@obelyzk/sdk 1.4.0 → 1.6.0

package/src/hooks/pre-tool-use.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# ObelyZK PreToolUse Hook
+#
+# Claude Code hook that intercepts tool calls and classifies on-chain
+# transactions before execution using the ZKML classifier.
+#
+# Install in .claude/settings.json:
+#   {
+#     "hooks": {
+#       "PreToolUse": [{
+#         "matcher": "Bash",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "/path/to/pre-tool-use.sh"
+#         }]
+#       }]
+#     }
+#   }
+#
+# Environment:
+#   PROVER_URL  - Prove-server base URL (default: http://localhost:8080)
+#
+# Exit behavior:
+#   Outputs JSON to stdout. Exit 0 always (fail-open).
+#   When classifier uses test weights, only warns — never blocks.
+
+set -euo pipefail
+
+PROVER_URL="${PROVER_URL:-http://localhost:8080}"
+CLASSIFY_TIMEOUT=5
+
+# Read hook context from stdin
+INPUT=$(cat)
+
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null || echo "")
+if [ -z "$TOOL_NAME" ]; then
+  exit 0
+fi
+
+# Only intercept Bash tool
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
+if [ -z "$COMMAND" ]; then
+  exit 0
+fi
+
+# Match on-chain transaction patterns
+if ! echo "$COMMAND" | grep -qE '(starkli invoke|starkli deploy|sncast invoke|sncast deploy)'; then
+  exit 0
+fi
+
+# Extract the first hex address from the command (target contract)
+TARGET=$(echo "$COMMAND" | grep -oE '0x[0-9a-fA-F]{10,66}' | head -1 || echo "")
+if [ -z "$TARGET" ]; then
+  exit 0
+fi
+
+# Classify the transaction
+RESULT=$(curl -s --max-time "$CLASSIFY_TIMEOUT" \
+  -X POST "${PROVER_URL}/api/v1/classify" \
+  -H "Content-Type: application/json" \
+  -d "{\"target\": \"$TARGET\", \"value\": \"0\", \"selector\": \"0x0\"}" \
+  2>/dev/null || echo '{"error": "prover_unreachable"}')
+
+# Check for errors
+ERROR=$(echo "$RESULT" | jq -r '.error // empty' 2>/dev/null || echo "")
+if [ -n "$ERROR" ]; then
+  # Fail-open: prover unreachable or error, allow the action
+  echo "ObelyZK: prover unreachable or error ($ERROR), allowing action" >&2
+  exit 0
+fi
+
+DECISION=$(echo "$RESULT" | jq -r '.decision // "approve"' 2>/dev/null || echo "approve")
+SCORE=$(echo "$RESULT" | jq -r '.threat_score // 0' 2>/dev/null || echo "0")
+PROOF_HASH=$(echo "$RESULT" | jq -r '.io_commitment // "unknown"' 2>/dev/null || echo "unknown")
+
+# Log classification result to stderr (visible in Claude Code logs)
+echo "ObelyZK classify: target=$TARGET decision=$DECISION threat_score=$SCORE" >&2
+
+case "$DECISION" in
+  block)
+    # With test weights, warn but don't block
+    echo "ObelyZK: WOULD BLOCK (test weights active). threat_score=$SCORE proof=$PROOF_HASH" >&2
+    # When trained weights are deployed, uncomment the following to enforce:
+    # jq -n --arg reason "ObelyZK Firewall: transaction blocked (threat_score=$SCORE). Proof: $PROOF_HASH" '{
+    #   hookSpecificOutput: {
+    #     hookEventName: "PreToolUse",
+    #     permissionDecision: "deny",
+    #     permissionDecisionReason: $reason
+    #   }
+    # }'
+    exit 0
+    ;;
+  escalate)
+    # Ask the user for confirmation
+    jq -n --arg reason "ObelyZK Firewall: transaction flagged (threat_score=$SCORE, target=$TARGET). Review before proceeding." '{
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "ask",
+        permissionDecisionReason: $reason
+      }
+    }'
+    exit 0
+    ;;
+  *)
+    # Approved — allow
+    exit 0
+    ;;
+esac

package/src/hooks/session-start.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# ObelyZK SessionStart Policy Hook
+#
+# Loads and displays the active policy configuration at session start.
+# Shows the current preset, commitment hash, and enforcement mode so
+# the agent knows what rules are active before taking any actions.
+#
+# Install in .claude/settings.json:
+#   {
+#     "hooks": {
+#       "SessionStart": [{
+#         "hooks": [{
+#           "type": "command",
+#           "command": "/path/to/session-start.sh"
+#         }]
+#       }]
+#     }
+#   }
+#
+# Environment:
+#   PROVER_URL  - Prove-server base URL (default: http://localhost:8080)
+
+set -euo pipefail
+
+PROVER_URL="${PROVER_URL:-http://localhost:8080}"
+
+# Try to reach the prover and get health info
+HEALTH=$(curl -s --max-time 3 "${PROVER_URL}/health" 2>/dev/null || echo '{}')
+
+if [ "$HEALTH" = "{}" ]; then
+  echo "ObelyZK Policy: prover unreachable at ${PROVER_URL}" >&2
+  echo "  Classification will be unavailable until the prover is running." >&2
+  exit 0
+fi
+
+GPU=$(echo "$HEALTH" | jq -r '.gpu // "unknown"' 2>/dev/null || echo "unknown")
+UPTIME=$(echo "$HEALTH" | jq -r '.uptime_s // "unknown"' 2>/dev/null || echo "unknown")
+MODELS=$(echo "$HEALTH" | jq -r '.models_loaded // "unknown"' 2>/dev/null || echo "unknown")
+
+echo "ObelyZK Policy Enforcement Active" >&2
+echo "  Prover:     ${PROVER_URL} (GPU: ${GPU}, uptime: ${UPTIME}s)" >&2
+echo "  Models:     ${MODELS}" >&2
+echo "  Classifier: test weights (NOT trained — decisions are non-meaningful)" >&2
+echo "  Policy:     standard (commitment enabled)" >&2
+echo "  Thresholds: approve <40K | escalate 40-70K | block >70K" >&2
+echo "" >&2
+echo "  All on-chain actions will be classified before execution." >&2
+echo "  Use firewall_health tool for detailed status." >&2
+
+exit 0