@scopebond/hook 0.2.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Avouro LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,74 @@
+# @scopebond/hook
+
+The Scopebond connector for **Claude Code** and **Cursor**. It checks every tool
+call a coding agent makes against your policy *before it runs*, blocks the ones
+outside policy, and records a signed receipt — locally, on the machine, and
+optionally mirrored to your Scopebond Cloud workspace for monitoring.
+
+- **Label:** in-path · prevents (a Claude Code `PreToolUse` deny via exit code 2
+  blocks even in bypass-permissions mode).
+- **Ceiling:** it governs actions the harness routes through its tool system
+  (shell, file, MCP, web). A process started outside the harness is not covered.
+
+## Enroll
+
+```
+npx @scopebond/hook init            # Claude Code (or: init --cursor)
+```
+
+`init` scaffolds `.scopebond/` (a machine signing key, a countersigning key, a
+starter policy — "protect main and production paths" — and a `.gitignore` so none
+of it is committed) and prints the hook configuration to add to
+`.claude/settings.json` or `.cursor/hooks.json`. Then run one safe command in the
+agent and see the receipt in `.scopebond/receipts.db`.
+
+## Connect it to your workspace (optional)
+
+To see the receipts in your hosted Scopebond workspace, create a connection from
+the portal's **Connect** step (it gives you a one-use enrollment bundle), save it
+as `scopebond-enrollment.json`, then:
+
+```
+npx @scopebond/hook connect https://<your-workspace> scopebond-enrollment.json
+```
+
+`connect` scaffolds `.scopebond/` if needed, enrolls this machine's countersigning
+key with the workspace, and stores a scoped machine credential in
+`.scopebond/cloud.json` (a secret — never commit it). From then on every receipt is
+mirrored to the workspace through a **durable outbox**: delivery is best-effort and
+never blocks a tool call, and receipts are retained locally and retried if the
+workspace is unreachable. `scopebond-hook flush` delivers anything still queued —
+run it on a session-end hook (and set `SCOPEBOND_HOOK_FLUSH_MS=0`) if you want zero
+per-call latency.
+
+## How it works
+
+Each tool call is mapped to a normalized [Action Taxonomy](https://github.com/avouro-com/scopebond)
+action (`shell.exec`, `git.push`, `file.write`, `mcp.tool.call`, …), signed by the
+machine key and decided against your policy by an in-process check-only gateway.
+An allowed action is a **cooperative allow** (recorded, never executed by the
+hook — the agent performs it); a denied action is blocked. Unknown tools are
+recorded as *not evaluated* and grant nothing. Anything unexpected fails closed
+(deny) with a repair message.
+
+Commands are stored as a scrubbed head plus a digest; file contents are never
+stored; common secret shapes are removed before signing.
+
+**Strict mode.** By default a tool with no taxonomy mapping is recorded *not
+evaluated* (not blocked). Add `--strict` (or `SCOPEBOND_HOOK_STRICT=1`) to deny
+unmapped tools too — fail-closed coverage for anything the taxonomy does not map.
+
+## Library
+
+The mapper and runtime are exported for testing and embedding:
+
+```js
+import { mapClaudeToolUse, createHookRuntime } from "@scopebond/hook";
+```
+
+`mapClaudeToolUse` / `mapCursorEvent` are pure functions (native payload →
+normalized action). `createHookRuntime` builds the check-only gateway from a
+policy, a machine key and a local receipt log; pass `cloud: { connection }` (from
+`connectCloud`) to mirror receipts to a workspace.
+
+Experimental alpha; controlled test use only.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+// scopebond-hook — govern a coding agent's tool calls against policy, in-path,
+// before they run, with a signed local receipt.
+//
+//   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)
+//   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)
+//   scopebond-hook init [--cursor]            scaffold keys + starter policy, print the config
+//   scopebond-hook connect <url> <bundle.json> [--cursor]
+//                                             enroll with a Cloud workspace and start exporting
+//   scopebond-hook flush                      deliver any queued receipts to Cloud now
+//
+// Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond
+// Fail-closed: any error denies the action with a repair message.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+import { createHookRuntime } from "./runtime.js";
+import { scaffold, harnessSnippet } from "./init.js";
+import { connectCloud, loadConnection, connectionPath } from "./cloud.js";
+function configDir() {
+    return process.env.SCOPEBOND_HOOK_DIR ?? join(process.cwd(), ".scopebond");
+}
+function runtimePaths(dir) {
+    const connection = loadConnection(dir);
+    return {
+        policyPath: join(dir, "policy.json"),
+        keyPath: join(dir, "agent.key"),
+        attesterPath: join(dir, "attester.key"),
+        dbPath: join(dir, "receipts.db"),
+        // Strict: deny (not just observe) tools with no taxonomy mapping.
+        strict: process.argv.includes("--strict") || process.env.SCOPEBOND_HOOK_STRICT === "1",
+        // When connected, auto-export receipts. A short bounded flush keeps the hot path
+        // fast; undelivered receipts persist in the durable outbox and flush next time
+        // (or via `scopebond-hook flush`, e.g. on a session-end hook).
+        ...(connection ? { cloud: { connection, flushTimeoutMs: Number(process.env.SCOPEBOND_HOOK_FLUSH_MS ?? 800) } } : {}),
+    };
+}
+function readStdin() {
+    try {
+        return readFileSync(0, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function denyClaude(reason) {
+    process.stdout.write(JSON.stringify({
+        hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason },
+    }) + "\n");
+    process.stderr.write(`Scopebond: ${reason}\n`);
+    process.exit(2);
+}
+async function runClaude() {
+    let input;
+    try {
+        input = JSON.parse(readStdin());
+    }
+    catch {
+        denyClaude("hook received invalid JSON on stdin");
+    }
+    try {
+        const runtime = createHookRuntime(runtimePaths(configDir()));
+        const decision = await runtime.evaluate(mapClaudeToolUse(input));
+        await runtime.flush();
+        if (decision.decision === "deny")
+            denyClaude(decision.reason);
+        if (decision.decision === "allow") {
+            process.stdout.write(JSON.stringify({
+                hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", permissionDecisionReason: decision.reason },
+            }) + "\n");
+            process.exit(0);
+        }
+        // not_evaluated: defer to the harness default (grant nothing, block nothing).
+        process.exit(0);
+    }
+    catch (error) {
+        denyClaude(`Scopebond hook failed closed: ${error.message}. Repair: run \`scopebond-hook init\`.`);
+    }
+}
+async function runCursor() {
+    let input = {};
+    try {
+        input = JSON.parse(readStdin());
+    }
+    catch { /* fall through to fail-closed deny below */ }
+    const event = String(input?.hook_event_name ?? input?.event ?? process.argv[3] ?? "");
+    let permission = "deny";
+    let message = "Scopebond hook failed closed";
+    try {
+        const runtime = createHookRuntime(runtimePaths(configDir()));
+        const decision = await runtime.evaluate(mapCursorEvent(event, input));
+        await runtime.flush();
+        permission = decision.decision === "deny" ? "deny" : decision.decision === "allow" ? "allow" : "ask";
+        message = decision.reason;
+    }
+    catch (error) {
+        permission = "deny";
+        message = `Scopebond hook failed closed: ${error.message}. Repair: run \`scopebond-hook init\`.`;
+    }
+    process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + "\n");
+    process.exit(0);
+}
+function runInit(args) {
+    const harness = args.includes("--cursor") ? "cursor" : "claude";
+    const dir = configDir();
+    const { agentKid, policyPath } = scaffold(dir, { force: args.includes("--force") });
+    console.log(`Scopebond hook enrolled in ${dir}`);
+    console.log(`  machine key    ${agentKid}`);
+    console.log(`  policy         ${policyPath} (starter — edit the limits)`);
+    console.log("");
+    console.log(`Add this to your ${harness === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+    console.log(harnessSnippet(harness));
+    console.log("");
+    console.log("Then run one safe command in the agent and see the receipt in .scopebond/receipts.db.");
+    console.log("To send receipts to your workspace, run: scopebond-hook connect <workspace-url> scopebond-enrollment.json");
+}
+async function runConnect(args) {
+    const positional = args.filter((a) => !a.startsWith("--"));
+    const url = positional[0];
+    const bundleFile = positional[1];
+    if (!url) {
+        console.error("usage: scopebond-hook connect <workspace-url> <enrollment-bundle.json> [--cursor]");
+        process.exit(1);
+    }
+    const dir = configDir();
+    // One command sets everything up: scaffold the key, attester and starter policy if
+    // they do not exist, then enroll and persist the scoped machine credential.
+    scaffold(dir, {});
+    let bundleText;
+    try {
+        bundleText = bundleFile ? readFileSync(bundleFile, "utf8") : readStdin();
+    }
+    catch {
+        console.error(`could not read the enrollment bundle${bundleFile ? ` from ${bundleFile}` : " on stdin"}`);
+        process.exit(1);
+    }
+    let bundle;
+    try {
+        bundle = JSON.parse(bundleText);
+    }
+    catch {
+        console.error("the enrollment bundle is not valid JSON");
+        process.exit(1);
+    }
+    try {
+        const c = await connectCloud(dir, url, bundle);
+        console.log(`Connected to ${c.url}`);
+        console.log(`  workspace     org ${c.organization_id} · env ${c.environment_id}`);
+        console.log(`  gateway id    ${c.gateway_id}`);
+        console.log(`  attester kid  ${c.attester_kid}`);
+        console.log(`  credential    stored in ${connectionPath(dir)} — a secret, do not commit`);
+        console.log("");
+        console.log(`Add this to your ${args.includes("--cursor") ? ".cursor/hooks.json" : ".claude/settings.json"}:`);
+        console.log(harnessSnippet(args.includes("--cursor") ? "cursor" : "claude"));
+        console.log("");
+        console.log("Run one safe command in the agent; the receipt appears in your workspace within seconds.");
+    }
+    catch (error) {
+        console.error(`connect failed: ${error.message}`);
+        process.exit(1);
+    }
+}
+async function runFlush() {
+    const dir = configDir();
+    if (!loadConnection(dir)) {
+        console.error("not connected to a workspace; run `scopebond-hook connect` first");
+        process.exit(1);
+    }
+    const runtime = createHookRuntime(runtimePaths(dir));
+    await runtime.exporter?.flush();
+    const status = runtime.exporter?.status();
+    console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : ""}`);
+    process.exit(status && status.pending > 0 ? 1 : 0);
+}
+const [cmd, ...rest] = process.argv.slice(2);
+if (cmd === "claude") {
+    await runClaude();
+}
+else if (cmd === "cursor") {
+    await runCursor();
+}
+else if (cmd === "init") {
+    runInit(rest);
+}
+else if (cmd === "connect") {
+    await runConnect(rest);
+}
+else if (cmd === "flush") {
+    await runFlush();
+}
+else {
+    console.error("usage: scopebond-hook <claude|cursor|init|connect|flush> [--cursor] [--force] [--strict]");
+    process.exit(1);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,wFAAwF;AACxF,+FAA+F;AAC/F,0DAA0D;AAC1D,gGAAgG;AAChG,uFAAuF;AACvF,EAAE;AACF,qDAAqD;AACrD,kEAAkE;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1E,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC;AACD,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;QAChC,kEAAkE;QAClE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG;QACtF,iFAAiF;QACjF,+EAA+E;QAC/E,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC;AACD,SAAS,SAAS;IAChB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE;KAClH,CAAC,GAAG,IAAI,CAAC,CAAC;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,UAAU,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAM,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM;YAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAClC,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,CAAC,MAAM,EAAE;aAC5H,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,IAAI,KAAK,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,KAAK,EAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,UAAU,GAA6B,MAAM,CAAC;IAClD,IAAI,OAAO,GAAG,8BAA8B,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,UAAU,GAAG,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACrG,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,MAAM,CAAC;QACpB,OAAO,GAAG,iCAAkC,KAAe,CAAC,OAAO,wCAAwC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,8BAA8B,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC;AAC3H,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,mFAAmF;IACnF,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,UAAU,CAAC,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpI,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA0B,CAAC;IAAC,CAAC;IACjE,MAAM,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,eAAe,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;QAC/G,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjI,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,OAAO,IAAI,CAAC,4BAA4B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7C,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;IAAC,MAAM,SAAS,EAAE,CAAC;AAAC,CAAC;KAC5C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;IAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AAAC,CAAC;KAClD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;IAAC,MAAM,QAAQ,EAAE,CAAC;AAAC,CAAC;KAC1C,CAAC;IACJ,OAAO,CAAC,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["#!/usr/bin/env node\n// scopebond-hook — govern a coding agent's tool calls against policy, in-path,\n// before they run, with a signed local receipt.\n//\n//   scopebond-hook claude                     evaluate a Claude Code PreToolUse call (stdin JSON)\n//   scopebond-hook cursor                     evaluate a Cursor hook event (stdin JSON)\n//   scopebond-hook init [--cursor]            scaffold keys + starter policy, print the config\n//   scopebond-hook connect <url> <bundle.json> [--cursor]\n//                                             enroll with a Cloud workspace and start exporting\n//   scopebond-hook flush                      deliver any queued receipts to Cloud now\n//\n// Config dir: $SCOPEBOND_HOOK_DIR, else ./.scopebond\n// Fail-closed: any error denies the action with a repair message.\n\nimport { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { CloudEnrollmentBundle } from \"@scopebond/gateway\";\nimport { mapClaudeToolUse, mapCursorEvent } from \"./map.js\";\nimport { createHookRuntime } from \"./runtime.js\";\nimport { scaffold, harnessSnippet } from \"./init.js\";\nimport { connectCloud, loadConnection, connectionPath } from \"./cloud.js\";\n\nfunction configDir(): string {\n  return process.env.SCOPEBOND_HOOK_DIR ?? join(process.cwd(), \".scopebond\");\n}\nfunction runtimePaths(dir: string) {\n  const connection = loadConnection(dir);\n  return {\n    policyPath: join(dir, \"policy.json\"),\n    keyPath: join(dir, \"agent.key\"),\n    attesterPath: join(dir, \"attester.key\"),\n    dbPath: join(dir, \"receipts.db\"),\n    // Strict: deny (not just observe) tools with no taxonomy mapping.\n    strict: process.argv.includes(\"--strict\") || process.env.SCOPEBOND_HOOK_STRICT === \"1\",\n    // When connected, auto-export receipts. A short bounded flush keeps the hot path\n    // fast; undelivered receipts persist in the durable outbox and flush next time\n    // (or via `scopebond-hook flush`, e.g. on a session-end hook).\n    ...(connection ? { cloud: { connection, flushTimeoutMs: Number(process.env.SCOPEBOND_HOOK_FLUSH_MS ?? 800) } } : {}),\n  };\n}\nfunction readStdin(): string {\n  try { return readFileSync(0, \"utf8\"); } catch { return \"\"; }\n}\n\nfunction denyClaude(reason: string): never {\n  process.stdout.write(JSON.stringify({\n    hookSpecificOutput: { hookEventName: \"PreToolUse\", permissionDecision: \"deny\", permissionDecisionReason: reason },\n  }) + \"\\n\");\n  process.stderr.write(`Scopebond: ${reason}\\n`);\n  process.exit(2);\n}\n\nasync function runClaude(): Promise<void> {\n  let input: Record<string, unknown>;\n  try { input = JSON.parse(readStdin()); } catch { denyClaude(\"hook received invalid JSON on stdin\"); }\n  try {\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(mapClaudeToolUse(input!));\n    await runtime.flush();\n    if (decision.decision === \"deny\") denyClaude(decision.reason);\n    if (decision.decision === \"allow\") {\n      process.stdout.write(JSON.stringify({\n        hookSpecificOutput: { hookEventName: \"PreToolUse\", permissionDecision: \"allow\", permissionDecisionReason: decision.reason },\n      }) + \"\\n\");\n      process.exit(0);\n    }\n    // not_evaluated: defer to the harness default (grant nothing, block nothing).\n    process.exit(0);\n  } catch (error) {\n    denyClaude(`Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`);\n  }\n}\n\nasync function runCursor(): Promise<void> {\n  let input: Record<string, unknown> = {};\n  try { input = JSON.parse(readStdin()); } catch { /* fall through to fail-closed deny below */ }\n  const event = String(input?.hook_event_name ?? input?.event ?? process.argv[3] ?? \"\");\n  let permission: \"allow\" | \"deny\" | \"ask\" = \"deny\";\n  let message = \"Scopebond hook failed closed\";\n  try {\n    const runtime = createHookRuntime(runtimePaths(configDir()));\n    const decision = await runtime.evaluate(mapCursorEvent(event, input));\n    await runtime.flush();\n    permission = decision.decision === \"deny\" ? \"deny\" : decision.decision === \"allow\" ? \"allow\" : \"ask\";\n    message = decision.reason;\n  } catch (error) {\n    permission = \"deny\";\n    message = `Scopebond hook failed closed: ${(error as Error).message}. Repair: run \\`scopebond-hook init\\`.`;\n  }\n  process.stdout.write(JSON.stringify({ permission, agentMessage: message }) + \"\\n\");\n  process.exit(0);\n}\n\nfunction runInit(args: string[]): void {\n  const harness = args.includes(\"--cursor\") ? \"cursor\" : \"claude\";\n  const dir = configDir();\n  const { agentKid, policyPath } = scaffold(dir, { force: args.includes(\"--force\") });\n  console.log(`Scopebond hook enrolled in ${dir}`);\n  console.log(`  machine key    ${agentKid}`);\n  console.log(`  policy         ${policyPath} (starter — edit the limits)`);\n  console.log(\"\");\n  console.log(`Add this to your ${harness === \"cursor\" ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n  console.log(harnessSnippet(harness));\n  console.log(\"\");\n  console.log(\"Then run one safe command in the agent and see the receipt in .scopebond/receipts.db.\");\n  console.log(\"To send receipts to your workspace, run: scopebond-hook connect <workspace-url> scopebond-enrollment.json\");\n}\n\nasync function runConnect(args: string[]): Promise<void> {\n  const positional = args.filter((a) => !a.startsWith(\"--\"));\n  const url = positional[0];\n  const bundleFile = positional[1];\n  if (!url) {\n    console.error(\"usage: scopebond-hook connect <workspace-url> <enrollment-bundle.json> [--cursor]\");\n    process.exit(1);\n  }\n  const dir = configDir();\n  // One command sets everything up: scaffold the key, attester and starter policy if\n  // they do not exist, then enroll and persist the scoped machine credential.\n  scaffold(dir, {});\n  let bundleText: string;\n  try { bundleText = bundleFile ? readFileSync(bundleFile, \"utf8\") : readStdin(); }\n  catch { console.error(`could not read the enrollment bundle${bundleFile ? ` from ${bundleFile}` : \" on stdin\"}`); process.exit(1); }\n  let bundle: CloudEnrollmentBundle;\n  try { bundle = JSON.parse(bundleText) as CloudEnrollmentBundle; }\n  catch { console.error(\"the enrollment bundle is not valid JSON\"); process.exit(1); }\n  try {\n    const c = await connectCloud(dir, url, bundle);\n    console.log(`Connected to ${c.url}`);\n    console.log(`  workspace     org ${c.organization_id} · env ${c.environment_id}`);\n    console.log(`  gateway id    ${c.gateway_id}`);\n    console.log(`  attester kid  ${c.attester_kid}`);\n    console.log(`  credential    stored in ${connectionPath(dir)} — a secret, do not commit`);\n    console.log(\"\");\n    console.log(`Add this to your ${args.includes(\"--cursor\") ? \".cursor/hooks.json\" : \".claude/settings.json\"}:`);\n    console.log(harnessSnippet(args.includes(\"--cursor\") ? \"cursor\" : \"claude\"));\n    console.log(\"\");\n    console.log(\"Run one safe command in the agent; the receipt appears in your workspace within seconds.\");\n  } catch (error) {\n    console.error(`connect failed: ${(error as Error).message}`);\n    process.exit(1);\n  }\n}\n\nasync function runFlush(): Promise<void> {\n  const dir = configDir();\n  if (!loadConnection(dir)) { console.error(\"not connected to a workspace; run `scopebond-hook connect` first\"); process.exit(1); }\n  const runtime = createHookRuntime(runtimePaths(dir));\n  await runtime.exporter?.flush();\n  const status = runtime.exporter?.status();\n  console.log(`flushed; ${status?.pending ?? 0} receipt(s) still pending${status?.lastError ? ` (last error: ${status.lastError})` : \"\"}`);\n  process.exit(status && status.pending > 0 ? 1 : 0);\n}\n\nconst [cmd, ...rest] = process.argv.slice(2);\nif (cmd === \"claude\") { await runClaude(); }\nelse if (cmd === \"cursor\") { await runCursor(); }\nelse if (cmd === \"init\") { runInit(rest); }\nelse if (cmd === \"connect\") { await runConnect(rest); }\nelse if (cmd === \"flush\") { await runFlush(); }\nelse {\n  console.error(\"usage: scopebond-hook <claude|cursor|init|connect|flush> [--cursor] [--force] [--strict]\");\n  process.exit(1);\n}\n"]}

package/dist/cloud.d.ts

@@ -0,0 +1,23 @@
+import { type CloudEnrollmentBundle, type CloudEnrollmentResult, type CloudExporter, type ReceiptStore } from "@scopebond/gateway";
+/** The persisted connection between this machine and a Cloud workspace. Holds the
+ *  scoped machine credential; treat cloud.json as a secret (written 0600). */
+export interface HookConnection extends CloudEnrollmentResult {
+    url: string;
+}
+export declare const connectionPath: (dir: string) => string;
+/** Read the persisted connection, or null when the hook is not connected to Cloud. */
+export declare function loadConnection(dir: string): HookConnection | null;
+/** Enroll the machine's attester with a workspace using the portal's one-use handoff,
+ *  then persist the scoped machine credential. The attester whose possession is proved
+ *  here is the same key the hook countersigns receipts with, so ingest accepts them. */
+export declare function connectCloud(dir: string, url: string, bundle: CloudEnrollmentBundle, fetchImpl?: typeof fetch): Promise<HookConnection>;
+/** Wrap a receipt store so every stored receipt is enqueued to a durable outbox and
+ *  exported to Cloud. Returns the wrapped store and the exporter (flush + stop). */
+export declare function attachExporter(outboxDbPath: string, connection: HookConnection, store: ReceiptStore, fetchImpl?: typeof fetch): {
+    store: ReceiptStore;
+    exporter: CloudExporter;
+};
+/** Attempt delivery with a bounded timeout so a per-invocation hook never hangs the
+ *  agent; undelivered receipts stay in the durable outbox and flush next time. */
+export declare function flushBounded(exporter: CloudExporter, timeoutMs?: number): Promise<void>;
+//# sourceMappingURL=cloud.d.ts.map

package/dist/cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../src/cloud.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAC9F,MAAM,oBAAoB,CAAC;AAG5B;8EAC8E;AAC9E,MAAM,WAAW,cAAe,SAAQ,qBAAqB;IAC3D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,MAAiC,CAAC;AAE/E,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAQjE;AAED;;wFAEwF;AACxF,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,GAChF,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED;oFACoF;AACpF,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,OAAO,KAAK,GAC9F;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,CAIlD;AAED;kFACkF;AAClF,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F"}

package/dist/cloud.js

@@ -0,0 +1,49 @@
+// scopebond-hook → Scopebond Cloud: enroll the machine's countersigning key with a
+// workspace and auto-export signed receipts to the hosted portal, so a connected
+// hook starts monitoring automatically. Reuses the gateway's enrollment and bounded
+// durable exporter (D40 — no new transport). The machine credential and the complete
+// receipt log stay local-first; export is best-effort and never blocks a tool call.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { completeCloudEnrollment, createCloudExporter, withCloudExporter, } from "@scopebond/gateway";
+import { SqliteCloudOutbox, loadOrCreateAttester } from "@scopebond/gateway/node";
+export const connectionPath = (dir) => join(dir, "cloud.json");
+/** Read the persisted connection, or null when the hook is not connected to Cloud. */
+export function loadConnection(dir) {
+    const path = connectionPath(dir);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof parsed.url === "string" && typeof parsed.credential === "string")
+            return parsed;
+    }
+    catch { /* fall through */ }
+    return null;
+}
+/** Enroll the machine's attester with a workspace using the portal's one-use handoff,
+ *  then persist the scoped machine credential. The attester whose possession is proved
+ *  here is the same key the hook countersigns receipts with, so ingest accepts them. */
+export async function connectCloud(dir, url, bundle, fetchImpl) {
+    const { attester } = loadOrCreateAttester({ file: join(dir, "attester.key") });
+    const result = await completeCloudEnrollment({ url, bundle, attester, fetch: fetchImpl });
+    const connection = { url, ...result };
+    writeFileSync(connectionPath(dir), JSON.stringify(connection, null, 2) + "\n", { mode: 0o600 });
+    return connection;
+}
+/** Wrap a receipt store so every stored receipt is enqueued to a durable outbox and
+ *  exported to Cloud. Returns the wrapped store and the exporter (flush + stop). */
+export function attachExporter(outboxDbPath, connection, store, fetchImpl) {
+    const outbox = new SqliteCloudOutbox(outboxDbPath);
+    const exporter = createCloudExporter({ url: connection.url, credential: connection.credential, outbox, fetch: fetchImpl });
+    return { store: withCloudExporter(store, exporter), exporter };
+}
+/** Attempt delivery with a bounded timeout so a per-invocation hook never hangs the
+ *  agent; undelivered receipts stay in the durable outbox and flush next time. */
+export async function flushBounded(exporter, timeoutMs = 3000) {
+    await Promise.race([
+        exporter.flush().catch(() => { }),
+        new Promise((resolve) => setTimeout(resolve, Math.max(0, timeoutMs)).unref?.()),
+    ]);
+}
+//# sourceMappingURL=cloud.js.map

package/dist/cloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../src/cloud.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,oFAAoF;AAEpF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,uBAAuB,EAAE,mBAAmB,EAAE,iBAAiB,GAEhE,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAQlF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAE/E,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QACjF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,MAAwB,CAAC;IAC/G,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;wFAEwF;AACxF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EAAE,GAAW,EAAE,MAA6B,EAAE,SAAwB;IAEjF,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAmB,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,cAAc,CAC5B,YAAoB,EAAE,UAA0B,EAAE,KAAmB,EAAE,SAAwB;IAE/F,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3H,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED;kFACkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB,EAAE,SAAS,GAAG,IAAI;IAC1E,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;QAChC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;KACtF,CAAC,CAAC;AACL,CAAC","sourcesContent":["// scopebond-hook → Scopebond Cloud: enroll the machine's countersigning key with a\n// workspace and auto-export signed receipts to the hosted portal, so a connected\n// hook starts monitoring automatically. Reuses the gateway's enrollment and bounded\n// durable exporter (D40 — no new transport). The machine credential and the complete\n// receipt log stay local-first; export is best-effort and never blocks a tool call.\n\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n  completeCloudEnrollment, createCloudExporter, withCloudExporter,\n  type CloudEnrollmentBundle, type CloudEnrollmentResult, type CloudExporter, type ReceiptStore,\n} from \"@scopebond/gateway\";\nimport { SqliteCloudOutbox, loadOrCreateAttester } from \"@scopebond/gateway/node\";\n\n/** The persisted connection between this machine and a Cloud workspace. Holds the\n *  scoped machine credential; treat cloud.json as a secret (written 0600). */\nexport interface HookConnection extends CloudEnrollmentResult {\n  url: string;\n}\n\nexport const connectionPath = (dir: string): string => join(dir, \"cloud.json\");\n\n/** Read the persisted connection, or null when the hook is not connected to Cloud. */\nexport function loadConnection(dir: string): HookConnection | null {\n  const path = connectionPath(dir);\n  if (!existsSync(path)) return null;\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf8\")) as Partial<HookConnection>;\n    if (typeof parsed.url === \"string\" && typeof parsed.credential === \"string\") return parsed as HookConnection;\n  } catch { /* fall through */ }\n  return null;\n}\n\n/** Enroll the machine's attester with a workspace using the portal's one-use handoff,\n *  then persist the scoped machine credential. The attester whose possession is proved\n *  here is the same key the hook countersigns receipts with, so ingest accepts them. */\nexport async function connectCloud(\n  dir: string, url: string, bundle: CloudEnrollmentBundle, fetchImpl?: typeof fetch,\n): Promise<HookConnection> {\n  const { attester } = loadOrCreateAttester({ file: join(dir, \"attester.key\") });\n  const result = await completeCloudEnrollment({ url, bundle, attester, fetch: fetchImpl });\n  const connection: HookConnection = { url, ...result };\n  writeFileSync(connectionPath(dir), JSON.stringify(connection, null, 2) + \"\\n\", { mode: 0o600 });\n  return connection;\n}\n\n/** Wrap a receipt store so every stored receipt is enqueued to a durable outbox and\n *  exported to Cloud. Returns the wrapped store and the exporter (flush + stop). */\nexport function attachExporter(\n  outboxDbPath: string, connection: HookConnection, store: ReceiptStore, fetchImpl?: typeof fetch,\n): { store: ReceiptStore; exporter: CloudExporter } {\n  const outbox = new SqliteCloudOutbox(outboxDbPath);\n  const exporter = createCloudExporter({ url: connection.url, credential: connection.credential, outbox, fetch: fetchImpl });\n  return { store: withCloudExporter(store, exporter), exporter };\n}\n\n/** Attempt delivery with a bounded timeout so a per-invocation hook never hangs the\n *  agent; undelivered receipts stay in the durable outbox and flush next time. */\nexport async function flushBounded(exporter: CloudExporter, timeoutMs = 3000): Promise<void> {\n  await Promise.race([\n    exporter.flush().catch(() => {}),\n    new Promise<void>((resolve) => setTimeout(resolve, Math.max(0, timeoutMs)).unref?.()),\n  ]);\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+export type { Mapped, NormalizedIntent } from "./map.js";
+export { createHookRuntime, starterPolicy } from "./runtime.js";
+export type { RuntimeConfig, Decision } from "./runtime.js";
+export { scaffold, harnessSnippet } from "./init.js";
+export { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from "./cloud.js";
+export type { HookConnection } from "./cloud.js";
+export { scrubSecrets, redactCommand, digest, sha256 } from "./minimize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxG,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+// @scopebond/hook — the Claude Code + Cursor connector. The library surface is
+// the deterministic mapper and the check-only runtime; the `scopebond-hook`
+// binary is the thin harness adapter over them.
+export { mapClaudeToolUse, mapCursorEvent } from "./map.js";
+export { createHookRuntime, starterPolicy } from "./runtime.js";
+export { scaffold, harnessSnippet } from "./init.js";
+export { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from "./cloud.js";
+export { scrubSecrets, redactCommand, digest, sha256 } from "./minimize.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC","sourcesContent":["// @scopebond/hook — the Claude Code + Cursor connector. The library surface is\n// the deterministic mapper and the check-only runtime; the `scopebond-hook`\n// binary is the thin harness adapter over them.\n\nexport { mapClaudeToolUse, mapCursorEvent } from \"./map.js\";\nexport type { Mapped, NormalizedIntent } from \"./map.js\";\nexport { createHookRuntime, starterPolicy } from \"./runtime.js\";\nexport type { RuntimeConfig, Decision } from \"./runtime.js\";\nexport { scaffold, harnessSnippet } from \"./init.js\";\nexport { connectCloud, loadConnection, attachExporter, flushBounded, connectionPath } from \"./cloud.js\";\nexport type { HookConnection } from \"./cloud.js\";\nexport { scrubSecrets, redactCommand, digest, sha256 } from \"./minimize.js\";\n"]}

package/dist/init.d.ts

@@ -0,0 +1,9 @@
+export declare function scaffold(dir: string, opts?: {
+    force?: boolean;
+}): {
+    agentKid: string;
+    policyPath: string;
+};
+/** The harness configuration snippet to install the hook. */
+export declare function harnessSnippet(harness: "claude" | "cursor"): string;
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAUA,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB9G;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAiBnE"}

package/dist/init.js

@@ -0,0 +1,46 @@
+// `scopebond-hook init` — scaffold the local enrollment: a machine signing key, a
+// gateway countersigning key and a starter policy. Keys and receipts stay on the
+// machine; no credentials are handled.
+import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { loadOrCreateAttester } from "@scopebond/gateway/node";
+import { createSigner } from "@scopebond/sdk";
+import { starterPolicy } from "./runtime.js";
+export function scaffold(dir, opts = {}) {
+    mkdirSync(dir, { recursive: true });
+    const keyPath = join(dir, "agent.key");
+    const attesterPath = join(dir, "attester.key");
+    const policyPath = join(dir, "policy.json");
+    // Never let the signing keys, the Cloud credential or the local log be committed.
+    const gitignorePath = join(dir, ".gitignore");
+    if (!existsSync(gitignorePath))
+        writeFileSync(gitignorePath, "*\n");
+    // Machine signing key (agent) + gateway countersigning key (attester). Reused if present.
+    loadOrCreateAttester({ file: keyPath });
+    loadOrCreateAttester({ file: attesterPath });
+    const agent = createSigner({ privateKeyPem: readFileSync(keyPath, "utf8") });
+    if (!existsSync(policyPath) || opts.force) {
+        writeFileSync(policyPath, JSON.stringify(starterPolicy(agent.kid), null, 2) + "\n");
+    }
+    return { agentKid: agent.kid, policyPath };
+}
+/** The harness configuration snippet to install the hook. */
+export function harnessSnippet(harness) {
+    if (harness === "cursor") {
+        return JSON.stringify({
+            version: 1,
+            hooks: {
+                beforeShellExecution: [{ command: "scopebond-hook cursor" }],
+                beforeMCPExecution: [{ command: "scopebond-hook cursor" }],
+                beforeReadFile: [{ command: "scopebond-hook cursor" }],
+                afterFileEdit: [{ command: "scopebond-hook cursor" }],
+            },
+        }, null, 2);
+    }
+    return JSON.stringify({
+        hooks: {
+            PreToolUse: [{ matcher: "*", hooks: [{ type: "command", command: "scopebond-hook claude" }] }],
+        },
+    }, null, 2);
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,iFAAiF;AACjF,uCAAuC;AAEvC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,OAA4B,EAAE;IAClE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,kFAAkF;IAClF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACpE,0FAA0F;IAC1F,oBAAoB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxC,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,KAAK,EAAE;gBACL,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;gBAC5D,kBAAkB,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;gBAC1D,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;gBACtD,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;aACtD;SACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE;YACL,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC;SAC/F;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACd,CAAC","sourcesContent":["// `scopebond-hook init` — scaffold the local enrollment: a machine signing key, a\n// gateway countersigning key and a starter policy. Keys and receipts stay on the\n// machine; no credentials are handled.\n\nimport { mkdirSync, writeFileSync, existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { loadOrCreateAttester } from \"@scopebond/gateway/node\";\nimport { createSigner } from \"@scopebond/sdk\";\nimport { starterPolicy } from \"./runtime.js\";\n\nexport function scaffold(dir: string, opts: { force?: boolean } = {}): { agentKid: string; policyPath: string } {\n  mkdirSync(dir, { recursive: true });\n  const keyPath = join(dir, \"agent.key\");\n  const attesterPath = join(dir, \"attester.key\");\n  const policyPath = join(dir, \"policy.json\");\n  // Never let the signing keys, the Cloud credential or the local log be committed.\n  const gitignorePath = join(dir, \".gitignore\");\n  if (!existsSync(gitignorePath)) writeFileSync(gitignorePath, \"*\\n\");\n  // Machine signing key (agent) + gateway countersigning key (attester). Reused if present.\n  loadOrCreateAttester({ file: keyPath });\n  loadOrCreateAttester({ file: attesterPath });\n  const agent = createSigner({ privateKeyPem: readFileSync(keyPath, \"utf8\") });\n  if (!existsSync(policyPath) || opts.force) {\n    writeFileSync(policyPath, JSON.stringify(starterPolicy(agent.kid), null, 2) + \"\\n\");\n  }\n  return { agentKid: agent.kid, policyPath };\n}\n\n/** The harness configuration snippet to install the hook. */\nexport function harnessSnippet(harness: \"claude\" | \"cursor\"): string {\n  if (harness === \"cursor\") {\n    return JSON.stringify({\n      version: 1,\n      hooks: {\n        beforeShellExecution: [{ command: \"scopebond-hook cursor\" }],\n        beforeMCPExecution: [{ command: \"scopebond-hook cursor\" }],\n        beforeReadFile: [{ command: \"scopebond-hook cursor\" }],\n        afterFileEdit: [{ command: \"scopebond-hook cursor\" }],\n      },\n    }, null, 2);\n  }\n  return JSON.stringify({\n    hooks: {\n      PreToolUse: [{ matcher: \"*\", hooks: [{ type: \"command\", command: \"scopebond-hook claude\" }] }],\n    },\n  }, null, 2);\n}\n"]}

package/dist/map.d.ts

@@ -0,0 +1,17 @@
+export interface NormalizedIntent {
+    action_type: string;
+    params: Record<string, unknown>;
+}
+export interface Mapped {
+    intent: NormalizedIntent;
+    /** false when no taxonomy type applies: emitted as tool.<name> and routed to the
+     *  observation path (not_evaluated), never granted. */
+    evaluated: boolean;
+    /** The native tool/event name, for diagnostics. */
+    source: string;
+}
+/** Map a Claude Code PreToolUse payload to a normalized taxonomy action. */
+export declare function mapClaudeToolUse(input: Record<string, unknown>): Mapped;
+/** Map a Cursor hook event to a normalized taxonomy action. */
+export declare function mapCursorEvent(event: string, payload: Record<string, unknown>): Mapped;
+//# sourceMappingURL=map.d.ts.map

package/dist/map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.d.ts","sourceRoot":"","sources":["../src/map.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AACD,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB;2DACuD;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;CAChB;AAqDD,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBvE;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBtF"}

package/dist/map.js

@@ -0,0 +1,104 @@
+// The mapper: a pure function from a coding agent's native tool call to a
+// normalized Scopebond action (Action Taxonomy v1). This is the connector's core
+// — deterministic and side-effect free, so it can be conformance-tested directly.
+import { digest, redactCommand } from "./minimize.js";
+const rel = (value, cwd) => {
+    const s = String(value ?? "");
+    if (cwd && s.startsWith(cwd))
+        return s.slice(cwd.length).replace(/^[\\/]+/, "");
+    return s;
+};
+/** The invoked program's basename, after stripping sudo and `env VAR=val` prefixes. */
+function programOf(command) {
+    const stripped = command.trim().replace(/^sudo\s+/, "").replace(/^(?:env\s+\S+=\S+\s+)+/, "");
+    const first = stripped.split(/\s+/)[0] ?? "";
+    return first.replace(/^.*[\\/]/, "");
+}
+// Best-effort `git push [--force|-f] [remote] [ref]` parse. Ambiguous pushes omit
+// the ref, which a ref bound then denies (fail closed).
+function parseGitPush(command) {
+    const t = command.trim().replace(/^sudo\s+/, "");
+    if (!/^git\s+push(\s|$)/.test(t))
+        return null;
+    const force = /(?:^|\s)(?:--force\b|--force-with-lease\b|-f\b)/.test(t);
+    const rest = t.replace(/^git\s+push\b/, "").trim();
+    const positional = rest.split(/\s+/).filter((a) => a && !a.startsWith("-"));
+    const params = { force };
+    if (positional[0])
+        params.remote = positional[0];
+    if (positional[1])
+        params.ref = positional[1].replace(/^[^:]*:/, ""); // src:dst → dst
+    return params;
+}
+function mapShell(command, cwd) {
+    const push = parseGitPush(command);
+    if (push)
+        return { intent: { action_type: "git.push", params: push }, evaluated: true, source: "shell" };
+    return {
+        intent: {
+            action_type: "shell.exec",
+            params: { command: redactCommand(command), program: programOf(command), ...(cwd ? { cwd } : {}) },
+        },
+        evaluated: true, source: "shell",
+    };
+}
+function parseMcpName(name) {
+    if (!name.startsWith("mcp__"))
+        return null;
+    const parts = name.split("__");
+    if (parts.length < 3)
+        return null;
+    return { server: parts[1], tool: parts.slice(2).join("__") };
+}
+function splitUrl(url) {
+    try {
+        const u = new URL(url);
+        return { host: u.host, path: u.pathname };
+    }
+    catch {
+        return { host: url, path: "" };
+    }
+}
+/** Map a Claude Code PreToolUse payload to a normalized taxonomy action. */
+export function mapClaudeToolUse(input) {
+    const name = String(input?.tool_name ?? "");
+    const ti = (input?.tool_input ?? {});
+    const cwd = input?.cwd ? String(input.cwd) : undefined;
+    if (name === "Bash")
+        return mapShell(String(ti.command ?? ""), cwd);
+    if (name === "Write" || name === "Edit" || name === "MultiEdit")
+        return { intent: { action_type: "file.write", params: { path: rel(ti.file_path, cwd) } }, evaluated: true, source: name };
+    if (name === "NotebookEdit")
+        return { intent: { action_type: "file.write", params: { path: rel(ti.notebook_path ?? ti.file_path, cwd) } }, evaluated: true, source: name };
+    if (name === "Read")
+        return { intent: { action_type: "file.read", params: { path: rel(ti.file_path, cwd) } }, evaluated: true, source: name };
+    if (name === "WebFetch") {
+        const { host, path } = splitUrl(String(ti.url ?? ""));
+        return { intent: { action_type: "net.fetch", params: { host, path, method: "GET" } }, evaluated: true, source: name };
+    }
+    const mcp = parseMcpName(name);
+    if (mcp)
+        return { intent: { action_type: "mcp.tool.call", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, evaluated: true, source: name };
+    return { intent: { action_type: `tool.${name.toLowerCase()}`, params: {} }, evaluated: false, source: name };
+}
+/** Map a Cursor hook event to a normalized taxonomy action. */
+export function mapCursorEvent(event, payload) {
+    const p = payload ?? {};
+    const cwd = p.cwd ? String(p.cwd) : undefined;
+    switch (event) {
+        case "beforeShellExecution":
+            return mapShell(String(p.command ?? ""), cwd);
+        case "beforeReadFile":
+            return { intent: { action_type: "file.read", params: { path: rel(p.path ?? p.file_path, cwd) } }, evaluated: true, source: event };
+        case "afterFileEdit":
+            return { intent: { action_type: "file.write", params: { path: rel(p.path ?? p.file_path, cwd) } }, evaluated: true, source: event };
+        case "beforeMCPExecution": {
+            const server = String(p.server ?? p.server_name ?? "");
+            const tool = String(p.tool ?? p.tool_name ?? "");
+            return { intent: { action_type: "mcp.tool.call", params: { server, tool, args_digest: digest(p.args ?? p.arguments ?? {}) } }, evaluated: true, source: event };
+        }
+        default:
+            return { intent: { action_type: `tool.${event.toLowerCase()}`, params: {} }, evaluated: false, source: event };
+    }
+}
+//# sourceMappingURL=map.js.map

package/dist/map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.js","sourceRoot":"","sources":["../src/map.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,iFAAiF;AACjF,kFAAkF;AAElF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAetD,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,GAAY,EAAU,EAAE;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,uFAAuF;AACvF,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,kFAAkF;AAClF,wDAAwD;AACxD,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,iDAAiD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,CAAC;IAClD,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB;IACtF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAY;IAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzG,OAAO;QACL,MAAM,EAAE;YACN,WAAW,EAAE,YAAY;YACzB,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAClG;QACD,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IAC1E,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;AAC3C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;QAC7D,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5H,IAAI,IAAI,KAAK,cAAc;QACzB,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChJ,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3H,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxH,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrK,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAgC;IAC5E,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,sBAAsB;YACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,KAAK,gBAAgB;YACnB,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACrI,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACtI,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAClK,CAAC;QACD;YACE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnH,CAAC;AACH,CAAC","sourcesContent":["// The mapper: a pure function from a coding agent's native tool call to a\n// normalized Scopebond action (Action Taxonomy v1). This is the connector's core\n// — deterministic and side-effect free, so it can be conformance-tested directly.\n\nimport { digest, redactCommand } from \"./minimize.js\";\n\nexport interface NormalizedIntent {\n  action_type: string;\n  params: Record<string, unknown>;\n}\nexport interface Mapped {\n  intent: NormalizedIntent;\n  /** false when no taxonomy type applies: emitted as tool.<name> and routed to the\n   *  observation path (not_evaluated), never granted. */\n  evaluated: boolean;\n  /** The native tool/event name, for diagnostics. */\n  source: string;\n}\n\nconst rel = (value: unknown, cwd?: string): string => {\n  const s = String(value ?? \"\");\n  if (cwd && s.startsWith(cwd)) return s.slice(cwd.length).replace(/^[\\\\/]+/, \"\");\n  return s;\n};\n\n/** The invoked program's basename, after stripping sudo and `env VAR=val` prefixes. */\nfunction programOf(command: string): string {\n  const stripped = command.trim().replace(/^sudo\\s+/, \"\").replace(/^(?:env\\s+\\S+=\\S+\\s+)+/, \"\");\n  const first = stripped.split(/\\s+/)[0] ?? \"\";\n  return first.replace(/^.*[\\\\/]/, \"\");\n}\n\n// Best-effort `git push [--force|-f] [remote] [ref]` parse. Ambiguous pushes omit\n// the ref, which a ref bound then denies (fail closed).\nfunction parseGitPush(command: string): Record<string, unknown> | null {\n  const t = command.trim().replace(/^sudo\\s+/, \"\");\n  if (!/^git\\s+push(\\s|$)/.test(t)) return null;\n  const force = /(?:^|\\s)(?:--force\\b|--force-with-lease\\b|-f\\b)/.test(t);\n  const rest = t.replace(/^git\\s+push\\b/, \"\").trim();\n  const positional = rest.split(/\\s+/).filter((a) => a && !a.startsWith(\"-\"));\n  const params: Record<string, unknown> = { force };\n  if (positional[0]) params.remote = positional[0];\n  if (positional[1]) params.ref = positional[1].replace(/^[^:]*:/, \"\"); // src:dst → dst\n  return params;\n}\n\nfunction mapShell(command: string, cwd?: string): Mapped {\n  const push = parseGitPush(command);\n  if (push) return { intent: { action_type: \"git.push\", params: push }, evaluated: true, source: \"shell\" };\n  return {\n    intent: {\n      action_type: \"shell.exec\",\n      params: { command: redactCommand(command), program: programOf(command), ...(cwd ? { cwd } : {}) },\n    },\n    evaluated: true, source: \"shell\",\n  };\n}\n\nfunction parseMcpName(name: string): { server: string; tool: string } | null {\n  if (!name.startsWith(\"mcp__\")) return null;\n  const parts = name.split(\"__\");\n  if (parts.length < 3) return null;\n  return { server: parts[1], tool: parts.slice(2).join(\"__\") };\n}\n\nfunction splitUrl(url: string): { host: string; path: string } {\n  try { const u = new URL(url); return { host: u.host, path: u.pathname }; }\n  catch { return { host: url, path: \"\" }; }\n}\n\n/** Map a Claude Code PreToolUse payload to a normalized taxonomy action. */\nexport function mapClaudeToolUse(input: Record<string, unknown>): Mapped {\n  const name = String(input?.tool_name ?? \"\");\n  const ti = (input?.tool_input ?? {}) as Record<string, unknown>;\n  const cwd = input?.cwd ? String(input.cwd) : undefined;\n  if (name === \"Bash\") return mapShell(String(ti.command ?? \"\"), cwd);\n  if (name === \"Write\" || name === \"Edit\" || name === \"MultiEdit\")\n    return { intent: { action_type: \"file.write\", params: { path: rel(ti.file_path, cwd) } }, evaluated: true, source: name };\n  if (name === \"NotebookEdit\")\n    return { intent: { action_type: \"file.write\", params: { path: rel(ti.notebook_path ?? ti.file_path, cwd) } }, evaluated: true, source: name };\n  if (name === \"Read\")\n    return { intent: { action_type: \"file.read\", params: { path: rel(ti.file_path, cwd) } }, evaluated: true, source: name };\n  if (name === \"WebFetch\") {\n    const { host, path } = splitUrl(String(ti.url ?? \"\"));\n    return { intent: { action_type: \"net.fetch\", params: { host, path, method: \"GET\" } }, evaluated: true, source: name };\n  }\n  const mcp = parseMcpName(name);\n  if (mcp) return { intent: { action_type: \"mcp.tool.call\", params: { server: mcp.server, tool: mcp.tool, args_digest: digest(ti) } }, evaluated: true, source: name };\n  return { intent: { action_type: `tool.${name.toLowerCase()}`, params: {} }, evaluated: false, source: name };\n}\n\n/** Map a Cursor hook event to a normalized taxonomy action. */\nexport function mapCursorEvent(event: string, payload: Record<string, unknown>): Mapped {\n  const p = payload ?? {};\n  const cwd = p.cwd ? String(p.cwd) : undefined;\n  switch (event) {\n    case \"beforeShellExecution\":\n      return mapShell(String(p.command ?? \"\"), cwd);\n    case \"beforeReadFile\":\n      return { intent: { action_type: \"file.read\", params: { path: rel(p.path ?? p.file_path, cwd) } }, evaluated: true, source: event };\n    case \"afterFileEdit\":\n      return { intent: { action_type: \"file.write\", params: { path: rel(p.path ?? p.file_path, cwd) } }, evaluated: true, source: event };\n    case \"beforeMCPExecution\": {\n      const server = String(p.server ?? p.server_name ?? \"\");\n      const tool = String(p.tool ?? p.tool_name ?? \"\");\n      return { intent: { action_type: \"mcp.tool.call\", params: { server, tool, args_digest: digest(p.args ?? p.arguments ?? {}) } }, evaluated: true, source: event };\n    }\n    default:\n      return { intent: { action_type: `tool.${event.toLowerCase()}`, params: {} }, evaluated: false, source: event };\n  }\n}\n"]}

package/dist/minimize.d.ts

@@ -0,0 +1,7 @@
+export declare const sha256: (value: string) => string;
+export declare const digest: (value: unknown) => string;
+export declare function scrubSecrets(text: string): string;
+/** A privacy-preserving representation of a shell command: a scrubbed, truncated
+ *  head plus a digest of the full original. The full command is never retained. */
+export declare function redactCommand(command: string, headLen?: number): string;
+//# sourceMappingURL=minimize.d.ts.map

package/dist/minimize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimize.d.ts","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,MAAsE,CAAC;AAC9G,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,KAAG,MAA2C,CAAC;AAYpF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED;mFACmF;AACnF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,MAAM,CAInE"}

package/dist/minimize.js

@@ -0,0 +1,31 @@
+// Data minimization for the hook: file contents are never stored, shell commands
+// are reduced to a scrubbed head plus a digest, and common secret shapes are
+// removed before anything is written or signed (SB09).
+import { createHash } from "node:crypto";
+import { canonical } from "@scopebond/policy-schema/canonical";
+export const sha256 = (value) => "sha256:" + createHash("sha256").update(value).digest("hex");
+export const digest = (value) => sha256(canonical(value));
+// Command-line shapes that commonly carry secrets. Over-scrubbing is safe.
+const SECRET_PATTERNS = [
+    /(--?(?:password|passwd|pwd|token|secret|api[-_]?key|auth)[=\s]+)(\S+)/gi,
+    /(Authorization:\s*Bearer\s+)(\S+)/gi,
+    /\b(gh[pousr]_[A-Za-z0-9]{20,})\b/g, // GitHub tokens
+    /\b(sk-[A-Za-z0-9]{20,})\b/g, // OpenAI-style keys
+    /\b(AKIA[0-9A-Z]{16})\b/g, // AWS access key id
+    /\b([A-Za-z0-9+/]{40,}={0,2})\b/g, // long base64 blobs
+];
+export function scrubSecrets(text) {
+    let out = text;
+    for (const re of SECRET_PATTERNS) {
+        out = out.replace(re, (_m, p1, p2) => (p2 !== undefined ? `${p1}***` : "***"));
+    }
+    return out;
+}
+/** A privacy-preserving representation of a shell command: a scrubbed, truncated
+ *  head plus a digest of the full original. The full command is never retained. */
+export function redactCommand(command, headLen = 64) {
+    const scrubbed = scrubSecrets(command);
+    const head = scrubbed.length > headLen ? `${scrubbed.slice(0, headLen)}…` : scrubbed;
+    return `${head} (${sha256(command)})`;
+}
+//# sourceMappingURL=minimize.js.map

package/dist/minimize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimize.js","sourceRoot":"","sources":["../src/minimize.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,6EAA6E;AAC7E,uDAAuD;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAc,CAAC,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,eAAe,GAAa;IAChC,yEAAyE;IACzE,qCAAqC;IACrC,mCAAmC,EAAY,gBAAgB;IAC/D,4BAA4B,EAAoB,oBAAoB;IACpE,yBAAyB,EAAuB,oBAAoB;IACpE,iCAAiC,EAAe,oBAAoB;CACrE,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAU,EAAE,EAAW,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAO,GAAG,EAAE;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;AACxC,CAAC","sourcesContent":["// Data minimization for the hook: file contents are never stored, shell commands\n// are reduced to a scrubbed head plus a digest, and common secret shapes are\n// removed before anything is written or signed (SB09).\n\nimport { createHash } from \"node:crypto\";\nimport { canonical } from \"@scopebond/policy-schema/canonical\";\n\nexport const sha256 = (value: string): string => \"sha256:\" + createHash(\"sha256\").update(value).digest(\"hex\");\nexport const digest = (value: unknown): string => sha256(canonical(value as never));\n\n// Command-line shapes that commonly carry secrets. Over-scrubbing is safe.\nconst SECRET_PATTERNS: RegExp[] = [\n  /(--?(?:password|passwd|pwd|token|secret|api[-_]?key|auth)[=\\s]+)(\\S+)/gi,\n  /(Authorization:\\s*Bearer\\s+)(\\S+)/gi,\n  /\\b(gh[pousr]_[A-Za-z0-9]{20,})\\b/g,           // GitHub tokens\n  /\\b(sk-[A-Za-z0-9]{20,})\\b/g,                   // OpenAI-style keys\n  /\\b(AKIA[0-9A-Z]{16})\\b/g,                      // AWS access key id\n  /\\b([A-Za-z0-9+/]{40,}={0,2})\\b/g,              // long base64 blobs\n];\n\nexport function scrubSecrets(text: string): string {\n  let out = text;\n  for (const re of SECRET_PATTERNS) {\n    out = out.replace(re, (_m, p1: string, p2?: string) => (p2 !== undefined ? `${p1}***` : \"***\"));\n  }\n  return out;\n}\n\n/** A privacy-preserving representation of a shell command: a scrubbed, truncated\n *  head plus a digest of the full original. The full command is never retained. */\nexport function redactCommand(command: string, headLen = 64): string {\n  const scrubbed = scrubSecrets(command);\n  const head = scrubbed.length > headLen ? `${scrubbed.slice(0, headLen)}…` : scrubbed;\n  return `${head} (${sha256(command)})`;\n}\n"]}

package/dist/runtime.d.ts

@@ -0,0 +1,41 @@
+import { type CloudExporter } from "@scopebond/gateway";
+import type { Mapped } from "./map.js";
+import { type HookConnection } from "./cloud.js";
+export interface RuntimeConfig {
+    policyPath: string;
+    keyPath: string;
+    attesterPath: string;
+    dbPath: string;
+    /** Strict mode: an unmapped tool is policy-checked (and denied by a closed
+     *  allowlist) instead of observed. Fail-closed for tools with no taxonomy
+     *  mapping; default false (observe, matching the connector conformance vector). */
+    strict?: boolean;
+    /** When connected to a Cloud workspace, receipts are auto-exported to the portal.
+     *  Export is best-effort and never changes the local decision. */
+    cloud?: {
+        connection: HookConnection;
+        fetch?: typeof fetch;
+        flushTimeoutMs?: number;
+    };
+}
+export interface Decision {
+    decision: "allow" | "deny" | "not_evaluated";
+    reason: string;
+    receipt?: unknown;
+}
+/** The default starter policy for a coding agent: protect release branches, deny
+ *  destructive programs, allow workspace file access, and trust only the enrolled
+ *  machine key. Every threshold is the operator's to edit. */
+export declare function starterPolicy(agentKid: string): Record<string, unknown>;
+/** Build the runtime. Throws on any setup failure (unparseable policy, missing
+ *  key, unavailable store) — the CLI turns that into a fail-closed deny. */
+export declare function createHookRuntime(config: RuntimeConfig): {
+    gateway: import("@scopebond/gateway").Gateway;
+    agentKid: string;
+    exporter: CloudExporter | undefined;
+    /** Deliver queued receipts to Cloud with a bounded timeout, then it is safe to
+     *  exit. Undelivered receipts persist in the durable outbox for the next run. */
+    flush(): Promise<void>;
+    evaluate(mapped: Mapped): Promise<Decision>;
+};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAMA,OAAO,EAA6C,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;uFAEmF;IACnF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;sEACkE;IAClE,KAAK,CAAC,EAAE;QAAE,UAAU,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvF;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;8DAE8D;AAC9D,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBvE;AAED;4EAC4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa;;;;IAuBnD;qFACiF;aAClE,OAAO,CAAC,IAAI,CAAC;qBAGL,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;EAapD"}

package/dist/runtime.js

@@ -0,0 +1,76 @@
+// The hook runtime: a check-only (M0) gateway built once from the enrolled
+// machine key, policy and a durable local receipt log. Each mapped action is
+// signed by the machine key, decided against policy and countersigned — locally,
+// with no HTTP server and no Cloud dependency in 0.1.
+import { readFileSync } from "node:fs";
+import { createGateway, StaticPrincipalKeyRegistry } from "@scopebond/gateway";
+import { loadOrCreateAttester, openReceiptStore } from "@scopebond/gateway/node";
+import { createSigner } from "@scopebond/sdk";
+import { attachExporter, flushBounded } from "./cloud.js";
+/** The default starter policy for a coding agent: protect release branches, deny
+ *  destructive programs, allow workspace file access, and trust only the enrolled
+ *  machine key. Every threshold is the operator's to edit. */
+export function starterPolicy(agentKid) {
+    return {
+        vocabulary_version: "1.0", policy_id: "coding-agent", version: 1,
+        clauses: [
+            {
+                id: "protect-branches", type: "action_allowlist", mode: "enforce", action_types: ["git.push"],
+                param_bounds: { ref: { pattern: "^(?!(?:main|master)$)(?!release/).+" } },
+                description: "Deny pushes to main, master and release/*.",
+            },
+            {
+                id: "safe-shell", type: "action_allowlist", mode: "enforce", action_types: ["shell.exec"],
+                param_bounds: { program: { pattern: "^(?!(?:rm|sudo|shutdown|reboot|mkfs|dd)$).+" } },
+                description: "Deny destructive programs (rm, sudo, …).",
+            },
+            { id: "workspace-files", type: "action_allowlist", mode: "enforce", action_types: ["file.write", "file.read"] },
+            { id: "keys", type: "key_policy", active_keys: [agentKid], description: "Only the enrolled machine key may sign." },
+        ],
+    };
+}
+/** Build the runtime. Throws on any setup failure (unparseable policy, missing
+ *  key, unavailable store) — the CLI turns that into a fail-closed deny. */
+export function createHookRuntime(config) {
+    const policy = JSON.parse(readFileSync(config.policyPath, "utf8"));
+    const agent = createSigner({ privateKeyPem: readFileSync(config.keyPath, "utf8") });
+    const keys = new StaticPrincipalKeyRegistry([
+        { kid: agent.kid, publicKeyPem: agent.publicKeyPem, purposes: ["agent"], status: "active" },
+    ]);
+    const { attester } = loadOrCreateAttester({ file: config.attesterPath });
+    const { store: baseStore } = openReceiptStore({ db: config.dbPath });
+    // When connected, mirror every stored receipt to the hosted portal through a
+    // durable outbox. The wrapped store's decision is unchanged; export is best-effort.
+    let store = baseStore;
+    let exporter;
+    if (config.cloud) {
+        const attached = attachExporter(config.dbPath + ".cloud-outbox.db", config.cloud.connection, baseStore, config.cloud.fetch);
+        store = attached.store;
+        exporter = attached.exporter;
+    }
+    const gateway = createGateway({ policy, authentication: { keys }, attester, store, mode: "check_only" });
+    return {
+        gateway,
+        agentKid: agent.kid,
+        exporter,
+        /** Deliver queued receipts to Cloud with a bounded timeout, then it is safe to
+         *  exit. Undelivered receipts persist in the durable outbox for the next run. */
+        async flush() {
+            if (exporter)
+                await flushBounded(exporter, config.cloud?.flushTimeoutMs);
+        },
+        async evaluate(mapped) {
+            const signed = agent.sign(mapped.intent);
+            if (!mapped.evaluated && !config.strict) {
+                // Unknown tool, non-strict: observe without evaluating — grants nothing (D30).
+                const { receipt } = await gateway.observeAction({ intent: signed.intent, authorization: signed.authorization });
+                return { decision: "not_evaluated", reason: `no policy applies to ${mapped.intent.action_type}`, receipt };
+            }
+            // Evaluated tools, and (in strict mode) unmapped tool.<name> actions, go
+            // through policy — a closed allowlist denies an unlisted action.
+            const result = await gateway.handleAction({ intent: signed.intent, authorization: signed.authorization });
+            return { decision: result.allowed ? "allow" : "deny", reason: result.reason, receipt: result.receipt };
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,6EAA6E;AAC7E,iFAAiF;AACjF,sDAAsD;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAsB,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAuB,MAAM,YAAY,CAAC;AAsB/E;;8DAE8D;AAC9D,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO;QACL,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAChE,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,UAAU,CAAC;gBAC7F,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAAE;gBACzE,WAAW,EAAE,4CAA4C;aAC1D;YACD;gBACE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,YAAY,CAAC;gBACzF,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE;gBACrF,WAAW,EAAE,0CAA0C;aACxD;YACD,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE;YAC/G,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE;SACpH;KACF,CAAC;AACJ,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,0BAA0B,CAAC;QAC1C,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;KAC5F,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,6EAA6E;IAC7E,oFAAoF;IACpF,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,IAAI,QAAmC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5H,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QACvB,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAEzG,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,QAAQ;QACR;yFACiF;QACjF,KAAK,CAAC,KAAK;YACT,IAAI,QAAQ;gBAAE,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAc;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,+EAA+E;gBAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;gBAChH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;YAC7G,CAAC;YACD,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["// The hook runtime: a check-only (M0) gateway built once from the enrolled\n// machine key, policy and a durable local receipt log. Each mapped action is\n// signed by the machine key, decided against policy and countersigned — locally,\n// with no HTTP server and no Cloud dependency in 0.1.\n\nimport { readFileSync } from \"node:fs\";\nimport { createGateway, StaticPrincipalKeyRegistry, type CloudExporter } from \"@scopebond/gateway\";\nimport { loadOrCreateAttester, openReceiptStore } from \"@scopebond/gateway/node\";\nimport { createSigner } from \"@scopebond/sdk\";\nimport type { Mapped } from \"./map.js\";\nimport { attachExporter, flushBounded, type HookConnection } from \"./cloud.js\";\n\nexport interface RuntimeConfig {\n  policyPath: string;\n  keyPath: string;\n  attesterPath: string;\n  dbPath: string;\n  /** Strict mode: an unmapped tool is policy-checked (and denied by a closed\n   *  allowlist) instead of observed. Fail-closed for tools with no taxonomy\n   *  mapping; default false (observe, matching the connector conformance vector). */\n  strict?: boolean;\n  /** When connected to a Cloud workspace, receipts are auto-exported to the portal.\n   *  Export is best-effort and never changes the local decision. */\n  cloud?: { connection: HookConnection; fetch?: typeof fetch; flushTimeoutMs?: number };\n}\n\nexport interface Decision {\n  decision: \"allow\" | \"deny\" | \"not_evaluated\";\n  reason: string;\n  receipt?: unknown;\n}\n\n/** The default starter policy for a coding agent: protect release branches, deny\n *  destructive programs, allow workspace file access, and trust only the enrolled\n *  machine key. Every threshold is the operator's to edit. */\nexport function starterPolicy(agentKid: string): Record<string, unknown> {\n  return {\n    vocabulary_version: \"1.0\", policy_id: \"coding-agent\", version: 1,\n    clauses: [\n      {\n        id: \"protect-branches\", type: \"action_allowlist\", mode: \"enforce\", action_types: [\"git.push\"],\n        param_bounds: { ref: { pattern: \"^(?!(?:main|master)$)(?!release/).+\" } },\n        description: \"Deny pushes to main, master and release/*.\",\n      },\n      {\n        id: \"safe-shell\", type: \"action_allowlist\", mode: \"enforce\", action_types: [\"shell.exec\"],\n        param_bounds: { program: { pattern: \"^(?!(?:rm|sudo|shutdown|reboot|mkfs|dd)$).+\" } },\n        description: \"Deny destructive programs (rm, sudo, …).\",\n      },\n      { id: \"workspace-files\", type: \"action_allowlist\", mode: \"enforce\", action_types: [\"file.write\", \"file.read\"] },\n      { id: \"keys\", type: \"key_policy\", active_keys: [agentKid], description: \"Only the enrolled machine key may sign.\" },\n    ],\n  };\n}\n\n/** Build the runtime. Throws on any setup failure (unparseable policy, missing\n *  key, unavailable store) — the CLI turns that into a fail-closed deny. */\nexport function createHookRuntime(config: RuntimeConfig) {\n  const policy = JSON.parse(readFileSync(config.policyPath, \"utf8\"));\n  const agent = createSigner({ privateKeyPem: readFileSync(config.keyPath, \"utf8\") });\n  const keys = new StaticPrincipalKeyRegistry([\n    { kid: agent.kid, publicKeyPem: agent.publicKeyPem, purposes: [\"agent\"], status: \"active\" },\n  ]);\n  const { attester } = loadOrCreateAttester({ file: config.attesterPath });\n  const { store: baseStore } = openReceiptStore({ db: config.dbPath });\n  // When connected, mirror every stored receipt to the hosted portal through a\n  // durable outbox. The wrapped store's decision is unchanged; export is best-effort.\n  let store = baseStore;\n  let exporter: CloudExporter | undefined;\n  if (config.cloud) {\n    const attached = attachExporter(config.dbPath + \".cloud-outbox.db\", config.cloud.connection, baseStore, config.cloud.fetch);\n    store = attached.store;\n    exporter = attached.exporter;\n  }\n  const gateway = createGateway({ policy, authentication: { keys }, attester, store, mode: \"check_only\" });\n\n  return {\n    gateway,\n    agentKid: agent.kid,\n    exporter,\n    /** Deliver queued receipts to Cloud with a bounded timeout, then it is safe to\n     *  exit. Undelivered receipts persist in the durable outbox for the next run. */\n    async flush(): Promise<void> {\n      if (exporter) await flushBounded(exporter, config.cloud?.flushTimeoutMs);\n    },\n    async evaluate(mapped: Mapped): Promise<Decision> {\n      const signed = agent.sign(mapped.intent);\n      if (!mapped.evaluated && !config.strict) {\n        // Unknown tool, non-strict: observe without evaluating — grants nothing (D30).\n        const { receipt } = await gateway.observeAction({ intent: signed.intent, authorization: signed.authorization });\n        return { decision: \"not_evaluated\", reason: `no policy applies to ${mapped.intent.action_type}`, receipt };\n      }\n      // Evaluated tools, and (in strict mode) unmapped tool.<name> actions, go\n      // through policy — a closed allowlist denies an unlisted action.\n      const result = await gateway.handleAction({ intent: signed.intent, authorization: signed.authorization });\n      return { decision: result.allowed ? \"allow\" : \"deny\", reason: result.reason, receipt: result.receipt };\n    },\n  };\n}\n"]}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@scopebond/hook",
+  "version": "0.2.0",
+  "description": "Scopebond hook for Claude Code and Cursor — checks each coding-agent tool call against policy before it runs (in-path, cooperative M0) and records a signed receipt, locally.",
+  "license": "Apache-2.0",
+  "author": "Avouro LLC",
+  "homepage": "https://github.com/avouro-com/scopebond/tree/main/packages/hook#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/avouro-com/scopebond.git",
+    "directory": "packages/hook"
+  },
+  "bugs": {
+    "url": "https://github.com/avouro-com/scopebond/issues"
+  },
+  "keywords": [
+    "scopebond",
+    "claude-code",
+    "cursor",
+    "hooks",
+    "ai-agents",
+    "policy"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "scopebond-hook": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@scopebond/policy-schema": "^0.3.0",
+    "@scopebond/sdk": "^0.1.1",
+    "@scopebond/gateway": "^0.5.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.json && node --test test/*.test.mjs"
+  }
+}