@newrelic/preflight 0.0.1-pre.1 → 1.0.0

package/dist/hooks/bash-classifier.js

@@ -0,0 +1,409 @@
+/**
+ * Coarse Bash command classifier.
+ *
+ * Bash is polymorphic: every shell invocation arrives as a single opaque
+ * `command` string, which makes downstream metrics blind to the difference
+ * between `git status` and `rm -rf node_modules`. This classifier turns the
+ * command into a small fixed set of categories so trackers, dashboards, and
+ * the audit trail can reason at the right granularity without trying to
+ * fully parse shell.
+ *
+ * Heuristic, not exact: pipelines, env-var prefixes, and `sudo` are stripped;
+ * the leading argv0 of the first command segment is matched against a lookup
+ * table. Anything we don't recognise falls into 'shell-other'.
+ */
+// ---------------------------------------------------------------------------
+// Lookup tables
+// ---------------------------------------------------------------------------
+const GIT_COMMANDS = new Set(['git', 'gh', 'gitk', 'tig']);
+const PACKAGE_MANAGERS = new Set([
+    'npm',
+    'yarn',
+    'pnpm',
+    'bun',
+    'pip',
+    'pip3',
+    'pipx',
+    'poetry',
+    'uv',
+    'cargo',
+    'gem',
+    'bundle',
+    'bundler',
+    'composer',
+    'brew',
+    'apt',
+    'apt-get',
+    'yum',
+    'dnf',
+    'apk',
+]);
+const TEST_RUNNERS = new Set([
+    'jest',
+    'vitest',
+    'mocha',
+    'pytest',
+    'rspec',
+    'phpunit',
+    'tap',
+    'ava',
+    'cypress',
+    'playwright',
+    'karma',
+    'tox',
+    'nose',
+    'nose2',
+    'unittest',
+    'busted',
+    'ginkgo',
+]);
+const BUILD_TOOLS = new Set([
+    'tsc',
+    'webpack',
+    'vite',
+    'rollup',
+    'esbuild',
+    'parcel',
+    'turbo',
+    'nx',
+    'make',
+    'gmake',
+    'cmake',
+    'ninja',
+    'gradle',
+    'gradlew',
+    'mvn',
+    'sbt',
+    'ant',
+    'rake',
+    'meson',
+    'bazel',
+    'buck',
+    'pants',
+    'swc',
+    'babel',
+]);
+const CONTAINER_TOOLS = new Set([
+    'docker',
+    'podman',
+    'docker-compose',
+    'podman-compose',
+    'kubectl',
+    'oc',
+    'helm',
+    'k9s',
+    'kustomize',
+    'kind',
+    'minikube',
+    'skaffold',
+    'buildah',
+    'crictl',
+]);
+const NETWORK_TOOLS = new Set([
+    'curl',
+    'wget',
+    'http',
+    'httpie',
+    'xh',
+    'nc',
+    'ncat',
+    'ssh',
+    'scp',
+    'sftp',
+    'rsync',
+    'ftp',
+    'telnet',
+    'mosh',
+]);
+const FS_OPS = new Set([
+    'ls',
+    'cat',
+    'cp',
+    'mv',
+    'rm',
+    'rmdir',
+    'mkdir',
+    'touch',
+    'find',
+    'chmod',
+    'chown',
+    'chgrp',
+    'tar',
+    'zip',
+    'unzip',
+    'gzip',
+    'gunzip',
+    'bzip2',
+    'xz',
+    'tree',
+    'ln',
+    'stat',
+    'du',
+    'df',
+    'pwd',
+    'realpath',
+    'readlink',
+    'basename',
+    'dirname',
+]);
+const SEARCH_TOOLS = new Set(['grep', 'rg', 'ag', 'ack', 'sed', 'awk', 'fzf']);
+const SCRIPT_INTERPRETERS = new Set([
+    'bash',
+    'sh',
+    'zsh',
+    'ksh',
+    'fish',
+    'dash',
+    'python',
+    'python3',
+    'python2',
+    'node',
+    'deno',
+    'ruby',
+    'perl',
+    'php',
+    'lua',
+    'tsx',
+    'ts-node',
+]);
+// ---------------------------------------------------------------------------
+// Patterns
+// ---------------------------------------------------------------------------
+// Destructive: rm with any recursive flag, force-pushes, hard resets, dd,
+// mkfs, drop/truncate, chmod 777, redirects to raw block devices,
+// pipe-to-shell remote execution.
+//
+// rm-recursive: any flag bundle that includes `r` or `R` (alone, or combined
+// with v / i / f / etc.), or the long-form `--recursive`. We only flag rm
+// when the recursive flag is present — plain `rm foo.txt` is not destructive.
+const DESTRUCTIVE_PATTERNS = [
+    /\brm\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*\b|--recursive\b)/,
+    // git push --force / -f, but NOT --force-with-lease / --force-if-includes
+    // (which are the recommended *safe* forms). Match the force token anywhere
+    // in the invocation, not just immediately after `push`.
+    /\bgit\s+push\b(?=.*\s(?:--force(?!-(?:with-lease|if-includes))\b|-f\b))/i,
+    /\bgit\s+reset\s+--hard\b/i,
+    /\bdd\s+if=/i,
+    /\bmkfs(?:\.\w+)?\b/i,
+    /\bshred\b/i,
+    /\b(?:DROP|TRUNCATE)\s+(?:TABLE|DATABASE|SCHEMA)\b/i,
+    /\bDELETE\s+FROM\b/i,
+    /\bchmod\s+777\b/,
+    />\s*\/dev\/sd[a-z]/,
+    /\b(?:curl|wget)\b.*\|\s*(?:\/[^\s]*\/)?(?:ba|z|k|da|fi|tc|c)?sh\b/i,
+    /\b(?:curl|wget)\b.*\|\s*(?:\/[^\s]*\/)?(?:node|python3?|perl|ruby)\b/i,
+];
+// Replace the contents of single- or double-quoted regions with spaces of
+// the same length so destructive-pattern matching can't be fooled by quoted
+// arguments — e.g. `git commit -m "rm -rf old code"` should NOT classify as
+// destructive. Heuristic: backslash-escapes inside quotes are honoured;
+// dollar-quoted, ANSI-quoted, and heredoc bodies are not handled.
+function maskQuotedRegions(command) {
+    let out = '';
+    let i = 0;
+    while (i < command.length) {
+        const ch = command[i];
+        if (ch === "'") {
+            out += ' ';
+            i++;
+            while (i < command.length && command[i] !== "'") {
+                out += ' ';
+                i++;
+            }
+            if (i < command.length) {
+                out += ' ';
+                i++;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            out += ' ';
+            i++;
+            while (i < command.length && command[i] !== '"') {
+                if (command[i] === '\\' && i + 1 < command.length) {
+                    out += '  ';
+                    i += 2;
+                    continue;
+                }
+                out += ' ';
+                i++;
+            }
+            if (i < command.length) {
+                out += ' ';
+                i++;
+            }
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+// Sudo short flags that take a value (-u nobody, -g wheel, etc.).
+const SUDO_VALUE_SHORT_FLAG = /^-[ughpUtCr]$/;
+// Sudo long flags that take a value when not given as --foo=bar.
+const SUDO_VALUE_LONG_FLAGS = new Set([
+    '--user',
+    '--group',
+    '--host',
+    '--prompt',
+    '--role',
+    '--type',
+    '--other-user',
+    '--close-from',
+]);
+const SEGMENT_SPLIT_RE = /\|\||&&|;|\|/;
+const SCRIPT_EXT_RE = /\.(?:sh|bash|zsh|py|js|mjs|cjs|ts|tsx|rb|pl|php|lua)$/i;
+// ---------------------------------------------------------------------------
+// Token normalization
+// ---------------------------------------------------------------------------
+function tokenize(command) {
+    return command.split(/\s+/).filter((t) => t.length > 0);
+}
+function stripEnvTokens(tokens) {
+    while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0] ?? '')) {
+        tokens.shift();
+    }
+}
+function stripSudoTokens(tokens) {
+    while (tokens.length > 0 && tokens[0] === 'sudo') {
+        tokens.shift();
+        // Consume sudo's own flags (which precede the wrapped command).
+        while (tokens.length > 0) {
+            const flag = tokens[0] ?? '';
+            if (!flag.startsWith('-'))
+                break;
+            tokens.shift();
+            const next = tokens[0];
+            if (next === undefined || next.startsWith('-'))
+                continue;
+            if (SUDO_VALUE_SHORT_FLAG.test(flag) || SUDO_VALUE_LONG_FLAGS.has(flag)) {
+                tokens.shift();
+            }
+        }
+    }
+}
+function firstSegment(command) {
+    const idx = command.search(SEGMENT_SPLIT_RE);
+    return idx >= 0 ? command.slice(0, idx).trim() : command;
+}
+// ---------------------------------------------------------------------------
+// Sub-classifiers
+// ---------------------------------------------------------------------------
+/**
+ * Package-manager invocations like `npm test`, `yarn run build`, `pnpm lint`
+ * should classify as the verb (test-runner / build / etc.), not as
+ * 'package-manager'. The package-manager category is for install/audit/etc.
+ */
+function refinePackageManager(leading, tokens) {
+    // tokens[0] is the package manager itself; look at the verb that follows.
+    const rest = tokens.slice(1).filter((t) => !t.startsWith('-'));
+    if (rest.length === 0)
+        return 'package-manager';
+    // `npm run X` / `yarn run X` / `pnpm run X` / `bun run X` — peel the 'run'.
+    let verbIdx = 0;
+    if (rest[0] === 'run' || rest[0] === 'run-script') {
+        if (rest.length < 2)
+            return 'package-manager';
+        verbIdx = 1;
+    }
+    const verb = rest[verbIdx]?.toLowerCase();
+    if (verb === undefined)
+        return 'package-manager';
+    if (verb === 'test' || verb === 'tests' || verb === 't')
+        return 'test-runner';
+    if (verb === 'build' || verb === 'compile')
+        return 'build';
+    if (verb === 'lint' || verb === 'typecheck' || verb === 'tsc')
+        return 'build';
+    if (leading === 'cargo' && verb === 'test')
+        return 'test-runner';
+    if (leading === 'cargo' && verb === 'build')
+        return 'build';
+    if (leading === 'go' && verb === 'test')
+        return 'test-runner';
+    if (leading === 'go' && verb === 'build')
+        return 'build';
+    return 'package-manager';
+}
+function classifyLeading(leading, tokens) {
+    if (leading.length === 0)
+        return 'shell-other';
+    if (GIT_COMMANDS.has(leading))
+        return 'git';
+    if (TEST_RUNNERS.has(leading))
+        return 'test-runner';
+    if (BUILD_TOOLS.has(leading))
+        return 'build';
+    if (CONTAINER_TOOLS.has(leading))
+        return 'container';
+    if (NETWORK_TOOLS.has(leading))
+        return 'network';
+    if (SEARCH_TOOLS.has(leading))
+        return 'search';
+    if (FS_OPS.has(leading))
+        return 'fs-op';
+    // Package managers may be wrapping a sub-command we recognise.
+    if (PACKAGE_MANAGERS.has(leading))
+        return refinePackageManager(leading, tokens);
+    // `go test`, `go build`, `cargo test`, `cargo build` — same handling.
+    if ((leading === 'go' || leading === 'cargo') && tokens.length >= 2) {
+        return refinePackageManager(leading, tokens);
+    }
+    // `npx jest`, `pnpx jest`, `bunx jest` — the runner is the second token.
+    if (leading === 'npx' || leading === 'pnpx' || leading === 'bunx') {
+        const next = tokens[1]?.toLowerCase();
+        if (next !== undefined) {
+            if (TEST_RUNNERS.has(next))
+                return 'test-runner';
+            if (BUILD_TOOLS.has(next))
+                return 'build';
+        }
+        return 'package-manager';
+    }
+    // Script interpreters: `bash foo.sh`, `python foo.py`, `node script.js`.
+    if (SCRIPT_INTERPRETERS.has(leading))
+        return 'custom-script';
+    return 'shell-other';
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+export function classifyBash(command) {
+    const trimmed = command.trim();
+    if (trimmed.length === 0) {
+        return { category: 'shell-other', leading: '', isDestructive: false, isNetwork: false };
+    }
+    // Destructive check runs against the full command with quoted regions
+    // masked out (so `git commit -m "rm -rf old"` doesn't fire) but otherwise
+    // unsplit (so pipe-to-shell patterns survive segment splitting and sudo
+    // stripping).
+    const masked = maskQuotedRegions(trimmed);
+    const isDestructive = DESTRUCTIVE_PATTERNS.some((p) => p.test(masked));
+    const segment = firstSegment(trimmed);
+    const tokens = tokenize(segment);
+    // sudo can wrap env vars (`sudo FOO=bar cmd`) and env vars can prefix sudo
+    // (`FOO=bar sudo cmd`), so we strip env → sudo → env to cover both shapes.
+    stripEnvTokens(tokens);
+    stripSudoTokens(tokens);
+    stripEnvTokens(tokens);
+    if (tokens.length === 0) {
+        return { category: 'shell-other', leading: '', isDestructive, isNetwork: false };
+    }
+    const leadingRaw = tokens[0] ?? '';
+    // An "explicit script path" is a relative-path invocation or anything with a
+    // recognisable script extension — the user wrote it as a path on purpose,
+    // so we preserve the full token as the leading.
+    const explicitScriptPath = leadingRaw.startsWith('./') || leadingRaw.startsWith('../') || SCRIPT_EXT_RE.test(leadingRaw);
+    const absolutePath = leadingRaw.startsWith('/');
+    const leading = explicitScriptPath ? leadingRaw : (leadingRaw.split('/').pop() ?? leadingRaw);
+    let category = classifyLeading(leading.toLowerCase(), tokens);
+    // Path-shaped invocations that don't resolve to a known tool are
+    // user-authored binaries / scripts.
+    if (category === 'shell-other' && (explicitScriptPath || absolutePath)) {
+        category = 'custom-script';
+    }
+    const isNetwork = category === 'network' || NETWORK_TOOLS.has(leading.toLowerCase());
+    return { category, leading, isDestructive, isNetwork };
+}
+//# sourceMappingURL=bash-classifier.js.map

package/dist/hooks/bash-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-classifier.js","sourceRoot":"","sources":["../../src/hooks/bash-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwBH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,OAAO;IACP,KAAK;IACL,QAAQ;IACR,SAAS;IACT,UAAU;IACV,MAAM;IACN,KAAK;IACL,SAAS;IACT,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;IACT,KAAK;IACL,KAAK;IACL,SAAS;IACT,YAAY;IACZ,OAAO;IACP,KAAK;IACL,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,SAAS;IACT,IAAI;IACJ,MAAM;IACN,KAAK;IACL,WAAW;IACX,MAAM;IACN,UAAU;IACV,UAAU;IACV,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,UAAU;IACV,UAAU;IACV,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,SAAS;CACV,CAAC,CAAC;AAEH,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,0EAA0E;AAC1E,kEAAkE;AAClE,kCAAkC;AAClC,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,oBAAoB,GAAsB;IAC9C,oDAAoD;IACpD,0EAA0E;IAC1E,2EAA2E;IAC3E,wDAAwD;IACxD,0EAA0E;IAC1E,2BAA2B;IAC3B,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,oDAAoD;IACpD,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,oEAAoE;IACpE,uEAAuE;CACxE,CAAC;AAEF,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,GAAG,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChD,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,GAAG,CAAC;YACX,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBAClD,GAAG,IAAI,IAAI,CAAC;oBACZ,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,MAAM,aAAa,GAAG,wDAAwD,CAAC;AAE/E,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,MAAgB;IACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAgB;IACvC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,gEAAgE;QAChE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM;YACjC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACzD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAe,EAAE,MAAyB;IACtE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAEhD,4EAA4E;IAC5E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,iBAAiB,CAAC;QAC9C,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAEjD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IAC9E,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC3D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAC9E,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IACjE,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAEzD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,MAAyB;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAE/C,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,aAAa,CAAC;IACpD,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IACrD,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAExC,+DAA+D;IAC/D,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEhF,sEAAsE;IACtE,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,yEAAyE;IACzE,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,aAAa,CAAC;YACjD,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC;IAE7D,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1F,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,cAAc;IACd,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEjC,2EAA2E;IAC3E,2EAA2E;IAC3E,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,6EAA6E;IAC7E,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChG,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,OAAO,GAAG,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,CAAC;IAE9F,IAAI,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IAE9D,iEAAiE;IACjE,oCAAoC;IACpC,IAAI,QAAQ,KAAK,aAAa,IAAI,CAAC,kBAAkB,IAAI,YAAY,CAAC,EAAE,CAAC;QACvE,QAAQ,GAAG,eAAe,CAAC;IAC7B,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAErF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}

package/dist/hooks/collector-script.d.ts

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * Hook collector script for Claude Code PreToolUse / PostToolUse / PostToolUseFailure hooks.
+ *
+ * Called by Claude Code on every tool invocation. Reads the hook JSON from stdin,
+ * extracts key fields, and appends a single JSONL line to the buffer file.
+ *
+ * Design constraints:
+ *   - <5ms execution budget — must never slow Claude Code
+ *   - No heavy imports (no shared package, no commander, no zod)
+ *   - All errors caught silently — always exits 0
+ *   - Config via env vars only (no file reads for config)
+ */
+/**
+ * Resolve the per-session buffer path. Validates sessionId against
+ * /^[a-zA-Z0-9_-]{1,128}$/ so a malicious session_id can't escape the storage
+ * dir. When sessionId is missing or fails validation, falls back to
+ * `buffer-unknown.jsonl` rather than the legacy shared `buffer.jsonl` — the
+ * MCP no longer reads the shared path.
+ *
+ * `NEW_RELIC_AI_MCP_BUFFER_PATH` is honored verbatim when set (used by tests
+ * and one-off configurations) and bypasses session-scoping.
+ */
+declare function getBufferPath(sessionId?: string): string;
+declare function getRecordContent(): boolean;
+declare function redact(value: string): string;
+declare function hashInput(input: unknown): string;
+declare function sizeOf(value: unknown): number;
+declare function truncate(value: string, maxLen: number): string;
+interface TranscriptUsage {
+    input_tokens?: number;
+    cache_creation_input_tokens?: number;
+    cache_read_input_tokens?: number;
+    output_tokens?: number;
+    model?: string;
+}
+declare function getTranscriptPath(cwd: string | undefined, sessionId: string | undefined): string | null;
+declare function readLastAssistantUsage(transcriptPath: string): TranscriptUsage | null;
+declare function collectTranscriptTokens(data: {
+    cwd?: string;
+    session_id?: string;
+    transcript_path?: string;
+}): void;
+declare function writePpidBreadcrumb(sessionId: string): void;
+declare function processHook(raw: string): void;
+export { processHook, redact, hashInput, sizeOf, truncate, getRecordContent, collectTranscriptTokens, readLastAssistantUsage, getTranscriptPath, getBufferPath, writePpidBreadcrumb, };
+//# sourceMappingURL=collector-script.d.ts.map

package/dist/hooks/collector-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-script.d.ts","sourceRoot":"","sources":["../../src/hooks/collector-script.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAwBH;;;;;;;;;GASG;AACH,iBAAS,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAQjD;AAiCD,iBAAS,gBAAgB,IAAI,OAAO,CAInC;AA0BD,iBAAS,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAarC;AAMD,iBAAS,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGzC;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQtC;AAED,iBAAS,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGvD;AAcD,UAAU,eAAe;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,iBAAS,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKhG;AAED,iBAAS,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAyC9E;AAsCD,iBAAS,uBAAuB,CAAC,IAAI,EAAE;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CAoEP;AAgBD,iBAAS,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgCpD;AA6KD,iBAAS,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAuHtC;AAGD,OAAO,EACL,WAAW,EACX,MAAM,EACN,SAAS,EACT,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,GACpB,CAAC"}