@seanmozeik/tripwire 0.7.0 → 0.7.2

package/src/lib/secrets.ts

@@ -1,184 +0,0 @@
-// Betterleaks supplies the maintained secret-rule set. The stdin command keeps
-// scanned content in memory and writes its JSON report to stdout.
-
-import { spawnSync } from 'node:child_process';
-
-import { Result, Schema } from 'effect';
-
-import type { SecretScannerConfig } from './config';
-
-const BetterleaksFindingSchema = Schema.Struct({
-  RuleID: Schema.String,
-  Description: Schema.String,
-  StartLine: Schema.Finite,
-  EndLine: Schema.Finite,
-  Secret: Schema.String,
-  Match: Schema.String,
-});
-
-const BetterleaksReportSchema = Schema.Array(BetterleaksFindingSchema);
-
-type BetterleaksFinding = typeof BetterleaksFindingSchema.Type;
-
-interface ScanSuccess {
-  readonly ok: true;
-  readonly hits: readonly { readonly rule: string; readonly count: number }[];
-  readonly redacted: string;
-}
-
-type ScanFailureCategory = 'missing-executable' | 'timeout' | 'non-zero-exit' | 'malformed-json';
-
-interface ScanFailure {
-  readonly ok: false;
-  readonly category: ScanFailureCategory;
-}
-
-type ScanResult = ScanSuccess | ScanFailure;
-
-interface ScannerInvocation {
-  readonly executable: string;
-  readonly args: readonly string[];
-  readonly input: string;
-  readonly timeoutMs: number;
-}
-
-interface ScannerProcessResult {
-  readonly status: number | null;
-  readonly stdout: string;
-  readonly error?: unknown;
-}
-
-type ScannerRunner = (invocation: ScannerInvocation) => ScannerProcessResult;
-
-const BETTERLEAKS_ARGS = [
-  'stdin',
-  '--report-format',
-  'json',
-  '--report-path',
-  '-',
-  '--exit-code',
-  '0',
-  '--no-banner',
-  '--no-color',
-  '--log-level',
-  'error',
-] as const;
-
-const defaultScannerRunner: ScannerRunner = ({ executable, args, input, timeoutMs }) => {
-  const result = spawnSync(executable, args, {
-    encoding: 'utf8',
-    input,
-    maxBuffer: 64 * 1024 * 1024,
-    stdio: ['pipe', 'pipe', 'ignore'],
-    timeout: timeoutMs,
-  });
-  const processResult: ScannerProcessResult = {
-    status: result.status,
-    stdout: typeof result.stdout === 'string' ? result.stdout : '',
-  };
-  return result.error === undefined ? processResult : { ...processResult, error: result.error };
-};
-
-const errorCode = (cause: unknown): string | undefined => {
-  if (typeof cause !== 'object' || cause === null || !('code' in cause)) {
-    return undefined;
-  }
-  return typeof cause.code === 'string' ? cause.code : undefined;
-};
-
-const classifyExecutionFailure = (cause: unknown): ScanFailureCategory => {
-  const code = errorCode(cause);
-  if (code === 'ENOENT') {
-    return 'missing-executable';
-  }
-  if (code === 'ETIMEDOUT') {
-    return 'timeout';
-  }
-  return 'non-zero-exit';
-};
-
-const summarizeHits = (
-  findings: readonly BetterleaksFinding[],
-): readonly { rule: string; count: number }[] => {
-  const counts = new Map<string, number>();
-  for (const finding of findings) {
-    counts.set(finding.RuleID, (counts.get(finding.RuleID) ?? 0) + 1);
-  }
-  return [...counts.entries()].map(([rule, count]) => ({ rule, count }));
-};
-
-const escapeRegExp = (value: string): string =>
-  value.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-
-// Replace every found secret in the original input with a tagged redaction.
-const redactWith = (input: string, findings: readonly BetterleaksFinding[]): string => {
-  let output = input;
-  // Sort by length descending so shorter matches that are substrings of
-  // Longer ones do not fire first and break the longer match.
-  const sorted = [...findings].toSorted((a, b) => b.Secret.length - a.Secret.length);
-  for (const finding of sorted) {
-    if (finding.Secret === '') {
-      continue;
-    }
-    output = output.replaceAll(finding.Secret, `[REDACTED:${finding.RuleID}]`);
-  }
-  return output;
-};
-
-const scanAndRedact = (
-  input: string,
-  config: SecretScannerConfig,
-  runner: ScannerRunner = defaultScannerRunner,
-): ScanResult => {
-  if (input.length === 0) {
-    return { ok: true, hits: [], redacted: input };
-  }
-
-  let processResult: ScannerProcessResult;
-  try {
-    processResult = runner({
-      executable: config.executable,
-      args: BETTERLEAKS_ARGS,
-      input,
-      timeoutMs: config.timeoutMs,
-    });
-  } catch {
-    return { ok: false, category: 'non-zero-exit' };
-  }
-
-  if (processResult.error !== undefined) {
-    return { ok: false, category: classifyExecutionFailure(processResult.error) };
-  }
-  if (processResult.status !== 0) {
-    return { ok: false, category: 'non-zero-exit' };
-  }
-
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(processResult.stdout) as unknown;
-  } catch {
-    return { ok: false, category: 'malformed-json' };
-  }
-
-  const decoded = Schema.decodeUnknownResult(BetterleaksReportSchema)(parsed);
-  if (Result.isFailure(decoded)) {
-    return { ok: false, category: 'malformed-json' };
-  }
-
-  const findings = decoded.success;
-  return { ok: true, hits: summarizeHits(findings), redacted: redactWith(input, findings) };
-};
-
-// `escapeRegExp` is exported so tests and callers can build patterns over the
-// Redacted output without reimplementing escaping.
-export type {
-  BetterleaksFinding,
-  ScanFailure,
-  ScanFailureCategory,
-  ScannerInvocation,
-  ScannerProcessResult,
-  ScannerRunner,
-  ScanResult,
-  ScanSuccess,
-};
-export { escapeRegExp, scanAndRedact };

package/src/main.ts

@@ -1,31 +0,0 @@
-#!/usr/bin/env bun
-
-import path from 'node:path';
-
-import pkg from '../package.json' with { type: 'json' };
-
-const INTERNAL_HOOK_FLAG = '--tripwire-hook';
-const FORCE_CLI_FLAG = '--tripwire-force-cli';
-
-const forceCliIndex = process.argv.indexOf(FORCE_CLI_FLAG, 2);
-const forceCli = forceCliIndex !== -1;
-if (forceCli) {
-  process.argv.splice(forceCliIndex, 1);
-}
-const cliArguments = process.argv.slice(2);
-const executableName = path.basename(process.argv0);
-const isHook =
-  !forceCli &&
-  (executableName === 'tripwire-hook' ||
-    cliArguments.includes(INTERNAL_HOOK_FLAG) ||
-    cliArguments.some((argument) => argument.startsWith('--cursor-event')));
-
-if (isHook) {
-  const { runHook } = await import('./dispatch');
-  runHook();
-} else if (cliArguments.length === 1 && cliArguments[0] === '--version') {
-  process.stdout.write(`${pkg.version}\n`);
-} else {
-  const { runCli } = await import('./cli');
-  await runCli();
-}

package/src/pi-extension.ts

@@ -1,337 +0,0 @@
-import { spawn } from 'node:child_process';
-import { once } from 'node:events';
-import { realpathSync } from 'node:fs';
-import path from 'node:path';
-import type { Readable } from 'node:stream';
-import { fileURLToPath } from 'node:url';
-
-interface PiToolCallEvent {
-  readonly input: Record<string, unknown>;
-  readonly toolCallId: string;
-  readonly toolName: string;
-}
-
-type PiToolResultEvent = PiToolCallEvent & {
-  readonly content: unknown;
-  readonly details: unknown;
-  readonly isError: boolean;
-};
-
-interface PiExtensionContext {
-  readonly abort: () => void;
-  readonly cwd: string;
-  readonly ui: { readonly notify: (message: string, level: 'error') => void };
-}
-
-interface TripwirePiExtensionApi {
-  readonly on: {
-    (
-      event: 'tool_call',
-      handler: (
-        event: PiToolCallEvent,
-        context: PiExtensionContext,
-      ) => Promise<{ readonly block?: boolean; readonly reason?: string } | undefined>,
-    ): void;
-    (
-      event: 'tool_result',
-      handler: (event: PiToolResultEvent, context: PiExtensionContext) => Promise<void>,
-    ): void;
-  };
-}
-
-interface HookResult {
-  readonly exitCode: number;
-  readonly stderr: string;
-  readonly stdout: string;
-}
-
-type TripwireProcessRunner = (hookPath: string, input: unknown) => Promise<HookResult>;
-
-const TIMEOUT_MS = 60_000;
-
-/** Resolve the Bun hook next to the built extension, following install symlinks. */
-const resolveShippedHookPath = (extensionUrl: string | URL = import.meta.url): string => {
-  const extensionPath = fileURLToPath(extensionUrl);
-  let resolved = extensionPath;
-  try {
-    resolved = realpathSync(extensionPath);
-  } catch {
-    // Keep the unresolved path when the module is not on disk yet (unit tests).
-  }
-  return path.join(path.dirname(resolved), 'tripwire');
-};
-
-const shippedHookPath = resolveShippedHookPath();
-
-const requiredStringField = (
-  value: Record<string, unknown>,
-  names: readonly string[],
-  label: string,
-): string => {
-  for (const name of names) {
-    const field = value[name];
-    if (typeof field === 'string') {
-      return field;
-    }
-  }
-  throw new Error(`Pi ${label} is missing`);
-};
-
-const stringArrayField = (value: Record<string, unknown>, name: string): string[] => {
-  const field = value[name];
-  return Array.isArray(field) ? field.filter((item) => typeof item === 'string') : [];
-};
-
-const editStrings = (
-  input: Record<string, unknown>,
-): { old_string: string; new_string: string } => {
-  const { edits } = input;
-  if (Array.isArray(edits)) {
-    const oldStrings: string[] = [];
-    const newStrings: string[] = [];
-    for (const edit of edits) {
-      if (!isRecord(edit)) {
-        continue;
-      }
-      const oldText = stringField(edit, 'oldText') ?? stringField(edit, 'old_string');
-      const newText = stringField(edit, 'newText') ?? stringField(edit, 'new_string');
-      if (oldText !== undefined) {
-        oldStrings.push(oldText);
-      }
-      if (newText !== undefined) {
-        newStrings.push(newText);
-      }
-    }
-    return { old_string: oldStrings.join('\n'), new_string: newStrings.join('\n') };
-  }
-  return {
-    old_string: stringField(input, 'oldText') ?? stringField(input, 'old_string') ?? '',
-    new_string:
-      stringField(input, 'newText') ??
-      stringField(input, 'new_string') ??
-      stringField(input, 'input') ??
-      stringField(input, '_input') ??
-      '',
-  };
-};
-
-const normalizedToolInputs = (event: PiToolCallEvent): readonly Record<string, unknown>[] => {
-  const { input, toolName } = event;
-  if (toolName === 'bash' || toolName === 'powershell') {
-    return [{ command: requiredStringField(input, ['command'], `${toolName} command`) }];
-  }
-  if (toolName === 'read') {
-    return [{ file_path: requiredStringField(input, ['path', 'file_path'], 'read path') }];
-  }
-  if (toolName === 'write') {
-    return [
-      {
-        content: requiredStringField(input, ['content'], 'write content'),
-        file_path: requiredStringField(input, ['path', 'file_path'], 'write path'),
-      },
-    ];
-  }
-  if (toolName === 'edit') {
-    const directPath = stringField(input, 'path') ?? stringField(input, 'file_path');
-    const paths = stringArrayField(input, 'paths');
-    let targets = paths;
-    if (targets.length === 0 && directPath !== undefined) {
-      targets = [directPath];
-    }
-    if (targets.length === 0) {
-      throw new Error('Pi edit path is missing');
-    }
-    const strings = editStrings(input);
-    const inputs: Record<string, unknown>[] = [];
-    for (const filePath of targets) {
-      inputs.push({ file_path: filePath, ...strings });
-    }
-    return inputs;
-  }
-  return [input];
-};
-
-const textFromContent = (content: unknown): string => {
-  if (typeof content === 'string') {
-    return content;
-  }
-  if (!Array.isArray(content)) {
-    return '';
-  }
-  const texts: string[] = [];
-  for (const item of content) {
-    if (isRecord(item) && item['type'] === 'text' && typeof item['text'] === 'string') {
-      texts.push(item['text']);
-    }
-  }
-  return texts.join('\n');
-};
-
-const normalizedToolResponse = (event: PiToolResultEvent): Record<string, unknown> => {
-  const text = textFromContent(event.content);
-  if (event.toolName === 'bash' || event.toolName === 'powershell') {
-    return { stdout: text, stderr: event.isError ? text : '', interrupted: event.isError };
-  }
-  if (event.toolName === 'read') {
-    return { content: text };
-  }
-  return { content: text, details: event.details, isError: event.isError };
-};
-
-const hookInputs = (
-  event: PiToolCallEvent | PiToolResultEvent,
-  hookEventName: 'PostToolUse' | 'PreToolUse',
-  cwd: string,
-): readonly Record<string, unknown>[] => {
-  const base = {
-    cwd,
-    hook_event_name: hookEventName,
-    tool_name: event.toolName,
-    tool_use_id: event.toolCallId,
-  };
-  if ('content' in event) {
-    return [{ ...base, tool_input: event.input, tool_response: normalizedToolResponse(event) }];
-  }
-  const inputs: Record<string, unknown>[] = [];
-  for (const toolInput of normalizedToolInputs(event)) {
-    inputs.push({ ...base, tool_input: toolInput });
-  }
-  return inputs;
-};
-
-const readStream = async (stream: Readable): Promise<string> => {
-  stream.setEncoding('utf8');
-  let output = '';
-  for await (const chunk of stream) {
-    output += String(chunk);
-  }
-  return output;
-};
-
-const runTripwire = async (hookPath: string, input: unknown): Promise<HookResult> => {
-  const child = spawn(hookPath, ['--tripwire-hook'], { stdio: ['pipe', 'pipe', 'pipe'] });
-  const state = { timedOut: false };
-  const timeout = setTimeout(() => {
-    state.timedOut = true;
-    child.kill('SIGKILL');
-  }, TIMEOUT_MS);
-  child.stdin.end(JSON.stringify(input));
-  try {
-    const [closed, stdout, stderr] = await Promise.all([
-      once(child, 'close'),
-      readStream(child.stdout),
-      readStream(child.stderr),
-    ]);
-    if (state.timedOut) {
-      throw new Error(`Tripwire exceeded its ${TIMEOUT_MS}ms timeout`);
-    }
-    return { exitCode: typeof closed[0] === 'number' ? closed[0] : 1, stderr, stdout };
-  } finally {
-    clearTimeout(timeout);
-  }
-};
-
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null && !Array.isArray(value);
-
-const stringField = (value: Record<string, unknown>, key: string): string | undefined => {
-  const field = value[key];
-  return typeof field === 'string' ? field : undefined;
-};
-
-const tripwirePiDenialReason = (result: HookResult): string | undefined => {
-  if (result.exitCode !== 0) {
-    return result.stderr.trim() || `Tripwire exited ${result.exitCode}`;
-  }
-  if (result.stdout.trim().length === 0) {
-    return 'Tripwire returned no decision';
-  }
-  try {
-    const value: unknown = JSON.parse(result.stdout);
-    if (!isRecord(value)) {
-      return 'Tripwire returned invalid JSON';
-    }
-    const specific = isRecord(value['hookSpecificOutput'])
-      ? value['hookSpecificOutput']
-      : undefined;
-    const decision =
-      (specific === undefined ? undefined : stringField(specific, 'permissionDecision')) ??
-      stringField(value, 'permissionDecision') ??
-      stringField(value, 'permission');
-    const reason =
-      (specific === undefined ? undefined : stringField(specific, 'permissionDecisionReason')) ??
-      stringField(value, 'permissionDecisionReason') ??
-      stringField(value, 'reason') ??
-      'Blocked by Tripwire';
-    if (decision === 'deny' || decision === 'ask') {
-      return reason;
-    }
-    if (stringField(value, 'decision') === 'block' || value['continue'] === false) {
-      return reason;
-    }
-    return value['continue'] === true || decision === 'allow'
-      ? undefined
-      : 'Tripwire returned an unrecognized response';
-  } catch {
-    return 'Tripwire returned invalid JSON';
-  }
-};
-
-const createTripwirePiExtension =
-  (hookPath: string, processRunner: TripwireProcessRunner = runTripwire) =>
-  (pi: TripwirePiExtensionApi): void => {
-    pi.on('tool_call', async (event, context) => {
-      try {
-        const inputs = hookInputs(event, 'PreToolUse', context.cwd);
-        const input = inputs.length === 1 ? inputs[0] : inputs;
-        if (input === undefined) {
-          throw new Error('Tripwire could not normalize the Pi tool call');
-        }
-        const reason = tripwirePiDenialReason(await processRunner(hookPath, input));
-        if (reason !== undefined) {
-          return { block: true, reason };
-        }
-        return {};
-      } catch (error) {
-        return {
-          block: true,
-          reason: `Tripwire failed closed: ${error instanceof Error ? error.message : String(error)}`,
-        };
-      }
-    });
-
-    pi.on('tool_result', async (event, context) => {
-      try {
-        const [input] = hookInputs(event, 'PostToolUse', context.cwd);
-        if (input === undefined) {
-          throw new Error('Tripwire could not normalize the Pi tool result');
-        }
-        const reason = tripwirePiDenialReason(await processRunner(hookPath, input));
-        if (reason !== undefined) {
-          context.ui.notify(`Tripwire stopped the session: ${reason}`, 'error');
-          context.abort();
-        }
-      } catch (error) {
-        context.ui.notify(
-          `Tripwire failed closed after tool use: ${error instanceof Error ? error.message : String(error)}`,
-          'error',
-        );
-        context.abort();
-      }
-    });
-  };
-
-export default createTripwirePiExtension(shippedHookPath);
-
-export {
-  createTripwirePiExtension,
-  hookInputs,
-  resolveShippedHookPath,
-  tripwirePiDenialReason,
-  type HookResult,
-  type PiExtensionContext,
-  type PiToolCallEvent,
-  type PiToolResultEvent,
-  type TripwirePiExtensionApi,
-  type TripwireProcessRunner,
-};