@pinta-ai/pinta-codex 1.2.2 → 1.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/core/config.d.ts +2 -0
- package/dist/core/config.js +15 -0
- package/dist/core/config.js.map +1 -1
- package/dist/core/guard.d.ts +13 -0
- package/dist/core/guard.js +41 -0
- package/dist/core/guard.js.map +1 -0
- package/dist/core/otlp.d.ts +2 -0
- package/dist/core/otlp.js +11 -1
- package/dist/core/otlp.js.map +1 -1
- package/dist/handlers/pre-tool-use.js +24 -1
- package/dist/handlers/pre-tool-use.js.map +1 -1
- package/package.json +1 -1
package/dist/core/config.d.ts
CHANGED
|
@@ -4,6 +4,8 @@ export interface PintaCodexConfig {
|
|
|
4
4
|
tracePath: string;
|
|
5
5
|
endpoint?: string;
|
|
6
6
|
headers: Record<string, string>;
|
|
7
|
+
/** Plan 5: manager-local guard endpoint (or undefined → guard skipped). */
|
|
8
|
+
guardEndpoint?: string;
|
|
7
9
|
}
|
|
8
10
|
export declare function loadConfig(): PintaCodexConfig;
|
|
9
11
|
/** Returns true if OTel endpoint is configured (signal to silently disable telemetry). */
|
package/dist/core/config.js
CHANGED
|
@@ -95,12 +95,27 @@ function loadConfig() {
|
|
|
95
95
|
const envFile = node_fs_1.default.existsSync(envFilePath) ? readEnvFile(envFilePath) : {};
|
|
96
96
|
const endpoint = resolveEndpoint(envFile);
|
|
97
97
|
const headersRaw = resolveHeaders(envFile);
|
|
98
|
+
// Plan 5: expose relay token for guard.ts (~/guard/evaluate auth header).
|
|
99
|
+
// Parse x-pinta-relay-token from the resolved OTEL headers string so guard.ts
|
|
100
|
+
// can read it from process.env.PINTA_RELAY_TOKEN (same as pinta-cc pattern).
|
|
101
|
+
if (headersRaw && !process.env.PINTA_RELAY_TOKEN) {
|
|
102
|
+
const tokenMatch = headersRaw.match(/x-pinta-relay-token=([^,\s]+)/i);
|
|
103
|
+
if (tokenMatch) {
|
|
104
|
+
process.env.PINTA_RELAY_TOKEN = tokenMatch[1];
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
// Plan 5 v1.2.4: codex CLI does NOT inject pinta-codex.env into hook
|
|
108
|
+
// subprocess env (unlike Claude Code's settings.json env-prefix). The hook
|
|
109
|
+
// must read PINTA_GUARD_ENDPOINT from envFile too — not just process.env.
|
|
110
|
+
// Same pattern as resolveEndpoint/resolveHeaders above.
|
|
111
|
+
const guardEndpoint = process.env.PINTA_GUARD_ENDPOINT ?? envFile.PINTA_GUARD_ENDPOINT;
|
|
98
112
|
return {
|
|
99
113
|
pluginRoot,
|
|
100
114
|
pluginData,
|
|
101
115
|
tracePath: node_path_1.default.join(pluginData, "trace.json"),
|
|
102
116
|
endpoint: endpoint?.replace(/\/+$/, ""),
|
|
103
117
|
headers: parseHeadersString(headersRaw ?? ""),
|
|
118
|
+
guardEndpoint,
|
|
104
119
|
};
|
|
105
120
|
}
|
|
106
121
|
/** Returns true if OTel endpoint is configured (signal to silently disable telemetry). */
|
package/dist/core/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":";;;;;AAwFA,gCAuCC;AAGD,0CAEC;AApID,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAY7B,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,iBAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAA+B;IACtD,iBAAiB;IACjB,8DAA8D;IAC9D,sEAAsE;IACtE,+EAA+E;IAC/E,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,kCAAkC;QAC9C,OAAO,CAAC,kCAAkC,CAAC;IAC7C,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,OAAO,CAAC,2BAA2B,CAAC;IACtC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC;IACzE,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAU,oBAAoB;QAC9D,OAAO,CAAC,oBAAoB,IAAc,SAAS;QACnD,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,oBAAoB;KAC/D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAA+B;IACrD,0DAA0D;IAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1F,IAAI,OAAO,CAAC,0BAA0B;QAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC;IAClF,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,OAAO,uBAAuB,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,OAAO,uBAAuB,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAC9D,CAAC;IACD,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;QAC7C,OAAO,uBAAuB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;WAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB;WAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;WAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB;WAC9B,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,mBAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,iBAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAEnE,OAAO;QACL,UAAU;QACV,UAAU;QACV,SAAS,EAAE,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;QAC9C,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,OAAO,EAAE,kBAAkB,CAAC,UAAU,IAAI,EAAE,CAAC;QAC7C,aAAa;KACd,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAgB,eAAe,CAAC,MAAwB;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
export interface GuardInput {
|
|
2
|
+
spanId: string;
|
|
3
|
+
toolName?: string;
|
|
4
|
+
toolInput?: unknown;
|
|
5
|
+
rawTextFields?: Record<string, string>;
|
|
6
|
+
}
|
|
7
|
+
export interface GuardResult {
|
|
8
|
+
decision: 'ALLOW' | 'DENY' | 'REVIEW';
|
|
9
|
+
reason: string | null;
|
|
10
|
+
durationMs: number;
|
|
11
|
+
failOpenReason?: 'timeout' | 'refused' | 'error';
|
|
12
|
+
}
|
|
13
|
+
export declare function evaluateGuard(input: GuardInput, endpoint: string | undefined): Promise<GuardResult | null>;
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.evaluateGuard = evaluateGuard;
|
|
4
|
+
const TIMEOUT_MS = 50;
|
|
5
|
+
function sleep(ms) {
|
|
6
|
+
return new Promise((_, reject) => setTimeout(() => {
|
|
7
|
+
const err = new Error('Guard request timed out');
|
|
8
|
+
err.name = 'TimeoutError';
|
|
9
|
+
reject(err);
|
|
10
|
+
}, ms));
|
|
11
|
+
}
|
|
12
|
+
async function evaluateGuard(input, endpoint) {
|
|
13
|
+
if (!endpoint)
|
|
14
|
+
return null;
|
|
15
|
+
if (process.env.PINTA_GUARD_DISABLED === '1')
|
|
16
|
+
return null;
|
|
17
|
+
const start = Date.now();
|
|
18
|
+
try {
|
|
19
|
+
const res = await Promise.race([
|
|
20
|
+
fetch(endpoint, {
|
|
21
|
+
method: 'POST',
|
|
22
|
+
headers: {
|
|
23
|
+
'content-type': 'application/json',
|
|
24
|
+
'x-pinta-relay-token': process.env.PINTA_RELAY_TOKEN ?? '',
|
|
25
|
+
},
|
|
26
|
+
body: JSON.stringify({ input }),
|
|
27
|
+
}),
|
|
28
|
+
sleep(TIMEOUT_MS),
|
|
29
|
+
]);
|
|
30
|
+
if (res.status !== 200) {
|
|
31
|
+
return { decision: 'ALLOW', reason: null, durationMs: Date.now() - start, failOpenReason: 'error' };
|
|
32
|
+
}
|
|
33
|
+
const body = (await res.json());
|
|
34
|
+
return { decision: body.decision, reason: body.reason, durationMs: body.durationMs ?? (Date.now() - start) };
|
|
35
|
+
}
|
|
36
|
+
catch (err) {
|
|
37
|
+
const reason = err.name === 'TimeoutError' ? 'timeout' : 'error';
|
|
38
|
+
return { decision: 'ALLOW', reason: null, durationMs: Date.now() - start, failOpenReason: reason };
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
//# sourceMappingURL=guard.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/core/guard.ts"],"names":[],"mappings":";;AA0BA,sCA4BC;AAxCD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,EAAE,EAAE,CAAC,CACP,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,QAA4B;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,KAAK,CAAC,QAAQ,EAAE;gBACd,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;iBAC3D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC;YACF,KAAK,CAAC,UAAU,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsF,CAAC;QACrH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAC/G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAmC,GAAa,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACrG,CAAC;AACH,CAAC"}
|
package/dist/core/otlp.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { BaseEvent } from "./types.js";
|
|
2
|
+
import type { GuardResult } from "./guard.js";
|
|
2
3
|
export interface OtlpAttribute {
|
|
3
4
|
key: string;
|
|
4
5
|
value: {
|
|
@@ -48,6 +49,7 @@ export declare function buildOtlpPayload(args: {
|
|
|
48
49
|
event: BaseEvent;
|
|
49
50
|
traceId: string;
|
|
50
51
|
now?: number;
|
|
52
|
+
guard?: GuardResult | null;
|
|
51
53
|
}): OtlpPayload;
|
|
52
54
|
/**
|
|
53
55
|
* Combine multiple per-hook payloads into a single OTLP payload by
|
package/dist/core/otlp.js
CHANGED
|
@@ -145,6 +145,16 @@ function resourceAttrs() {
|
|
|
145
145
|
function buildOtlpPayload(args) {
|
|
146
146
|
const ts = args.now ?? Date.now();
|
|
147
147
|
const tsNano = (BigInt(ts) * 1000000n).toString();
|
|
148
|
+
const attrs = flattenEvent(args.event);
|
|
149
|
+
if (args.guard) {
|
|
150
|
+
attrs.push({ key: 'pinta.guard.decision', value: { stringValue: args.guard.decision.toLowerCase() } }, { key: 'pinta.guard.duration_ms', value: { intValue: args.guard.durationMs } });
|
|
151
|
+
if (args.guard.reason) {
|
|
152
|
+
attrs.push({ key: 'pinta.guard.matched_rule', value: { stringValue: args.guard.reason } });
|
|
153
|
+
}
|
|
154
|
+
if (args.guard.failOpenReason) {
|
|
155
|
+
attrs.push({ key: 'pinta.guard.fail_open_reason', value: { stringValue: args.guard.failOpenReason } });
|
|
156
|
+
}
|
|
157
|
+
}
|
|
148
158
|
const span = {
|
|
149
159
|
traceId: ulidToTraceId(args.traceId),
|
|
150
160
|
spanId: newSpanId(),
|
|
@@ -152,7 +162,7 @@ function buildOtlpPayload(args) {
|
|
|
152
162
|
kind: 1, // SPAN_KIND_INTERNAL
|
|
153
163
|
startTimeUnixNano: tsNano,
|
|
154
164
|
endTimeUnixNano: tsNano,
|
|
155
|
-
attributes:
|
|
165
|
+
attributes: attrs,
|
|
156
166
|
};
|
|
157
167
|
return {
|
|
158
168
|
resourceSpans: [
|
package/dist/core/otlp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"otlp.js","sourceRoot":"","sources":["../../src/core/otlp.ts"],"names":[],"mappings":";;;;;
|
|
1
|
+
{"version":3,"file":"otlp.js","sourceRoot":"","sources":["../../src/core/otlp.ts"],"names":[],"mappings":";;;;;AA0DA,sCAgBC;AAGD,8BAEC;AA6FD,4CA2CC;AAOD,gCAIC;AAlOD,oDAA4B;AAC5B,4CAAoB;AAEpB,2CAA+C;AAG/C,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,8CAA8C;AAE9E;;;GAGG;AACH,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAC3C,SAAS,eAAe;IACtB,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IACvD,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC;IAC9D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAiCD,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,gEAAgE;IAChE,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,CAAC,IAAI,IAAI,CAAC;IACV,qCAAqC;IACrC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS;IACvB,OAAO,gBAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,uBAAuB;IACvB,WAAW;IACX,uBAAuB;CACxB,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAW;IACjD,wCAAwC;IACxC,MAAM,SAAS,GAAG,IAAA,oBAAQ,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,OAAO,GAAG,GAAG,KAAK,kBAAkB,IAAI,GAAG,KAAK,qBAAqB;QACzE,CAAC,CAAE,MAAgB;QACnB,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,IAAA,kBAAM,EAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,GAAW,EAAE,CAAU;IAC1C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,OAAO,CAAC,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,KAAK,SAAS;YACZ,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC1B,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5B,KAAK,QAAQ;YACX,IAAI,CAAC;gBACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,CAAC;QACH;YACE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,aAAqB;IACtC,gCAAgC;IAChC,OAAO,aAAa;SACjB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;SACxC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACpC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,+EAA+E;IAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,0EAA0E;IAC1E,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,iBAAiB;YAAE,SAAS,CAAC,8BAA8B;QACrE,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;QACxD,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,EAAE;QACrE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;QACpE,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;QACnE,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE;QACxE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;QACxD,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;QACxE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,QAAQ,EAAE,EAAE,EAAE;QAC3D,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAE,CAAC,IAAI,EAAE,EAAE,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAKhC;IACC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,QAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,EAC1F,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAC/E,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAa;QACrB,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,SAAS,EAAE;QACnB,IAAI,EAAE,SAAS,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE;QACtD,IAAI,EAAE,CAAC,EAAE,qBAAqB;QAC9B,iBAAiB,EAAE,MAAM;QACzB,eAAe,EAAE,MAAM;QACvB,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,OAAO;QACL,aAAa,EAAE;YACb;gBACE,QAAQ,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE;gBACzC,UAAU,EAAE;oBACV;wBACE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE;wBACvD,KAAK,EAAE,CAAC,IAAI,CAAC;qBACd;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,QAAuB;IAChD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;IACvD,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAChC,CAAC"}
|
|
@@ -4,12 +4,35 @@ exports.handlePreToolUse = handlePreToolUse;
|
|
|
4
4
|
const transport_js_1 = require("../core/transport.js");
|
|
5
5
|
const trace_js_1 = require("../core/trace.js");
|
|
6
6
|
const otlp_js_1 = require("../core/otlp.js");
|
|
7
|
+
const guard_js_1 = require("../core/guard.js");
|
|
7
8
|
async function handlePreToolUse(event, config) {
|
|
9
|
+
// codex CLI doesn't inject pinta-codex.env into hook env; config.guardEndpoint
|
|
10
|
+
// already merges process.env + envFile fallback (1.2.4).
|
|
11
|
+
const guardEndpoint = config.guardEndpoint;
|
|
12
|
+
const rawToolInput = typeof event.tool_input === 'string'
|
|
13
|
+
? event.tool_input
|
|
14
|
+
: JSON.stringify(event.tool_input);
|
|
15
|
+
const guard = await (0, guard_js_1.evaluateGuard)({
|
|
16
|
+
spanId: event.session_id ?? 'unknown',
|
|
17
|
+
toolName: event.tool_name,
|
|
18
|
+
toolInput: event.tool_input,
|
|
19
|
+
rawTextFields: { toolInput: rawToolInput },
|
|
20
|
+
}, guardEndpoint);
|
|
8
21
|
const transport = new transport_js_1.Transport(config);
|
|
9
22
|
await transport.flush();
|
|
10
23
|
const traceId = new trace_js_1.TraceManager(config).currentTrace();
|
|
11
|
-
const payload = (0, otlp_js_1.buildOtlpPayload)({ event, traceId });
|
|
24
|
+
const payload = (0, otlp_js_1.buildOtlpPayload)({ event, traceId, guard });
|
|
12
25
|
await transport.send(payload);
|
|
26
|
+
if (guard?.decision === 'DENY') {
|
|
27
|
+
const out = {
|
|
28
|
+
hookSpecificOutput: {
|
|
29
|
+
hookEventName: 'PreToolUse',
|
|
30
|
+
permissionDecision: 'deny',
|
|
31
|
+
permissionDecisionReason: guard.reason ?? 'guard_deny',
|
|
32
|
+
},
|
|
33
|
+
};
|
|
34
|
+
process.stdout.write(JSON.stringify(out) + '\n');
|
|
35
|
+
}
|
|
13
36
|
return 0;
|
|
14
37
|
}
|
|
15
38
|
//# sourceMappingURL=pre-tool-use.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pre-tool-use.js","sourceRoot":"","sources":["../../src/handlers/pre-tool-use.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"pre-tool-use.js","sourceRoot":"","sources":["../../src/handlers/pre-tool-use.ts"],"names":[],"mappings":";;AAOA,4CAqCC;AA1CD,uDAAiD;AACjD,+CAAgD;AAChD,6CAAmD;AACnD,+CAAiD;AAE1C,KAAK,UAAU,gBAAgB,CACpC,KAAsB,EACtB,MAAwB;IAExB,+EAA+E;IAC/E,yDAAyD;IACzD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACvD,CAAC,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAa,EAC/B;QACE,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;QACrC,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,aAAa,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;KAC3C,EACD,aAAa,CACd,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,wBAAS,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,uBAAY,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,IAAA,0BAAgB,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,KAAK,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG;YACV,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAe;gBACnC,wBAAwB,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY;aACvD;SACF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|