@scopebond/hook 0.11.0 → 0.12.0

package/README.md

@@ -200,7 +200,20 @@ portal's **Connect** step (it gives you a one-use enrollment bundle), save it as
 npx @scopebond/hook connect https://<your-workspace> scopebond-enrollment.json
 ```
 
-In Windows PowerShell, use `npx.cmd` instead of `npx` if script execution policy blocks `npx.ps1`; no execution-policy change is needed. Enrollment registers both the gateway attester and the hook's separate agent signing key with proof of possession, so Cloud can verify authenticated receipts.
+In Windows PowerShell, use `npx.cmd` instead of `npx` if script execution policy blocks `npx.ps1`; no execution-policy change is needed. Every command the hook prints for you to run uses `npx.cmd` on Windows.
+
+### Is it delivering?
+
+`status` shows when this computer last delivered records, how many are waiting to send and the
+last problem. Records are never dropped from the queue while they wait: a long outage only makes
+the queue longer. If the workspace refuses this computer's connection (it was revoked, replaced or
+removed), `status` says **NOT DELIVERING** with the time it stopped and the one command that fixes
+it, which is signing in again. `doctor` also checks that the workspace still accepts the connection,
+not only that it is reachable, and fails when it does not.
+
+Signing in puts the hook in your user-level agent settings (`~/.claude/settings.json`, `~/.cursor/hooks.json` or `~/.codex/hooks.json`), so every project on this computer is checked; `--project` connects one project instead. Signing in again never rewrites a settings file that already holds the right hook entry.
+
+Enrollment registers both the gateway attester and the hook's separate agent signing key with proof of possession, so Cloud can verify authenticated receipts.
 
 `connect` does the whole setup in one command: it scaffolds `.scopebond/` if needed,
 enrolls this machine's countersigning key, stores a scoped machine credential in

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAiqBA,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAS7F"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAmqBA,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAS7F"}

package/dist/cli.js

@@ -52,6 +52,8 @@ import { runDispatchCommand } from "./dispatch-cli.js";
 import { describeAction } from "./explain.js";
 import { ensureDurableRuntime, pinnedCliPath, isEphemeralPath } from "./runtime-install.js";
 import { cliCommand, hookCommand, hookVersion } from "./version.js";
+import { recordRulesCredential } from "./delivery-state.js";
+import { describeDelivery } from "./delivery-report.js";
 import { computeManifest, renderManifest } from "./capabilities.js";
 import { runProofFixtures, loadProofs, saveProofs, proofPassed, deliverProofReceipts } from "./proof.js";
 import { fileURLToPath } from "node:url";
@@ -920,7 +922,14 @@ async function finishConnect(dir, url, bundle, harness, args) {
             console.log(`✓ ${harnessName(harness)} already configured in ${existing}`);
         }
         else if (!args.includes("--no-install")) {
-            const { file } = placeHook(harness, process.cwd(), undefined);
+            // A connection for this computer (the user home, the default) covers every project,
+            // so the hook goes into the user-level agent settings. Placing it in the current
+            // folder's project settings — what this did before — left every other project
+            // unchecked, and a sign-in run from a scratch folder governed only that folder.
+            // `--project` (a per-project connection) keeps the project placement.
+            const file = dir === userHome()
+                ? writeHarnessConfig(userHarnessFile(harness), harness, durableHookCommand(harness))
+                : placeHook(harness, process.cwd(), undefined).file;
             console.log(`✓ ${harnessName(harness)} configured in ${file}`);
             if (harness === "codex")
                 console.log(`\nOne last step: ${codexTrustStep}`);
@@ -1279,16 +1288,17 @@ function cliPath() {
 /** `install` — the once-per-machine, user-level install (SB112). Scaffolds the
  *  user home and registers the hook by absolute path in the user-level agent config,
  *  so every project a developer opens is governed without a per-repo `init`. */
+/** The command a user-level agent setting runs. Run through `npx`, this CLI lives in npm's
+ *  throwaway cache; registering that path would leave a hook that stops starting whenever
+ *  npm clears it — and a hook that cannot start lets every action through. Pin the durable
+ *  copy, as `init` does, and fall back to the portable `npx` command when none can be made. */
+function durableHookCommand(h) {
+    const pin = ensureDurableRuntime(cliPath(), hookVersion());
+    return pin.cli ? absoluteHookCommand(pin.cli, h) : hookCommand(h);
+}
 function runInstall(args) {
     const dir = userHome();
-    // Run through `npx`, this CLI lives in npm's throwaway cache; registering that path
-    // would leave a hook that stops starting whenever npm clears it — and a hook that
-    // cannot start lets every action through. Pin the durable copy, as `init` does, and
-    // fall back to the portable `npx` command when none can be made.
-    const commandFor = (h) => {
-        const pin = ensureDurableRuntime(cliPath(), hookVersion());
-        return pin.cli ? absoluteHookCommand(pin.cli, h) : hookCommand(h);
-    };
+    const commandFor = durableHookCommand;
     const harnessesFor = () => args.includes("--codex") ? ["codex"]
         : args.includes("--cursor") ? ["cursor"]
             : args.includes("--claude") ? ["claude"]
@@ -1393,6 +1403,13 @@ function runStatus() {
     console.log(`  Cursor           ${harnessScopeLabel(cursor) || (cursorDetected() ? "detected, not configured" : "not detected")}`);
     console.log(`  Codex            ${codex.project || codex.user ? `${harnessScopeLabel(codex)} — approve once with /hooks` : codexDetected() ? "detected, not configured" : "not detected"}`);
     console.log(`  cloud workspace  ${connected ? "connected" : "not connected (local only)"}`);
+    {
+        const activeDir = resolveConfigDir(process.cwd());
+        const connection = loadConnection(activeDir);
+        if (connection)
+            for (const line of describeDelivery(activeDir, connection).lines)
+                console.log(`                   ${line}`);
+    }
     {
         const activeDir = resolveConfigDir(process.cwd());
         const meta = readMeta(activeDir);
@@ -1557,6 +1574,33 @@ async function runDoctor() {
             reachable = `unreachable (${error.message})`;
         }
         console.log(`  cloud            ${connection.url} — ${reachable}`);
+        // SB273: an authenticated check. Reaching the workspace says nothing about whether it
+        // still accepts this computer; the rules endpoint answers 401 when it does not.
+        let accepted = "unknown";
+        try {
+            const res = await fetch(new URL("/v1/policy", connection.url).toString(), {
+                headers: { authorization: `Bearer ${connection.credential}`, "x-scopebond-hook-version": hookVersion() },
+                redirect: "error", signal: AbortSignal.timeout(10_000),
+            });
+            if (res.status === 401) {
+                accepted = "REFUSED (401)";
+                recordRulesCredential(active, false, Date.now());
+            }
+            else if (res.ok || res.status === 204 || res.status === 304) {
+                accepted = "accepted";
+                recordRulesCredential(active, true, Date.now());
+            }
+            else
+                accepted = `unknown (HTTP ${res.status})`;
+        }
+        catch (error) {
+            accepted = `not checked (${error.message})`;
+        }
+        console.log(`  connection       ${accepted}`);
+        const delivery = describeDelivery(active, connection);
+        for (const line of delivery.lines)
+            console.log(`                   ${line}`);
+        problems.push(...delivery.problems);
     }
     console.log(problems.length ? `\n${problems.length} problem(s): ${problems.join("; ")}` : `\nAll good.`);
     process.exitCode = problems.length ? 1 : 0;
@@ -1630,6 +1674,12 @@ async function runLogin(args) {
         });
         return { status: response.status, json: await response.json().catch(() => ({})) };
     };
+    // SB276: run from inside an agent session (its own terminal or tool call), a sign-in can
+    // land in the agent's working folder rather than this person's, and the person may never
+    // see the code to approve. Say so plainly; the hook settings are left alone either way.
+    if (process.env.CLAUDECODE || process.env.CODEX_SANDBOX || process.env.CURSOR_AGENT) {
+        console.error("Note: this looks like a coding agent's own terminal. Signing in works best from your own terminal window, outside the agent.");
+    }
     let start;
     try {
         start = await post("/v1/device/code", { client_name: hostname(), harness });