@modootoday/pmcp 0.10.0 → 0.11.0

package/dist/project/hook-adapter.d.ts

@@ -0,0 +1,11 @@
+import { S as ShellHookSpec, H as HookTool } from '../hook-spec-PRSnYGLV.js';
+
+type Decision = {
+    readonly decision: "allow" | "deny";
+    readonly reason?: string;
+};
+declare function guardPath(root: string, command: readonly string[]): string;
+declare function evaluateShellHook(root: string, policy: ShellHookSpec, tool: HookTool, payload: unknown): Decision;
+declare function nativeHookDecision(tool: HookTool, decision: Decision): object;
+
+export { evaluateShellHook, guardPath, nativeHookDecision };

package/dist/project/hook-adapter.js

@@ -0,0 +1,191 @@
+// src/project/hook-adapter.ts
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "fs";
+import { dirname, isAbsolute, relative, resolve } from "path";
+var denied = () => ({
+  decision: "deny",
+  reason: "Shell guard failed validation or execution"
+});
+function guardPath(root, command) {
+  const script = command[0]?.startsWith(".agents/guards/") ? command[0] : command[1];
+  if (!script?.startsWith(".agents/guards/")) {
+    throw new Error("Hook command must execute a script under .agents/guards/");
+  }
+  const absolute = resolve(root, script);
+  const base = resolve(root, ".agents/guards");
+  const inside = relative(base, absolute);
+  if (isAbsolute(inside) || inside === ".." || inside.startsWith("../") || inside.startsWith("..\\")) {
+    throw new Error("Hook guard must stay under .agents/guards/");
+  }
+  if (!existsSync(absolute) || !statSync(absolute).isFile()) {
+    throw new Error("Hook guard script must exist");
+  }
+  const actual = relative(base, realpathSync(absolute));
+  if (isAbsolute(actual) || actual === ".." || actual.startsWith("../") || actual.startsWith("..\\")) {
+    throw new Error("Hook guard cannot resolve outside .agents/guards/");
+  }
+  return absolute;
+}
+function object(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return value;
+}
+function scalar(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  if (value.startsWith('"')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      return value;
+    }
+  }
+  return value;
+}
+function evaluateShellHook(root, policy, tool, payload) {
+  try {
+    const value = object(payload);
+    const call = object(value["toolCall"]);
+    const input = tool === "antigravity" ? object(call["args"]) : object(value["tool_input"]);
+    const name = tool === "antigravity" ? call["name"] : value["tool_name"];
+    const shellNames = {
+      codex: ["Bash", "exec_command", "shell", "shell_command"],
+      gemini: ["run_shell_command"],
+      antigravity: ["run_command"]
+    };
+    if (typeof name !== "string") {
+      return denied();
+    }
+    if (!shellNames[tool].includes(name)) {
+      return { decision: "allow" };
+    }
+    const command = scalar(
+      input[tool === "antigravity" ? "CommandLine" : "command"]
+    );
+    if (command === void 0 || command.length > 65536) {
+      return denied();
+    }
+    const cwd = scalar(input["Cwd"]) ?? scalar(value["cwd"]) ?? root;
+    const args = [...policy.command];
+    const script = guardPath(root, args);
+    if (args[0]?.startsWith(".agents/guards/")) {
+      args[0] = script;
+    } else {
+      args[1] = script;
+    }
+    const executable = args.shift();
+    if (!executable) {
+      return denied();
+    }
+    const result = spawnSync(executable, args, {
+      cwd: root,
+      env: { PATH: process.env["PATH"], LANG: "C.UTF-8" },
+      input: JSON.stringify({
+        runtime: tool,
+        event: "before_shell",
+        command,
+        cwd
+      }),
+      encoding: "utf8",
+      timeout: policy.timeoutMs,
+      killSignal: "SIGKILL",
+      maxBuffer: 65536
+    });
+    if (result.status !== 0 || result.error) {
+      return denied();
+    }
+    const response = object(JSON.parse(result.stdout));
+    if (Object.keys(response).some(
+      (key) => !["decision", "reason"].includes(key)
+    ) || !["allow", "deny"].includes(String(response["decision"])) || response["reason"] !== void 0 && typeof response["reason"] !== "string") {
+      return denied();
+    }
+    return {
+      decision: response["decision"],
+      ...typeof response["reason"] === "string" ? { reason: response["reason"].slice(0, 2e3) } : {}
+    };
+  } catch {
+    return denied();
+  }
+}
+function nativeHookDecision(tool, decision) {
+  if (tool === "codex") {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: decision.decision,
+        ...decision.reason ? { permissionDecisionReason: decision.reason } : {}
+      }
+    };
+  }
+  return decision;
+}
+async function main() {
+  const [, , , tool, file, integrity] = process.argv;
+  const supported = tool === "codex" || tool === "gemini" || tool === "antigravity";
+  if (!supported) {
+    process.exitCode = 2;
+    return;
+  }
+  let decision = denied();
+  try {
+    if (!file) {
+      throw new Error("Missing hook policy");
+    }
+    const bytes = readFileSync(file);
+    const adapter = readFileSync(process.argv[1]);
+    const actual = createHash("sha256").update(adapter).update(bytes).digest("hex");
+    if (actual !== integrity) {
+      throw new Error("Hook integrity mismatch");
+    }
+    const policy = JSON.parse(bytes.toString("utf8"));
+    if (!policy.targets.includes(tool)) {
+      throw new Error("Hook target mismatch");
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+      const bytes2 = Buffer.from(chunk);
+      size += bytes2.length;
+      if (size > 131072) {
+        throw new Error("Hook input too large");
+      }
+      chunks.push(bytes2);
+    }
+    const root = resolve(dirname(file), "../..");
+    const guardSha256 = createHash("sha256").update(readFileSync(guardPath(root, policy.command))).digest("hex");
+    if (policy.contractVersion !== 1 || guardSha256 !== policy.guardSha256) {
+      throw new Error(
+        "Hook guard source changed; reproject and review native trust"
+      );
+    }
+    decision = evaluateShellHook(
+      root,
+      policy,
+      tool,
+      JSON.parse(Buffer.concat(chunks).toString("utf8"))
+    );
+  } catch {
+    decision = denied();
+  }
+  process.stdout.write(
+    `${JSON.stringify(nativeHookDecision(tool, decision))}
+`
+  );
+}
+if (process.argv[2] === "--pmcp-shell-hook") {
+  await main();
+}
+export {
+  evaluateShellHook,
+  guardPath,
+  nativeHookDecision
+};
+//# sourceMappingURL=hook-adapter.js.map