@seanmozeik/tripwire 0.6.7 → 0.7.0

package/src/lib/log.ts

@@ -1,12 +1,11 @@
 import { appendFileSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
-// oxlint-disable-next-line unicorn/import-style
-import { dirname } from 'node:path';
+import path from 'node:path';
 
 const LOG_PATH = `${homedir()}/.claude/tripwire.log`;
 
 try {
-  mkdirSync(dirname(LOG_PATH), { recursive: true });
+  mkdirSync(path.dirname(LOG_PATH), { recursive: true });
 } catch {
   // Directory creation failure is non-fatal — logging is best-effort.
 }

package/src/lib/secrets.ts

@@ -1,121 +1,184 @@
-// Secret scanning via the `betterleaks` binary (Zach Rice's gitleaks
-// Successor, MIT). We spawn it once per PostToolUse, write the tool
-// Output to a temp file, scan the file, parse JSON findings, redact
-// Matches in-place, and delete the temp file.
-//
-// Why subprocess vs. inline regex: betterleaks ships the curated
-// 100+-rule pack the gitleaks ecosystem has tuned over years (AWS, GH,
-// Stripe, OpenAI, Anthropic, mongo URLs, JWTs, private keys, plus ~70
-// Long-tail vendors). We get all of it for one fork+exec, ~250–300ms.
-//
-// Why a temp file vs. `--pipe`: betterleaks `--pipe` *adds* stdin to its
-// Scan but does not replace the directory walk, so it scans the cwd as
-// Well. Writing to a tempfile in /tmp and using `--source <file>` is
-// Scoped, deterministic, and only ~5ms slower.
+// Betterleaks supplies the maintained secret-rule set. The stdin command keeps
+// scanned content in memory and writes its JSON report to stdout.
 
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-// oxlint-disable-next-line unicorn/import-style
-import { join } from 'node:path';
-
-interface BetterleaksFinding {
-  readonly RuleID: string;
-  readonly Description: string;
-  readonly StartLine: number;
-  readonly EndLine: number;
-  readonly Secret: string;
-  readonly Match: string;
-}
 
-interface ScanResult {
+import { Result, Schema } from 'effect';
+
+import type { SecretScannerConfig } from './config';
+
+const BetterleaksFindingSchema = Schema.Struct({
+  RuleID: Schema.String,
+  Description: Schema.String,
+  StartLine: Schema.Finite,
+  EndLine: Schema.Finite,
+  Secret: Schema.String,
+  Match: Schema.String,
+});
+
+const BetterleaksReportSchema = Schema.Array(BetterleaksFindingSchema);
+
+type BetterleaksFinding = typeof BetterleaksFindingSchema.Type;
+
+interface ScanSuccess {
+  readonly ok: true;
   readonly hits: readonly { readonly rule: string; readonly count: number }[];
   readonly redacted: string;
 }
 
-const BETTERLEAKS_BIN = '/opt/homebrew/bin/betterleaks';
+type ScanFailureCategory = 'missing-executable' | 'timeout' | 'non-zero-exit' | 'malformed-json';
+
+interface ScanFailure {
+  readonly ok: false;
+  readonly category: ScanFailureCategory;
+}
+
+type ScanResult = ScanSuccess | ScanFailure;
+
+interface ScannerInvocation {
+  readonly executable: string;
+  readonly args: readonly string[];
+  readonly input: string;
+  readonly timeoutMs: number;
+}
+
+interface ScannerProcessResult {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly error?: unknown;
+}
+
+type ScannerRunner = (invocation: ScannerInvocation) => ScannerProcessResult;
+
+const BETTERLEAKS_ARGS = [
+  'stdin',
+  '--report-format',
+  'json',
+  '--report-path',
+  '-',
+  '--exit-code',
+  '0',
+  '--no-banner',
+  '--no-color',
+  '--log-level',
+  'error',
+] as const;
+
+const defaultScannerRunner: ScannerRunner = ({ executable, args, input, timeoutMs }) => {
+  const result = spawnSync(executable, args, {
+    encoding: 'utf8',
+    input,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ['pipe', 'pipe', 'ignore'],
+    timeout: timeoutMs,
+  });
+  const processResult: ScannerProcessResult = {
+    status: result.status,
+    stdout: typeof result.stdout === 'string' ? result.stdout : '',
+  };
+  return result.error === undefined ? processResult : { ...processResult, error: result.error };
+};
+
+const errorCode = (cause: unknown): string | undefined => {
+  if (typeof cause !== 'object' || cause === null || !('code' in cause)) {
+    return undefined;
+  }
+  return typeof cause.code === 'string' ? cause.code : undefined;
+};
+
+const classifyExecutionFailure = (cause: unknown): ScanFailureCategory => {
+  const code = errorCode(cause);
+  if (code === 'ENOENT') {
+    return 'missing-executable';
+  }
+  if (code === 'ETIMEDOUT') {
+    return 'timeout';
+  }
+  return 'non-zero-exit';
+};
 
 const summarizeHits = (
   findings: readonly BetterleaksFinding[],
 ): readonly { rule: string; count: number }[] => {
   const counts = new Map<string, number>();
-  for (const f of findings) {
-    counts.set(f.RuleID, (counts.get(f.RuleID) ?? 0) + 1);
+  for (const finding of findings) {
+    counts.set(finding.RuleID, (counts.get(finding.RuleID) ?? 0) + 1);
   }
   return [...counts.entries()].map(([rule, count]) => ({ rule, count }));
 };
 
-const escapeRegExp = (s: string): string => s.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+const escapeRegExp = (value: string): string =>
+  value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
 
 // Replace every found secret in the original input with a tagged redaction.
 const redactWith = (input: string, findings: readonly BetterleaksFinding[]): string => {
-  let out = input;
+  let output = input;
   // Sort by length descending so shorter matches that are substrings of
-  // Longer ones don't fire first and break the longer match.
+  // Longer ones do not fire first and break the longer match.
   const sorted = [...findings].toSorted((a, b) => b.Secret.length - a.Secret.length);
-  for (const f of sorted) {
-    if (f.Secret === '') {
+  for (const finding of sorted) {
+    if (finding.Secret === '') {
       continue;
     }
-    out = out.replaceAll(f.Secret, `[REDACTED:${f.RuleID}]`);
+    output = output.replaceAll(finding.Secret, `[REDACTED:${finding.RuleID}]`);
   }
-  return out;
+  return output;
 };
 
-const scanAndRedact = (input: string, timeoutMs = 5000): ScanResult => {
+const scanAndRedact = (
+  input: string,
+  config: SecretScannerConfig,
+  runner: ScannerRunner = defaultScannerRunner,
+): ScanResult => {
   if (input.length === 0) {
-    return { hits: [], redacted: input };
+    return { ok: true, hits: [], redacted: input };
   }
-  const dir = mkdtempSync(join(tmpdir(), 'tripwire-scan-'));
-  const inPath = join(dir, 'input');
-  const reportPath = join(dir, 'report.json');
+
+  let processResult: ScannerProcessResult;
   try {
-    writeFileSync(inPath, input);
-    const result = spawnSync(
-      BETTERLEAKS_BIN,
-      [
-        'detect',
-        '--no-git',
-        '--no-banner',
-        '--no-color',
-        '--report-format',
-        'json',
-        '--report-path',
-        reportPath,
-        '--source',
-        inPath,
-        '--exit-code',
-        '0',
-        '--log-level',
-        'error',
-      ],
-      { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 64 * 1024 * 1024 },
-    );
-    if (result.error !== undefined) {
-      return { hits: [], redacted: input };
-    }
-    let findings: BetterleaksFinding[];
-    try {
-      const raw = readFileSync(reportPath, 'utf8');
-      const parsed = JSON.parse(raw || '[]') as unknown;
-      findings = Array.isArray(parsed) ? (parsed as BetterleaksFinding[]) : [];
-    } catch {
-      return { hits: [], redacted: input };
-    }
-    if (findings.length === 0) {
-      return { hits: [], redacted: input };
-    }
-    return { hits: summarizeHits(findings), redacted: redactWith(input, findings) };
-  } finally {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch {
-      // Best-effort cleanup.
-    }
+    processResult = runner({
+      executable: config.executable,
+      args: BETTERLEAKS_ARGS,
+      input,
+      timeoutMs: config.timeoutMs,
+    });
+  } catch {
+    return { ok: false, category: 'non-zero-exit' };
   }
+
+  if (processResult.error !== undefined) {
+    return { ok: false, category: classifyExecutionFailure(processResult.error) };
+  }
+  if (processResult.status !== 0) {
+    return { ok: false, category: 'non-zero-exit' };
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(processResult.stdout) as unknown;
+  } catch {
+    return { ok: false, category: 'malformed-json' };
+  }
+
+  const decoded = Schema.decodeUnknownResult(BetterleaksReportSchema)(parsed);
+  if (Result.isFailure(decoded)) {
+    return { ok: false, category: 'malformed-json' };
+  }
+
+  const findings = decoded.success;
+  return { ok: true, hits: summarizeHits(findings), redacted: redactWith(input, findings) };
 };
 
-// `escapeRegExp` is exported so tests / callers can build patterns over the
-// Redacted output without re-implementing escaping.
-export type { BetterleaksFinding, ScanResult };
+// `escapeRegExp` is exported so tests and callers can build patterns over the
+// Redacted output without reimplementing escaping.
+export type {
+  BetterleaksFinding,
+  ScanFailure,
+  ScanFailureCategory,
+  ScannerInvocation,
+  ScannerProcessResult,
+  ScannerRunner,
+  ScanResult,
+  ScanSuccess,
+};
 export { escapeRegExp, scanAndRedact };

package/src/main.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env bun
+
+import path from 'node:path';
+
+import pkg from '../package.json' with { type: 'json' };
+
+const INTERNAL_HOOK_FLAG = '--tripwire-hook';
+const FORCE_CLI_FLAG = '--tripwire-force-cli';
+
+const forceCliIndex = process.argv.indexOf(FORCE_CLI_FLAG, 2);
+const forceCli = forceCliIndex !== -1;
+if (forceCli) {
+  process.argv.splice(forceCliIndex, 1);
+}
+const cliArguments = process.argv.slice(2);
+const executableName = path.basename(process.argv0);
+const isHook =
+  !forceCli &&
+  (executableName === 'tripwire-hook' ||
+    cliArguments.includes(INTERNAL_HOOK_FLAG) ||
+    cliArguments.some((argument) => argument.startsWith('--cursor-event')));
+
+if (isHook) {
+  const { runHook } = await import('./dispatch');
+  runHook();
+} else if (cliArguments.length === 1 && cliArguments[0] === '--version') {
+  process.stdout.write(`${pkg.version}\n`);
+} else {
+  const { runCli } = await import('./cli');
+  await runCli();
+}

package/src/pi-extension.ts

@@ -0,0 +1,337 @@
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { realpathSync } from 'node:fs';
+import path from 'node:path';
+import type { Readable } from 'node:stream';
+import { fileURLToPath } from 'node:url';
+
+interface PiToolCallEvent {
+  readonly input: Record<string, unknown>;
+  readonly toolCallId: string;
+  readonly toolName: string;
+}
+
+type PiToolResultEvent = PiToolCallEvent & {
+  readonly content: unknown;
+  readonly details: unknown;
+  readonly isError: boolean;
+};
+
+interface PiExtensionContext {
+  readonly abort: () => void;
+  readonly cwd: string;
+  readonly ui: { readonly notify: (message: string, level: 'error') => void };
+}
+
+interface TripwirePiExtensionApi {
+  readonly on: {
+    (
+      event: 'tool_call',
+      handler: (
+        event: PiToolCallEvent,
+        context: PiExtensionContext,
+      ) => Promise<{ readonly block?: boolean; readonly reason?: string } | undefined>,
+    ): void;
+    (
+      event: 'tool_result',
+      handler: (event: PiToolResultEvent, context: PiExtensionContext) => Promise<void>,
+    ): void;
+  };
+}
+
+interface HookResult {
+  readonly exitCode: number;
+  readonly stderr: string;
+  readonly stdout: string;
+}
+
+type TripwireProcessRunner = (hookPath: string, input: unknown) => Promise<HookResult>;
+
+const TIMEOUT_MS = 60_000;
+
+/** Resolve the Bun hook next to the built extension, following install symlinks. */
+const resolveShippedHookPath = (extensionUrl: string | URL = import.meta.url): string => {
+  const extensionPath = fileURLToPath(extensionUrl);
+  let resolved = extensionPath;
+  try {
+    resolved = realpathSync(extensionPath);
+  } catch {
+    // Keep the unresolved path when the module is not on disk yet (unit tests).
+  }
+  return path.join(path.dirname(resolved), 'tripwire');
+};
+
+const shippedHookPath = resolveShippedHookPath();
+
+const requiredStringField = (
+  value: Record<string, unknown>,
+  names: readonly string[],
+  label: string,
+): string => {
+  for (const name of names) {
+    const field = value[name];
+    if (typeof field === 'string') {
+      return field;
+    }
+  }
+  throw new Error(`Pi ${label} is missing`);
+};
+
+const stringArrayField = (value: Record<string, unknown>, name: string): string[] => {
+  const field = value[name];
+  return Array.isArray(field) ? field.filter((item) => typeof item === 'string') : [];
+};
+
+const editStrings = (
+  input: Record<string, unknown>,
+): { old_string: string; new_string: string } => {
+  const { edits } = input;
+  if (Array.isArray(edits)) {
+    const oldStrings: string[] = [];
+    const newStrings: string[] = [];
+    for (const edit of edits) {
+      if (!isRecord(edit)) {
+        continue;
+      }
+      const oldText = stringField(edit, 'oldText') ?? stringField(edit, 'old_string');
+      const newText = stringField(edit, 'newText') ?? stringField(edit, 'new_string');
+      if (oldText !== undefined) {
+        oldStrings.push(oldText);
+      }
+      if (newText !== undefined) {
+        newStrings.push(newText);
+      }
+    }
+    return { old_string: oldStrings.join('\n'), new_string: newStrings.join('\n') };
+  }
+  return {
+    old_string: stringField(input, 'oldText') ?? stringField(input, 'old_string') ?? '',
+    new_string:
+      stringField(input, 'newText') ??
+      stringField(input, 'new_string') ??
+      stringField(input, 'input') ??
+      stringField(input, '_input') ??
+      '',
+  };
+};
+
+const normalizedToolInputs = (event: PiToolCallEvent): readonly Record<string, unknown>[] => {
+  const { input, toolName } = event;
+  if (toolName === 'bash' || toolName === 'powershell') {
+    return [{ command: requiredStringField(input, ['command'], `${toolName} command`) }];
+  }
+  if (toolName === 'read') {
+    return [{ file_path: requiredStringField(input, ['path', 'file_path'], 'read path') }];
+  }
+  if (toolName === 'write') {
+    return [
+      {
+        content: requiredStringField(input, ['content'], 'write content'),
+        file_path: requiredStringField(input, ['path', 'file_path'], 'write path'),
+      },
+    ];
+  }
+  if (toolName === 'edit') {
+    const directPath = stringField(input, 'path') ?? stringField(input, 'file_path');
+    const paths = stringArrayField(input, 'paths');
+    let targets = paths;
+    if (targets.length === 0 && directPath !== undefined) {
+      targets = [directPath];
+    }
+    if (targets.length === 0) {
+      throw new Error('Pi edit path is missing');
+    }
+    const strings = editStrings(input);
+    const inputs: Record<string, unknown>[] = [];
+    for (const filePath of targets) {
+      inputs.push({ file_path: filePath, ...strings });
+    }
+    return inputs;
+  }
+  return [input];
+};
+
+const textFromContent = (content: unknown): string => {
+  if (typeof content === 'string') {
+    return content;
+  }
+  if (!Array.isArray(content)) {
+    return '';
+  }
+  const texts: string[] = [];
+  for (const item of content) {
+    if (isRecord(item) && item['type'] === 'text' && typeof item['text'] === 'string') {
+      texts.push(item['text']);
+    }
+  }
+  return texts.join('\n');
+};
+
+const normalizedToolResponse = (event: PiToolResultEvent): Record<string, unknown> => {
+  const text = textFromContent(event.content);
+  if (event.toolName === 'bash' || event.toolName === 'powershell') {
+    return { stdout: text, stderr: event.isError ? text : '', interrupted: event.isError };
+  }
+  if (event.toolName === 'read') {
+    return { content: text };
+  }
+  return { content: text, details: event.details, isError: event.isError };
+};
+
+const hookInputs = (
+  event: PiToolCallEvent | PiToolResultEvent,
+  hookEventName: 'PostToolUse' | 'PreToolUse',
+  cwd: string,
+): readonly Record<string, unknown>[] => {
+  const base = {
+    cwd,
+    hook_event_name: hookEventName,
+    tool_name: event.toolName,
+    tool_use_id: event.toolCallId,
+  };
+  if ('content' in event) {
+    return [{ ...base, tool_input: event.input, tool_response: normalizedToolResponse(event) }];
+  }
+  const inputs: Record<string, unknown>[] = [];
+  for (const toolInput of normalizedToolInputs(event)) {
+    inputs.push({ ...base, tool_input: toolInput });
+  }
+  return inputs;
+};
+
+const readStream = async (stream: Readable): Promise<string> => {
+  stream.setEncoding('utf8');
+  let output = '';
+  for await (const chunk of stream) {
+    output += String(chunk);
+  }
+  return output;
+};
+
+const runTripwire = async (hookPath: string, input: unknown): Promise<HookResult> => {
+  const child = spawn(hookPath, ['--tripwire-hook'], { stdio: ['pipe', 'pipe', 'pipe'] });
+  const state = { timedOut: false };
+  const timeout = setTimeout(() => {
+    state.timedOut = true;
+    child.kill('SIGKILL');
+  }, TIMEOUT_MS);
+  child.stdin.end(JSON.stringify(input));
+  try {
+    const [closed, stdout, stderr] = await Promise.all([
+      once(child, 'close'),
+      readStream(child.stdout),
+      readStream(child.stderr),
+    ]);
+    if (state.timedOut) {
+      throw new Error(`Tripwire exceeded its ${TIMEOUT_MS}ms timeout`);
+    }
+    return { exitCode: typeof closed[0] === 'number' ? closed[0] : 1, stderr, stdout };
+  } finally {
+    clearTimeout(timeout);
+  }
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+const stringField = (value: Record<string, unknown>, key: string): string | undefined => {
+  const field = value[key];
+  return typeof field === 'string' ? field : undefined;
+};
+
+const tripwirePiDenialReason = (result: HookResult): string | undefined => {
+  if (result.exitCode !== 0) {
+    return result.stderr.trim() || `Tripwire exited ${result.exitCode}`;
+  }
+  if (result.stdout.trim().length === 0) {
+    return 'Tripwire returned no decision';
+  }
+  try {
+    const value: unknown = JSON.parse(result.stdout);
+    if (!isRecord(value)) {
+      return 'Tripwire returned invalid JSON';
+    }
+    const specific = isRecord(value['hookSpecificOutput'])
+      ? value['hookSpecificOutput']
+      : undefined;
+    const decision =
+      (specific === undefined ? undefined : stringField(specific, 'permissionDecision')) ??
+      stringField(value, 'permissionDecision') ??
+      stringField(value, 'permission');
+    const reason =
+      (specific === undefined ? undefined : stringField(specific, 'permissionDecisionReason')) ??
+      stringField(value, 'permissionDecisionReason') ??
+      stringField(value, 'reason') ??
+      'Blocked by Tripwire';
+    if (decision === 'deny' || decision === 'ask') {
+      return reason;
+    }
+    if (stringField(value, 'decision') === 'block' || value['continue'] === false) {
+      return reason;
+    }
+    return value['continue'] === true || decision === 'allow'
+      ? undefined
+      : 'Tripwire returned an unrecognized response';
+  } catch {
+    return 'Tripwire returned invalid JSON';
+  }
+};
+
+const createTripwirePiExtension =
+  (hookPath: string, processRunner: TripwireProcessRunner = runTripwire) =>
+  (pi: TripwirePiExtensionApi): void => {
+    pi.on('tool_call', async (event, context) => {
+      try {
+        const inputs = hookInputs(event, 'PreToolUse', context.cwd);
+        const input = inputs.length === 1 ? inputs[0] : inputs;
+        if (input === undefined) {
+          throw new Error('Tripwire could not normalize the Pi tool call');
+        }
+        const reason = tripwirePiDenialReason(await processRunner(hookPath, input));
+        if (reason !== undefined) {
+          return { block: true, reason };
+        }
+        return {};
+      } catch (error) {
+        return {
+          block: true,
+          reason: `Tripwire failed closed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
+    });
+
+    pi.on('tool_result', async (event, context) => {
+      try {
+        const [input] = hookInputs(event, 'PostToolUse', context.cwd);
+        if (input === undefined) {
+          throw new Error('Tripwire could not normalize the Pi tool result');
+        }
+        const reason = tripwirePiDenialReason(await processRunner(hookPath, input));
+        if (reason !== undefined) {
+          context.ui.notify(`Tripwire stopped the session: ${reason}`, 'error');
+          context.abort();
+        }
+      } catch (error) {
+        context.ui.notify(
+          `Tripwire failed closed after tool use: ${error instanceof Error ? error.message : String(error)}`,
+          'error',
+        );
+        context.abort();
+      }
+    });
+  };
+
+export default createTripwirePiExtension(shippedHookPath);
+
+export {
+  createTripwirePiExtension,
+  hookInputs,
+  resolveShippedHookPath,
+  tripwirePiDenialReason,
+  type HookResult,
+  type PiExtensionContext,
+  type PiToolCallEvent,
+  type PiToolResultEvent,
+  type TripwirePiExtensionApi,
+  type TripwireProcessRunner,
+};

package/src/rules/bash-deny.ts

@@ -1,4 +1,4 @@
-import { type Segment, hasBypass } from '../lib/bash';
+import { type Segment, UNSUPPORTED_SHELL_HEAD, hasBypass } from '../lib/bash';
 import { type Decision, allow, ask, deny, merge } from '../lib/decision';
 
 interface Spec {
@@ -12,10 +12,19 @@ interface Spec {
 
 const argsJoined = (seg: Segment): string => seg.tokens.slice(1).join(' ');
 
-const flagPresent = (seg: Segment, ...flags: readonly string[]): boolean =>
-  seg.flags.some((f) => flags.includes(f));
+const flagPresent = (seg: Segment, ...flags: readonly string[]): boolean => {
+  const segmentFlags = new Set(seg.flags);
+  return flags.some((flag) => segmentFlags.has(flag));
+};
 
 const SPECS: readonly Spec[] = [
+  {
+    rule: 'unsupported-shell-structure',
+    action: 'deny',
+    message:
+      'Tripwire cannot inspect every executable branch in this shell structure. Rewrite it as simple commands joined with `;`, `&&`, or `||` so each command can be checked.',
+    match: (seg) => seg.head === UNSUPPORTED_SHELL_HEAD,
+  },
   // ── catastrophic deletions ────────────────────────────────────────────
   {
     rule: 'rm-rf-root',
@@ -342,6 +351,7 @@ const SPECS: readonly Spec[] = [
 // Have no legitimate prompt-line override. If the user genuinely needs
 // One of these to run, they should do it in a terminal themselves.
 const UNBYPASSABLE_RULES: ReadonlySet<string> = new Set([
+  'unsupported-shell-structure',
   // Catastrophic / irreversible
   'rm-rf-root',
   'rm-rf-home',