = navigationHost(url);
+    if (host === null) return { allowed: true, host: null };
+    const sessionId = this.deps.sessionId ?? "ses_local";
+    if (this.hosts.seen(sessionId, host)) {
+      return { allowed: true, host, remembered: true };
+    }
+    const gate = this.deps.gate;
+    const verdict = gate === void 0 ? { effect: DECISION_EFFECT6.ALLOW, reason: "no rules configured" } : gate.evaluate({ action: BROWSER_ACTION, target: host });
+    if (verdict.effect === DECISION_EFFECT6.ALLOW) {
+      this.hosts.remember(sessionId, host);
+      return { allowed: true, host };
+    }
+    if (verdict.effect === DECISION_EFFECT6.DENY) {
+      return { allowed: false, host, message: `Denied by Memnox: ${verdict.reason}` };
+    }
+    const request = {
+      sessionId,
+      agent: this.deps.agent ?? "an agent",
+      operation: BROWSER_ACTION,
+      target: host,
+      fingerprint: digest4(`${BROWSER_ACTION}:${host}`),
+      reason: verdict.reason
+    };
+    const hold = this.deps.hold;
+    if (hold === void 0) {
+      return {
+        allowed: false,
+        host,
+        message: `${verdict.reason}
+Nobody could be asked, so it was denied. Run the agent under "memnox run".`
+      };
+    }
+    const result = await hold.hold(request);
+    if (!holdAllowed4(result)) {
+      return { allowed: false, host, message: describeHold2(result, request) };
+    }
+    this.hosts.remember(sessionId, host);
+    return { allowed: true, host };
+  }
+};
+
+// src/record.ts
+import { randomUUID } from "crypto";
+import {
+  ACTOR_TYPE,
+  ENFORCEMENT_MODE,
+  EVENT_SCHEMA_VERSION,
+  EVENT_SURFACE,
+  TOOL_CLASS
+} from "@memnox/core";
+var CLASSES = Object.values(TOOL_CLASS);
+function classOf(value) {
+  return CLASSES.includes(value) ? value : TOOL_CLASS.UNKNOWN;
+}
+function eventFor(input) {
+  const { outcome } = input;
+  return {
+    id: `evt_${randomUUID().replace(/-/g, "").slice(0, 20)}`,
+    schemaVersion: EVENT_SCHEMA_VERSION,
+    at: input.at,
+    sessionId: input.sessionId ?? "ses_local",
+    agent: input.agent ?? "an agent",
+    actorType: ACTOR_TYPE.AGENT,
+    surface: outcome.binary === "git" ? EVENT_SURFACE.GIT : EVENT_SURFACE.SHELL,
+    operation: outcome.action,
+    class: classOf(outcome.class),
+    effect: input.effect,
+    mode: ENFORCEMENT_MODE.ENFORCE,
+    reason: input.reason,
+    // A digest, never the arguments: an argument list is where a secret would be.
+    argsDigest: outcome.argsDigest,
+    ...outcome.target === void 0 ? {} : { target: outcome.target },
+    ...input.rule === void 0 ? {} : { rule: input.rule },
+    ...input.policyHash === void 0 ? {} : { policyHash: input.policyHash },
+    ...input.bundleHash === void 0 ? {} : { bundleHash: input.bundleHash },
+    ...input.conditionsInForce === void 0 ? {} : { conditionsInForce: input.conditionsInForce },
+    ...input.exitCode === void 0 ? {} : { exitCode: input.exitCode },
+    ...input.durationMs === void 0 ? {} : { durationMs: input.durationMs }
+  };
+}
+async function record(sink, input) {
+  if (sink === null) return;
+  try {
+    await sink.append(eventFor(input));
+  } catch {
+  }
+}
+
+// src/breaker-seam.ts
+import {
+  breachIn,
+  DEFAULT_THRESHOLDS,
+  describePause,
+  outcomesFrom,
+  REPLAY_LIMIT,
+  SessionPauses,
+  SqliteEventStore
+} from "@memnox/core";
+async function pauseHolding(home, sessionId) {
+  if (sessionId === void 0 || sessionId === "") return null;
+  try {
+    return await new SessionPauses(home).inForce(sessionId);
+  } catch {
+    return null;
+  }
+}
+function pauseMessage(pause) {
+  return [
+    `Paused by Memnox: ${describePause(pause)}`,
+    `Resume with "memnox resume ${pause.sessionId}".`
+  ].join("\n");
+}
+async function resumedAt(home, sessionId) {
+  try {
+    const pause = await new SessionPauses(home).read(sessionId);
+    return pause?.resumedAt ?? null;
+  } catch {
+    return null;
+  }
+}
+async function observeSession(options) {
+  const { home, sessionId } = options;
+  if (sessionId === void 0 || sessionId === "") return null;
+  try {
+    const since = await resumedAt(home, sessionId);
+    const store = SqliteEventStore.forHome(home);
+    let events;
+    try {
+      events = await store.query({
+        sessionId,
+        limit: REPLAY_LIMIT,
+        ...since === null ? {} : { since }
+      });
+    } finally {
+      store.close();
+    }
+    const breach = breachIn(
+      outcomesFrom(events),
+      options.thresholds ?? DEFAULT_THRESHOLDS
+    );
+    if (breach === null) return null;
+    const last = events[events.length - 1];
+    const pause = {
+      sessionId,
+      signal: breach.signal,
+      reason: breach.reason,
+      reached: breach.reached,
+      ceiling: breach.ceiling,
+      pausedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...last === void 0 ? {} : { lastAction: last.operation }
+    };
+    await new SessionPauses(home).pause(pause);
+    return pause;
+  } catch {
+    return null;
+  }
+}
+
+// src/seam-runtime.ts
+import { execFileSync } from "child_process";
+import { statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve } from "path";
+import {
+  CloudLeases,
+  holdFor,
+  LeaseGate,
+  LeaseRegistry,
+  SESSION_VAR as SESSION_VAR2,
+  TtyLeasePrompt
+} from "@memnox/core";
+var log = (message) => {
+  process.stderr.write(`[memnox] ${message}
+`);
+};
+async function buildAuthorizer() {
+  const config = await readHookConfig(process.env, homedir2());
+  const gate = await loadHookGate(config);
+  if (gate === null) {
+    log(`no gate configured \u2014 set ${ENV_POLICIES}`);
+  }
+  return new HookAuthorizer({
+    ...gate === null ? {} : { gate },
+    log
+  });
+}
+async function readStdin() {
+  const chunks = [];
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) chunks.push(String(chunk));
+  return chunks.join("");
+}
+function buildLeases(cwd = process.cwd()) {
+  const root = repositoryRoot(cwd);
+  if (root === null) return void 0;
+  return {
+    gate: new LeaseGate({
+      registry: new LeaseRegistry(homedir2()),
+      /* The workspace's register too, so two machines on one repository stop being a
+         coin flip. It makes no call at all without an account file, and an
+         unreachable control plane never stops a write. */
+      shared: new CloudLeases(homedir2()),
+      prompt: new TtyLeasePrompt(),
+      now: () => (/* @__PURE__ */ new Date()).toISOString()
+    }),
+    holder: {
+      agent: process.env[ENV_AGENT_NAME] ?? DEFAULT_AGENT_NAME,
+      /* The session `memnox run` set. Without one, every command would be its own
+         session and a lease would never survive to the next line. */
+      sessionId: process.env[SESSION_VAR2] ?? `ses_pid_${process.ppid}`,
+      /* The agent, not this wrapper. A wrapper exits the moment its command does, so
+         holding its own pid would mark every lease abandoned as soon as it was taken. */
+      pid: process.ppid
+    },
+    repositoryRoot: root,
+    isDirectory: (path) => {
+      try {
+        return statSync(resolve(root, path)).isDirectory();
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function repositoryRoot(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function buildHold(timeoutMs) {
+  return holdFor({
+    home: homedir2(),
+    /* Opening /dev/tty on a headless box succeeds often enough that asking there
+       would swallow the question, so this is asked of stdin instead. */
+    interactive: process.stdin.isTTY === true,
+    announce: log,
+    ...timeoutMs === void 0 ? {} : { timeoutMs }
+  });
+}
+export {
+  BROWSER_ACTION,
+  BrowserSeam,
+  DAEMON_TIMEOUT_MS,
+  DEFAULT_AGENT_NAME,
+  EGRESS_ACTIONS,
+  EGRESS_BLIND_SPOTS,
+  EGRESS_CONNECT_ACTION,
+  EGRESS_DEFAULT_PORT,
+  EGRESS_MAX_BODY_BYTES,
+  EGRESS_REQUEST_ACTION,
+  ENV_AGENT_NAME,
+  ENV_AGENT_ROLE,
+  ENV_POLICIES,
+  EgressSeam,
+  FALLBACK_SHELL,
+  GIT_CREDENTIAL_ACTION,
+  GitCredentialSeam,
+  HOOKS,
+  HOOK_MARKER,
+  HookAuthorizer,
+  INTERCEPTOR_DIR,
+  INTERCEPT_BINARY,
+  POLICY_PATH_SEPARATOR,
+  REAL_SHELL_VAR,
+  SHELL_ACTION,
+  SHELL_EXIT_OK,
+  SHELL_EXIT_WITHHELD,
+  SHELL_MODE,
+  ShellSeam,
+  askDaemon,
+  askStatus,
+  buildAuthorizer,
+  buildHold,
+  buildLeases,
+  eventFor,
+  installGitHooks,
+  installInterceptors,
+  interceptorDirFor,
+  invokedFor,
+  loadHookGate,
+  log,
+  observeSession,
+  parseGitInput,
+  pauseHolding,
+  pauseMessage,
+  readHookConfig,
+  readStdin,
+  realPath,
+  realShell,
+  record,
+  removeGitHooks,
+  removeInterceptors,
+  reportToDaemon,
+  resolveReal,
+  ruleOnCommand,
+  shellInvocation,
+  verdictFor
+};