@odingard/guardian-hook 0.1.1 → 0.3.0

package/dist/agent-sdk.js

@@ -0,0 +1,628 @@
+// src/run.ts
+import { createGuardianClient } from "@odingard/guardian-sdk";
+
+// src/classify.ts
+import { createHash } from "node:crypto";
+var HOOK_TOOLS = [
+  {
+    name: "shell",
+    suggestedMode: "allow",
+    description: "Ordinary shell commands (build, test, read-only inspection)."
+  },
+  {
+    name: "shell_deploy",
+    suggestedMode: "ask",
+    description: "Infrastructure and deploy commands: terraform/tofu apply or destroy, pulumi up, kubectl apply/delete, helm install/upgrade, cdk/serverless/fly/vercel deploys, cloud deploy CLIs."
+  },
+  {
+    name: "shell_destructive",
+    suggestedMode: "ask",
+    description: "Destructive commands: rm -rf, git reset --hard, git clean, force pushes, dropping databases, disk formatting."
+  },
+  {
+    name: "git_push",
+    suggestedMode: "ask",
+    description: "Pushing commits to a remote."
+  },
+  {
+    name: "shell_session",
+    suggestedMode: "ask",
+    description: "Starting an interactive shell, interpreter or remote session (bash, python, ssh, docker exec -it). What is typed into it later is not seen by Guardian."
+  },
+  {
+    name: "file_write",
+    suggestedMode: "allow",
+    description: "Creating or editing files in the workspace."
+  },
+  {
+    name: "web_fetch",
+    suggestedMode: "allow",
+    description: "Fetching a URL."
+  }
+];
+var MAX_COMMAND = 2e3;
+var DEPLOY = [
+  /\b(terraform|tofu)\b.*\s(apply|destroy|import|state\s+(rm|mv|push))\b/,
+  /\bpulumi\s+(up|destroy|update)\b/,
+  /\bkubectl\b.*\s(apply|delete|create|replace|patch|scale|rollout|drain|cordon)\b/,
+  /\bhelm\s+(install|upgrade|uninstall|rollback|delete)\b/,
+  /\b(cdk|serverless|sls|sam)\s+(deploy|destroy|remove)\b/,
+  /\bfly(ctl)?\s+(deploy|destroy|apps\s+destroy|scale)\b/,
+  /\bvercel\b.*(--prod\b|\bdeploy\b|\bpromote\b|\bremove\b)/,
+  /\bnetlify\s+deploy\b.*--prod\b/,
+  /\bgcloud\s+.*\b(deploy|delete)\b/,
+  /\baws\s+.*\b(deploy|delete-stack|create-stack|update-stack|terminate-instances|delete-db-instance)\b/,
+  /\baz\s+.*\b(deploy|delete|create)\b/,
+  /\bwrangler\s+(deploy|publish|delete)\b/,
+  /\bdocker\s+(push|compose\s+.*\bup\b.*--remote)\b/,
+  /\b(npm|pnpm|yarn)\s+publish\b/,
+  /\btwine\s+upload\b/,
+  /\bgh\s+(release\s+create|workflow\s+run|pr\s+merge)\b/
+];
+var DESTRUCTIVE = [
+  /\brm\s+(?:-\S*[rR]\S*\s+(?:-\S+\s+)*|-\S*f\S*\s+-\S*[rR])/,
+  /\bgit\s+reset\s+.*--hard\b/,
+  /\bgit\s+clean\s+-\S*f/,
+  /\bgit\s+push\b.*(\s--force\b|\s-f\b|--force-with-lease|\s\+\S)/,
+  /\bgit\s+(branch\s+-D|checkout\s+--\s|restore\s+--source)\b/,
+  /\b(drop|truncate)\s+(table|database|schema)\b/i,
+  /\bdelete\s+from\s+\w+\s*(;|$)/i,
+  /\b(mkfs|dd\s+if=|shred|wipefs)\b/,
+  /\bchmod\s+-R\s+777\b/,
+  /\bfind\b.*\s-delete\b/
+];
+var GIT_PUSH = /\bgit\s+push\b/;
+var INTERPRETERS = new Set(
+  "sh bash zsh dash ksh mksh csh tcsh fish ash pwsh powershell python python2 python3 ipython node nodejs deno bun ruby irb perl php lua luajit r julia ghci scala groovysh jshell tclsh wish expect su login tmux screen script".split(" ")
+);
+var DB_CLIENTS = new Set(
+  "psql mysql mariadb mongo mongosh cqlsh sqlplus clickhouse-client".split(" ")
+);
+var DB_INLINE = /^(-c|-e|-f|--command|--execute|--file|--eval|--query)(=|$)/;
+var NET_PIPES = new Set("telnet nc ncat netcat socat openssl".split(" "));
+var SSH_VALUE_OPTS = new Set(
+  "-B -b -c -D -E -e -F -I -i -J -L -l -m -O -o -p -Q -R -S -W -w".split(" ")
+);
+var SUDO_VALUE_OPTS = new Set("-u -g -U -C -D -h -p -r -t -T".split(" "));
+var REDIS_VALUE_OPTS = new Set("-h -p -a -n -u --user --pass".split(" "));
+var WRAPPERS = new Set(
+  "exec command builtin nohup time env stdbuf nice ionice".split(" ")
+);
+function positionals(args, valueOpts) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (valueOpts.has(a)) i++;
+    else if (!a.startsWith("-")) out.push(a);
+  }
+  return out;
+}
+function startsSession(segment) {
+  const words = segment.trim().split(/\s+/).filter(Boolean);
+  let wrapped = false;
+  while (words.length > 0) {
+    const w = words[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || WRAPPERS.has(w) || wrapped && w.startsWith("-")) {
+      wrapped ||= WRAPPERS.has(w);
+      words.shift();
+      continue;
+    }
+    break;
+  }
+  if (words.length === 0) return false;
+  const base = (words[0].split(/[\\/]/).pop() ?? "").replace(/^['"]+|['"]+$/g, "").toLowerCase().replace(/\.exe$/, "");
+  const args = words.slice(1);
+  if (args.some((a) => /^(--version|-V|--help)$/.test(a))) {
+    return false;
+  }
+  if (base === "sudo" || base === "doas" || base === "busybox") {
+    if (base !== "busybox" && args.some((a) => /^-[a-zA-Z]*[is]$/.test(a))) {
+      return true;
+    }
+    const rest = positionals(args, SUDO_VALUE_OPTS);
+    if (rest.length === 0) return false;
+    return startsSession(args.slice(args.indexOf(rest[0])).join(" "));
+  }
+  if (base === "ssh" || base === "mosh") {
+    if (args.some((a) => /^-[a-zA-Z]*t/.test(a))) return true;
+    return positionals(args, SSH_VALUE_OPTS).length <= 1;
+  }
+  if (["docker", "podman", "nerdctl", "kubectl", "oc"].includes(base)) {
+    if (!args.some((a) => ["exec", "run", "attach", "debug"].includes(a))) {
+      return false;
+    }
+    return args.includes("attach") || args.some(
+      (a) => /^(-[a-zA-Z]*i[a-zA-Z]*|--interactive|--stdin)(=true)?$/.test(a)
+    );
+  }
+  if (DB_CLIENTS.has(base)) {
+    return !args.some((a) => DB_INLINE.test(a)) && !segment.includes("<");
+  }
+  if (base === "sqlite3") {
+    return positionals(args, /* @__PURE__ */ new Set(["-cmd"])).length <= 1;
+  }
+  if (base === "redis-cli") {
+    return positionals(args, REDIS_VALUE_OPTS).length === 0;
+  }
+  if (NET_PIPES.has(base)) {
+    return base === "openssl" ? args[0] === "s_client" : !args.some((a) => /^-[a-zA-Z]*z/.test(a));
+  }
+  if (!INTERPRETERS.has(base) && !/^python[0-9.]+$/.test(base)) return false;
+  if ((base === "deno" || base === "bun") && args[0] === "repl") return true;
+  const code = args.findIndex((a) => /^-[a-zA-Z]*c[a-zA-Z]*$/.test(a));
+  if (code >= 0 && /sh$/.test(base)) {
+    const inner = args.slice(code + 1).join(" ").replace(/['"]/g, " ");
+    if (startsInteractiveSession(inner)) return true;
+  }
+  if (args.some((a) => /^(-[a-zA-Z]*[is][a-zA-Z]*|--interactive|-)$/.test(a))) {
+    return true;
+  }
+  return args.every((a) => a.startsWith("-") && !/^-[a-zA-Z]*[ce]/.test(a));
+}
+function startsInteractiveSession(command) {
+  if (/\bwhile\s+(?:IFS=\S*\s+)?read\b/.test(command)) return true;
+  return command.split(/&&|\|\||[;&|\n()]|\$\(|`/).some((segment) => startsSession(segment));
+}
+function classifyCommand(command) {
+  if (DESTRUCTIVE.some((re) => re.test(command))) return "shell_destructive";
+  if (DEPLOY.some((re) => re.test(command))) return "shell_deploy";
+  if (GIT_PUSH.test(command)) return "git_push";
+  if (startsInteractiveSession(command)) return "shell_session";
+  return "shell";
+}
+function mcpToolName(server, tool) {
+  const part = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").replace(/^(\d)/, "x$1") || "x";
+  return `mcp.${part(server)}.${part(tool)}`.slice(0, 64).replace(/[._-]+$/, "");
+}
+function bounded(text, max = MAX_COMMAND) {
+  return text.length <= max ? text : `${text.slice(0, max)}\u2026 [${text.length - max} more chars]`;
+}
+function digest(text) {
+  return `sha256:${createHash("sha256").update(text).digest("hex")}`;
+}
+function str(value) {
+  return typeof value === "string" ? value : "";
+}
+var SHELL_TOOLS = {
+  Bash: "command",
+  // Claude Code; Codex shell and unified exec
+  shell: "command",
+  bash: "command",
+  // DeepSeek Harness (plain and persistent)
+  pwsh: "command",
+  // DeepSeek Harness on Windows
+  terminal_send: "text"
+  // DeepSeek Harness PTY: typed input runs as a command
+};
+var FILE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit",
+  "write",
+  // DeepSeek Harness
+  "edit"
+  // DeepSeek Harness
+]);
+function commandText(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+    return value.join(" ");
+  }
+  return "";
+}
+var MAX_PATHS = 50;
+function patchTargets(patch) {
+  const targets = [];
+  const re = /^[ \t]*\*\*\* (Add File|Update File|Delete File|Move to): (.+?)[ \t\r]*$/gm;
+  for (const m of patch.matchAll(re)) {
+    const kind = m[1];
+    const op = kind === "Add File" ? "add" : kind === "Update File" ? "update" : kind === "Delete File" ? "delete" : "move";
+    targets.push({ op, path: m[2] });
+  }
+  return targets;
+}
+function fileWrite(operation, path, content, cwd, summaryVerb) {
+  return {
+    toolName: "file_write",
+    arguments: {
+      operation,
+      path,
+      contentBytes: Buffer.byteLength(content),
+      contentDigest: digest(content),
+      ...cwd
+    },
+    summary: `${summaryVerb} ${path}`
+  };
+}
+function governedCall(call) {
+  const { tool, input } = call;
+  const cwd = call.cwd ? { cwd: call.cwd } : {};
+  const shellField = Object.hasOwn(SHELL_TOOLS, tool) ? SHELL_TOOLS[tool] : void 0;
+  if (shellField) {
+    const command = commandText(input[shellField]);
+    const toolName = classifyCommand(command);
+    return {
+      toolName,
+      arguments: {
+        command: bounded(command),
+        ...tool === "Bash" || tool === "shell" ? {} : { agentTool: tool },
+        ...cwd
+      },
+      summary: `Run: ${bounded(command, 160)}`
+    };
+  }
+  if (FILE_TOOLS.has(tool)) {
+    const path = str(input.file_path) || str(input.notebook_path);
+    const content = str(input.content) || str(input.new_string) || str(input.new_source) || (Array.isArray(input.edits) ? JSON.stringify(input.edits) : "");
+    return fileWrite(
+      tool,
+      path,
+      content,
+      cwd,
+      tool === "Write" || tool === "write" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "str_replace_editor") {
+    if (input.command === "view") return null;
+    const sub = str(input.command) || "unknown";
+    const content = str(input.file_text) || str(input.new_str);
+    return fileWrite(
+      `str_replace_editor.${sub}`,
+      str(input.path),
+      content,
+      cwd,
+      sub === "create" ? "Write" : "Edit"
+    );
+  }
+  if (tool === "apply_patch") {
+    const patch = commandText(input.command) || str(input.patch) || str(input.input);
+    const targets = patchTargets(patch);
+    const paths = [...new Set(targets.map((t) => t.path))];
+    const shown = paths.slice(0, MAX_PATHS).map((p) => bounded(p, 500));
+    return {
+      toolName: "file_write",
+      arguments: {
+        operation: "apply_patch",
+        path: shown[0] ?? "",
+        paths: shown,
+        ...paths.length > MAX_PATHS ? { morePaths: paths.length - MAX_PATHS } : {},
+        operations: targets.slice(0, MAX_PATHS).map((t) => `${t.op} ${bounded(t.path, 500)}`),
+        contentBytes: Buffer.byteLength(patch),
+        contentDigest: digest(patch),
+        ...cwd
+      },
+      summary: paths.length === 0 ? "Apply a patch (no file headers found)" : paths.length === 1 ? `Patch ${bounded(paths[0], 160)}` : `Patch ${paths.length} files: ${bounded(paths.join(", "), 160)}`
+    };
+  }
+  if (tool === "WebFetch" || tool === "web_fetch") {
+    const url = str(input.url);
+    return {
+      toolName: "web_fetch",
+      arguments: { url: bounded(url, 500) },
+      summary: `Fetch ${bounded(url, 160)}`
+    };
+  }
+  const mcp = /^mcp__(.+?)__(.+)$/.exec(tool);
+  if (mcp) {
+    const [, server, name] = mcp;
+    const json = JSON.stringify(input);
+    return {
+      toolName: mcpToolName(server, name),
+      arguments: json.length <= MAX_COMMAND ? { server, tool: name, input } : {
+        server,
+        tool: name,
+        inputBytes: json.length,
+        inputDigest: digest(json)
+      },
+      summary: `MCP ${server} \u2192 ${name}`
+    };
+  }
+  return null;
+}
+function tierOf(toolName) {
+  const known = HOOK_TOOLS.find((t) => t.name === toolName);
+  return known ? known.suggestedMode : "ask";
+}
+
+// src/decide.ts
+var PLAIN = {
+  NOT_AUTHORIZED: "this agent is not authorized for it",
+  APPROVAL_DENIED: "the approver declined it",
+  APPROVAL_NOT_SATISFIED: "the approver declined it",
+  APPROVAL_EXPIRED: "the approval expired",
+  UNAUTHENTICATED: "the Guardian agent credential was rejected",
+  INVALID_REQUEST: `this tool is not allowed for the agent yet. In the Guardian console: Agents \u2192 this agent \u2192 the connection's card \u2192 "Allow a tool by name"`,
+  SERVICE_UNAVAILABLE: "Guardian could not be reached",
+  REQUEST_CONFLICT: "Guardian saw a conflicting request"
+};
+function plain(code) {
+  return PLAIN[code] ?? code;
+}
+function denied(call, code, extra = {}) {
+  return {
+    decision: "deny",
+    reason: `Guardian blocked ${call.toolName} (${code}): ${plain(code)}. Do not retry or work around this; ask the developer to review it in the Guardian console.`,
+    ...extra
+  };
+}
+var FINAL_CHECK_LEAD_MS = 1500;
+var isPending = (r) => !r.ok && (r.reasonCode === "APPROVAL_REQUIRED" || r.reasonCode === "APPROVAL_PENDING") || r.ok && r.decision === "ASK";
+async function decide(call, options) {
+  const wait = options.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = options.now ?? Date.now;
+  const log = options.log ?? (() => {
+  });
+  let result;
+  try {
+    result = await options.client.request({
+      action: "tool.invoke",
+      connectionId: options.connectionId,
+      toolName: call.toolName,
+      arguments: call.arguments,
+      purpose: `${options.agentName}: ${call.summary}`,
+      ...options.requestTtlMs !== void 0 ? { ttlMs: options.requestTtlMs } : {}
+    });
+  } catch {
+    return denied(call, "SERVICE_UNAVAILABLE");
+  }
+  const answeredAt = now();
+  const requestId = result.requestId;
+  let approvedByHuman = false;
+  if (isPending(result)) {
+    if (!requestId) return denied(call, "MISSING_REQUEST_ID");
+    log(
+      `Guardian: "${call.summary}" is held for approval (request ${requestId}). Approve it on your phone or in the console.`
+    );
+    const window = Math.min(
+      options.approvalTimeoutMs,
+      options.requestTtlMs ?? options.approvalTimeoutMs
+    );
+    const lead = Math.min(FINAL_CHECK_LEAD_MS, Math.floor(window / 4));
+    const lastCheckAt = answeredAt + window - lead;
+    const maxInterval = Math.max(
+      options.maxPollIntervalMs ?? 1e4,
+      options.pollIntervalMs
+    );
+    let interval = options.pollIntervalMs;
+    for (; ; ) {
+      await wait(Math.max(0, Math.min(interval, lastCheckAt - now())));
+      interval = Math.min(Math.ceil(interval * 1.5), maxInterval);
+      let claimed;
+      try {
+        claimed = await options.client.claim(requestId);
+      } catch {
+        claimed = { ok: false, reasonCode: "APPROVAL_REQUIRED", requestId };
+      }
+      if (!isPending(claimed)) {
+        result = claimed;
+        approvedByHuman = claimed.ok && claimed.decision === "ALLOW";
+        break;
+      }
+      if (now() >= lastCheckAt) {
+        return {
+          decision: "deny",
+          reason: `Guardian is still waiting for a human to approve ${call.toolName} (request ${requestId}). Nothing ran. Tell the developer it needs approval in the Guardian app, then try again.`,
+          requestId,
+          guardianDecision: "ASK"
+        };
+      }
+    }
+  }
+  if (!result.ok || result.decision !== "ALLOW" || !result.capabilityToken) {
+    const code = result.ok ? result.reasonCode ?? (result.decision === "DENY" ? "DENIED" : "MISSING_CAPABILITY") : result.reasonCode;
+    return denied(call, code, {
+      ...requestId ? { requestId } : {},
+      guardianDecision: "DENY"
+    });
+  }
+  let executed;
+  try {
+    executed = await options.client.execute({
+      requestId: result.requestId,
+      capabilityToken: result.capabilityToken
+    });
+  } catch {
+    executed = { ok: false, reasonCode: "SERVICE_UNAVAILABLE" };
+  }
+  if (!executed.ok) {
+    return denied(call, executed.reasonCode, {
+      requestId: result.requestId,
+      guardianDecision: approvedByHuman ? "ASK" : "ALLOW",
+      approvedByHuman
+    });
+  }
+  return {
+    decision: "allow",
+    reason: approvedByHuman ? `Approved by a human in Guardian (request ${result.requestId}).` : `Allowed by Guardian policy (request ${result.requestId}).`,
+    requestId: result.requestId,
+    guardianDecision: approvedByHuman ? "ASK" : "ALLOW",
+    approvedByHuman
+  };
+}
+
+// src/run.ts
+var DEFAULT_BASE_URL = "https://guardian-api.odingard.com";
+var REQUEST_TTL_MS = 3e5;
+var MAX_WAIT_MS = REQUEST_TTL_MS;
+var DEFAULT_DEADLINE_MS = 54e4;
+var AGENT_NAMES = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  dsh: "DeepSeek Harness"
+};
+function formatVerdict(dialect, verdict) {
+  if (verdict === null) {
+    return { stdout: "", stderr: "", exitCode: 0, verdict };
+  }
+  if (dialect === "claude-code") {
+    return {
+      stdout: claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  if (verdict.decision === "allow") {
+    return {
+      stdout: dialect === "codex" ? "" : claudeCodeOutput(verdict),
+      stderr: "",
+      exitCode: 0,
+      verdict
+    };
+  }
+  return {
+    stdout: claudeCodeOutput(verdict),
+    stderr: verdict.reason,
+    exitCode: 2,
+    verdict
+  };
+}
+function claudeCodeOutput(verdict) {
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: verdict.decision,
+      permissionDecisionReason: verdict.reason
+    }
+  });
+}
+function connectionFor(toolName, env) {
+  const allow = env.GUARDIAN_CONNECTION_ID?.trim() || void 0;
+  if (tierOf(toolName) === "allow") return allow;
+  return env.GUARDIAN_HOOK_ASK_CONNECTION_ID?.trim() || allow;
+}
+async function runHook(stdin, env, deps = {}) {
+  return (await runHookAs("claude-code", stdin, env, deps)).stdout;
+}
+async function runHookAs(dialect, stdin, env, deps = {}) {
+  const requested = Number(
+    env.GUARDIAN_HOOK_DEADLINE_MS ?? DEFAULT_DEADLINE_MS
+  );
+  const deadlineMs = Number.isFinite(requested) && requested > 0 ? Math.min(requested, DEFAULT_DEADLINE_MS) : DEFAULT_DEADLINE_MS;
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(
+      () => resolve({
+        decision: "deny",
+        reason: "Guardian hook: no decision before the hook's deadline. Nothing ran."
+      }),
+      deadlineMs
+    );
+    timer.unref?.();
+  });
+  try {
+    const verdict = await Promise.race([
+      evaluate(dialect, stdin, env, deps, deadlineMs).catch(
+        () => ({
+          decision: "deny",
+          reason: "Guardian hook: crashed. Nothing ran."
+        })
+      ),
+      timedOut
+    ]);
+    return formatVerdict(dialect, verdict);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function evaluate(dialect, stdinText, env, deps, deadlineMs) {
+  const failClosed = (reason) => ({
+    decision: "deny",
+    reason: `Guardian hook: ${reason}`
+  });
+  let input;
+  try {
+    input = JSON.parse(await stdinText);
+  } catch {
+    return failClosed(
+      "could not read the tool call from the agent. Nothing ran."
+    );
+  }
+  if (!input || typeof input.tool_name !== "string") {
+    return failClosed("the tool call had no tool name. Nothing ran.");
+  }
+  const call = governedCall({
+    tool: input.tool_name,
+    input: input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {},
+    ...typeof input.cwd === "string" ? { cwd: input.cwd } : {}
+  });
+  if (call === null) return null;
+  const connectionId = connectionFor(call.toolName, env);
+  const credential = env.GUARDIAN_AGENT_CREDENTIAL?.trim();
+  const baseUrl = (env.GUARDIAN_BASE_URL?.trim() || DEFAULT_BASE_URL).replace(
+    /\/+$/,
+    ""
+  );
+  if (!deps.client && (!credential || !connectionId)) {
+    return failClosed(
+      `GUARDIAN_AGENT_CREDENTIAL and GUARDIAN_CONNECTION_ID must be set (run \`${dialect === "claude-code" ? "npx @odingard/guardian-hook" : `guardian-hook ${dialect}`} setup\`). Nothing ran.`
+    );
+  }
+  if (!deps.client && !baseUrl.startsWith("https://")) {
+    return failClosed("GUARDIAN_BASE_URL must be https. Nothing ran.");
+  }
+  const requested = Number(
+    env.GUARDIAN_HOOK_APPROVAL_TIMEOUT_MS ?? MAX_WAIT_MS
+  );
+  const ceiling = Math.max(0, Math.min(MAX_WAIT_MS, deadlineMs - 3e4));
+  const approvalTimeoutMs = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), ceiling) : ceiling;
+  return decide(call, {
+    client: deps.client ?? createGuardianClient({
+      baseUrl,
+      credential,
+      ...env.GUARDIAN_ADAPTER_ID ? { adapterId: env.GUARDIAN_ADAPTER_ID } : {}
+    }),
+    connectionId: connectionId ?? "",
+    agentName: env.GUARDIAN_HOOK_AGENT_NAME?.trim() || AGENT_NAMES[dialect],
+    approvalTimeoutMs,
+    requestTtlMs: REQUEST_TTL_MS,
+    pollIntervalMs: 2e3,
+    ...deps.wait ? { wait: deps.wait } : {},
+    ...deps.now ? { now: deps.now } : {},
+    ...deps.log ? { log: deps.log } : {}
+  });
+}
+
+// src/agent-sdk.ts
+function guardianPreToolUse(options = {}) {
+  return async (input) => {
+    if (input.hook_event_name && input.hook_event_name !== "PreToolUse") {
+      return {};
+    }
+    const base = options.env ?? process.env;
+    const env = {
+      ...base,
+      GUARDIAN_HOOK_AGENT_NAME: options.agentName ?? base.GUARDIAN_HOOK_AGENT_NAME ?? "Claude agent"
+    };
+    const output = await runHook(
+      JSON.stringify({
+        tool_name: input.tool_name,
+        tool_input: input.tool_input,
+        cwd: input.cwd
+      }),
+      env,
+      {
+        log: options.log ?? ((line) => process.stderr.write(`${line}
+`)),
+        ...options.client ? { client: options.client } : {},
+        ...options.wait ? { wait: options.wait } : {},
+        ...options.now ? { now: options.now } : {}
+      }
+    );
+    return output ? JSON.parse(output) : {};
+  };
+}
+var GUARDIAN_HOOK_TIMEOUT_SECONDS = Math.ceil(MAX_WAIT_MS / 1e3) + 30;
+function guardianHookMatcher(options = {}) {
+  return {
+    hooks: [guardianPreToolUse(options)],
+    timeout: GUARDIAN_HOOK_TIMEOUT_SECONDS,
+    onFailure: "block"
+  };
+}
+export {
+  GUARDIAN_HOOK_TIMEOUT_SECONDS,
+  guardianHookMatcher,
+  guardianPreToolUse
+};