@mutmutco/cursor-plugin 4.2.7 → 4.3.1

package/scripts/env-write-lint.mjs

@@ -1,146 +0,0 @@
-// No-env floor, shell surface (#2663): deny Bash/PowerShell/shell commands that CREATE a real .env file.
-// #3563 adds the patch form: Codex accepts `apply_patch <<'EOF' … EOF` through its SHELL tools, which the
-// Edit|Write|apply_patch matcher never sees, so patch bodies are read here too.
-// The Edit/Write vault-edit-gate already blocks hand-writing a .env through the file tools; this closes the
-// shell bypass — `cp .env.example .env`, `echo ... > .env`, `tee .env`, `Out-File .env`, etc. Reads
-// (`cat .env`, `source .env`, `< .env`), deletes (`rm .env`), and the allowed template names
-// (`.env.example`, `*.template`) are NOT blocked. Pure detection — exported for tests, no IO here.
-
-import { applyPatchWriteTargets, invokesApplyPatch } from './edit-tool-paths.mjs';
-
-const DENY_REASON =
-  'No .env — the org is env-free. This command creates a .env file; don\'t. Deliver config vault-native '
-  + '(`mmi-cli stage` injects secrets into the process env; `mmi-cli vault secrets` manages names). If something '
-  + 'genuinely cannot proceed without a .env, STOP and consult the board (file an issue) — do not create it.';
-
-/** True for a token that names a REAL .env file (`.env` or `.env.<suffix>`), excluding the allowed template
- *  names (`.env.example`, anything ending `.example`, anything containing `.template`). Strips surrounding
- *  quotes and any directory prefix. */
-export function isRealEnvToken(token) {
-  if (!token || typeof token !== 'string') return false;
-  const unquoted = token.replace(/^['"]/, '').replace(/['"]$/, '');
-  const base = unquoted.replace(/\\/g, '/').split('/').pop() ?? '';
-  // Win32 strips trailing dots and spaces from the final path component, so `.env.` and `.env ` both
-  // CREATE `.env` — through any writer that goes via Win32 path normalisation, which includes Rust's
-  // std::fs, the writer behind Codex's apply_patch. Node/libuv uses verbatim paths and is the exception,
-  // which is why this never showed up from a Node probe (cross-vendor check, kimi-k3).
-  const b = base.replace(/[. ]+$/, '').toLowerCase() || base.toLowerCase();
-  if (!/^\.env(\.[^/]+)?$/.test(b)) return false;
-  if (b === '.env.example' || b.endsWith('.example') || b.includes('.template')) return false;
-  return true;
-}
-
-// A path-ish token: no shell metacharacters. Used to pull redirect/cmdlet targets out of a command.
-const PATH_TOKEN = "(['\"]?[^\\s'\"|;&<>()]+['\"]?)";
-
-// Redirection to a target: >, >>, 1>, 2>, &>, >| — the classic `echo x > .env` / `cat > .env` create.
-const REDIRECT_RE = new RegExp(`(?:\\d?>>?\\|?|&>)\\s*${PATH_TOKEN}`, 'g');
-// tee / Tee-Object (with any flags) writing a file.
-const TEE_RE = new RegExp(`\\b(?:tee|Tee-Object)\\b(?:\\s+-{1,2}\\S+)*\\s+${PATH_TOKEN}`, 'gi');
-// PowerShell content writers targeting a file (positional or -Path/-FilePath/-LiteralPath).
-const PS_WRITE_RE = new RegExp(
-  `\\b(?:Out-File|Set-Content|Add-Content|New-Item)\\b[^|;&]*?(?:-(?:Path|FilePath|LiteralPath)\\s+)?${PATH_TOKEN}`,
-  'gi',
-);
-// Copy/move/link verbs — the destination is (conventionally) the LAST path token; block when it is a real .env.
-// `copy`/`move` are the cmd.exe spellings AND the default PowerShell aliases for Copy-Item/Move-Item, so
-// `copy .env.example .env` reached disk past every analyzer (pre-existing since #2663; found by the #3563
-// cross-vendor check, openai-sol). `xcopy`/`robocopy` are the other two Windows spellings.
-
-// #5820: segment separators include NEWLINES. Without them a multi-line script — a heredoc body, an
-// SSH `bash -s` payload — collapses into ONE segment, and the copy/git/touch scans below then pair a
-// verb on one line with "the last path token in the segment" from an unrelated line further down:
-// `cp a b` on line 1 plus a later line ending in an env-shaped token was denied as env_write_copy,
-// neither line a write (found applying the documented jerv-central procedure, runbooks/box-ops.md).
-// Adding \r\n strictly TIGHTENS the scans — every real create form still matches on its own line.
-const SEGMENT_RE = /(?:\|\||&&|[;&|\r\n])/;
-
-const COPY_VERBS = /^(?:cp|mv|install|ln|rsync|copy|move|xcopy|robocopy|Copy-Item|Move-Item)$/i;
-
-/** Inspect one command for a real-.env CREATE. Returns { block, reason, reasonId } or null (clean). */
-export function analyze({ toolName, command } = {}) {
-  void toolName;
-  if (!command || typeof command !== 'string') return null;
-
-  // #3563: a patch can arrive through the SHELL, not just the `apply_patch` tool — Codex accepts
-  // `apply_patch <<'EOF' … EOF` and `bash -lc "apply_patch <<'EOF' …"` via its shell tools. Those calls
-  // carry `tool_name: "shell"`, so the Edit|Write|apply_patch matcher never fires the vault gate, and the
-  // shell lints below see no redirect, tee or copy to catch. Same matcher-vs-payload gap as the tool
-  // form, one door over (cross-vendor check, kimi-k3), so the shell gate reads patch bodies too.
-  //
-  // Two precision rules, both from a false deny: the command must actually INVOKE `apply_patch` (patch
-  // text inside a `cat` heredoc writes nothing), and only WRITE targets count (a `*** Delete File: .env`
-  // removes a .env, which this floor has never blocked).
-  if (invokesApplyPatch(command)) {
-    for (const target of applyPatchWriteTargets(command)) {
-      if (isRealEnvToken(target)) return deny('env_write_apply_patch');
-    }
-  }
-
-  for (const m of command.matchAll(REDIRECT_RE)) {
-    if (isRealEnvToken(m[1])) return deny('env_write_redirect');
-  }
-  for (const m of command.matchAll(TEE_RE)) {
-    if (isRealEnvToken(m[1])) return deny('env_write_tee');
-  }
-  for (const m of command.matchAll(PS_WRITE_RE)) {
-    if (isRealEnvToken(m[1])) return deny('env_write_ps');
-  }
-
-  // Copy/move/link: only the DESTINATION (last path token in the segment) creating a real .env is a write —
-  // `cat .env` (read) stays allowed. A COPY of a .env is itself a .env-shaped secret file, so
-  // `cp .env .env.bak` is blocked too; an earlier version of this comment promised otherwise and the code
-  // never did (cross-vendor check, openai-sol). Under "no .env ever" the code is right.
-  //
-  // The verb is found ANYWHERE in the segment, not only at token 0: `cmd /c copy …`, `sudo cp …` and
-  // `bash -lc "cp …"` all put a wrapper first. And the destination is not always last — PowerShell takes
-  // `-Destination`, and `cp <file> <dir>/` names the directory while the basename comes from the source
-  // (all four ALLOWED before this; cross-vendor check, openai-sol).
-  for (const raw of command.split(SEGMENT_RE)) {
-    const seg = raw.trim();
-    if (!seg) continue;
-    const tokens = seg.split(/\s+/).filter(Boolean);
-    const verbAt = tokens.findIndex((t) => COPY_VERBS.test(t.replace(/\\/g, '/').split('/').pop() ?? ''));
-    if (verbAt === -1) continue;
-    const after = tokens.slice(verbAt + 1);
-    // Named destination wins when present (`Copy-Item -Destination .env -Path x` puts it first).
-    const namedAt = after.findIndex((t) => /^-(?:Destination|dest)$/i.test(t));
-    if (namedAt !== -1 && isRealEnvToken(after[namedAt + 1])) return deny('env_write_copy');
-    const paths = after.filter((t) => !t.startsWith('-'));
-    if (isRealEnvToken(paths[paths.length - 1])) return deny('env_write_copy');
-    // `cp .env dir/` lands `dir/.env`: a directory destination takes the SOURCE's basename.
-    const dest = paths[paths.length - 1];
-    if (paths.length > 1 && dest && /[\\/]$/.test(dest) && paths.slice(0, -1).some((p) => isRealEnvToken(p))) {
-      return deny('env_write_copy');
-    }
-  }
-
-  // `git checkout <ref> -- <path>` / `git restore --source <ref> <path>` materialise a file from history.
-  for (const raw of command.split(SEGMENT_RE)) {
-    const tokens = raw.trim().split(/\s+/).filter(Boolean);
-    const gitAt = tokens.findIndex((t) => (t.replace(/\\/g, '/').split('/').pop() ?? '') === 'git');
-    if (gitAt === -1 || !/^(?:checkout|restore)$/i.test(tokens[gitAt + 1] ?? '')) continue;
-    if (tokens.slice(gitAt + 2).some((t) => isRealEnvToken(t))) return deny('env_write_git_restore');
-  }
-
-  // touch: any non-flag arg that is a real .env token creates the file.
-  for (const raw of command.split(SEGMENT_RE)) {
-    const seg = raw.trim();
-    if (!seg) continue;
-    const tokens = seg.split(/\s+/).filter(Boolean);
-    if (!tokens.length || tokens[0].toLowerCase() !== 'touch') continue;
-    const paths = tokens.slice(1).filter((t) => !t.startsWith('-'));
-    if (paths.some((p) => isRealEnvToken(p))) return deny('env_write_touch');
-  }
-
-  // dd of=<path>: block when the of= target is a real .env token.
-  for (const m of command.matchAll(/\bdd\b[^|;&]*?\bof=(['"]?[^\s'"|;&]+['"]?)/gi)) {
-    if (isRealEnvToken(m[1])) return deny('env_write_dd');
-  }
-
-  return null;
-}
-
-function deny(reasonId) {
-  return { block: true, reason: DENY_REASON, reasonId };
-}

package/scripts/hook-io.mjs

@@ -1,22 +0,0 @@
-// Shared stdin reader for Claude Code hook scripts (#1668).
-// Each hook script receives a JSON payload on stdin. This helper reads it and
-// returns the parsed object. Throws on any read or parse error so callers can
-// catch and exit 0 (hooks must never crash a turn).
-import { createInterface } from 'node:readline';
-
-/**
- * Read all stdin lines and JSON-parse them.
- * #4118: the shared runner now runs a gate IN-PROCESS and has already drained stdin, so it passes the
- * buffered payload in. Parsing it here keeps ONE contract — same throw on unreadable input, so every
- * gate's fail-open/fail-closed branch is reached identically whether it was spawned or imported.
- * @param {Buffer|string} [buffered] Payload already read by the caller; stdin is read when absent.
- * @returns {Promise<unknown>} Parsed JSON payload.
- * @throws {Error} On readline or JSON parse failure.
- */
-export async function readHookInput(buffered) {
-  if (buffered !== undefined) return JSON.parse(Buffer.isBuffer(buffered) ? buffered.toString('utf8') : String(buffered));
-  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
-  const lines = [];
-  for await (const line of rl) lines.push(line);
-  return JSON.parse(lines.join('\n'));
-}

package/scripts/hook-policy.mjs

@@ -1,78 +0,0 @@
-// Canonical MMI hook policy. Host adapters select a named gate; they do not choose scripts,
-// failure posture, timeouts, or response semantics themselves.
-
-export const HOOK_POLICY_VERSION = 2;
-
-export const HOOK_GATES = Object.freeze({
-  'command-ladder': Object.freeze({
-    event: 'PreToolUse',
-    script: 'pretooluse-shell-gates.mjs',
-    failure: 'closed',
-    fallbackGate: 'command-ladder',
-    timeoutMs: 10_000,
-  }),
-  'vault-edit': Object.freeze({
-    event: 'PreToolUse',
-    script: 'vault-edit-gate.mjs',
-    failure: 'closed',
-    fallbackGate: 'vault-edit',
-    timeoutMs: 5_000,
-  }),
-});
-
-export const HOOK_SURFACES = Object.freeze({
-  claude: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['CLAUDE_PLUGIN_ROOT', 'PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  codex: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['PLUGIN_ROOT', 'CLAUDE_PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  kimi: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['KIMI_PLUGIN_ROOT', 'PLUGIN_ROOT', 'CLAUDE_PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  cursor: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze([]),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  kilo: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['KILO_PLUGIN_ROOT', 'PLUGIN_ROOT', 'CLAUDE_PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  jervcode: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['PI_PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-  hermes: Object.freeze({
-    lifecycle: 'active',
-    rootEnv: Object.freeze(['HERMES_PLUGIN_ROOT']),
-    postToolOutput: 'unsupported',
-    finalOutput: 'unsupported',
-  }),
-});
-
-export function hookGate(id) {
-  const gate = HOOK_GATES[id];
-  if (!gate) throw new Error(`unknown MMI hook gate: ${id || '(empty)'}`);
-  return gate;
-}
-
-export function hookSurface(token) {
-  const surface = HOOK_SURFACES[token];
-  if (!surface) throw new Error(`unknown MMI hook surface: ${token || '(empty)'}`);
-  return surface;
-}