@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.90

package/dist/hook-runtime/hooks/session-end.js

@@ -0,0 +1,495 @@
+#!/usr/bin/env node
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join as join3 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/daemon/principal.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/workos-connect.ts
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/daemon/principal.ts
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join3(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+
+// src/hooks/agent.ts
+function parseAgent(argv) {
+  const i = argv.indexOf("--agent");
+  const value = i !== -1 ? argv[i + 1] : void 0;
+  if (value === "codex" || value === "hermes") {
+    return value;
+  }
+  return "claude_code";
+}
+
+// src/hooks/normalize.ts
+import { createHash as createHash3 } from "crypto";
+var HERMES_EVENT_MAP = {
+  on_session_start: "SessionStart",
+  on_session_end: "SessionEnd",
+  pre_llm_call: "UserPromptSubmit",
+  post_llm_call: "Stop",
+  pre_tool_call: "PreToolUse",
+  post_tool_call: "PostToolUse",
+  subagent_stop: "SubagentStop"
+};
+function normalizeEnvelope(parsed, agent) {
+  if (agent === "codex") {
+    const event = parsed.hook_event_name;
+    if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
+      const stableToolIdentity = JSON.stringify([
+        parsed.session_id ?? null,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ]);
+      return {
+        ...parsed,
+        tool_use_id: `codex:fallback:v1:${createHash3("sha256").update(stableToolIdentity).digest("hex")}`
+      };
+    }
+    return parsed;
+  }
+  if (agent !== "hermes") {
+    return parsed;
+  }
+  const raw = parsed.hook_event_name;
+  if (typeof raw === "string" && raw in HERMES_EVENT_MAP) {
+    return { ...parsed, hook_event_name: HERMES_EVENT_MAP[raw] };
+  }
+  return parsed;
+}
+
+// src/hooks/session-end.ts
+var STDIN_TIMEOUT_MS = 1e3;
+var DAEMON_TIMEOUT_MS = 250;
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const timer = setTimeout(() => {
+      reject(new Error("stdin read timeout"));
+    }, STDIN_TIMEOUT_MS);
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => {
+      clearTimeout(timer);
+      resolve(Buffer.concat(chunks).toString("utf-8"));
+    });
+    process.stdin.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+function emit() {
+  process.stdout.write("{}\n");
+}
+async function main() {
+  const agent = parseAgent(process.argv);
+  let raw;
+  try {
+    raw = await readStdin();
+  } catch {
+    emit();
+    return;
+  }
+  let envelope;
+  try {
+    envelope = normalizeEnvelope(
+      JSON.parse(raw),
+      agent
+    );
+  } catch {
+    emit();
+    return;
+  }
+  if (envelope.hook_event_name !== "SessionEnd") {
+    emit();
+    return;
+  }
+  if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
+    emit();
+    return;
+  }
+  await daemonRequest(
+    "session_end",
+    { sessionId: envelope.session_id },
+    { timeoutMs: DAEMON_TIMEOUT_MS }
+  );
+  emit();
+}
+main().catch(() => {
+  emit();
+});