@mutmutco/kilo-plugin 3.79.0

package/scripts/hook-run.mjs

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+// Shared hook process core. Every active host calls this runner with only its surface token and a
+// policy gate id. Host-specific event/tool matching stays in the adapter; policy and failure behavior
+// stay here.
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { hookGate, hookSurface } from './hook-policy.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export function parseHookArgv(argv) {
+  const parsed = { surface: '', gate: '' };
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === '--surface') parsed.surface = argv[++index] ?? '';
+    else if (argv[index] === '--gate') parsed.gate = argv[++index] ?? '';
+  }
+  return parsed;
+}
+
+export function pluginRoot(surfaceToken, env = process.env, here = HERE) {
+  const surface = hookSurface(surfaceToken);
+  for (const name of surface.rootEnv) {
+    const candidate = env[name];
+    if (candidate && existsSync(join(candidate, 'scripts', 'hook-policy.mjs'))) return resolve(candidate);
+  }
+  return resolve(here, '..');
+}
+
+export function payloadMeta(input) {
+  try {
+    const payload = JSON.parse(Buffer.from(input).toString('utf8'));
+    return {
+      sessionId: typeof payload?.session_id === 'string' ? payload.session_id : '',
+      cwd: typeof payload?.cwd === 'string' ? payload.cwd : '',
+    };
+  } catch {
+    return { sessionId: '', cwd: '' };
+  }
+}
+
+function normalizeInput(surface, gate, input) {
+  if (surface !== 'cursor') return input;
+  try {
+    const payload = JSON.parse(Buffer.from(input).toString('utf8'));
+    if (!payload || typeof payload !== 'object') return input;
+    if (payload.tool_name === 'Shell') {
+      payload.tool_name = process.platform === 'win32' ? 'PowerShell' : 'Bash';
+    }
+    if (!payload.session_id && typeof payload.conversation_id === 'string') {
+      payload.session_id = payload.conversation_id;
+    }
+    if (gate === 'secret-output' && payload.tool_response == null && payload.tool_output != null) {
+      payload.tool_response = payload.tool_output;
+    }
+    return Buffer.from(JSON.stringify(payload));
+  } catch {
+    return input;
+  }
+}
+
+function adaptOutput(surface, stdout) {
+  if (surface !== 'cursor' || !stdout.trim()) return stdout;
+  try {
+    const payload = JSON.parse(stdout);
+    const decision = payload?.hookSpecificOutput;
+    if (decision?.permissionDecision !== 'deny') return '';
+    const reason = decision.permissionDecisionReason || 'MMI policy denied this tool call.';
+    return `${JSON.stringify({ permission: 'deny', user_message: reason, agent_message: reason })}\n`;
+  } catch {
+    return stdout;
+  }
+}
+
+function childEnv(surface, input, env) {
+  const meta = payloadMeta(input);
+  return {
+    ...env,
+    MMI_HOOK_SURFACE: surface,
+    ...(meta.sessionId && !env.MMI_GATE_SESSION_ID ? { MMI_GATE_SESSION_ID: meta.sessionId } : {}),
+    ...(meta.cwd && !env.MMI_HOOK_ACTIVITY_CWD ? { MMI_HOOK_ACTIVITY_CWD: meta.cwd } : {}),
+  };
+}
+
+function inlineDeny(surface, gate, root) {
+  return `${JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: `MMI ${gate} gate could not run on ${surface} and its fail-closed fallback is missing from the plugin install at ${root}. Reinstall the MMI plugin, or set MMI_GATES_FAIL_OPEN=1 to proceed unguarded.`,
+    },
+  })}\n`;
+}
+
+function invoke(target, args, input, env, timeoutMs) {
+  const result = spawnSync(process.execPath, [target, ...args], {
+    input,
+    encoding: 'utf8',
+    env,
+    timeout: timeoutMs,
+    windowsHide: true,
+  });
+  return {
+    status: result.status ?? 1,
+    stdout: typeof result.stdout === 'string' ? result.stdout : '',
+    stderr: typeof result.stderr === 'string' ? result.stderr : '',
+    error: result.error,
+  };
+}
+
+export function runPolicyGate({ surface, gate: gateId, input = Buffer.alloc(0), env = process.env, here = HERE }) {
+  const gate = hookGate(gateId);
+  hookSurface(surface);
+  const root = pluginRoot(surface, env, here);
+  const target = join(root, 'scripts', gate.script);
+  const normalizedInput = normalizeInput(surface, gateId, input);
+  const effectiveEnv = childEnv(surface, normalizedInput, env);
+  let result;
+
+  if (!existsSync(target)) {
+    result = { status: 1, stdout: '', stderr: `[mmi-${surface}-hook] ${gate.script} not found under ${root}\n` };
+  } else {
+    result = invoke(target, [], normalizedInput, effectiveEnv, gate.timeoutMs);
+    if (result.status === 0 || result.status === 2) {
+      return { ...result, stdout: adaptOutput(surface, result.stdout) };
+    }
+    result.stderr += `[mmi-${surface}-hook] ${gate.script} exited ${result.status}\n`;
+  }
+
+  if (gate.failure === 'open') return { ...result, status: 0 };
+
+  const crashGate = join(root, 'scripts', 'deny-gate-crash.mjs');
+  if (!existsSync(crashGate)) {
+    return { status: 0, stdout: inlineDeny(surface, gate.fallbackGate, root), stderr: result.stderr };
+  }
+  const fallback = invoke(crashGate, [gate.fallbackGate], normalizedInput, effectiveEnv, gate.timeoutMs);
+  return {
+    ...fallback,
+    stdout: adaptOutput(surface, fallback.stdout),
+    stderr: `${result.stderr}${fallback.stderr}`,
+  };
+}
+
+function readStdin() {
+  try {
+    return readFileSync(0);
+  } catch {
+    return Buffer.alloc(0);
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const { surface, gate } = parseHookArgv(argv);
+  let result;
+  try {
+    result = runPolicyGate({ surface, gate, input: readStdin() });
+  } catch (error) {
+    process.stderr.write(`[mmi-hook] ${error.message}\n`);
+    process.exit(1);
+  }
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exit(result.status);
+}
+
+// Codex may import this file from a replacement cache while process.argv[1] still names the deleted
+// cache path captured when the session loaded. Match the stable relative suffix, not URL identity.
+if (process.argv[1] && process.argv[1].replace(/\\/g, '/').endsWith('scripts/hook-run.mjs')) main();

package/scripts/hook-trace.mjs

@@ -0,0 +1,108 @@
+// Uniform greppable hook-activity log (#2599). Every hook invocation appends ONE line so a
+// user/agent can see "what just ran" (ran / healed X / denied Y / failed Z) and a recurring silent
+// failure is grep-discoverable. This generalizes the per-hook trace pattern that lived only in
+// shell-redirect-lint.mjs into one shared mechanism every hook reuses (epic #2589 transparency lane).
+//
+// Format: one JSONL line per invocation with stable keys —
+//   { "ts","surface","event","script","outcome","action", ... }
+// outcome vocabulary: "ran" (pass-through) | "deny" (blocked) | "heal" (transformed output) |
+//   "observe" (would-block, observe mode) | "bypass" (escape hatch used) | "failed" (hook errored).
+//
+// Path: repo-local gitignored state (.git/mmi-runtime/hooks/activity.jsonl — never tracked); falls
+// back to a per-cwd tmpdir path outside a repo so the trace still works anywhere. Fail-soft always:
+// the trace must never crash a turn or block a tool call.
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const DEFAULT_SURFACE = 'claude';
+
+// #3642: four hooks append on every tool call and nothing ever pruned, so the trace reached 17 MB on
+// the Hub checkout — in `.git/`, so invisible to `git status` and to every worktree/scratch sweep.
+// Trim on append: past MAX_BYTES, keep the last KEEP_BYTES. KEEP sits above the 512 KB tail the
+// doctor's redactor-liveness probe reads (cli/src/hook-activity.ts), so trimming never shortens the
+// window a reader sees. MAX is high enough that the read-rewrite happens once every few weeks.
+// The CLI mirror in cli/src/hook-activity.ts deliberately has no copy of this: with the SessionStart
+// hook retired (#3630) it writes at most a row a session, and the bound is a property of the FILE —
+// whoever appends next enforces it, and that is effectively always this writer.
+const MAX_BYTES = 4 * 1024 * 1024;
+const KEEP_BYTES = 1024 * 1024;
+
+/**
+ * Drop the oldest rows once the log passes MAX_BYTES, keeping the last KEEP_BYTES from the first
+ * line boundary (a byte-slice would leave a torn row at the head). Fail-soft: a trim that cannot
+ * run leaves the log as it is rather than losing the append behind it.
+ *
+ * @param {string} path
+ * @returns {void}
+ */
+function trimIfOversized(path) {
+  try {
+    if (statSync(path).size <= MAX_BYTES) return;
+    const tail = readFileSync(path, 'utf8').slice(-KEEP_BYTES);
+    const firstBreak = tail.indexOf('\n');
+    writeFileSync(path, firstBreak === -1 ? '' : tail.slice(firstBreak + 1), 'utf8');
+  } catch {
+    /* no log yet, or an unreadable one — the append below is still worth attempting */
+  }
+}
+
+function fallbackPath(cwd) {
+  const hash = createHash('sha256').update(resolve(cwd)).digest('hex').slice(0, 16);
+  return join(tmpdir(), 'mmi-cli', hash, 'hooks', 'activity.jsonl');
+}
+
+/**
+ * Resolve the hook-activity log path for a working directory.
+ * Prefers the repo-local gitignored state dir (`.git/mmi-runtime/hooks/activity.jsonl` via
+ * `git rev-parse --git-path`); falls back to a per-cwd tmpdir path so the trace still works
+ * outside a repo. Env overrides: `MMI_HOOK_ACTIVITY_LOG` (full path, wins outright) and
+ * `MMI_HOOK_ACTIVITY_CWD` (resolve against this directory instead of the hook process's own cwd —
+ * the Kimi launcher stamps it from the hook payload because Kimi runs plugin hooks with cwd = the
+ * plugin root, which is not a repo).
+ *
+ * @param {string} [cwd]
+ * @param {Record<string,string|undefined>} [env]
+ * @returns {string}
+ */
+export function activityLogPath(cwd = process.cwd(), env = process.env) {
+  if (env.MMI_HOOK_ACTIVITY_LOG) return env.MMI_HOOK_ACTIVITY_LOG;
+  const effectiveCwd = env.MMI_HOOK_ACTIVITY_CWD || cwd;
+  try {
+    return execFileSync(
+      'git',
+      ['-C', effectiveCwd, 'rev-parse', '--path-format=absolute', '--git-path', 'mmi-runtime/hooks/activity.jsonl'],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000, windowsHide: true },
+    ).trim();
+  } catch {
+    return fallbackPath(effectiveCwd);
+  }
+}
+
+/**
+ * Append one hook-activity line. Fail-soft: any IO error is swallowed (the trace must never crash a
+ * turn). `ts` is stamped and `surface` defaulted when absent.
+ *
+ * @param {{ surface?: string, event: string, script: string, outcome: string, action?: string, [k: string]: unknown }} entry
+ * @param {{ cwd?: string, env?: Record<string,string|undefined> }} [opts]
+ * @returns {void}
+ */
+export function appendHookActivity(entry, opts = {}) {
+  try {
+    const path = activityLogPath(opts.cwd, opts.env);
+    const line = {
+      ts: new Date().toISOString(),
+      // #3563: the same scripts now run under Codex too, and a Codex deny logged as `surface: "claude"`
+      // sends anyone reading the trace to the wrong manifest. The Codex launcher sets MMI_HOOK_SURFACE.
+      surface: (opts.env ?? process.env).MMI_HOOK_SURFACE || DEFAULT_SURFACE,
+      ...entry,
+    };
+    mkdirSync(dirname(path), { recursive: true });
+    trimIfOversized(path);
+    appendFileSync(path, `${JSON.stringify(line)}\n`, 'utf8');
+  } catch {
+    /* fail-soft — never crash a turn for the trace */
+  }
+}