@mutmutco/kilo-plugin 3.79.0

package/server.mjs

@@ -0,0 +1,237 @@
+// Kilo Code plugin module (kilo-p1). Loaded in-process by the Kilo plugin host.
+//
+// The shared gate scripts read a Claude/Kimi snake_case stdin payload (`tool_name`, `tool_input`,
+// `tool_response`) and never grew a second vocabulary — the Codex and Kimi launchers already established
+// that translation lives in a thin per-host shell, not in the gates. server.mjs is that shell for Kilo:
+// every hook translates the Kilo camelCase hook input into the snake_case shape and replays it through
+// scripts/hook-run.mjs, the same named-policy launcher every active host uses. The launcher stamps
+// MMI_HOOK_SURFACE=kilo (which also engages the shared redactor's rewrite channel) and owns the
+// fail-closed fallback for crashed deny gates.
+//
+// Kilo's contract differences, all confirmed on a real host (see plans/2026-07-31-kilo-code-plugin-port.md):
+//   - blocking a tool = throwing from `tool.execute.before`
+//   - rewriting output = mutating `output.output` in `tool.execute.after`, and `output.text` in
+//     `experimental.text.complete` — a WORKING redactor, unlike Codex/Kimi
+//   - tool names are lowercase (`bash`, `write`, `edit`, `patch`, `glob`, `grep`, `read`) and the bash
+//     args carry `command`, the write args carry `filePath`
+//   - npm lifecycle scripts are disabled, so first-run provisioning lives here, is idempotent and
+//     version-stamped, and NEVER throws (a broken provision reports, it does not brick the session)
+//   - the package ships NO command wrappers: Kilo lists skills in the `/` picker natively, so a
+//     same-named command would duplicate the skill (kilo-p1 user feedback on /mmi)
+
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_JSON = JSON.parse(readFileSync(join(HERE, 'package.json'), 'utf8'));
+const VERSION = typeof PACKAGE_JSON.version === 'string' ? PACKAGE_JSON.version : '0.0.0';
+const KILO_HOME_DIR = join(homedir(), '.kilo');
+const VERSION_STAMP = join(KILO_HOME_DIR, '.mmi-kilo-version');
+const LAUNCHER = join(HERE, 'scripts', 'hook-run.mjs');
+const SPAWN_TIMEOUT_MS = 30_000;
+
+/** The Kilo host runs plugins in-process under a Bun-compiled binary, so `process.execPath` is the kilo
+ *  binary, NOT node. The launcher must run under real Node — that is what the shared gate scripts are. */
+export function nodeBin() {
+  const base = String(process.execPath).replace(/\\/g, '/').split('/').pop()?.toLowerCase() ?? '';
+  if (base === 'node' || base === 'node.exe') return process.execPath;
+  return 'node';
+}
+
+// Kilo tool names → the Claude vocabulary the shared gates already understand.
+const SHELL_TOOLS = new Set(['bash', 'shell', 'powershell']);
+const EDIT_TOOLS = new Set(['write', 'edit', 'patch', 'apply_patch']);
+const REDACT_TOOL_NAME = {
+  bash: 'Bash', shell: 'Bash', powershell: 'Bash',
+  write: 'Write', edit: 'Write', patch: 'Write', apply_patch: 'apply_patch',
+  read: 'Read', grep: 'Grep', glob: 'Glob',
+};
+
+/** Idempotent first-run provisioning of the non-plugin payload (~/.kilo/{skills,command,agent}) behind
+ *  the version stamp. Never throws: a broken provision reports and lets the session proceed. */
+export function provisionKiloPayload(root = HERE, version = VERSION) {
+  try {
+    const stamp = VERSION_STAMP;
+    if (existsSync(stamp) && readFileSync(stamp, 'utf8') === version) {
+      return { provisioned: false, detail: `MMI Kilo payload current (${version})` };
+    }
+    const skillsSource = join(root, 'skills');
+    if (existsSync(skillsSource)) {
+      for (const entry of readdirSync(skillsSource, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('_')) continue;
+        cpSync(join(skillsSource, entry.name), join(KILO_HOME_DIR, 'skills', entry.name), {
+          recursive: true,
+        });
+      }
+    }
+    // Kilo lists skills in the `/` picker natively, so the package ships NO command wrappers — a
+    // same-named command would duplicate the skill in the picker (kilo-p1 user feedback). Only the
+    // agent payload is copied; an empty/absent source dir is left alone (and a stale provisioned
+    // command from an older install is NOT resurrected).
+    for (const from of [join(root, 'agent')]) {
+      if (!existsSync(from)) continue;
+      const files = readdirSync(from);
+      if (files.length === 0) continue;
+      const to = join(KILO_HOME_DIR, 'agent');
+      mkdirSync(to, { recursive: true });
+      for (const file of files) {
+        cpSync(join(from, file), join(to, file), { recursive: true });
+      }
+    }
+    mkdirSync(KILO_HOME_DIR, { recursive: true });
+    writeFileSync(stamp, version, 'utf8');
+    return { provisioned: true, detail: `provisioned MMI Kilo payload ${version} into ~/.kilo` };
+  } catch (err) {
+    return { provisioned: false, detail: `MMI Kilo provisioning failed: ${err && err.message}` };
+  }
+}
+
+function hookPayload(event, input, toolName, toolInput, toolResponse) {
+  const payload = {
+    hook_event_name: event,
+    session_id: typeof input.sessionID === 'string' ? input.sessionID : '',
+    cwd: typeof input.cwd === 'string' && input.cwd ? input.cwd : process.cwd(),
+  };
+  if (toolName !== undefined) payload.tool_name = toolName;
+  if (toolInput !== undefined) payload.tool_input = toolInput;
+  if (toolResponse !== undefined) payload.tool_response = toolResponse;
+  return payload;
+}
+
+/** Run one named shared-policy gate with a buffered snake_case payload. Returns the deny
+ *  decision parsed from the launcher's stdout envelope (exit 2 is the shared block signal too), plus the
+ *  raw stdout so redaction hooks can read the rewrite. */
+export function runGate(gate, payload) {
+  const args = ['--surface', 'kilo', '--gate', gate];
+  let result;
+  try {
+    result = spawnSync(nodeBin(), [LAUNCHER, ...args], {
+      input: JSON.stringify(payload),
+      encoding: 'utf8',
+      timeout: SPAWN_TIMEOUT_MS,
+      // The Kilo host is a GUI process (VS Code extension) with no console; without this flag every
+      // gate spawn flashes a headed terminal window on Windows. The shared runner hides its child too.
+      windowsHide: true,
+    });
+  } catch (err) {
+    return { denied: false, reason: '', stdout: '', error: String(err && err.message) };
+  }
+  const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+  const denyLine = stdout.split(/\r?\n/).find((line) => line.trim().startsWith('{'));
+  if (denyLine) {
+    try {
+      const decision = JSON.parse(denyLine).hookSpecificOutput;
+      if (decision?.permissionDecision === 'deny') {
+        return { denied: true, reason: decision.permissionDecisionReason || `${gate} denied the tool call`, stdout };
+      }
+    } catch {
+      // malformed envelope — treat as no decision, fall through to the exit-code signal
+    }
+  }
+  if (result.status === 2) {
+    return { denied: true, reason: `${gate} exited 2 (deny)`, stdout };
+  }
+  return { denied: false, reason: '', stdout, error: result.error ? String(result.error) : '' };
+}
+
+function denyError(gate, reason) {
+  return new Error(`MMI ${gate} deny: ${reason}`);
+}
+
+function bashToolInput(args) {
+  const command = typeof args?.command === 'string' ? args.command : '';
+  return { command };
+}
+
+function editToolInput(args) {
+  const filePath = typeof args?.filePath === 'string' ? args.filePath : '';
+  const input = {};
+  if (filePath) {
+    input.file_path = filePath;
+    input.path = filePath;
+  }
+  if (typeof args?.command === 'string' && args.command) input.command = args.command;
+  if (typeof args?.patch === 'string' && args.patch) input.patch = args.patch;
+  if (typeof args?.content === 'string') input.content = args.content;
+  return input;
+}
+
+/** The redactor's stdout is `{"hookSpecificOutput":{"updatedToolOutput": <redacted>}}` when it changed
+ *  something, and nothing when clean. Returns the rewrite, or undefined when there is none. */
+function readRedactorRewrite(stdout) {
+  const line = String(stdout ?? '').split(/\r?\n/).find((l) => l.trim().startsWith('{'));
+  if (!line) return undefined;
+  try {
+    const updated = JSON.parse(line).hookSpecificOutput?.updatedToolOutput;
+    return typeof updated === 'string' || updated !== undefined ? updated : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export default {
+  id: 'mmi',
+  server: async () => {
+    const provisioned = provisionKiloPayload();
+    return {
+      // Stamps the session env so every gate this session spawns inherits the real surface, the real
+      // session key (deny-gate-crash breaker), and the real project cwd (activity trace placement).
+      'shell.env': async (input, output) => {
+        output.env = {
+          ...output.env,
+          MMI_HOOK_SURFACE: 'kilo',
+          KILO_PLUGIN_ROOT: HERE,
+          ...(typeof input.sessionID === 'string' && input.sessionID
+            ? { MMI_GATE_SESSION_ID: input.sessionID }
+            : {}),
+          ...(typeof input.cwd === 'string' && input.cwd ? { MMI_HOOK_ACTIVITY_CWD: input.cwd } : {}),
+        };
+      },
+      // PreToolUse equivalent: run the shared shell + vault deny gates; throwing blocks the tool.
+      'tool.execute.before': async (input, output) => {
+        const tool = typeof input.tool === 'string' ? input.tool : '';
+        const args = output.args ?? {};
+        if (SHELL_TOOLS.has(tool)) {
+          const payload = hookPayload('PreToolUse', input, 'Bash', bashToolInput(args));
+          const decision = runGate('command-ladder', payload);
+          if (decision.denied) throw denyError('command-ladder', decision.reason);
+          return;
+        }
+        if (EDIT_TOOLS.has(tool)) {
+          const payload = hookPayload('PreToolUse', input, 'Write', editToolInput(args));
+          const decision = runGate('vault-edit', payload);
+          if (decision.denied) throw denyError('vault-edit', decision.reason);
+        }
+      },
+      // PostToolUse equivalent with a WORKING rewrite channel: secret-redact.mjs's updatedToolOutput is
+      // applied to output.output. Write/Read/WebFetch are not rewriteable (same harness limit as Claude).
+      'tool.execute.after': async (input, output) => {
+        const tool = typeof input.tool === 'string' ? input.tool : '';
+        const translated = REDACT_TOOL_NAME[tool];
+        if (!translated) return;
+        const payload = hookPayload('PostToolUse', input, translated, input.args, output.output ?? '');
+        const gate = runGate('secret-output', payload);
+        const rewrite = readRedactorRewrite(gate.stdout);
+        if (rewrite !== undefined) output.output = rewrite;
+      },
+      // Final-text redaction: the same redactor, run against the completed text part.
+      'experimental.text.complete': async (input, output) => {
+        const text = typeof output.text === 'string' ? output.text : '';
+        if (!text) return;
+        const payload = hookPayload('PostToolUse', input, 'Bash', undefined, text);
+        const gate = runGate('secret-output', payload);
+        const rewrite = readRedactorRewrite(gate.stdout);
+        if (rewrite !== undefined) output.text = rewrite;
+      },
+      // A failed provision must be audible but never fatal.
+      dispose: async () => {
+        if (!provisioned.provisioned && provisioned.detail.startsWith('MMI Kilo provisioning failed')) {
+          process.stderr.write(`${provisioned.detail}\n`);
+        }
+      },
+    };
+  },
+};