@seanmozeik/tripwire 0.6.7 → 0.7.1

package/src/cli.ts

@@ -1,264 +0,0 @@
-#!/usr/bin/env bun
-// `tripwire test '<command>'` — pipe a synthetic event through the
-// Dispatcher and pretty-print the decision. Indispensable for tuning
-// Rules without going through Claude Code.
-//
-// `tripwire install <target>` — install tripwire hooks for AI agents.
-//
-// Usage:
-//   Bun src/cli.ts test 'rm -rf /etc'
-//   Bun src/cli.ts test --tool=Read --path=.env
-//   Bun src/cli.ts test --post --tool=Bash --stdout='ghp_<token>'
-//   Bun src/cli.ts install claude
-//   Bun src/cli.ts install codex
-//   Bun src/cli.ts install pi
-//   Bun src/cli.ts install all
-
-// oxlint-disable-next-line unicorn/import-style
-import { dirname } from 'node:path';
-
-import { BunServices } from '@effect/platform-bun';
-import { file } from 'bun';
-import { Effect, Option } from 'effect';
-import { Argument, Command, Flag } from 'effect/unstable/cli';
-
-import pkg from '../package.json' with { type: 'json' };
-import { installAll, installClaude, installCodex, installPi } from './lib/install';
-
-// Resolve tripwire-hook path at runtime using process.argv
-// This works in both script mode (bun run) and compiled/bundled mode
-const runtimeSelf = (): string => {
-  const isBunCli = /\/bun(?<ext>\.exe)?$/.test(process.argv[0] ?? '');
-  return isBunCli ? process.argv[1]! : process.argv[0]!;
-};
-
-const dispatchBin = async (): Promise<string> => {
-  const cliPath = runtimeSelf();
-  const cliDir = dirname(cliPath);
-  // Try tripwire-hook in same directory first (installed scenario)
-  const installedPath = `${cliDir}/tripwire-hook`;
-  try {
-    await file(installedPath).text();
-    return installedPath;
-  } catch {
-    // Fallback to development scenario: tripwire-hook in ../dist relative to CLI
-    return `${cliDir}/tripwire.js`;
-  }
-};
-
-interface BuiltEvent {
-  hook_event_name: string;
-  tool_name: string;
-  cwd: string;
-  session_id: string;
-  tool_input?: unknown;
-  tool_response?: unknown;
-}
-
-const buildToolInput = (
-  tool: string,
-  command: string | undefined,
-  path: string | undefined,
-  content: string | undefined,
-): unknown => {
-  if (tool === 'Bash') {
-    return { command: command ?? '' };
-  }
-  if (tool === 'Read') {
-    return { file_path: path ?? '' };
-  }
-  if (tool === 'Write') {
-    return { file_path: path ?? '', content: content ?? '' };
-  }
-  if (tool === 'Edit' || tool === 'MultiEdit') {
-    return { file_path: path ?? '', old_string: '', new_string: content ?? '' };
-  }
-  return undefined;
-};
-
-interface EventParams {
-  readonly tool: string;
-  readonly post: boolean;
-  readonly command: string | undefined;
-  readonly path: string | undefined;
-  readonly stdout: string | undefined;
-  readonly stderr: string | undefined;
-  readonly content: string | undefined;
-}
-
-const buildEvent = (params: EventParams): BuiltEvent => {
-  const { tool, post, command, path, stdout, stderr, content } = params;
-  const eventName = post ? 'PostToolUse' : 'PreToolUse';
-  const event: BuiltEvent = {
-    hook_event_name: eventName,
-    tool_name: tool,
-    cwd: process.cwd(),
-    session_id: 'tripwire-cli-test',
-    tool_input: buildToolInput(tool, command, path, content),
-  };
-  if (post) {
-    event.tool_response =
-      tool === 'Bash' ? { stdout: stdout ?? '', stderr: stderr ?? '' } : { content: content ?? '' };
-  }
-  return event;
-};
-
-const runTest = (config: {
-  readonly command: string | undefined;
-  readonly content: string | undefined;
-  readonly path: string | undefined;
-  readonly post: boolean;
-  readonly stderr: string | undefined;
-  readonly stdout: string | undefined;
-  readonly tool: string;
-}): Effect.Effect<void> =>
-  Effect.gen(function* () {
-    const { command, content, path, post, stderr, stdout, tool } = config;
-    const event = buildEvent({ tool, post, command, path, stdout, stderr, content });
-    const bin = yield* Effect.promise(() => dispatchBin());
-    const result = Bun.spawnSync([bin], {
-      stdin: new TextEncoder().encode(JSON.stringify(event)),
-      timeout: 10_000,
-      stdout: 'pipe',
-      stderr: 'pipe',
-    });
-    if (result.exitCode !== 0) {
-      const errorOutput = new TextDecoder().decode(result.stderr);
-      console.error(`error: ${errorOutput}`);
-      process.exit(1);
-    }
-    const output = new TextDecoder().decode(result.stdout);
-    try {
-      const parsed = JSON.parse(output) as unknown;
-      console.log(JSON.stringify(parsed, null, 2));
-    } catch {
-      console.log(output);
-    }
-  });
-
-const testCommand = Command.make(
-  'test',
-  {
-    command: Argument.string('command').pipe(
-      Argument.optional,
-      Argument.withDescription('Command to test (for Bash tool)'),
-    ),
-    content: Flag.string('content').pipe(
-      Flag.optional,
-      Flag.withDescription('Content for Write/Edit tools'),
-    ),
-    path: Flag.string('path').pipe(
-      Flag.optional,
-      Flag.withDescription('File path for Read/Write/Edit tools'),
-    ),
-    post: Flag.boolean('post').pipe(Flag.withDescription('Test PostToolUse instead of PreToolUse')),
-    stderr: Flag.string('stderr').pipe(
-      Flag.optional,
-      Flag.withDescription('Stderr for PostToolUse Bash'),
-    ),
-    stdout: Flag.string('stdout').pipe(
-      Flag.optional,
-      Flag.withDescription('Stdout for PostToolUse Bash'),
-    ),
-    tool: Flag.string('tool').pipe(
-      Flag.withDefault('Bash'),
-      Flag.withDescription('Tool name (Bash, Read, Write, Edit, MultiEdit)'),
-    ),
-  },
-  ({ command, content, path, post, stderr, stdout, tool }) =>
-    runTest({
-      command: Option.getOrUndefined(command),
-      content: Option.getOrUndefined(content),
-      path: Option.getOrUndefined(path),
-      post,
-      stderr: Option.getOrUndefined(stderr),
-      stdout: Option.getOrUndefined(stdout),
-      tool,
-    }),
-).pipe(Command.withDescription('Test a synthetic hook event'));
-
-const runInstall = (target: string): Effect.Effect<void> =>
-  Effect.gen(function* () {
-    if (!['claude', 'codex', 'pi', 'all'].includes(target)) {
-      console.error(`error: unknown target "${target}"`);
-      console.error('Valid targets: claude, codex, pi, all');
-      process.exit(1);
-    }
-
-    let results: {
-      readonly target: string;
-      readonly result: { readonly success: boolean; readonly message: string };
-    }[];
-
-    switch (target) {
-      case 'claude': {
-        const result = yield* Effect.promise(() => installClaude());
-        results = [{ target: 'claude', result }];
-        break;
-      }
-      case 'codex': {
-        const result = yield* Effect.promise(() => installCodex());
-        results = [{ target: 'codex', result }];
-        break;
-      }
-      case 'pi': {
-        const result = yield* Effect.promise(() => installPi());
-        results = [{ target: 'pi', result }];
-        break;
-      }
-      case 'all': {
-        const installResults = yield* Effect.promise(() => installAll());
-        results = installResults.map((r) => ({ target: r.target, result: r }));
-        break;
-      }
-      default: {
-        results = [];
-        break;
-      }
-    }
-
-    let hasFailure = false;
-    for (const { target: t, result: r } of results) {
-      if (r.success) {
-        const symbol = r.message.startsWith('Already configured') ? '⊙' : '✓';
-        console.log(`${symbol} [${t}] ${r.message}`);
-      } else {
-        console.error(`✗ [${t}] ${r.message}`);
-        hasFailure = true;
-      }
-    }
-
-    if (hasFailure) {
-      process.exit(1);
-    }
-  });
-
-const installCommand = Command.make(
-  'install',
-  {
-    target: Argument.string('target').pipe(
-      Argument.withDescription('Target agent (claude, codex, pi, or all)'),
-    ),
-  },
-  ({ target }) => runInstall(target),
-).pipe(Command.withDescription('Install tripwire hooks for AI agents'));
-
-const app = Command.make('tripwire').pipe(
-  Command.withDescription('Opinionated hooks dispatcher for AI coding agents'),
-  Command.withSubcommands([testCommand, installCommand]),
-);
-
-const program = Command.run(app, { version: pkg.version });
-
-const main = async (): Promise<void> => {
-  try {
-    await Effect.runPromise(program.pipe(Effect.provide(BunServices.layer)));
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(message);
-    process.exitCode = 1;
-  }
-};
-
-// oxlint-disable-next-line no-void, unicorn/prefer-top-level-await
-void main();

package/src/dispatch.ts

@@ -1,354 +0,0 @@
-#!/usr/bin/env bun
-// Tripwire — Claude Code hooks dispatcher.
-//
-// Reads a hook event JSON payload on stdin, routes by hook_event_name +
-// Tool_name, runs rules with per-rule timeouts, merges decisions
-// (most-restrictive wins), scans PostToolUse output for secrets via
-// Betterleaks, and writes Claude Code's expected JSON response on stdout.
-//
-// Design rules:
-//   - A buggy or slow rule must never block the agent. Every rule runs
-//     Under a timeout; any defect or timeout collapses to `allow`, logged.
-//   - Block messages address the agent in second person and name the
-//     Concrete alternative tool / approach. No vague "denied for safety".
-//   - One bypass token: `tripwire-allow` (any comment syntax) on a code
-//     Line, or `# tripwire-allow` in a bash command.
-
-import { BunRuntime } from '@effect/platform-bun';
-import { Cause, Effect, Exit, Schema } from 'effect';
-
-import { parseCommand } from './lib/bash';
-import {
-  CONFIG_PATH,
-  getDefaultConfig,
-  loadConfigResult,
-  mergeWithDefaults,
-  type Config,
-} from './lib/config';
-import { type Decision, allow, deny, merge } from './lib/decision';
-import {
-  type BashInput,
-  type EditInput,
-  type HookEvent,
-  HookEventSchema,
-  type ReadInput,
-  type WriteInput,
-  isBashInput,
-  isEditInput,
-  isReadInput,
-  isWriteInput,
-} from './lib/event.ts';
-import { logError } from './lib/log';
-import { bashDeny } from './rules/bash-deny';
-import { bashGit } from './rules/bash-git';
-import { bashNetworkInstall } from './rules/bash-network-install';
-import { bashRedirect } from './rules/bash-redirect';
-import { bashScopedRm } from './rules/bash-scoped-rm';
-import { bashTarExplosion } from './rules/bash-tar-explosion';
-import { bashToolPolicy } from './rules/bash-tool-policy';
-import { configCustom } from './rules/config-custom';
-import { lazyCode } from './rules/lazy-code';
-import { pathProtect } from './rules/path-protect';
-import { postSecretScrub } from './rules/post-secret-scrub';
-import { readProtect } from './rules/read-protect';
-
-const readStdin = async (): Promise<string> => {
-  const chunks: Buffer[] = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk as Buffer);
-  }
-  return Buffer.concat(chunks).toString('utf8');
-};
-
-const writeAllow = (): void => {
-  process.stdout.write('{"continue": true}\n');
-};
-
-// Codex's PreToolUse hook rejects `hookSpecificOutput.additionalContext`
-// (openai/codex issue #19385). Detect Codex via its `turn_id` extension
-// And downgrade output accordingly. Claude Code accepts it, so we only
-// Narrow when we can confirm we're on Codex.
-const isCodex = (event: HookEvent): boolean => event.turn_id !== undefined;
-
-interface WarnOutput {
-  hookEventName: string;
-  additionalContext?: string;
-}
-
-const writeWarn = (event: HookEvent, decision: Decision): void => {
-  const eventName = event.hook_event_name;
-  const reason = `[tripwire:${decision.rule}] ${decision.message}`;
-  if (isCodex(event)) {
-    // Codex rejects `additionalContext` on PreToolUse. Send only
-    // `systemMessage`.
-    process.stdout.write(`${JSON.stringify({ continue: true, systemMessage: reason })}\n`);
-    return;
-  }
-  const hookSpecificOutput: WarnOutput = { hookEventName: eventName, additionalContext: reason };
-  process.stdout.write(`${JSON.stringify({ continue: true, hookSpecificOutput })}\n`);
-};
-
-const writePreToolGate = (eventName: string, decision: Decision): void => {
-  const out = {
-    hookSpecificOutput: {
-      hookEventName: eventName,
-      permissionDecision: decision.kind === 'deny' ? 'deny' : 'ask',
-      permissionDecisionReason: `[tripwire:${decision.rule}] ${decision.message}`,
-    },
-  };
-  process.stdout.write(`${JSON.stringify(out)}\n`);
-};
-
-const writePostToolBlock = (decision: Decision): void => {
-  const out = {
-    continue: true,
-    decision: 'block',
-    reason: `[tripwire:${decision.rule}] ${decision.message}`,
-  };
-  process.stdout.write(`${JSON.stringify(out)}\n`);
-};
-
-// Tool names vary across hosts. Claude Code uses `Bash`/`Read`/`Write`/
-// `Edit`/`MultiEdit`. Codex sends `apply_patch` for file edits. Devin sends
-// `exec` for shell. Pi (via pi-hooks) sends lowercase `bash`/`read`/`write`/
-// `edit`. Normalize everything to the Claude vocabulary so the rest of the
-// Dispatcher only deals with one set of names.
-const normalizeToolName = (name: string): string => {
-  const n = name.toLowerCase();
-  if (n === 'bash' || n === 'exec' || n === 'shell' || n === 'run_command') {
-    return 'Bash';
-  }
-  if (n === 'read' || n === 'read_file') {
-    return 'Read';
-  }
-  if (n === 'write' || n === 'write_file') {
-    return 'Write';
-  }
-  if (n === 'edit' || n === 'edit_file' || n === 'multiedit' || n === 'apply_patch') {
-    return 'Edit';
-  }
-  if (n === 'webfetch' || n === 'web_fetch' || n === 'fetch') {
-    return 'WebFetch';
-  }
-  return name;
-};
-
-type RuleFn = () => Decision;
-
-const runRule = (name: string, fn: RuleFn, timeoutMs: number): Effect.Effect<Decision> =>
-  Effect.gen(function* () {
-    const exit = yield* Effect.exit(
-      Effect.try({ try: fn, catch: (e) => e }).pipe(Effect.timeout(timeoutMs)),
-    );
-    if (Exit.isSuccess(exit)) {
-      return exit.value;
-    }
-    logError(name, Cause.pretty(exit.cause));
-    return allow(name);
-  });
-
-interface Rule {
-  readonly name: string;
-  readonly fn: RuleFn;
-}
-
-const collectPreToolUseRules = (tool: string, input: unknown, config: Config): Rule[] => {
-  const rules: Rule[] = [];
-  if (tool === 'Bash' && isBashInput(input)) {
-    const i: BashInput = input;
-    const segments = parseCommand(i.command);
-    rules.push({ name: 'bash-deny', fn: () => bashDeny(segments, i.command) });
-    rules.push({
-      name: 'bash-git',
-      fn: () => bashGit(segments, i.command, config.git ?? { enforceConventionalCommits: true }),
-    });
-    rules.push({
-      name: 'bash-scoped-rm',
-      fn: () => bashScopedRm(segments, i.command, config.safePaths ?? {}),
-    });
-    rules.push({ name: 'bash-redirect', fn: () => bashRedirect(segments, i.command) });
-    rules.push({ name: 'bash-network-install', fn: () => bashNetworkInstall(segments, i.command) });
-    rules.push({ name: 'bash-tar-explosion', fn: () => bashTarExplosion(segments, i.command) });
-    rules.push({ name: 'bash-tool-policy', fn: () => bashToolPolicy(segments, i.command) });
-    rules.push({
-      name: 'config-custom',
-      fn: () =>
-        configCustom(
-          segments,
-          i.command,
-          config.blockedCommands ?? [],
-          config.allowedCommands ?? [],
-        ),
-    });
-    return rules;
-  }
-  if (tool === 'Read' && isReadInput(input)) {
-    const i: ReadInput = input;
-    rules.push({ name: 'read-protect', fn: () => readProtect(i) });
-    return rules;
-  }
-  const isEdit = (tool === 'Edit' || tool === 'MultiEdit') && isEditInput(input);
-  const isWrite = tool === 'Write' && isWriteInput(input);
-  if (isEdit) {
-    const i: EditInput = input;
-    rules.push({ name: 'path-protect', fn: () => pathProtect(i) });
-    rules.push({ name: 'lazy-code', fn: () => lazyCode(i) });
-  } else if (isWrite) {
-    const i: WriteInput = input;
-    rules.push({ name: 'path-protect', fn: () => pathProtect(i) });
-    rules.push({ name: 'lazy-code', fn: () => lazyCode(i) });
-  }
-  return rules;
-};
-
-const collectPostToolUseRules = (tool: string, response: unknown): Rule[] => {
-  if (tool === 'Bash' || tool === 'Read' || tool === 'WebFetch') {
-    return [{ name: 'post-secret-scrub', fn: () => postSecretScrub({ toolName: tool, response }) }];
-  }
-  return [];
-};
-
-const runRules = (rules: readonly Rule[], timeoutMs: number): Effect.Effect<Decision> =>
-  Effect.gen(function* () {
-    if (rules.length === 0) {
-      return allow('no-rules');
-    }
-    const decisions: Decision[] = [];
-    for (const r of rules) {
-      decisions.push(yield* runRule(r.name, r.fn, timeoutMs));
-    }
-    return merge(decisions);
-  });
-
-const runRulesSync = (rules: readonly Rule[]): Decision => {
-  if (rules.length === 0) {
-    return allow('no-rules');
-  }
-  return merge(rules.map((r) => r.fn()));
-};
-
-const decide = (event: HookEvent, config: Config = getDefaultConfig()): Decision => {
-  const mergedConfig = mergeWithDefaults(config);
-  const tool = normalizeToolName(event.tool_name ?? '');
-  if (event.hook_event_name === 'PreToolUse') {
-    return runRulesSync(collectPreToolUseRules(tool, event.tool_input, mergedConfig));
-  }
-  if (event.hook_event_name === 'PostToolUse') {
-    return runRulesSync(collectPostToolUseRules(tool, event.tool_response));
-  }
-  return allow('no-rules');
-};
-
-const handleBashAllow = (event: HookEvent, decision: Decision, _config: Config): void => {
-  if (decision.kind === 'warn') {
-    writeWarn(event, decision);
-    return;
-  }
-  writeAllow();
-};
-
-const handleAllow = (event: HookEvent, decision: Decision, config: Config): void => {
-  const eventName = event.hook_event_name;
-  const tool = normalizeToolName(event.tool_name ?? '');
-  if (eventName === 'PreToolUse' && tool === 'Bash') {
-    handleBashAllow(event, decision, config);
-    return;
-  }
-  if (decision.kind === 'warn') {
-    writeWarn(event, decision);
-    return;
-  }
-  writeAllow();
-};
-
-// A broken config (bad JSON / unknown field / decode failure) silently dropping
-// All custom policy is the dangerous case this guards. Fail closed: deny the
-// Pending PreToolUse call with the decode error inline so the agent halts and
-// The user sees it, rather than running on bare defaults unannounced.
-const configErrorMessage = (error: string): string =>
-  `tripwire config at ${CONFIG_PATH} failed to load, so ALL custom safety policy is ` +
-  `inactive. Failing closed until it is fixed. Fix the JSON, then this clears on the next ` +
-  `call (the shim daemon caches config at warm — restart it there). Error: ${error}`;
-
-const program = Effect.gen(function* () {
-  const configLoad = yield* loadConfigResult();
-  const raw = yield* Effect.promise(readStdin);
-
-  const parseExit = yield* Effect.exit(
-    Effect.try({ try: () => JSON.parse(raw) as unknown, catch: (e) => e }),
-  );
-  if (Exit.isFailure(parseExit)) {
-    logError('parse', Cause.pretty(parseExit.cause));
-    writeAllow();
-    return;
-  }
-
-  const decodeExit = yield* Effect.exit(
-    Schema.decodeUnknownEffect(HookEventSchema)(parseExit.value),
-  );
-  if (Exit.isFailure(decodeExit)) {
-    logError('decode', Cause.pretty(decodeExit.cause));
-    writeAllow();
-    return;
-  }
-  const event = decodeExit.value;
-
-  if (!configLoad.ok) {
-    if (event.hook_event_name === 'PreToolUse') {
-      writePreToolGate(
-        event.hook_event_name,
-        deny('config-error', configErrorMessage(configLoad.error)),
-      );
-      return;
-    }
-    // Config governs PreToolUse gating; PostToolUse secret-scrub is config-
-    // Independent and there is always an imminent next PreToolUse to surface the
-    // Deny, so don't block already-run output here.
-    writeAllow();
-    return;
-  }
-  const config = configLoad.config;
-
-  if (event.hook_event_name === 'PreToolUse') {
-    const decision = decide(event, config);
-    if (decision.kind === 'deny' || decision.kind === 'ask') {
-      writePreToolGate(event.hook_event_name, decision);
-      return;
-    }
-    handleAllow(event, decision, config);
-    return;
-  }
-
-  if (event.hook_event_name === 'PostToolUse') {
-    const decision = decide(event, config);
-    if (decision.kind === 'deny') {
-      writePostToolBlock(decision);
-      return;
-    }
-    writeAllow();
-    return;
-  }
-
-  writeAllow();
-});
-
-const handled = program.pipe(
-  Effect.catchCause((cause) => {
-    logError('dispatch-fatal', Cause.pretty(cause));
-    writeAllow();
-    return Effect.void;
-  }),
-);
-
-if (import.meta.main) {
-  BunRuntime.runMain(handled);
-}
-
-export {
-  collectPostToolUseRules,
-  collectPreToolUseRules,
-  decide,
-  normalizeToolName,
-  runRules,
-  runRulesSync,
-};

package/src/index.ts

@@ -1,6 +0,0 @@
-export type { Decision } from './lib/decision.ts';
-export type { HookEvent } from './lib/event.ts';
-export type { Config, ConfigLoad } from './lib/config.ts';
-export { allow, deny, ask, warn } from './lib/decision.ts';
-export { decide } from './dispatch.ts';
-export { getDefaultConfig, loadConfig, loadConfigResult, mergeWithDefaults } from './lib/config.ts';