@praxis.guard/auditor-cli 0.0.56 → 0.0.58
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bridge/guard-storage-root.d.ts +12 -0
- package/dist/bridge/guard-storage-root.d.ts.map +1 -1
- package/dist/bridge/guard-storage-root.js +38 -2
- package/dist/bridge/guard-storage-root.js.map +1 -1
- package/dist/bridge/guard-workspace-session.d.ts +20 -0
- package/dist/bridge/guard-workspace-session.d.ts.map +1 -0
- package/dist/bridge/guard-workspace-session.js +97 -0
- package/dist/bridge/guard-workspace-session.js.map +1 -0
- package/dist/hooks/before-mcp-argv.d.ts.map +1 -1
- package/dist/hooks/before-mcp-argv.js +5 -7
- package/dist/hooks/before-mcp-argv.js.map +1 -1
- package/dist/hooks/run-before-mcp.d.ts.map +1 -1
- package/dist/hooks/run-before-mcp.js +6 -1
- package/dist/hooks/run-before-mcp.js.map +1 -1
- package/dist/hooks/run-before-shell.d.ts.map +1 -1
- package/dist/hooks/run-before-shell.js +5 -1
- package/dist/hooks/run-before-shell.js.map +1 -1
- package/dist/mcp/evaluate-guard.d.ts.map +1 -1
- package/dist/mcp/evaluate-guard.js +7 -2
- package/dist/mcp/evaluate-guard.js.map +1 -1
- package/dist/mcp/guard-schemas.d.ts +2 -0
- package/dist/mcp/guard-schemas.d.ts.map +1 -1
- package/dist/mcp/guard-schemas.js +5 -1
- package/dist/mcp/guard-schemas.js.map +1 -1
- package/native/darwin-amd64/praxis-guard-daemon +0 -0
- package/native/darwin-amd64/praxis-guard-hook +0 -0
- package/native/darwin-arm64/praxis-guard-daemon +0 -0
- package/native/darwin-arm64/praxis-guard-hook +0 -0
- package/native/linux-amd64/praxis-guard-daemon +0 -0
- package/native/linux-amd64/praxis-guard-hook +0 -0
- package/native/linux-arm64/praxis-guard-daemon +0 -0
- package/native/linux-arm64/praxis-guard-hook +0 -0
- package/package.json +1 -1
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
import { type WorkspaceHints } from "./guard-workspace-session.js";
|
|
2
|
+
export { isEphemeralWorkspacePath, isReliableWorkspaceRoot, readActiveWorkspaceFromSession, } from "./guard-workspace-session.js";
|
|
1
3
|
/** Canonical (IDE-neutral) subdir for guard runtime state under a workspace root. */
|
|
2
4
|
export declare const GUARD_DIR = ".praxis/guard";
|
|
3
5
|
/** Legacy Cursor-only subdir. Read for back-compat; new writes go to GUARD_DIR. */
|
|
@@ -10,10 +12,20 @@ export declare const LEGACY_GUARD_DIR = ".cursor/guard";
|
|
|
10
12
|
* 1. `.praxis/` — neutral marker (preferred; dropped by `auditor setup`)
|
|
11
13
|
* 2. `.cursor/hooks.json` — legacy Cursor marker
|
|
12
14
|
* 3. `.git/` — repo root fallback
|
|
15
|
+
*
|
|
16
|
+
* `~/.praxis` alone is skipped — it is global config, not a project workspace.
|
|
13
17
|
*/
|
|
14
18
|
export declare function resolveGuardStorageRoot(preferredCwd?: string): string;
|
|
19
|
+
/** Resolve guard storage from hook/MCP workspace hints (shared by hooks and guard MCP). */
|
|
20
|
+
export declare function resolveGuardStorageRootFromHints(hints?: WorkspaceHints): string;
|
|
21
|
+
/** Persist a resolved repo root so MCP guard writes tickets where hooks read them. */
|
|
22
|
+
export declare function rememberResolvedWorkspaceRoot(resolvedRoot: string): void;
|
|
23
|
+
/** Persist the active workspace so MCP guard can align tickets with hook cwd. */
|
|
24
|
+
export declare function rememberActiveWorkspace(hints?: WorkspaceHints): void;
|
|
15
25
|
/** Absolute path to the guard storage dir for a given preferred cwd. */
|
|
16
26
|
export declare function guardStorageDir(preferredCwd?: string): string;
|
|
17
27
|
/** Absolute path to a named subdir/file under the guard storage dir. */
|
|
18
28
|
export declare function guardSubpath(segment: string, preferredCwd?: string): string;
|
|
29
|
+
export type { WorkspaceHints } from "./guard-workspace-session.js";
|
|
30
|
+
export { resolvePreferredWorkspaceCwd } from "./guard-workspace-session.js";
|
|
19
31
|
//# sourceMappingURL=guard-storage-root.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-storage-root.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"guard-storage-root.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,eAAO,MAAM,SAAS,kBAAkB,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAWhD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAsBrE;AAED,2FAA2F;AAC3F,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,CAE/E;AAED,sFAAsF;AACtF,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAGxE;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAKpE;AA4BD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}
|
|
@@ -1,9 +1,19 @@
|
|
|
1
1
|
import { existsSync, mkdirSync, renameSync } from "node:fs";
|
|
2
|
+
import os from "node:os";
|
|
2
3
|
import path from "node:path";
|
|
4
|
+
import { pickWorkspaceHint, readActiveWorkspaceFromSession, resolvePreferredWorkspaceCwd, isReliableWorkspaceRoot, writeActiveWorkspaceSession, } from "./guard-workspace-session.js";
|
|
5
|
+
export { isEphemeralWorkspacePath, isReliableWorkspaceRoot, readActiveWorkspaceFromSession, } from "./guard-workspace-session.js";
|
|
3
6
|
/** Canonical (IDE-neutral) subdir for guard runtime state under a workspace root. */
|
|
4
7
|
export const GUARD_DIR = ".praxis/guard";
|
|
5
8
|
/** Legacy Cursor-only subdir. Read for back-compat; new writes go to GUARD_DIR. */
|
|
6
9
|
export const LEGACY_GUARD_DIR = ".cursor/guard";
|
|
10
|
+
function isUserHomeDir(dir) {
|
|
11
|
+
return path.resolve(dir) === path.resolve(os.homedir());
|
|
12
|
+
}
|
|
13
|
+
/** `~/.praxis` holds global policies/daemon config — not the active repo workspace. */
|
|
14
|
+
function isGlobalHomePraxisMarker(dir) {
|
|
15
|
+
return isUserHomeDir(dir) && existsSync(path.join(dir, ".praxis"));
|
|
16
|
+
}
|
|
7
17
|
/**
|
|
8
18
|
* Resolve where guard runtime state lives. Hooks and MCP redeem must use the same root
|
|
9
19
|
* (workspace), not the subprocess cwd (e.g. `packages/auditor-cli`).
|
|
@@ -12,6 +22,8 @@ export const LEGACY_GUARD_DIR = ".cursor/guard";
|
|
|
12
22
|
* 1. `.praxis/` — neutral marker (preferred; dropped by `auditor setup`)
|
|
13
23
|
* 2. `.cursor/hooks.json` — legacy Cursor marker
|
|
14
24
|
* 3. `.git/` — repo root fallback
|
|
25
|
+
*
|
|
26
|
+
* `~/.praxis` alone is skipped — it is global config, not a project workspace.
|
|
15
27
|
*/
|
|
16
28
|
export function resolveGuardStorageRoot(preferredCwd) {
|
|
17
29
|
const override = process.env.PRAXIS_GUARD_STORAGE_ROOT?.trim();
|
|
@@ -20,7 +32,7 @@ export function resolveGuardStorageRoot(preferredCwd) {
|
|
|
20
32
|
let dir = preferredCwd?.trim() ? path.resolve(preferredCwd.trim()) : process.cwd();
|
|
21
33
|
const fsRoot = path.parse(dir).root;
|
|
22
34
|
while (true) {
|
|
23
|
-
if (existsSync(path.join(dir, ".praxis")))
|
|
35
|
+
if (existsSync(path.join(dir, ".praxis")) && !isGlobalHomePraxisMarker(dir))
|
|
24
36
|
return dir;
|
|
25
37
|
if (existsSync(path.join(dir, ".cursor", "hooks.json")))
|
|
26
38
|
return dir;
|
|
@@ -30,7 +42,30 @@ export function resolveGuardStorageRoot(preferredCwd) {
|
|
|
30
42
|
break;
|
|
31
43
|
dir = path.dirname(dir);
|
|
32
44
|
}
|
|
33
|
-
|
|
45
|
+
const fallback = preferredCwd?.trim() ? path.resolve(preferredCwd.trim()) : process.cwd();
|
|
46
|
+
if (isReliableWorkspaceRoot(fallback))
|
|
47
|
+
return fallback;
|
|
48
|
+
const cached = readActiveWorkspaceFromSession();
|
|
49
|
+
if (cached)
|
|
50
|
+
return cached;
|
|
51
|
+
return fallback;
|
|
52
|
+
}
|
|
53
|
+
/** Resolve guard storage from hook/MCP workspace hints (shared by hooks and guard MCP). */
|
|
54
|
+
export function resolveGuardStorageRootFromHints(hints) {
|
|
55
|
+
return resolveGuardStorageRoot(resolvePreferredWorkspaceCwd(hints));
|
|
56
|
+
}
|
|
57
|
+
/** Persist a resolved repo root so MCP guard writes tickets where hooks read them. */
|
|
58
|
+
export function rememberResolvedWorkspaceRoot(resolvedRoot) {
|
|
59
|
+
if (!isReliableWorkspaceRoot(resolvedRoot))
|
|
60
|
+
return;
|
|
61
|
+
writeActiveWorkspaceSession(resolvedRoot);
|
|
62
|
+
}
|
|
63
|
+
/** Persist the active workspace so MCP guard can align tickets with hook cwd. */
|
|
64
|
+
export function rememberActiveWorkspace(hints) {
|
|
65
|
+
const preferred = pickWorkspaceHint(hints);
|
|
66
|
+
if (!preferred)
|
|
67
|
+
return;
|
|
68
|
+
rememberResolvedWorkspaceRoot(resolveGuardStorageRoot(preferred));
|
|
34
69
|
}
|
|
35
70
|
const migratedRoots = new Set();
|
|
36
71
|
/**
|
|
@@ -68,4 +103,5 @@ export function guardStorageDir(preferredCwd) {
|
|
|
68
103
|
export function guardSubpath(segment, preferredCwd) {
|
|
69
104
|
return path.join(guardStorageDir(preferredCwd), segment);
|
|
70
105
|
}
|
|
106
|
+
export { resolvePreferredWorkspaceCwd } from "./guard-workspace-session.js";
|
|
71
107
|
//# sourceMappingURL=guard-storage-root.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-storage-root.js","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD
|
|
1
|
+
{"version":3,"file":"guard-storage-root.js","sourceRoot":"","sources":["../../src/bridge/guard-storage-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;AAEzC,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,uFAAuF;AACvF,SAAS,wBAAwB,CAAC,GAAW;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,GAAG,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAEpC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACxF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACnD,IAAI,GAAG,KAAK,MAAM;YAAE,MAAM;QAC1B,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1F,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvD,MAAM,MAAM,GAAG,8BAA8B,EAAE,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gCAAgC,CAAC,KAAsB;IACrE,OAAO,uBAAuB,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC;QAAE,OAAO;IACnD,2BAA2B,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,6BAA6B,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACpC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAE7B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,GAAG,KAAK,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,YAAqB;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACnD,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,YAAqB;IACjE,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAGD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Hook/MCP scratch dirs under tmp (e.g. auditor-hook-*) must not anchor tickets.
|
|
3
|
+
* Nested project paths under tmp (…/Projects/Praxis) remain valid for tests and CI.
|
|
4
|
+
*/
|
|
5
|
+
export declare function isEphemeralWorkspacePath(resolved: string): boolean;
|
|
6
|
+
/** Repo-like roots where hooks and MCP should read/write guard state. */
|
|
7
|
+
export declare function isReliableWorkspaceRoot(resolved: string): boolean;
|
|
8
|
+
export type WorkspaceHints = {
|
|
9
|
+
cwd?: string | null;
|
|
10
|
+
workspaceRoot?: string | null;
|
|
11
|
+
workspaceRoots?: readonly string[] | null;
|
|
12
|
+
};
|
|
13
|
+
/** Last hook-fired workspace; ignored when ephemeral or no longer on disk. */
|
|
14
|
+
export declare function readActiveWorkspaceFromSession(): string | undefined;
|
|
15
|
+
export declare function pickWorkspaceHint(hints?: WorkspaceHints): string | undefined;
|
|
16
|
+
/** Best cwd hint for workspace-scoped guard state (hooks, MCP guard, tickets). */
|
|
17
|
+
export declare function resolvePreferredWorkspaceCwd(hints?: WorkspaceHints): string | undefined;
|
|
18
|
+
/** Persist resolved workspace root for MCP guard when hooks omit cwd. */
|
|
19
|
+
export declare function writeActiveWorkspaceSession(workspaceRoot: string): void;
|
|
20
|
+
//# sourceMappingURL=guard-workspace-session.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guard-workspace-session.d.ts","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYlE;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CASjE;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3C,CAAC;AAsBF,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,SAAS,CAcnE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,kFAAkF;AAClF,wBAAgB,4BAA4B,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEvF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAavE"}
|
|
@@ -0,0 +1,97 @@
|
|
|
1
|
+
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
2
|
+
import os from "node:os";
|
|
3
|
+
import path from "node:path";
|
|
4
|
+
function activeWorkspaceFile() {
|
|
5
|
+
return path.join(os.homedir(), ".praxis", "guard", "active-workspace.json");
|
|
6
|
+
}
|
|
7
|
+
function isUserHomeDir(dir) {
|
|
8
|
+
return path.resolve(dir) === path.resolve(os.homedir());
|
|
9
|
+
}
|
|
10
|
+
/**
|
|
11
|
+
* Hook/MCP scratch dirs under tmp (e.g. auditor-hook-*) must not anchor tickets.
|
|
12
|
+
* Nested project paths under tmp (…/Projects/Praxis) remain valid for tests and CI.
|
|
13
|
+
*/
|
|
14
|
+
export function isEphemeralWorkspacePath(resolved) {
|
|
15
|
+
const normalized = path.resolve(resolved);
|
|
16
|
+
const base = path.basename(normalized);
|
|
17
|
+
if (/^auditor-hook-/.test(base))
|
|
18
|
+
return true;
|
|
19
|
+
const tmp = path.resolve(os.tmpdir());
|
|
20
|
+
if (normalized !== tmp && !normalized.startsWith(`${tmp}${path.sep}`))
|
|
21
|
+
return false;
|
|
22
|
+
const relative = path.relative(tmp, normalized);
|
|
23
|
+
if (!relative || relative.startsWith(".."))
|
|
24
|
+
return false;
|
|
25
|
+
if (relative.includes(path.sep))
|
|
26
|
+
return false;
|
|
27
|
+
return !existsSync(path.join(normalized, ".git"));
|
|
28
|
+
}
|
|
29
|
+
/** Repo-like roots where hooks and MCP should read/write guard state. */
|
|
30
|
+
export function isReliableWorkspaceRoot(resolved) {
|
|
31
|
+
const normalized = path.resolve(resolved);
|
|
32
|
+
if (isEphemeralWorkspacePath(normalized))
|
|
33
|
+
return false;
|
|
34
|
+
if (isUserHomeDir(normalized) && existsSync(path.join(normalized, ".praxis")))
|
|
35
|
+
return false;
|
|
36
|
+
return (existsSync(path.join(normalized, ".git")) ||
|
|
37
|
+
existsSync(path.join(normalized, ".praxis")) ||
|
|
38
|
+
existsSync(path.join(normalized, ".cursor", "hooks.json")));
|
|
39
|
+
}
|
|
40
|
+
function pickExplicitWorkspaceHint(hints) {
|
|
41
|
+
const envRoot = process.env.PRAXIS_GUARD_WORKSPACE_ROOT?.trim();
|
|
42
|
+
if (envRoot)
|
|
43
|
+
return envRoot;
|
|
44
|
+
const cwd = hints?.cwd?.trim();
|
|
45
|
+
if (cwd)
|
|
46
|
+
return cwd;
|
|
47
|
+
const workspaceRoot = hints?.workspaceRoot?.trim();
|
|
48
|
+
if (workspaceRoot)
|
|
49
|
+
return workspaceRoot;
|
|
50
|
+
const roots = hints?.workspaceRoots;
|
|
51
|
+
if (Array.isArray(roots)) {
|
|
52
|
+
for (const root of roots) {
|
|
53
|
+
if (typeof root === "string" && root.trim())
|
|
54
|
+
return root.trim();
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
return undefined;
|
|
58
|
+
}
|
|
59
|
+
/** Last hook-fired workspace; ignored when ephemeral or no longer on disk. */
|
|
60
|
+
export function readActiveWorkspaceFromSession() {
|
|
61
|
+
try {
|
|
62
|
+
const raw = readFileSync(activeWorkspaceFile(), "utf8");
|
|
63
|
+
const parsed = JSON.parse(raw);
|
|
64
|
+
if (typeof parsed.workspace_root !== "string" || !parsed.workspace_root.trim()) {
|
|
65
|
+
return undefined;
|
|
66
|
+
}
|
|
67
|
+
const root = path.resolve(parsed.workspace_root.trim());
|
|
68
|
+
if (!existsSync(root))
|
|
69
|
+
return undefined;
|
|
70
|
+
if (!isReliableWorkspaceRoot(root))
|
|
71
|
+
return undefined;
|
|
72
|
+
return root;
|
|
73
|
+
}
|
|
74
|
+
catch {
|
|
75
|
+
return undefined;
|
|
76
|
+
}
|
|
77
|
+
}
|
|
78
|
+
export function pickWorkspaceHint(hints) {
|
|
79
|
+
return pickExplicitWorkspaceHint(hints);
|
|
80
|
+
}
|
|
81
|
+
/** Best cwd hint for workspace-scoped guard state (hooks, MCP guard, tickets). */
|
|
82
|
+
export function resolvePreferredWorkspaceCwd(hints) {
|
|
83
|
+
return pickExplicitWorkspaceHint(hints) ?? readActiveWorkspaceFromSession();
|
|
84
|
+
}
|
|
85
|
+
/** Persist resolved workspace root for MCP guard when hooks omit cwd. */
|
|
86
|
+
export function writeActiveWorkspaceSession(workspaceRoot) {
|
|
87
|
+
try {
|
|
88
|
+
const sessionFile = activeWorkspaceFile();
|
|
89
|
+
mkdirSync(path.dirname(sessionFile), { recursive: true });
|
|
90
|
+
writeFileSync(sessionFile, `${JSON.stringify({ workspace_root: workspaceRoot, updated_at: new Date().toISOString() }, null, 2)}\n`, "utf8");
|
|
91
|
+
}
|
|
92
|
+
catch (e) {
|
|
93
|
+
const msg = e instanceof Error ? e.message : String(e);
|
|
94
|
+
process.stderr.write(`[auditor] active workspace cache skipped (${msg})\n`);
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
//# sourceMappingURL=guard-workspace-session.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guard-workspace-session.js","sourceRoot":"","sources":["../../src/bridge/guard-workspace-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,SAAS,mBAAmB;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,wBAAwB,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAsB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,aAAa,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,KAAK,GAAG,KAAK,EAAE,cAAc,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,KAAsB;IACjE,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,8BAA8B,EAAE,CAAC;AAC9E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,2BAA2B,CAAC,aAAqB;IAC/D,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CACX,WAAW,EACX,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACvG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,GAAG,KAAK,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"before-mcp-argv.d.ts","sourceRoot":"","sources":["../../src/hooks/before-mcp-argv.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"before-mcp-argv.d.ts","sourceRoot":"","sources":["../../src/hooks/before-mcp-argv.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAa1F;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAkBnF;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,GAAG,SAAS,CAKvF"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { resolvePreferredWorkspaceCwd } from "../bridge/guard-storage-root.js";
|
|
1
2
|
/**
|
|
2
3
|
* When Cursor encodes MCP tools as `MCP:<server>:<tool>` (see Cursor hooks docs / preToolUse), split into
|
|
3
4
|
* server + bare tool name for policy rows under `policies.mcp.<server>.<tool>`.
|
|
@@ -56,12 +57,9 @@ export function stringifyToolInput(raw) {
|
|
|
56
57
|
}
|
|
57
58
|
}
|
|
58
59
|
export function preferredHookCwd(payload) {
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
return payload.workspace_roots[0];
|
|
64
|
-
}
|
|
65
|
-
return undefined;
|
|
60
|
+
return resolvePreferredWorkspaceCwd({
|
|
61
|
+
cwd: typeof payload.cwd === "string" ? payload.cwd : undefined,
|
|
62
|
+
workspaceRoots: Array.isArray(payload.workspace_roots) ? payload.workspace_roots : undefined,
|
|
63
|
+
});
|
|
66
64
|
}
|
|
67
65
|
//# sourceMappingURL=before-mcp-argv.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"before-mcp-argv.js","sourceRoot":"","sources":["../../src/hooks/before-mcp-argv.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"before-mcp-argv.js","sourceRoot":"","sources":["../../src/hooks/before-mcp-argv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAG/E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,UAAU,IAAI,QAAQ;gBAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAkC;IACvE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,OAAO,4BAA4B,CAAC;QAClC,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC9D,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KAC7F,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-mcp.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-mcp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAsBhF;;GAEG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"run-before-mcp.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-mcp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAsBhF;;GAEG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuJ/D;AAED,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CAM7F"}
|
|
@@ -2,7 +2,7 @@ import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
|
|
|
2
2
|
import { appendAuditJsonl } from "../audit/jsonl.js";
|
|
3
3
|
import { getInstallId } from "../cli/install-id.js";
|
|
4
4
|
import { evaluateMcpProposal } from "../shell/evaluate.js";
|
|
5
|
-
import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
|
|
5
|
+
import { rememberActiveWorkspace, rememberResolvedWorkspaceRoot, resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
|
|
6
6
|
import { toolInputSha256 } from "../approval/fingerprint.js";
|
|
7
7
|
import { formatHookAllowViaCredentialMessage, formatHookDenyMessages, } from "./agent-message.js";
|
|
8
8
|
import { sendGuardEvent } from "../telemetry/guard-events.js";
|
|
@@ -52,7 +52,12 @@ export async function runBeforeMcpHookFromStdin() {
|
|
|
52
52
|
const { skipped, evaluation } = evaluateMcpProposal(policy, argv);
|
|
53
53
|
const { classification, flags, tier } = evaluation;
|
|
54
54
|
const initialReasons = evaluation.reasons.map((r) => r.message);
|
|
55
|
+
rememberActiveWorkspace({
|
|
56
|
+
cwd: typeof payload.cwd === "string" ? payload.cwd : undefined,
|
|
57
|
+
workspaceRoots: Array.isArray(payload.workspace_roots) ? payload.workspace_roots : undefined,
|
|
58
|
+
});
|
|
55
59
|
const storageRoot = resolveGuardStorageRoot(preferredHookCwd(payload));
|
|
60
|
+
rememberResolvedWorkspaceRoot(storageRoot);
|
|
56
61
|
const auditLogRoot = storageRoot;
|
|
57
62
|
const toolInputHash = toolInputSha256(payload.tool_input);
|
|
58
63
|
if (skipped) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-mcp.js","sourceRoot":"","sources":["../../src/hooks/run-before-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"run-before-mcp.js","sourceRoot":"","sources":["../../src/hooks/run-before-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAClI,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACL,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAO/D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,KAAK,UAAU,aAAa;IAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,OAAO,GAAG,MAAM,aAAa,EAA6B,CAAC;IACjE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAE1C,MAAM,WAAW,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAA+B;YAC3C,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,yDAAyD;YACvE,aAAa,EAAE,+DAA+D;SAC/E,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAEhC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IACnD,MAAM,cAAc,GAAa,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAE1E,uBAAuB,CAAC;QACtB,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC9D,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KAC7F,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,WAAW,CAAC;IACjC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,oBAAoB,CAAC;YACzB,OAAO;YACP,WAAW;YACX,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,OAAO,EAAE,cAAc;YACvB,cAAc;YACd,YAAY;YACZ,eAAe;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAoD,IAAI,CAAC;IAC3E,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,OAAO,GAAG,cAAc,CAAC;IAE7B,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC;YAC/C,IAAI;YACJ,IAAI;YACJ,WAAW;YACX,aAAa;YACb,WAAW;YACX,gBAAgB,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACtE,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC/C,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACvD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,mCAAmC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM;QACnB,CAAC,CAAC,sBAAsB,CAAC;YACrB,IAAI,EAAE,oBAAoB;YAC1B,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,WAAW;YACrB,cAAc;SACf,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GACZ,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC;YACE,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QACH,CAAC,CAAC;YACE,UAAU;YACV,YAAY,EAAE,YAAa,CAAC,YAAY;YACxC,aAAa,EAAE,YAAa,CAAC,aAAa;SAC3C,CAAC;IAER,IAAI,CAAC;QACH,MAAM,gBAAgB,CACpB;YACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACvC,IAAI;YACJ,cAAc;YACd,KAAK;YACL,IAAI;YACJ,UAAU;YACV,cAAc;YACd,iBAAiB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACrD,iBAAiB,EAAE,aAAa;YAChC,OAAO;YACP,oBAAoB,EAAE,kBAAkB;YACxC,UAAU;SACX,EACD,YAAY,CACb,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,cAAc,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACrB,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1B,GAAG,EAAE,GAAG,WAAW,EAAE;QACrB,IAAI;QACJ,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpD,UAAU;QACV,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK;QACX,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE;YACJ,IAAI,EAAE,oBAAoB;YAC1B,cAAc;YACd,mBAAmB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACvD,oBAAoB,EAAE,kBAAkB;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,GAAY;IAC/D,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,yDAAyD;QACvE,aAAa,EAAE,0CAA0C,MAAM,CAAC,GAAG,CAAC,EAAE;KACvE,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-shell.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"run-before-shell.d.ts","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEzG,YAAY,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAOzG;;GAEG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CA0JjE;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,4BAA4B,CAMtF"}
|
|
@@ -2,7 +2,7 @@ import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
|
|
|
2
2
|
import { getInstallId } from "../cli/install-id.js";
|
|
3
3
|
import { analyzeShellCommand } from "../shell/analyze-command.js";
|
|
4
4
|
import { commandMayContainGovernedTool } from "../shell/governed-tools.js";
|
|
5
|
-
import { resolveGuardStorageRoot } from "../bridge/guard-storage-root.js";
|
|
5
|
+
import { rememberActiveWorkspace, rememberResolvedWorkspaceRoot, resolveGuardStorageRoot, } from "../bridge/guard-storage-root.js";
|
|
6
6
|
import { sendGuardEvent } from "../telemetry/guard-events.js";
|
|
7
7
|
import { resolveShellMutateHookPermission } from "./before-shell-mutate.js";
|
|
8
8
|
import { readStdinJson, tryAppendAuditEvent } from "./before-shell-io.js";
|
|
@@ -35,7 +35,11 @@ export async function runBeforeShellHookFromStdin() {
|
|
|
35
35
|
}
|
|
36
36
|
const [policy, policyRevision] = await Promise.all([loadPoliciesV1(), readPoliciesV1Revision()]);
|
|
37
37
|
const analysis = analyzeShellCommand(command, policy);
|
|
38
|
+
rememberActiveWorkspace({
|
|
39
|
+
cwd: typeof payload.cwd === "string" ? payload.cwd : undefined,
|
|
40
|
+
});
|
|
38
41
|
const storageRoot = resolveGuardStorageRoot(typeof payload.cwd === "string" ? payload.cwd : undefined);
|
|
42
|
+
rememberResolvedWorkspaceRoot(storageRoot);
|
|
39
43
|
if (analysis.skipped) {
|
|
40
44
|
await handleSkippedShellHook({
|
|
41
45
|
payload,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,
|
|
1
|
+
{"version":3,"file":"run-before-shell.js","sourceRoot":"","sources":["../../src/hooks/run-before-shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EACL,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAK5B,SAAS,gBAAgB,CAAC,IAAU;IAClC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,OAAO,GAAG,MAAM,aAAa,EAA+B,CAAC;IACnE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5E,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACtD,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU;YACV,cAAc;YACd,YAAY,EAAE,YAAY,IAAI,EAAE;YAChC,eAAe;SAChB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtD,uBAAuB,CAAC;QACtB,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,uBAAuB,CACzC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;IACF,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,sBAAsB,CAAC;YAC3B,OAAO;YACP,UAAU,EAAE,wBAAwB;YACpC,cAAc;YACd,YAAY,EAAE,WAAW;YACzB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,MAAM,IAAI,GAAS,QAAQ,CAAC,IAAI,CAAC;IAEjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtF,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnG,IAAI,UAAU,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,cAAc,GAAoD,IAAI,CAAC;IAE3E,IAAI,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,cAAc;YACd,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC/C,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,YAAY,GAAG,mCAAmC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7E,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM;QACnB,CAAC,CAAC,sBAAsB,CAAC;YACrB,IAAI,EAAE,sBAAsB;YAC5B,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,cAAc;SACf,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GACZ,UAAU,KAAK,OAAO;QACpB,CAAC,CAAC;YACE,UAAU;YACV,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QACH,CAAC,CAAC;YACE,UAAU;YACV,YAAY,EAAE,YAAa,CAAC,YAAY;YACxC,aAAa,EAAE,YAAa,CAAC,aAAa;SAC3C,CAAC;IAER,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IACvD,MAAM,mBAAmB,CACvB;QACE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;QACJ,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI;QACJ,UAAU;QACV,cAAc;QACd,iBAAiB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;QACrD,OAAO;QACP,oBAAoB,EAAE,kBAAkB;QACxC,UAAU;KACX,EACD,WAAW,CACZ,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,cAAc,CAAC;QACnB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,IAAI,EAAE,cAAc;QACpB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI;QAC1B,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,IAAI;QACJ,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACpD,UAAU;QACV,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE;YACJ,IAAI,EAAE,sBAAsB;YAC5B,cAAc;YACd,mBAAmB,EAAE,cAAc,EAAE,UAAU,IAAI,IAAI;YACvD,oBAAoB,EAAE,kBAAkB;YACxC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;SAC9C;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,0DAA0D;QACxE,aAAa,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,EAAE;KACpD,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"evaluate-guard.d.ts","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAqC,MAAM,oBAAoB,CAAC;AAkBvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,CAAC;AA+CF,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAwKnE"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { v4 as uuidv4 } from "uuid";
|
|
2
2
|
import { loadPoliciesV1, readPoliciesV1Revision } from "../policy/index.js";
|
|
3
|
-
import {
|
|
3
|
+
import { rememberResolvedWorkspaceRoot, resolveGuardStorageRootFromHints, } from "../bridge/guard-storage-root.js";
|
|
4
4
|
import { evaluateMcpProposal, evaluateShellProposal } from "../shell/evaluate.js";
|
|
5
5
|
import { sendGuardEvent } from "../telemetry/guard-events.js";
|
|
6
6
|
import { getInstallId } from "../cli/install-id.js";
|
|
@@ -55,7 +55,12 @@ export async function evaluateGuard(input, policyState) {
|
|
|
55
55
|
resetHeartbeatIdle();
|
|
56
56
|
policyState.policy = await loadPoliciesV1();
|
|
57
57
|
policyState.policyRevision = await readPoliciesV1Revision();
|
|
58
|
-
const storageRoot =
|
|
58
|
+
const storageRoot = resolveGuardStorageRootFromHints({
|
|
59
|
+
cwd: input.proposal.cwd,
|
|
60
|
+
workspaceRoot: input.context?.workspace_root,
|
|
61
|
+
workspaceRoots: input.context?.workspace_roots,
|
|
62
|
+
});
|
|
63
|
+
rememberResolvedWorkspaceRoot(storageRoot);
|
|
59
64
|
const shellCommand = input.proposal.kind === "shell"
|
|
60
65
|
? input.proposal.raw_command ?? input.proposal.argv.join(" ")
|
|
61
66
|
: null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,
|
|
1
|
+
{"version":3,"file":"evaluate-guard.js","sourceRoot":"","sources":["../../src/mcp/evaluate-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAa,MAAM,oBAAoB,CAAC;AACvF,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAsB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,2BAA2B,CAAC;AAQnC,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAU;IAC7C,IAAI,OAAO;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAI5B;IACC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,eAAe,EAAE,OAAO;YACxB,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,oFAAoF;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,YAAY,EACV,mGAAmG;aACtG;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,WAAwB;IAExB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,kBAAkB,EAAE,CAAC;IAErB,WAAW,CAAC,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,WAAW,CAAC,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAE5D,MAAM,WAAW,GAAG,gCAAgC,CAAC;QACnD,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvB,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;QAC5C,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,eAAe;KAC/C,CAAC,CAAC;IACH,6BAA6B,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAChB,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAC7B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,YAAY;QAC7C,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;QAC3B,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,OAAO,GAAG,WAAW,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;IACjE,IAAI,UAAU,GAAG,WAAW,EAAE,UAAU,IAAI,SAAU,CAAC,UAAU,CAAC;IAClE,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAE7B,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;YACnC,UAAU,GAAG;gBACX,GAAG,UAAU;gBACb,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,cAAc,EAAE,gBAAgB,CAAC,cAAc;gBAC/C,KAAK,EAAE,gBAAgB,CAAC,KAAK;gBAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBAC/B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;oBACjF,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,4CAA4C;4BACrD,OAAO,EAAE;gCACP,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,YAAY,EAAE,gBAAgB,CAAC,cAAc,CAAC,YAAY;gCAC1D,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,IAAI;gCAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI;6BAC5B;yBACF;qBACF;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAS,UAAU,CAAC,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC;QAC3D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IACH,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC;IAC/C,MAAM,kBAAkB,GACtB,CAAC,OAAO;QACR,IAAI,KAAK,aAAa;QACtB,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,qBAAqB,KAAK,IAAI;QAC9B,UAAU,GAAG,CAAC,CAAC;IAEjB,IACE,kBAAkB;QAClB,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EACnF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,KAAK;YACjB,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,OAAO;YACP,oBAAoB,EAAE,QAAQ,EAAE,4BAA4B,IAAI,IAAI;SACrE,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QACzC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QACrC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,IAAI;QACJ,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACpC,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,KAAK,EAAE;YACL,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;SAC1C;QACD,SAAS,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IAEF,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,EAAE,OAAO;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI;QACtD,IAAI,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,KAAK,cAAc,CAAC;QAClB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM;QACN,OAAO;QACP,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,WAAW,EACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;aACtF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;QAC7B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,cAAc;QACxB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,QAAQ;QACR,SAAS,EAAE,YAAY,EAAE;QACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,GAAG,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI;YACrC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,cAAc,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,EAAE;YACJ,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;SACvD;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}
|
|
@@ -28,6 +28,8 @@ export declare const GuardInputSchema: z.ZodObject<{
|
|
|
28
28
|
agent_id: z.ZodOptional<z.ZodString>;
|
|
29
29
|
user_id: z.ZodOptional<z.ZodString>;
|
|
30
30
|
environment: z.ZodOptional<z.ZodString>;
|
|
31
|
+
workspace_root: z.ZodOptional<z.ZodString>;
|
|
32
|
+
workspace_roots: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
31
33
|
approval: z.ZodOptional<z.ZodObject<{
|
|
32
34
|
request_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
33
35
|
grant: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-schemas.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;EAAgC,CAAC;AAC7D,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAS3D,eAAO,MAAM,gBAAgB
|
|
1
|
+
{"version":3,"file":"guard-schemas.d.ts","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;;EAAgC,CAAC;AAC7D,eAAO,MAAM,kBAAkB;;;EAA2B,CAAC;AAS3D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,sBAAsB,QAUwD,CAAC;AAE5F,eAAO,MAAM,2BAA2B,QAKmE,CAAC"}
|
|
@@ -23,6 +23,8 @@ export const GuardInputSchema = z.object({
|
|
|
23
23
|
agent_id: z.string().optional(),
|
|
24
24
|
user_id: z.string().optional(),
|
|
25
25
|
environment: z.string().optional(),
|
|
26
|
+
workspace_root: z.string().optional(),
|
|
27
|
+
workspace_roots: z.array(z.string()).optional(),
|
|
26
28
|
approval: ApprovalContextSchema,
|
|
27
29
|
wait_ms: z.number().int().nonnegative().optional(),
|
|
28
30
|
tool_input_sha256: z.string().nullable().optional(),
|
|
@@ -31,7 +33,9 @@ export const GuardInputSchema = z.object({
|
|
|
31
33
|
});
|
|
32
34
|
export const GUARD_TOOL_DESCRIPTION = "Praxis policy gatekeeper. Call this BEFORE you run any shell command or state-changing " +
|
|
33
35
|
"action on the user's behalf, including actions you would run via other tools or connectors. " +
|
|
34
|
-
"Pass the exact `argv` you intend to run with `mode: \"enforce\"
|
|
36
|
+
"Pass the exact `argv` you intend to run with `mode: \"enforce\"`, and set `proposal.cwd` " +
|
|
37
|
+
"(or `context.workspace_root`) to the workspace/repo root so execution tickets land where hooks read them. " +
|
|
38
|
+
"Then obey the response: " +
|
|
35
39
|
"if `decision` is `block`, do NOT run the command; if `require_approval`, call `guard_wait` " +
|
|
36
40
|
"and wait for it to resolve; only proceed when `decision` is `allow`. " +
|
|
37
41
|
"(`mode: \"shadow\"` is a dry-run whose `decision` is always `allow`; the real verdict is in the " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-schemas.js","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GACjC,yFAAyF;IACzF,8FAA8F;IAC9F,
|
|
1
|
+
{"version":3,"file":"guard-schemas.js","sourceRoot":"","sources":["../../src/mcp/guard-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC/C,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;QAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,sBAAsB,GACjC,yFAAyF;IACzF,8FAA8F;IAC9F,2FAA2F;IAC3F,4GAA4G;IAC5G,0BAA0B;IAC1B,6FAA6F;IAC7F,uEAAuE;IACvE,kGAAkG;IAClG,oDAAoD;IACpD,yFAAyF,CAAC;AAE5F,MAAM,CAAC,MAAM,2BAA2B,GACtC,mGAAmG;IACnG,qGAAqG;IACrG,oGAAoG;IACpG,wGAAwG;IACxG,yGAAyG,CAAC"}
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|