@mnemonik/codex-hooks 0.3.1 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/hook.js +49 -75
- package/dist/hook.js.map +1 -1
- package/dist/install.js +2 -4
- package/dist/install.js.map +1 -1
- package/dist/lib/behavior.d.ts +6 -14
- package/dist/lib/behavior.js +6 -14
- package/dist/lib/behavior.js.map +1 -1
- package/dist/lib/http.d.ts +14 -1
- package/dist/lib/http.js +31 -0
- package/dist/lib/http.js.map +1 -1
- package/dist/lib/shellTokens.d.ts +13 -68
- package/dist/lib/shellTokens.js +27 -322
- package/dist/lib/shellTokens.js.map +1 -1
- package/dist/lib/types.d.ts +22 -1
- package/dist/lib/types.js.map +1 -1
- package/package.json +1 -1
package/dist/hook.js
CHANGED
|
@@ -5,9 +5,9 @@ import { relative } from 'node:path';
|
|
|
5
5
|
import { extractToolFileTargets } from './lib/applyPatch.js';
|
|
6
6
|
import { additionalContext, continueStop, denyPreToolUse, systemMessage, trimContext, } from './lib/codexOutput.js';
|
|
7
7
|
import { isNonInteractive, parseBypass, resolveConfig } from './lib/env.js';
|
|
8
|
-
import { PROMPT_CONTEXT, PRE_EDIT_GATE,
|
|
9
|
-
import { fetchHookContext, fetchSnapshot, reportBypass, reportGateFired, trackIdeEdit, } from './lib/http.js';
|
|
10
|
-
import {
|
|
8
|
+
import { PROMPT_CONTEXT, PRE_EDIT_GATE, CHECKPOINT_PRESSURE } from './lib/behavior.js';
|
|
9
|
+
import { fetchHookContext, fetchPolicyReminder, fetchSnapshot, reportBypass, reportGateFired, trackIdeEdit, } from './lib/http.js';
|
|
10
|
+
import { matchIrreducibleDeny } from './lib/shellTokens.js';
|
|
11
11
|
async function readStdin() {
|
|
12
12
|
return new Promise((res) => {
|
|
13
13
|
let buf = '';
|
|
@@ -141,87 +141,61 @@ async function handlePreEdit(input, config) {
|
|
|
141
141
|
'Bypass: MNEMONIK_BYPASS_HOOKS=1 MNEMONIK_BYPASS_TYPE=<typo|formatting|regenerated|already_grounded|other>.',
|
|
142
142
|
].join('\n')));
|
|
143
143
|
}
|
|
144
|
+
/**
|
|
145
|
+
* PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
|
|
146
|
+
*
|
|
147
|
+
* 1. Local irreducible deny-floor for catastrophic patterns (rm -rf
|
|
148
|
+
* root/home, dd to a whole disk, mkfs of a whole disk).
|
|
149
|
+
* 2. Server policy-reminder fetch — POST tool args to
|
|
150
|
+
* /api/v1/hooks/policy-reminder, emit matched policies as a
|
|
151
|
+
* systemMessage. Codex PreToolUse can't inject additionalContext
|
|
152
|
+
* reliably so systemMessage is the right surface.
|
|
153
|
+
* 3. Allow on no match / unreachable server.
|
|
154
|
+
*
|
|
155
|
+
* Codex only reaches this guard when the host emits a Bash PreToolUse
|
|
156
|
+
* event. As of 2026-05, OpenAI documents incomplete interception for
|
|
157
|
+
* the newer unified_exec shell path; coverage is host-dependent.
|
|
158
|
+
*/
|
|
144
159
|
async function handlePreBash(input, config) {
|
|
145
|
-
// Codex only reaches this guard when the host emits a Bash PreToolUse event.
|
|
146
|
-
// As of 2026-05, OpenAI documents incomplete interception for the newer
|
|
147
|
-
// unified_exec shell path; we still gate when the event arrives, but
|
|
148
|
-
// host coverage is partial.
|
|
149
|
-
if (FORBIDDEN_GATE === 'off' && MUST_CONFIRM_GATE === 'off') {
|
|
150
|
-
await emitGateFired(input, config, 'Bash', 'off', 'off');
|
|
151
|
-
writeAllow();
|
|
152
|
-
}
|
|
153
160
|
const command = typeof input.tool_input?.command === 'string' ? input.tool_input.command : '';
|
|
154
161
|
if (!command.trim())
|
|
155
162
|
writeAllow();
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
let forbiddenHit = null;
|
|
167
|
-
let mustConfirmHit = null;
|
|
168
|
-
for (let cmdIdx = 0; cmdIdx < commands.length; cmdIdx++) {
|
|
169
|
-
const tokens = commands[cmdIdx];
|
|
170
|
-
const quotedFlags = wasQuoted[cmdIdx];
|
|
171
|
-
forbiddenHit = forbiddenHit ?? matchCommand(tokens, forbiddenPatterns, quotedFlags);
|
|
172
|
-
mustConfirmHit = mustConfirmHit ?? matchCommand(tokens, mustConfirmPatterns, quotedFlags);
|
|
173
|
-
if (forbiddenHit && mustConfirmHit)
|
|
174
|
-
break;
|
|
175
|
-
}
|
|
176
|
-
if (forbiddenHit) {
|
|
177
|
-
await runPolicyGate(input, config, 'forbiddenCommand', forbiddenHit, FORBIDDEN_GATE);
|
|
178
|
-
return;
|
|
163
|
+
// Layer 1: irreducible deny-floor.
|
|
164
|
+
const denyName = matchIrreducibleDeny(command);
|
|
165
|
+
if (denyName) {
|
|
166
|
+
await emitGateFired(input, config, 'Bash', 'enforce', `irreducible_deny_${denyName}`);
|
|
167
|
+
writeOutput(denyPreToolUse([
|
|
168
|
+
'MNEMONIK_IRREDUCIBLE_DENY',
|
|
169
|
+
`Bash blocked: command matches the catastrophic-action floor (${denyName}).`,
|
|
170
|
+
'These three patterns (rm -rf / | ~ | $HOME, dd of=<whole-disk>, mkfs <whole-disk>) are blocked unconditionally because the cost of a false negative is "your machine."',
|
|
171
|
+
"Bypass for legitimate one-off use: MNEMONIK_BYPASS_HOOKS=1 + MNEMONIK_BYPASS_TYPE=other + MNEMONIK_BYPASS_DETAIL 50-200 chars.",
|
|
172
|
+
].join('\n')));
|
|
179
173
|
}
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
174
|
+
// Layer 2: server-side policy reminder.
|
|
175
|
+
if (!config.apiKey) {
|
|
176
|
+
await emitGateFired(input, config, 'Bash', 'advisory', 'no_api_key');
|
|
177
|
+
writeAllow();
|
|
183
178
|
}
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
* - `enforce`: deny via Codex's permissionDecision='deny' shape.
|
|
195
|
-
*/
|
|
196
|
-
async function runPolicyGate(input, config, kind, pattern, mode) {
|
|
197
|
-
if (mode === 'off') {
|
|
198
|
-
await emitGateFired(input, config, 'Bash', mode, `policy_${kind}_off`);
|
|
179
|
+
const reminder = await fetchPolicyReminder({
|
|
180
|
+
server: config.server,
|
|
181
|
+
apiKey: config.apiKey,
|
|
182
|
+
cwd: input.cwd,
|
|
183
|
+
codexSessionId: sessionId(input),
|
|
184
|
+
tool: 'Bash',
|
|
185
|
+
context: command,
|
|
186
|
+
});
|
|
187
|
+
if (!reminder?.ok || reminder.policies.length === 0) {
|
|
188
|
+
await emitGateFired(input, config, 'Bash', 'advisory', reminder ? 'no_match' : 'unreachable');
|
|
199
189
|
writeAllow();
|
|
200
190
|
}
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
'Recommended: do NOT run this. Surface the policy to the user; if they explicitly confirm, the user should run it directly.',
|
|
207
|
-
'This advisory will become a hard block when FORBIDDEN_GATE flips to "enforce".',
|
|
208
|
-
].join(' ')
|
|
209
|
-
: [
|
|
210
|
-
`Mnemonik: a mustConfirm policy matched the command — pattern "${pattern}".`,
|
|
211
|
-
'Recommended: present a clear summary of what you are about to do and why, then wait for the user to respond before running it.',
|
|
212
|
-
'This advisory will become a hard block when MUST_CONFIRM_GATE flips to "enforce".',
|
|
213
|
-
].join(' ')));
|
|
191
|
+
const lines = ['Mnemonik: project policies matched this command. Read each rule and act accordingly.'];
|
|
192
|
+
for (const p of reminder.policies) {
|
|
193
|
+
const desc = p.description ?? p.pattern;
|
|
194
|
+
const repl = p.replacement ? ` Replacement: ${p.replacement}.` : '';
|
|
195
|
+
lines.push(`- [${p.kind}] ${desc}${repl}`);
|
|
214
196
|
}
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
writeOutput(denyPreToolUse([
|
|
218
|
-
'MNEMONIK_POLICY_GATE',
|
|
219
|
-
`Bash blocked by ${kind} policy: pattern "${pattern}" matched the command.`,
|
|
220
|
-
kind === 'forbiddenCommand'
|
|
221
|
-
? 'Forbidden commands cannot be run via the agent. If this is intentional, the user must run it directly OR remove the policy.'
|
|
222
|
-
: 'Fix: present a summary of what this command does and why, get explicit user confirmation, then proceed.',
|
|
223
|
-
"Bypass: MNEMONIK_BYPASS_HOOKS=1 + MNEMONIK_BYPASS_TYPE=<typo|formatting|regenerated|already_grounded|other>; 'other' additionally requires MNEMONIK_BYPASS_DETAIL 50-200 chars.",
|
|
224
|
-
].join('\n')));
|
|
197
|
+
await emitGateFired(input, config, 'Bash', 'advisory', `policy_match_${reminder.policies.length}`);
|
|
198
|
+
writeOutput(systemMessage(lines.join('\n')));
|
|
225
199
|
}
|
|
226
200
|
async function handlePostTool(input, config) {
|
|
227
201
|
const tool = input.tool_name ?? '';
|
package/dist/hook.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hook.js","sourceRoot":"","sources":["../src/hook.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAEL,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,YAAY,EACZ,QAAQ,GACT,MAAM,sBAAsB,CAAC;AAG9B,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,CAAC,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC,EACpC,OAAe;IAEf,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI;QACJ,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B,EAAE,GAAW,EAAE,YAAoB;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,YAAY,CAAC,0CAA0C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QACrF,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,MAAkB;IACzE,IAAI,cAAc,KAAK,KAAK;QAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,eAAe;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,WAAW,CACT,aAAa,CACX;YACE,kDAAkD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC1G,iGAAiG;YACjG,8FAA8F;SAC/F,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,WAAW,CACT,cAAc,CACZ;QACE,gCAAgC;QAChC,sDAAsD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAC9G,8DAA8D;QAC9D,4GAA4G;KAC7G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,6EAA6E;IAC7E,wEAAwE;IACxE,qEAAqE;IACrE,4BAA4B;IAC5B,IAAI,cAAc,KAAK,KAAK,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAE5B,MAAM,iBAAiB,GACrB,cAAc,KAAK,KAAK;QACtB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,kBAAkB,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,MAAM,mBAAmB,GACvB,iBAAiB,KAAK,KAAK;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;QACjC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,YAAY,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;QACpF,cAAc,GAAG,cAAc,IAAI,YAAY,CAAC,MAAM,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,YAAY,IAAI,cAAc;YAAE,MAAM;IAC5C,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;IAC1E,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAwC,EACxC,OAAe,EACf,IAAc;IAEd,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC;QACvE,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAC;QAC5E,WAAW,CACT,aAAa,CACX,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC;gBACE,sEAAsE,OAAO,IAAI;gBACjF,4HAA4H;gBAC5H,gFAAgF;aACjF,CAAC,IAAI,CAAC,GAAG,CAAC;YACb,CAAC,CAAC;gBACE,iEAAiE,OAAO,IAAI;gBAC5E,gIAAgI;gBAChI,mFAAmF;aACpF,CAAC,IAAI,CAAC,GAAG,CAAC,CAChB,CACF,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,CAAC;IACxE,WAAW,CACT,cAAc,CACZ;QACE,sBAAsB;QACtB,mBAAmB,IAAI,qBAAqB,OAAO,wBAAwB;QAC3E,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC,6HAA6H;YAC/H,CAAC,CAAC,yGAAyG;QAC7G,iLAAiL;KAClL,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAqB,EAAE,MAAkB;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAqB,EAAE,MAAkB;IACjE,IAAI,mBAAmB,KAAK,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM;QACb,oBAAoB,EAAE,KAAK,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB;QAAE,UAAU,EAAE,CAAC;IACtD,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAqB;IAC3C,IAAI,gBAAgB,EAAE;QAAE,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,eAAe;YAC9C,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,UAAU,EAAE,CAAC;IACf,CAAC;IAED,QAAQ,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM;QACR,KAAK,YAAY;YACf,IACE,KAAK,CAAC,SAAS,KAAK,aAAa;gBACjC,KAAK,CAAC,SAAS,KAAK,MAAM;gBAC1B,KAAK,CAAC,SAAS,KAAK,OAAO,EAC3B,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC9D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,EAAE,CAAC;YACb,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM;QACR;YACE,UAAU,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,UAAU,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC5G,CAAC;QACF,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}
|
|
1
|
+
{"version":3,"file":"hook.js","sourceRoot":"","sources":["../src/hook.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC9C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,CAAC,CAAC;QACF,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACjC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,IAAI,MAAM;QAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,uBAAuB,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC,EACpC,OAAe;IAEf,MAAM,eAAe,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI;QACJ,IAAI;QACJ,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B,EAAE,GAAW,EAAE,YAAoB;IAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAqB,EACrB,MAAkB,EAClB,IAAY,EACZ,IAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,YAAY,CAAC,0CAA0C,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QACrF,UAAU,EAAE,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAqB,EAAE,MAAkB;IACzE,IAAI,cAAc,KAAK,KAAK;QAAE,UAAU,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,eAAe;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,IAAI,GAAG,aAAa,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ;QAAE,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,WAAW,CACT,aAAa,CACX;YACE,kDAAkD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAC1G,iGAAiG;YACjG,8FAA8F;SAC/F,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvD,WAAW,CACT,cAAc,CACZ;QACE,gCAAgC;QAChC,sDAAsD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAC9G,8DAA8D;QAC9D,4GAA4G;KAC7G,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAkB;IACpE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,CAAC;IAElC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC;QACtF,WAAW,CACT,cAAc,CACZ;YACE,2BAA2B;YAC3B,gEAAgE,QAAQ,IAAI;YAC5E,wKAAwK;YACxK,gIAAgI;SACjI,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CACF,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAO;QACtB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9F,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,sFAAsF,CAAC,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAqB,EAAE,MAAkB;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB;QAAE,UAAU,EAAE,CAAC;IACrD,WAAW,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAqB,EAAE,MAAkB;IACjE,IAAI,mBAAmB,KAAK,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,UAAU,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM;QACb,oBAAoB,EAAE,KAAK,CAAC,sBAAsB;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB;QAAE,UAAU,EAAE,CAAC;IACtD,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAqB;IAC3C,IAAI,gBAAgB,EAAE;QAAE,UAAU,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,cAAc,EAAE,SAAS,CAAC,KAAK,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,eAAe;YAC9C,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,UAAU,EAAE,CAAC;IACf,CAAC;IAED,QAAQ,KAAK,CAAC,eAAe,EAAE,CAAC;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM;QACR,KAAK,YAAY;YACf,IACE,KAAK,CAAC,SAAS,KAAK,aAAa;gBACjC,KAAK,CAAC,SAAS,KAAK,MAAM;gBAC1B,KAAK,CAAC,SAAS,KAAK,OAAO,EAC3B,CAAC;gBACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC9D,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,UAAU,EAAE,CAAC;YACb,MAAM;QACR,KAAK,aAAa;YAChB,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM;QACR;YACE,UAAU,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,CAAC,KAAK,IAAI,EAAE;IACV,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,UAAU,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC5G,CAAC;QACF,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}
|
package/dist/install.js
CHANGED
|
@@ -92,10 +92,8 @@ async function main() {
|
|
|
92
92
|
` dispatcher -> ${dispatcher}`,
|
|
93
93
|
'',
|
|
94
94
|
'Installed Codex hooks only. This does not install or modify skills, rules, AGENTS.md, .mnemonik.json, or MCP config.',
|
|
95
|
-
'
|
|
96
|
-
|
|
97
|
-
" MUST_CONFIRM_GATE = 'advisory' → mustConfirm match allows + emits a systemMessage nudge.",
|
|
98
|
-
" Either can be flipped to 'advisory' / 'enforce' / 'off' by editing the constant and bumping the package version.",
|
|
95
|
+
'Bash policy reminders are server-driven. The dispatcher posts the command to /api/v1/hooks/policy-reminder; matched policies come back as a systemMessage. No per-kind knobs in the client.',
|
|
96
|
+
'Local irreducible deny-floor blocks three catastrophic patterns unconditionally: rm -rf / | ~ | $HOME, dd of=<whole-disk>, mkfs <whole-disk>.',
|
|
99
97
|
].join('\n'));
|
|
100
98
|
return 0;
|
|
101
99
|
}
|
package/dist/install.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAmBxC,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAO,GAAG,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,CACZ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,OAA2B,EAC3B,KAAkB;IAElB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,OAAO,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,aAAa,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC;QACxF,OAAO,GAAG,MAAM,oCAAoC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,uBAAuB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,iDAAiD,UAAU,sCAAsC,CAClG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAgC,CAAC;IACrE,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAEzC,KAAK,CAAC,YAAY,GAAG,cAAc,CACjC,KAAK,CAAC,YAAY,EAClB,sBAAsB,EACtB,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,gBAAgB,GAAG,cAAc,CACrC,KAAK,CAAC,gBAAgB,EACtB,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1F,KAAK,CAAC,WAAW,GAAG,cAAc,CAChC,KAAK,CAAC,WAAW,EACjB,0CAA0C,EAC1C,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/E,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,CACT;QACE,oCAAoC,SAAS,EAAE;QAC/C,qBAAqB,UAAU,EAAE;QACjC,qBAAqB,UAAU,EAAE;QACjC,EAAE;QACF,sHAAsH;QACtH,
|
|
1
|
+
{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAmBxC,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,OAAO,GAAG,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,OAAO,CACZ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,OAA2B,EAC3B,KAAkB;IAElB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACnD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAkB;IACjD,IAAI,iCAAiC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,OAAO,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,CAAC,aAAa,EAAE,KAAK,IAAI,aAAa,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,CAAC;QACxF,OAAO,GAAG,MAAM,oCAAoC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,uBAAuB,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,iDAAiD,UAAU,sCAAsC,CAClG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAgC,CAAC;IACrE,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAEzC,KAAK,CAAC,YAAY,GAAG,cAAc,CACjC,KAAK,CAAC,YAAY,EAClB,sBAAsB,EACtB,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,gBAAgB,GAAG,cAAc,CACrC,KAAK,CAAC,gBAAgB,EACtB,SAAS,EACT,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1F,KAAK,CAAC,WAAW,GAAG,cAAc,CAChC,KAAK,CAAC,WAAW,EACjB,0CAA0C,EAC1C,cAAc,CAAC,UAAU,CAAC,CAC3B,CAAC;IACF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAE/E,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,MAAM,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,CACT;QACE,oCAAoC,SAAS,EAAE;QAC/C,qBAAqB,UAAU,EAAE;QACjC,qBAAqB,UAAU,EAAE;QACjC,EAAE;QACF,sHAAsH;QACtH,6LAA6L;QAC7L,+IAA+I;KAChJ,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,IAAI,EAAE;SACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,CAAC"}
|
package/dist/lib/behavior.d.ts
CHANGED
|
@@ -35,23 +35,15 @@ export declare const PRE_EDIT_GATE: GateMode;
|
|
|
35
35
|
*/
|
|
36
36
|
export declare const PRE_EDIT_ADVISORY_AUTO_FETCH = true;
|
|
37
37
|
/**
|
|
38
|
-
* PreToolUse Bash gate
|
|
38
|
+
* PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
|
|
39
39
|
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
/**
|
|
46
|
-
* PreToolUse Bash gate — `mustConfirm` policy kind.
|
|
47
|
-
*
|
|
48
|
-
* Default `advisory`: the policy semantic is "pause and confirm with
|
|
49
|
-
* the user." Advisory emits the policy text as additionalContext and
|
|
50
|
-
* allows; the agent + user enforce the pause. Flip to `enforce` for
|
|
51
|
-
* a hard block on match, or `off` to disable. Kept in sync with
|
|
40
|
+
* Per-kind policy enforcement moved server-side. The dispatcher posts
|
|
41
|
+
* the bash command to /api/v1/hooks/policy-reminder and emits whatever
|
|
42
|
+
* comes back as systemMessage (Codex PreToolUse cannot inject
|
|
43
|
+
* additionalContext reliably). The only LOCAL gate is the irreducible
|
|
44
|
+
* deny-floor in lib/shellTokens.ts. Kept in sync with
|
|
52
45
|
* @mnemonik/claude-code-hooks.
|
|
53
46
|
*/
|
|
54
|
-
export declare const MUST_CONFIRM_GATE: GateMode;
|
|
55
47
|
/**
|
|
56
48
|
* Stop checkpoint pressure (Codex-specific name for the Stop gate that
|
|
57
49
|
* surfaces a continuation reason when meaningful work hasn't been
|
package/dist/lib/behavior.js
CHANGED
|
@@ -33,23 +33,15 @@ export const PRE_EDIT_GATE = 'advisory';
|
|
|
33
33
|
*/
|
|
34
34
|
export const PRE_EDIT_ADVISORY_AUTO_FETCH = true;
|
|
35
35
|
/**
|
|
36
|
-
* PreToolUse Bash gate
|
|
36
|
+
* PreToolUse Bash gate (phase 3 simplification, 0.4.x line).
|
|
37
37
|
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
/**
|
|
44
|
-
* PreToolUse Bash gate — `mustConfirm` policy kind.
|
|
45
|
-
*
|
|
46
|
-
* Default `advisory`: the policy semantic is "pause and confirm with
|
|
47
|
-
* the user." Advisory emits the policy text as additionalContext and
|
|
48
|
-
* allows; the agent + user enforce the pause. Flip to `enforce` for
|
|
49
|
-
* a hard block on match, or `off` to disable. Kept in sync with
|
|
38
|
+
* Per-kind policy enforcement moved server-side. The dispatcher posts
|
|
39
|
+
* the bash command to /api/v1/hooks/policy-reminder and emits whatever
|
|
40
|
+
* comes back as systemMessage (Codex PreToolUse cannot inject
|
|
41
|
+
* additionalContext reliably). The only LOCAL gate is the irreducible
|
|
42
|
+
* deny-floor in lib/shellTokens.ts. Kept in sync with
|
|
50
43
|
* @mnemonik/claude-code-hooks.
|
|
51
44
|
*/
|
|
52
|
-
export const MUST_CONFIRM_GATE = 'advisory';
|
|
53
45
|
/**
|
|
54
46
|
* Stop checkpoint pressure (Codex-specific name for the Stop gate that
|
|
55
47
|
* surfaces a continuation reason when meaningful work hasn't been
|
package/dist/lib/behavior.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"behavior.js","sourceRoot":"","sources":["../../src/lib/behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAa,UAAU,CAAC;AAEnD,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAa,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD
|
|
1
|
+
{"version":3,"file":"behavior.js","sourceRoot":"","sources":["../../src/lib/behavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAa,UAAU,CAAC;AAEnD,kCAAkC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAa,UAAU,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa,UAAU,CAAC"}
|
package/dist/lib/http.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { HookContextResponse, SnapshotResponse } from './types.js';
|
|
1
|
+
import type { HookContextResponse, PolicyReminderResponse, SnapshotResponse } from './types.js';
|
|
2
2
|
export interface FetchSnapshotInput {
|
|
3
3
|
server: string;
|
|
4
4
|
apiKey: string;
|
|
@@ -6,6 +6,19 @@ export interface FetchSnapshotInput {
|
|
|
6
6
|
codexSessionId: string;
|
|
7
7
|
}
|
|
8
8
|
export declare function fetchSnapshot(input: FetchSnapshotInput): Promise<SnapshotResponse | null>;
|
|
9
|
+
/**
|
|
10
|
+
* JIT policy reminder fetch — see claude-code-hooks for the full
|
|
11
|
+
* rationale. Soft-fails on auth/lookup/timeout.
|
|
12
|
+
*/
|
|
13
|
+
export interface FetchPolicyReminderInput {
|
|
14
|
+
server: string;
|
|
15
|
+
apiKey: string;
|
|
16
|
+
cwd: string;
|
|
17
|
+
codexSessionId: string;
|
|
18
|
+
tool: string;
|
|
19
|
+
context: string;
|
|
20
|
+
}
|
|
21
|
+
export declare function fetchPolicyReminder(input: FetchPolicyReminderInput): Promise<PolicyReminderResponse | null>;
|
|
9
22
|
export interface FetchHookContextInput {
|
|
10
23
|
server: string;
|
|
11
24
|
apiKey: string;
|
package/dist/lib/http.js
CHANGED
|
@@ -34,6 +34,37 @@ export async function fetchSnapshot(input) {
|
|
|
34
34
|
cleanup();
|
|
35
35
|
}
|
|
36
36
|
}
|
|
37
|
+
export async function fetchPolicyReminder(input) {
|
|
38
|
+
if (!input.context.trim())
|
|
39
|
+
return null;
|
|
40
|
+
const url = `${input.server.replace(/\/$/, '')}/api/v1/hooks/policy-reminder`;
|
|
41
|
+
const { signal, cleanup } = withTimeout(FETCH_TIMEOUT_MS);
|
|
42
|
+
try {
|
|
43
|
+
const res = await fetch(url, {
|
|
44
|
+
method: 'POST',
|
|
45
|
+
headers: {
|
|
46
|
+
'content-type': 'application/json',
|
|
47
|
+
authorization: `Bearer ${input.apiKey}`,
|
|
48
|
+
},
|
|
49
|
+
body: JSON.stringify({
|
|
50
|
+
cwd: input.cwd,
|
|
51
|
+
claudeSessionId: input.codexSessionId,
|
|
52
|
+
tool: input.tool,
|
|
53
|
+
context: input.context,
|
|
54
|
+
}),
|
|
55
|
+
signal,
|
|
56
|
+
});
|
|
57
|
+
if (!res.ok)
|
|
58
|
+
return null;
|
|
59
|
+
return (await res.json());
|
|
60
|
+
}
|
|
61
|
+
catch {
|
|
62
|
+
return null;
|
|
63
|
+
}
|
|
64
|
+
finally {
|
|
65
|
+
cleanup();
|
|
66
|
+
}
|
|
67
|
+
}
|
|
37
68
|
export async function fetchHookContext(input) {
|
|
38
69
|
const url = `${input.server.replace(/\/$/, '')}/api/v1/hooks/context`;
|
|
39
70
|
const { signal, cleanup } = withTimeout(FETCH_TIMEOUT_MS);
|
package/dist/lib/http.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,OAAO;aACd,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,cAAc;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7F,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/lib/http.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,OAAO;aACd,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC;IAC9E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,eAAe,EAAE,KAAK,CAAC,cAAc;gBACrC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,SAAS,EAAE,KAAK,CAAC,cAAc;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC;IACrE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAKlC;IACC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC7F,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
|
|
@@ -1,71 +1,16 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* Irreducible deny-floor for catastrophic, irreversible commands.
|
|
3
|
+
* Kept in sync with @mnemonik/claude-code-hooks/src/lib/shellTokens.ts —
|
|
4
|
+
* see the comment block there for the full rationale.
|
|
3
5
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
* be a single self-contained file with zero npm dependencies.
|
|
10
|
-
* - The regex-only approach is the false-positive trap the plan explicitly
|
|
11
|
-
* calls out (e.g. matching `rm -rf` inside a string literal). We avoid
|
|
12
|
-
* that by tokenising first and only matching tokens, never substrings.
|
|
13
|
-
*
|
|
14
|
-
* Limitations the caller MUST know:
|
|
15
|
-
* - Single-quoted strings are kept verbatim as one token (correct).
|
|
16
|
-
* - Double-quoted strings keep their content but $expansion is NOT resolved.
|
|
17
|
-
* - Backticks / $(...) are tokenised as raw text, not recursed into.
|
|
18
|
-
* - Pipes / redirects / && / || split commands so each side can be matched
|
|
19
|
-
* independently — the result is a list of token arrays, one per command.
|
|
20
|
-
*/
|
|
21
|
-
export interface TokenizeResult {
|
|
22
|
-
/** Each entry is one command in a pipeline / sequence. */
|
|
23
|
-
commands: string[][];
|
|
24
|
-
/**
|
|
25
|
-
* Parallel to `commands`: per-token boolean — true iff the token came from
|
|
26
|
-
* (or partially included) a quoted region (single OR double quotes). The
|
|
27
|
-
* regex match path uses this to exclude quoted argument bodies from
|
|
28
|
-
* pattern matching, so a project policy regex like `\b(api|db|...):` can't
|
|
29
|
-
* spuriously match because "api" appears inside `gh api 'jq-query-text'`.
|
|
30
|
-
* The plain-phrase / token-subsequence path doesn't need this since it
|
|
31
|
-
* already operates on whole tokens — quoted strings stay as one token
|
|
32
|
-
* and are compared verbatim.
|
|
33
|
-
*/
|
|
34
|
-
wasQuoted: boolean[][];
|
|
35
|
-
}
|
|
36
|
-
export declare function tokenize(input: string): TokenizeResult;
|
|
37
|
-
/**
|
|
38
|
-
* Match a token sequence against a project policy pattern.
|
|
39
|
-
*
|
|
40
|
-
* Pattern kinds (auto-detected — authors don't have to wrap in /…/):
|
|
41
|
-
* - Plain phrase like "git push origin main" — split into pattern tokens by
|
|
42
|
-
* whitespace; matches when a contiguous sub-sequence of `commandTokens`
|
|
43
|
-
* equals the pattern tokens. Critically, this does NOT substring-match
|
|
44
|
-
* against `tokens.join(' ')` — that would defeat the tokenizer (e.g.
|
|
45
|
-
* `echo '{"x":"git push origin main"}'` would falsely match because the
|
|
46
|
-
* literal phrase appears inside a single-quoted JSON token).
|
|
47
|
-
* - Glob like "git push *" or "delete-*" — pattern tokens with "*" matching
|
|
48
|
-
* any single command token (one-for-one). "*" within a token (e.g.
|
|
49
|
-
* "delete-*") is anchored to one whole command token.
|
|
50
|
-
* - Regex — anything that looks like a regex (contains "|", "\\", "^", "$",
|
|
51
|
-
* "(", ")", ".", "+", "?", "{", "}", "[", "]") OR is wrapped in /…/ or
|
|
52
|
-
* /…/i. Compiled and tested against `tokens.join(' ')`. The auto-detect
|
|
53
|
-
* covers the realistic case where a project's mustConfirm pattern is
|
|
54
|
-
* pipe-alternation (e.g. "make staging|make prod|git push|git commit")
|
|
55
|
-
* without explicit /…/ wrapping.
|
|
56
|
-
*
|
|
57
|
-
* Returning the matched pattern (verbatim) lets the dispatcher emit it
|
|
58
|
-
* verbatim in telemetry and deny-reason text.
|
|
59
|
-
*/
|
|
60
|
-
export declare function matchCommand(commandTokens: string[], patterns: string[], wasQuoted?: boolean[]): string | null;
|
|
61
|
-
/**
|
|
62
|
-
* Built-in `forbiddenCommand` patterns — catastrophic, host-rooted, no
|
|
63
|
-
* legitimate agent use. Kept in sync with @mnemonik/claude-code-hooks.
|
|
64
|
-
*/
|
|
65
|
-
export declare const BUILT_IN_FORBIDDEN: readonly string[];
|
|
66
|
-
/**
|
|
67
|
-
* Built-in `mustConfirm` patterns — operations the user almost certainly
|
|
68
|
-
* wants done at some point but never silently. Kept in sync with
|
|
69
|
-
* @mnemonik/claude-code-hooks.
|
|
6
|
+
* Phase 3 simplification (codex-hooks 0.4.0): all other policy matching
|
|
7
|
+
* moved server-side. The dispatcher posts to /api/v1/hooks/policy-reminder
|
|
8
|
+
* and emits whatever reminders come back. This file is the ONE place the
|
|
9
|
+
* dispatcher still does local pattern matching, only for "your machine
|
|
10
|
+
* is bricked" patterns.
|
|
70
11
|
*/
|
|
71
|
-
export declare const
|
|
12
|
+
export declare const IRREDUCIBLE_DENY: ReadonlyArray<{
|
|
13
|
+
name: string;
|
|
14
|
+
pattern: RegExp;
|
|
15
|
+
}>;
|
|
16
|
+
export declare function matchIrreducibleDeny(command: string): string | null;
|
package/dist/lib/shellTokens.js
CHANGED
|
@@ -1,328 +1,33 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* Irreducible deny-floor for catastrophic, irreversible commands.
|
|
3
|
+
* Kept in sync with @mnemonik/claude-code-hooks/src/lib/shellTokens.ts —
|
|
4
|
+
* see the comment block there for the full rationale.
|
|
3
5
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
*
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
let mode = 'normal';
|
|
29
|
-
const flushToken = () => {
|
|
30
|
-
if (buf.length > 0) {
|
|
31
|
-
current.push(buf);
|
|
32
|
-
currentQuoted.push(bufQuoted);
|
|
33
|
-
buf = '';
|
|
34
|
-
bufQuoted = false;
|
|
35
|
-
}
|
|
36
|
-
};
|
|
37
|
-
const flushCommand = () => {
|
|
38
|
-
flushToken();
|
|
39
|
-
if (current.length > 0) {
|
|
40
|
-
commands.push(current);
|
|
41
|
-
wasQuotedAll.push(currentQuoted);
|
|
42
|
-
}
|
|
43
|
-
current = [];
|
|
44
|
-
currentQuoted = [];
|
|
45
|
-
};
|
|
46
|
-
for (let i = 0; i < input.length; i++) {
|
|
47
|
-
const c = input[i];
|
|
48
|
-
if (mode === 'single') {
|
|
49
|
-
if (c === "'") {
|
|
50
|
-
mode = 'normal';
|
|
51
|
-
}
|
|
52
|
-
else {
|
|
53
|
-
buf += c;
|
|
54
|
-
bufQuoted = true;
|
|
55
|
-
}
|
|
56
|
-
continue;
|
|
57
|
-
}
|
|
58
|
-
if (mode === 'double') {
|
|
59
|
-
if (c === '"') {
|
|
60
|
-
mode = 'normal';
|
|
61
|
-
}
|
|
62
|
-
else if (c === '\\' && i + 1 < input.length) {
|
|
63
|
-
// Handle escaped quotes inside double-quoted strings.
|
|
64
|
-
buf += input[++i];
|
|
65
|
-
bufQuoted = true;
|
|
66
|
-
}
|
|
67
|
-
else {
|
|
68
|
-
buf += c;
|
|
69
|
-
bufQuoted = true;
|
|
70
|
-
}
|
|
71
|
-
continue;
|
|
72
|
-
}
|
|
73
|
-
// mode === 'normal'
|
|
74
|
-
if (c === "'") {
|
|
75
|
-
mode = 'single';
|
|
76
|
-
bufQuoted = true; // entering quoted region — even if empty, mark token
|
|
77
|
-
continue;
|
|
78
|
-
}
|
|
79
|
-
if (c === '"') {
|
|
80
|
-
mode = 'double';
|
|
81
|
-
bufQuoted = true;
|
|
82
|
-
continue;
|
|
83
|
-
}
|
|
84
|
-
if (c === '\\' && i + 1 < input.length) {
|
|
85
|
-
buf += input[++i];
|
|
86
|
-
continue;
|
|
87
|
-
}
|
|
88
|
-
if (c === ' ' || c === '\t' || c === '\n') {
|
|
89
|
-
flushToken();
|
|
90
|
-
continue;
|
|
91
|
-
}
|
|
92
|
-
// Two-char meta tokens we recognise.
|
|
93
|
-
if ((c === '|' && input[i + 1] === '|') ||
|
|
94
|
-
(c === '&' && input[i + 1] === '&') ||
|
|
95
|
-
(c === '>' && input[i + 1] === '>') ||
|
|
96
|
-
(c === '<' && input[i + 1] === '<')) {
|
|
97
|
-
flushCommand();
|
|
98
|
-
i++;
|
|
99
|
-
continue;
|
|
100
|
-
}
|
|
101
|
-
if (c === '|' || c === ';' || c === '&') {
|
|
102
|
-
flushCommand();
|
|
103
|
-
continue;
|
|
104
|
-
}
|
|
105
|
-
if (c === '>' || c === '<') {
|
|
106
|
-
flushCommand();
|
|
107
|
-
continue;
|
|
108
|
-
}
|
|
109
|
-
buf += c;
|
|
110
|
-
}
|
|
111
|
-
flushCommand();
|
|
112
|
-
return { commands, wasQuoted: wasQuotedAll };
|
|
113
|
-
}
|
|
114
|
-
/**
|
|
115
|
-
* Match a token sequence against a project policy pattern.
|
|
116
|
-
*
|
|
117
|
-
* Pattern kinds (auto-detected — authors don't have to wrap in /…/):
|
|
118
|
-
* - Plain phrase like "git push origin main" — split into pattern tokens by
|
|
119
|
-
* whitespace; matches when a contiguous sub-sequence of `commandTokens`
|
|
120
|
-
* equals the pattern tokens. Critically, this does NOT substring-match
|
|
121
|
-
* against `tokens.join(' ')` — that would defeat the tokenizer (e.g.
|
|
122
|
-
* `echo '{"x":"git push origin main"}'` would falsely match because the
|
|
123
|
-
* literal phrase appears inside a single-quoted JSON token).
|
|
124
|
-
* - Glob like "git push *" or "delete-*" — pattern tokens with "*" matching
|
|
125
|
-
* any single command token (one-for-one). "*" within a token (e.g.
|
|
126
|
-
* "delete-*") is anchored to one whole command token.
|
|
127
|
-
* - Regex — anything that looks like a regex (contains "|", "\\", "^", "$",
|
|
128
|
-
* "(", ")", ".", "+", "?", "{", "}", "[", "]") OR is wrapped in /…/ or
|
|
129
|
-
* /…/i. Compiled and tested against `tokens.join(' ')`. The auto-detect
|
|
130
|
-
* covers the realistic case where a project's mustConfirm pattern is
|
|
131
|
-
* pipe-alternation (e.g. "make staging|make prod|git push|git commit")
|
|
132
|
-
* without explicit /…/ wrapping.
|
|
133
|
-
*
|
|
134
|
-
* Returning the matched pattern (verbatim) lets the dispatcher emit it
|
|
135
|
-
* verbatim in telemetry and deny-reason text.
|
|
136
|
-
*/
|
|
137
|
-
export function matchCommand(commandTokens, patterns, wasQuoted) {
|
|
138
|
-
if (commandTokens.length === 0 || patterns.length === 0)
|
|
139
|
-
return null;
|
|
140
|
-
const joined = commandTokens.join(' ').trim();
|
|
141
|
-
// Regex-safe joined excludes content of quoted tokens — see TokenizeResult
|
|
142
|
-
// doc comment. Each quoted token becomes a single-character placeholder so
|
|
143
|
-
// patterns can't bridge across them either. When wasQuoted is not provided
|
|
144
|
-
// (test fixtures, legacy callers), fall back to the old behavior.
|
|
145
|
-
const joinedForRegex = wasQuoted
|
|
146
|
-
? commandTokens
|
|
147
|
-
.map((t, i) => (wasQuoted[i] ? '' : t))
|
|
148
|
-
.join(' ')
|
|
149
|
-
.trim()
|
|
150
|
-
: joined;
|
|
151
|
-
for (const raw of patterns) {
|
|
152
|
-
const pattern = raw.trim();
|
|
153
|
-
if (!pattern)
|
|
154
|
-
continue;
|
|
155
|
-
const explicitRegex = parseExplicitRegex(pattern);
|
|
156
|
-
if (explicitRegex !== null) {
|
|
157
|
-
try {
|
|
158
|
-
if (new RegExp(explicitRegex.body, explicitRegex.flags).test(joinedForRegex)) {
|
|
159
|
-
return pattern;
|
|
160
|
-
}
|
|
161
|
-
}
|
|
162
|
-
catch {
|
|
163
|
-
/* invalid regex — skip */
|
|
164
|
-
}
|
|
165
|
-
continue;
|
|
166
|
-
}
|
|
167
|
-
// Pipe alternation: split into segments and decide phrase-vs-regex
|
|
168
|
-
// PER SEGMENT — but ONLY at the top level of the pattern. Pipes inside
|
|
169
|
-
// `(...)` or `[...]` groups are regex syntax (alternation inside a
|
|
170
|
-
// capture group, character class), not policy alternatives. Splitting
|
|
171
|
-
// them produced the v0.2.0 false positive: a YAML-targeted regex like
|
|
172
|
-
// `\b(app|db|...|api|...):` was split into a phrase segment "api" that
|
|
173
|
-
// matched any command containing `api` as a token (e.g. `gh api ...`).
|
|
174
|
-
const segments = splitTopLevelPipes(pattern);
|
|
175
|
-
for (const segment of segments) {
|
|
176
|
-
if (matchOneSegment(segment, commandTokens, joinedForRegex))
|
|
177
|
-
return pattern;
|
|
178
|
-
}
|
|
6
|
+
* Phase 3 simplification (codex-hooks 0.4.0): all other policy matching
|
|
7
|
+
* moved server-side. The dispatcher posts to /api/v1/hooks/policy-reminder
|
|
8
|
+
* and emits whatever reminders come back. This file is the ONE place the
|
|
9
|
+
* dispatcher still does local pattern matching, only for "your machine
|
|
10
|
+
* is bricked" patterns.
|
|
11
|
+
*/
|
|
12
|
+
export const IRREDUCIBLE_DENY = [
|
|
13
|
+
{
|
|
14
|
+
name: 'rm-rf-root-or-home',
|
|
15
|
+
pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f?[a-zA-Z]*\s+(?:\/|~|\$HOME)(?![A-Za-z0-9/_-])/,
|
|
16
|
+
},
|
|
17
|
+
{
|
|
18
|
+
name: 'dd-of-whole-disk',
|
|
19
|
+
pattern: /\bdd\b[^|;&]*\bof=\/dev\/(?:sd[a-z]|nvme\d+n\d+|hd[a-z]|vd[a-z])(?![A-Za-z0-9])/,
|
|
20
|
+
},
|
|
21
|
+
{
|
|
22
|
+
name: 'mkfs-whole-disk',
|
|
23
|
+
pattern: /\bmkfs(?:\.[a-z0-9]+)?\b[^|;&]*?\s\/dev\/(?:sd[a-z]|nvme\d+n\d+|hd[a-z]|vd[a-z])(?![A-Za-z0-9])/,
|
|
24
|
+
},
|
|
25
|
+
];
|
|
26
|
+
export function matchIrreducibleDeny(command) {
|
|
27
|
+
for (const { name, pattern } of IRREDUCIBLE_DENY) {
|
|
28
|
+
if (pattern.test(command))
|
|
29
|
+
return name;
|
|
179
30
|
}
|
|
180
31
|
return null;
|
|
181
32
|
}
|
|
182
|
-
function matchOneSegment(segment, commandTokens, joined) {
|
|
183
|
-
if (looksLikeRegex(segment)) {
|
|
184
|
-
try {
|
|
185
|
-
return new RegExp(segment).test(joined);
|
|
186
|
-
}
|
|
187
|
-
catch {
|
|
188
|
-
return false;
|
|
189
|
-
}
|
|
190
|
-
}
|
|
191
|
-
const tokens = segment.split(/\s+/).filter(Boolean);
|
|
192
|
-
if (tokens.length === 0)
|
|
193
|
-
return false;
|
|
194
|
-
return matchTokenSubsequence(commandTokens, tokens);
|
|
195
|
-
}
|
|
196
|
-
/**
|
|
197
|
-
* Split `pattern` on `|` only when the pipe is at the top level (not nested
|
|
198
|
-
* inside `(...)` or `[...]`). Backslash-escapes the next character. Used by
|
|
199
|
-
* matchCommand to handle policy patterns like `make staging|make prod` while
|
|
200
|
-
* leaving regex group alternations like `(app|db|...)` intact.
|
|
201
|
-
*/
|
|
202
|
-
function splitTopLevelPipes(pattern) {
|
|
203
|
-
const segments = [];
|
|
204
|
-
let buf = '';
|
|
205
|
-
let depthParen = 0;
|
|
206
|
-
let depthBracket = 0;
|
|
207
|
-
for (let i = 0; i < pattern.length; i++) {
|
|
208
|
-
const c = pattern[i];
|
|
209
|
-
if (c === '\\' && i + 1 < pattern.length) {
|
|
210
|
-
buf += c + pattern[i + 1];
|
|
211
|
-
i++;
|
|
212
|
-
continue;
|
|
213
|
-
}
|
|
214
|
-
if (c === '(')
|
|
215
|
-
depthParen++;
|
|
216
|
-
else if (c === ')')
|
|
217
|
-
depthParen = Math.max(0, depthParen - 1);
|
|
218
|
-
else if (c === '[')
|
|
219
|
-
depthBracket++;
|
|
220
|
-
else if (c === ']')
|
|
221
|
-
depthBracket = Math.max(0, depthBracket - 1);
|
|
222
|
-
if (c === '|' && depthParen === 0 && depthBracket === 0) {
|
|
223
|
-
const trimmed = buf.trim();
|
|
224
|
-
if (trimmed)
|
|
225
|
-
segments.push(trimmed);
|
|
226
|
-
buf = '';
|
|
227
|
-
continue;
|
|
228
|
-
}
|
|
229
|
-
buf += c;
|
|
230
|
-
}
|
|
231
|
-
const tail = buf.trim();
|
|
232
|
-
if (tail)
|
|
233
|
-
segments.push(tail);
|
|
234
|
-
return segments.length > 0 ? segments : [pattern];
|
|
235
|
-
}
|
|
236
|
-
/**
|
|
237
|
-
* /regex/ or /regex/i — explicit opt-in to joined-form regex matching.
|
|
238
|
-
* Returns null when the pattern isn't wrapped this way.
|
|
239
|
-
*/
|
|
240
|
-
function parseExplicitRegex(pattern) {
|
|
241
|
-
if (!pattern.startsWith('/'))
|
|
242
|
-
return null;
|
|
243
|
-
const tail = pattern.endsWith('/i') ? '/i' : pattern.endsWith('/') ? '/' : null;
|
|
244
|
-
if (!tail)
|
|
245
|
-
return null;
|
|
246
|
-
return { body: pattern.slice(1, pattern.length - tail.length), flags: tail === '/i' ? 'i' : '' };
|
|
247
|
-
}
|
|
248
|
-
/**
|
|
249
|
-
* Heuristic: does `pattern` contain regex metacharacters that aren't part of
|
|
250
|
-
* the plain-phrase / glob vocabulary? `*` alone is glob, not regex. The pipe
|
|
251
|
-
* is the most common case in real-world policies.
|
|
252
|
-
*/
|
|
253
|
-
function looksLikeRegex(pattern) {
|
|
254
|
-
return /[|\\.^$()+?{}[\]]/.test(pattern);
|
|
255
|
-
}
|
|
256
|
-
/**
|
|
257
|
-
* True iff `patternTokens` appears as a contiguous sub-sequence of
|
|
258
|
-
* `commandTokens`. A "*" pattern token matches any single command token.
|
|
259
|
-
*
|
|
260
|
-
* Whole-token matches only — `git push` does NOT match a command token
|
|
261
|
-
* `'git push origin main'` (a single-quoted string), which is the property
|
|
262
|
-
* that protects us from the false-positive Bash regex trap. A pattern token
|
|
263
|
-
* is allowed to be a partial-string glob (`git*`) — those still only match
|
|
264
|
-
* a single whole command token, never crossing token boundaries.
|
|
265
|
-
*/
|
|
266
|
-
function matchTokenSubsequence(commandTokens, patternTokens) {
|
|
267
|
-
const need = patternTokens.length;
|
|
268
|
-
if (need === 0)
|
|
269
|
-
return true;
|
|
270
|
-
for (let start = 0; start <= commandTokens.length - need; start++) {
|
|
271
|
-
let ok = true;
|
|
272
|
-
for (let i = 0; i < need; i++) {
|
|
273
|
-
const cmd = commandTokens[start + i] ?? '';
|
|
274
|
-
const pat = patternTokens[i] ?? '';
|
|
275
|
-
if (pat === '*')
|
|
276
|
-
continue;
|
|
277
|
-
if (pat.includes('*')) {
|
|
278
|
-
// Within-token glob, e.g. "delete-*" — anchored to the whole token.
|
|
279
|
-
const escaped = pat
|
|
280
|
-
.split('*')
|
|
281
|
-
.map((seg) => seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
|
|
282
|
-
.join('.*');
|
|
283
|
-
if (!new RegExp(`^${escaped}$`).test(cmd)) {
|
|
284
|
-
ok = false;
|
|
285
|
-
break;
|
|
286
|
-
}
|
|
287
|
-
continue;
|
|
288
|
-
}
|
|
289
|
-
if (cmd !== pat) {
|
|
290
|
-
ok = false;
|
|
291
|
-
break;
|
|
292
|
-
}
|
|
293
|
-
}
|
|
294
|
-
if (ok)
|
|
295
|
-
return true;
|
|
296
|
-
}
|
|
297
|
-
return false;
|
|
298
|
-
}
|
|
299
|
-
/**
|
|
300
|
-
* Built-in `forbiddenCommand` patterns — catastrophic, host-rooted, no
|
|
301
|
-
* legitimate agent use. Kept in sync with @mnemonik/claude-code-hooks.
|
|
302
|
-
*/
|
|
303
|
-
export const BUILT_IN_FORBIDDEN = [
|
|
304
|
-
'rm -rf /',
|
|
305
|
-
'rm -rf ~',
|
|
306
|
-
'rm -rf $HOME',
|
|
307
|
-
];
|
|
308
|
-
/**
|
|
309
|
-
* Built-in `mustConfirm` patterns — operations the user almost certainly
|
|
310
|
-
* wants done at some point but never silently. Kept in sync with
|
|
311
|
-
* @mnemonik/claude-code-hooks.
|
|
312
|
-
*/
|
|
313
|
-
export const BUILT_IN_MUST_CONFIRM = [
|
|
314
|
-
'git push origin main',
|
|
315
|
-
'git push origin master',
|
|
316
|
-
'git push --force',
|
|
317
|
-
'git reset --hard',
|
|
318
|
-
'git merge main',
|
|
319
|
-
'git merge master',
|
|
320
|
-
'git branch -D',
|
|
321
|
-
'npm publish',
|
|
322
|
-
'pnpm publish',
|
|
323
|
-
'yarn publish',
|
|
324
|
-
'docker rm',
|
|
325
|
-
'docker rmi',
|
|
326
|
-
'kubectl delete',
|
|
327
|
-
];
|
|
328
33
|
//# sourceMappingURL=shellTokens.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"shellTokens.js","sourceRoot":"","sources":["../../src/lib/shellTokens.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"shellTokens.js","sourceRoot":"","sources":["../../src/lib/shellTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAqD;IAChF;QACE,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4EAA4E;KACtF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,iFAAiF;KAC3F;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iGAAiG;KAC3G;CACF,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/lib/types.d.ts
CHANGED
|
@@ -34,12 +34,33 @@ export interface BypassEnvelope {
|
|
|
34
34
|
detail: string | null;
|
|
35
35
|
invalidReason: string | null;
|
|
36
36
|
}
|
|
37
|
+
/**
|
|
38
|
+
* Server response from /api/v1/hooks/policy-reminder. Each entry is a
|
|
39
|
+
* context-triggered policy whose trigger_keywords overlap the action
|
|
40
|
+
* context the dispatcher posted.
|
|
41
|
+
*/
|
|
42
|
+
export interface PolicyReminderResponse {
|
|
43
|
+
ok: boolean;
|
|
44
|
+
reason?: 'unauthorized' | 'no_project' | 'no_context' | 'lookup_failed';
|
|
45
|
+
policies: Array<{
|
|
46
|
+
id: string;
|
|
47
|
+
kind: string;
|
|
48
|
+
pattern: string;
|
|
49
|
+
description: string | null;
|
|
50
|
+
replacement: string | null;
|
|
51
|
+
}>;
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Server snapshot. Phase 3 (0.4.0): dispatcher no longer matches against
|
|
55
|
+
* `policies` locally; policy decisions live in /api/v1/hooks/policy-reminder.
|
|
56
|
+
* `policies` retained for backwards compat with older servers.
|
|
57
|
+
*/
|
|
37
58
|
export interface SnapshotResponse {
|
|
38
59
|
ok: boolean;
|
|
39
60
|
reason?: 'unauthorized' | 'no_project' | 'no_active_session';
|
|
40
61
|
coveredFiles: string[];
|
|
41
62
|
editedFiles: string[];
|
|
42
|
-
policies
|
|
63
|
+
policies?: {
|
|
43
64
|
forbiddenCommand: Array<{
|
|
44
65
|
pattern: string;
|
|
45
66
|
description: string;
|
package/dist/lib/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAqGA,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mnemonik/codex-hooks",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Codex lifecycle hooks for Mnemonik memory awareness and host-side grounding gates. Hooks only: does not install skills, rules, AGENTS.md, .mnemonik.json, or MCP config.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|