@shield-agent/kya 0.23.1 → 0.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.cursor-plugin/plugin.json +2 -2
- package/.mcp.json +1 -1
- package/README.md +42 -10
- package/amp/settings.example.json +1 -1
- package/assets/report-activity.png +0 -0
- package/assets/report-certify.png +0 -0
- package/assets/report-changes.png +0 -0
- package/assets/report-gateway-backends.png +0 -0
- package/assets/report-gateway-listeners.png +0 -0
- package/assets/report-gateway-playground.png +0 -0
- package/assets/report-gateway-policies.png +0 -0
- package/assets/report-gateway-routes.png +0 -0
- package/assets/report-gateway.png +0 -0
- package/assets/report-overview.png +0 -0
- package/claude/claude_desktop_config.example.json +1 -1
- package/cline/cline_mcp_settings.example.json +1 -1
- package/copilot/mcp-config.example.json +1 -1
- package/dist/certify/context.d.ts +7 -0
- package/dist/certify/context.d.ts.map +1 -1
- package/dist/certify/context.js +9 -1
- package/dist/certify/context.js.map +1 -1
- package/dist/certify/evaluate.d.ts.map +1 -1
- package/dist/certify/evaluate.js +13 -1
- package/dist/certify/evaluate.js.map +1 -1
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +18 -4
- package/dist/cli.js.map +1 -1
- package/dist/commands/hook.d.ts +6 -0
- package/dist/commands/hook.d.ts.map +1 -1
- package/dist/commands/hook.js +203 -46
- package/dist/commands/hook.js.map +1 -1
- package/dist/commands/import-traces.d.ts +1 -1
- package/dist/commands/import-traces.d.ts.map +1 -1
- package/dist/commands/import-traces.js +10 -6
- package/dist/commands/import-traces.js.map +1 -1
- package/dist/commands/investigate.d.ts.map +1 -1
- package/dist/commands/investigate.js +4 -0
- package/dist/commands/investigate.js.map +1 -1
- package/dist/commands/notify-flush.d.ts.map +1 -1
- package/dist/commands/notify-flush.js +1 -1
- package/dist/commands/notify-flush.js.map +1 -1
- package/dist/importers/agt.d.ts +24 -0
- package/dist/importers/agt.d.ts.map +1 -0
- package/dist/importers/agt.js +242 -0
- package/dist/importers/agt.js.map +1 -0
- package/dist/importers/formats.d.ts +8 -5
- package/dist/importers/formats.d.ts.map +1 -1
- package/dist/importers/formats.js +16 -10
- package/dist/importers/formats.js.map +1 -1
- package/dist/importers/index.d.ts +17 -0
- package/dist/importers/index.d.ts.map +1 -1
- package/dist/importers/index.js +67 -18
- package/dist/importers/index.js.map +1 -1
- package/dist/investigate/incidents.d.ts +3 -1
- package/dist/investigate/incidents.d.ts.map +1 -1
- package/dist/investigate/incidents.js +4 -0
- package/dist/investigate/incidents.js.map +1 -1
- package/dist/investigate/index.d.ts +2 -0
- package/dist/investigate/index.d.ts.map +1 -1
- package/dist/investigate/index.js +2 -0
- package/dist/investigate/index.js.map +1 -1
- package/dist/investigate/last-run.d.ts +33 -0
- package/dist/investigate/last-run.d.ts.map +1 -0
- package/dist/investigate/last-run.js +157 -0
- package/dist/investigate/last-run.js.map +1 -0
- package/dist/node-upgrade.js +1 -1
- package/dist/node-upgrade.js.map +1 -1
- package/dist/notify/index.d.ts +1 -0
- package/dist/notify/index.d.ts.map +1 -1
- package/dist/notify/index.js +6 -0
- package/dist/notify/index.js.map +1 -1
- package/dist/notify/log.d.ts +45 -0
- package/dist/notify/log.d.ts.map +1 -0
- package/dist/notify/log.js +163 -0
- package/dist/notify/log.js.map +1 -0
- package/dist/notify/sender.d.ts +14 -0
- package/dist/notify/sender.d.ts.map +1 -1
- package/dist/notify/sender.js +32 -8
- package/dist/notify/sender.js.map +1 -1
- package/dist/offline-evaluate.d.ts +8 -0
- package/dist/offline-evaluate.d.ts.map +1 -1
- package/dist/offline-evaluate.js +19 -8
- package/dist/offline-evaluate.js.map +1 -1
- package/dist/otel/exporter.d.ts +5 -2
- package/dist/otel/exporter.d.ts.map +1 -1
- package/dist/otel/exporter.js +8 -2
- package/dist/otel/exporter.js.map +1 -1
- package/dist/otel/stats.d.ts +21 -0
- package/dist/otel/stats.d.ts.map +1 -0
- package/dist/otel/stats.js +80 -0
- package/dist/otel/stats.js.map +1 -0
- package/dist/receipt/render-receipt.d.ts +31 -0
- package/dist/receipt/render-receipt.d.ts.map +1 -1
- package/dist/receipt/render-receipt.js +204 -2
- package/dist/receipt/render-receipt.js.map +1 -1
- package/dist/trail.d.ts +10 -0
- package/dist/trail.d.ts.map +1 -1
- package/dist/trail.js +7 -0
- package/dist/trail.js.map +1 -1
- package/droid/README.md +1 -1
- package/droid/mcp.example.json +1 -1
- package/gemini/settings.example.json +1 -1
- package/grok/README.md +1 -1
- package/kilo/kilo.example.json +1 -1
- package/kimi/mcp.example.json +1 -1
- package/kiro/mcp.example.json +1 -1
- package/manifest.json +1 -1
- package/mastracode/mcp.example.json +1 -1
- package/mcp.json +1 -1
- package/openai/codex.config.example.toml +1 -1
- package/opencode/opencode.example.json +1 -1
- package/package.json +2 -2
- package/qwen/settings.example.json +1 -1
- package/server.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAO3D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,8GAA8G;IAC9G,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAkMD,wBAAsB,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA2GnE"}
|
package/dist/commands/hook.js
CHANGED
|
@@ -1,13 +1,18 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* kya hook - PreToolUse interception for hosts with native hooks
|
|
3
3
|
* (Claude Code, Grok, Kimi Code). Offline local evaluate only: no network,
|
|
4
|
-
* sub-second, fail-open on any internal error
|
|
5
|
-
* blocks; REQUIRE_APPROVE records advisory unless
|
|
4
|
+
* sub-second, fail-open on any internal error unless --fail-closed (hosted).
|
|
5
|
+
* DENY (local never-list) blocks; REQUIRE_APPROVE records advisory unless
|
|
6
|
+
* --strict.
|
|
6
7
|
*/
|
|
7
|
-
import {
|
|
8
|
+
import { createHash } from "node:crypto";
|
|
9
|
+
import { closeSync, lstatSync, mkdirSync, openSync, readdirSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
|
|
10
|
+
import { join } from "node:path";
|
|
11
|
+
import { globalConfigDir, resolveConfig } from "../config.js";
|
|
8
12
|
import { runEvalTool } from "./eval-tool.js";
|
|
9
13
|
import { appendTrail, defaultSessionId, hostToProduct } from "../trail.js";
|
|
10
14
|
import { deriveWireChangeFields } from "../diff-preview.js";
|
|
15
|
+
import { matchesNeverList } from "../offline-evaluate.js";
|
|
11
16
|
import { maybeSpawnNotifyFlush } from "../notify/dispatch.js";
|
|
12
17
|
function tokenCount(v) {
|
|
13
18
|
return typeof v === "number" && Number.isFinite(v) && v >= 0
|
|
@@ -57,6 +62,9 @@ function parsePayload(stdinText) {
|
|
|
57
62
|
toolName: (typeof p.tool_name === "string" && p.tool_name) ||
|
|
58
63
|
(typeof p.toolName === "string" && p.toolName) ||
|
|
59
64
|
undefined,
|
|
65
|
+
toolUseId: (typeof p.tool_use_id === "string" && p.tool_use_id) ||
|
|
66
|
+
(typeof p.toolUseId === "string" && p.toolUseId) ||
|
|
67
|
+
undefined,
|
|
60
68
|
toolInput: p.tool_input ?? p.toolInput,
|
|
61
69
|
usage: readUsageShape(p.usage) ?? readUsageShape(toolResponse?.usage),
|
|
62
70
|
};
|
|
@@ -75,70 +83,219 @@ function deny(reason) {
|
|
|
75
83
|
stderr: `${reason}\n`,
|
|
76
84
|
};
|
|
77
85
|
}
|
|
86
|
+
const SEEN_TTL_MS = 24 * 3600_000;
|
|
87
|
+
const PRUNE_EVERY_MS = 3600_000;
|
|
88
|
+
const MARKER_NAME = /^[0-9a-f]{64}$/;
|
|
89
|
+
/**
|
|
90
|
+
* Atomic once-per-call claim for side effects (trail, notify, ping), so a
|
|
91
|
+
* user-level hook and a plugin hook for the same call record once. Verdicts are
|
|
92
|
+
* still computed by every copy. Any filesystem problem, or a marker dir that is
|
|
93
|
+
* not a real directory owned by this user, counts as "first seen" (today's
|
|
94
|
+
* behavior: record). Markers older than 24 h are pruned at most hourly, and
|
|
95
|
+
* only regular files named like a marker are ever unlinked.
|
|
96
|
+
* The key includes session_id when present: ids may repeat across sessions/hosts.
|
|
97
|
+
*/
|
|
98
|
+
function claimToolUse(toolUseId, sessionId, env) {
|
|
99
|
+
const dir = join(globalConfigDir(env), "hook-seen");
|
|
100
|
+
try {
|
|
101
|
+
try {
|
|
102
|
+
mkdirSync(dir, { recursive: true, mode: 0o700 });
|
|
103
|
+
}
|
|
104
|
+
catch {
|
|
105
|
+
return true;
|
|
106
|
+
}
|
|
107
|
+
const st = lstatSync(dir);
|
|
108
|
+
if (!st.isDirectory() || (process.getuid && st.uid !== process.getuid()))
|
|
109
|
+
return true;
|
|
110
|
+
// JSON array so ("a:b","c") and ("a","b:c") cannot collide.
|
|
111
|
+
const key = sessionId ? JSON.stringify([sessionId, toolUseId]) : toolUseId;
|
|
112
|
+
try {
|
|
113
|
+
closeSync(openSync(join(dir, createHash("sha256").update(key).digest("hex")), "wx"));
|
|
114
|
+
}
|
|
115
|
+
catch (e) {
|
|
116
|
+
return e.code !== "EEXIST";
|
|
117
|
+
}
|
|
118
|
+
const stamp = join(dir, ".pruned");
|
|
119
|
+
let last = 0;
|
|
120
|
+
let stampOk = true;
|
|
121
|
+
try {
|
|
122
|
+
const ss = lstatSync(stamp);
|
|
123
|
+
stampOk = ss.isFile();
|
|
124
|
+
last = ss.mtimeMs;
|
|
125
|
+
}
|
|
126
|
+
catch { /* first run */ }
|
|
127
|
+
if (stampOk && Date.now() - last > PRUNE_EVERY_MS) {
|
|
128
|
+
writeFileSync(stamp, "");
|
|
129
|
+
utimesSync(stamp, new Date(), new Date());
|
|
130
|
+
for (const f of readdirSync(dir)) {
|
|
131
|
+
if (!MARKER_NAME.test(f))
|
|
132
|
+
continue;
|
|
133
|
+
try {
|
|
134
|
+
const fs = lstatSync(join(dir, f));
|
|
135
|
+
if (fs.isFile() && Date.now() - fs.mtimeMs > SEEN_TTL_MS)
|
|
136
|
+
unlinkSync(join(dir, f));
|
|
137
|
+
}
|
|
138
|
+
catch { /* raced with another pruner */ }
|
|
139
|
+
}
|
|
140
|
+
}
|
|
141
|
+
}
|
|
142
|
+
catch { /* marker trouble never fails the hook; record as before */ }
|
|
143
|
+
return true;
|
|
144
|
+
}
|
|
145
|
+
// ponytail: this timer cannot preempt the synchronous offline evaluate, config
|
|
146
|
+
// read or trail write. The host's own 5 s limit is only enforced as a block when
|
|
147
|
+
// the hosted plugin hook sets "onFailure": "block"; this timer covers async
|
|
148
|
+
// (injected or future HTTP) evaluators only.
|
|
149
|
+
function withTimeout(p, ms) {
|
|
150
|
+
let t;
|
|
151
|
+
return Promise.race([
|
|
152
|
+
p,
|
|
153
|
+
new Promise((_, rej) => { t = setTimeout(() => rej(new Error("KYA evaluate timed out")), ms); }),
|
|
154
|
+
]).finally(() => clearTimeout(t));
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Deny with a best-effort audit row and notify, so a block caused by an internal
|
|
158
|
+
* error is not invisible. Never throws. FAIL_CLOSED rows are deliberately NOT
|
|
159
|
+
* deduped by the tool_use_id claim: the other hook copy may have recorded an
|
|
160
|
+
* ALLOW, and the trail must also show that this copy blocked the call.
|
|
161
|
+
*/
|
|
162
|
+
function auditedDeny(reason, reasonCode, input, payload, dedupe = false) {
|
|
163
|
+
try {
|
|
164
|
+
// Only for NEVER_EVENT: every hook copy reaches the same never-list verdict,
|
|
165
|
+
// so the claim only collapses duplicate rows/notifies and never the verdict.
|
|
166
|
+
if (dedupe && payload?.toolUseId && !claimToolUse(payload.toolUseId, payload.sessionId, input.env)) {
|
|
167
|
+
return deny(reason);
|
|
168
|
+
}
|
|
169
|
+
const trailCwd = payload?.cwd?.trim() || input.cwd;
|
|
170
|
+
const ev = {
|
|
171
|
+
ts: new Date().toISOString(),
|
|
172
|
+
sessionId: payload?.sessionId ?? defaultSessionId(input.env),
|
|
173
|
+
host: "ide",
|
|
174
|
+
product: hostToProduct(input.host),
|
|
175
|
+
toolId: payload?.toolName ?? "unknown",
|
|
176
|
+
verdict: "DENY",
|
|
177
|
+
reasonCode,
|
|
178
|
+
mode: "offline",
|
|
179
|
+
neverEvent: reasonCode === "NEVER_EVENT",
|
|
180
|
+
};
|
|
181
|
+
try {
|
|
182
|
+
appendTrail(trailCwd, ev, input.env);
|
|
183
|
+
}
|
|
184
|
+
catch { /* audit is best effort */ }
|
|
185
|
+
maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: ev });
|
|
186
|
+
}
|
|
187
|
+
catch { /* never block the deny itself */ }
|
|
188
|
+
return deny(reason);
|
|
189
|
+
}
|
|
190
|
+
// Non-PreToolUse hook events that legitimately carry no gate decision.
|
|
191
|
+
const OTHER_EVENT = /^(post[_-]?tool[_-]?use.*|stop|subagent[_-]?(start|stop)|permission[_-]?request|elicitation.*|session[_-]?(start|end)|user[_-]?prompt[_-]?submit|notification|pre[_-]?compact)$/i;
|
|
78
192
|
export async function runHook(input) {
|
|
193
|
+
let payload;
|
|
79
194
|
try {
|
|
80
|
-
|
|
81
|
-
if (!payload)
|
|
82
|
-
return ALLOW;
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
195
|
+
payload = parsePayload(input.stdinText);
|
|
196
|
+
if (!payload) {
|
|
197
|
+
return input.failClosed ? auditedDeny("KYA fail-closed: unreadable hook payload", "FAIL_CLOSED", input) : ALLOW;
|
|
198
|
+
}
|
|
199
|
+
const isPre = !payload.event || /^(PreToolUse|pre[_-]tool[_-]use)$/i.test(payload.event);
|
|
200
|
+
// Fail-closed: an event name we do not recognize is evaluated, not waved through.
|
|
201
|
+
if (!isPre && (!input.failClosed || OTHER_EVENT.test(payload.event ?? "")))
|
|
86
202
|
return ALLOW;
|
|
87
|
-
|
|
203
|
+
if (!payload.toolName) {
|
|
204
|
+
return input.failClosed ? auditedDeny("KYA fail-closed: hook payload has no tool_name", "FAIL_CLOSED", input, payload) : ALLOW;
|
|
205
|
+
}
|
|
206
|
+
const toolName = payload.toolName;
|
|
207
|
+
// A bad host in env or .kya/config.json must not swallow a never-list match:
|
|
208
|
+
// retry with the default host forced, so DENY blocks in both modes.
|
|
209
|
+
const resolve = (flags) => resolveConfig({
|
|
88
210
|
cwd: input.cwd,
|
|
89
211
|
env: input.env,
|
|
90
|
-
flags
|
|
212
|
+
flags,
|
|
91
213
|
allowMissingApiKey: true,
|
|
92
214
|
requireApiKey: false,
|
|
93
215
|
offline: true,
|
|
94
216
|
});
|
|
217
|
+
let config;
|
|
218
|
+
try {
|
|
219
|
+
config = resolve({});
|
|
220
|
+
}
|
|
221
|
+
catch (e) {
|
|
222
|
+
if (input.failClosed)
|
|
223
|
+
throw e;
|
|
224
|
+
config = resolve({ host: "ide" });
|
|
225
|
+
}
|
|
226
|
+
const cfg = config;
|
|
95
227
|
const evaluate = input.evaluate ??
|
|
96
|
-
(async (toolId, args) => (await runEvalTool(
|
|
97
|
-
const
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
//
|
|
102
|
-
//
|
|
103
|
-
|
|
104
|
-
const trailEvent = {
|
|
105
|
-
ts: new Date().toISOString(),
|
|
106
|
-
sessionId: payload.sessionId ?? defaultSessionId(input.env),
|
|
107
|
-
host: config.host,
|
|
108
|
-
product: hostToProduct(input.host),
|
|
109
|
-
toolId: response.toolId ?? payload.toolName,
|
|
110
|
-
verdict: response.verdict,
|
|
111
|
-
reasonCode: response.reasonCode ?? "",
|
|
112
|
-
mode: "offline",
|
|
113
|
-
neverEvent: response.reasonCode === "NEVER_EVENT",
|
|
114
|
-
argsHash: response.argsHash,
|
|
115
|
-
...(changeFields ?? {}),
|
|
116
|
-
...(payload.usage?.tokensIn !== undefined
|
|
117
|
-
? { tokensIn: payload.usage.tokensIn }
|
|
118
|
-
: {}),
|
|
119
|
-
...(payload.usage?.tokensOut !== undefined
|
|
120
|
-
? { tokensOut: payload.usage.tokensOut }
|
|
121
|
-
: {}),
|
|
122
|
-
};
|
|
228
|
+
(async (toolId, args) => (await runEvalTool(cfg, { toolId, args, offline: true })).response);
|
|
229
|
+
const evaluating = Promise.resolve().then(() => evaluate(toolName, payload?.toolInput ?? {}));
|
|
230
|
+
const response = input.failClosed
|
|
231
|
+
? await withTimeout(evaluating, input.evalTimeoutMs ?? 4000)
|
|
232
|
+
: await evaluating;
|
|
233
|
+
// The verdict exists: nothing below may lose a DENY, so side-effect errors
|
|
234
|
+
// are contained here and never reach the outer catch.
|
|
235
|
+
let firstSeen = true;
|
|
123
236
|
try {
|
|
124
|
-
|
|
237
|
+
// payload.cwd is host-supplied and only feeds the project-basename stamp;
|
|
238
|
+
// the trail path itself comes from env/KYA_HOME - no traversal risk.
|
|
239
|
+
const trailCwd = payload.cwd?.trim() || input.cwd;
|
|
240
|
+
// Wire change fields (summary, diffPreview, targetPath) feed the receipt's
|
|
241
|
+
// Changes tab; redaction + opt-out live inside deriveWireChangeFields.
|
|
242
|
+
const changeFields = deriveWireChangeFields(toolName, payload.toolInput ?? {}, input.env);
|
|
243
|
+
const trailEvent = {
|
|
244
|
+
ts: new Date().toISOString(),
|
|
245
|
+
sessionId: payload.sessionId ?? defaultSessionId(input.env),
|
|
246
|
+
host: cfg.host,
|
|
247
|
+
product: hostToProduct(input.host),
|
|
248
|
+
toolId: response.toolId ?? toolName,
|
|
249
|
+
verdict: response.verdict,
|
|
250
|
+
reasonCode: response.reasonCode ?? "",
|
|
251
|
+
mode: "offline",
|
|
252
|
+
neverEvent: response.reasonCode === "NEVER_EVENT",
|
|
253
|
+
argsHash: response.argsHash,
|
|
254
|
+
...(changeFields ?? {}),
|
|
255
|
+
...(payload.usage?.tokensIn !== undefined ? { tokensIn: payload.usage.tokensIn } : {}),
|
|
256
|
+
...(payload.usage?.tokensOut !== undefined ? { tokensOut: payload.usage.tokensOut } : {}),
|
|
257
|
+
};
|
|
258
|
+
firstSeen = payload.toolUseId ? claimToolUse(payload.toolUseId, payload.sessionId, input.env) : true;
|
|
259
|
+
if (firstSeen) {
|
|
260
|
+
try {
|
|
261
|
+
appendTrail(trailCwd, trailEvent, input.env);
|
|
262
|
+
}
|
|
263
|
+
catch {
|
|
264
|
+
/* observe path never breaks the gate */
|
|
265
|
+
}
|
|
266
|
+
// Webhooks + OTLP export ride a detached helper; the hook never waits on
|
|
267
|
+
// the network. No-op unless a sink is configured.
|
|
268
|
+
maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
|
|
269
|
+
}
|
|
125
270
|
}
|
|
126
271
|
catch {
|
|
127
272
|
/* observe path never breaks the gate */
|
|
128
273
|
}
|
|
129
|
-
// Webhooks + OTLP export ride a detached helper; the hook never waits on
|
|
130
|
-
// the network. No-op unless a sink is configured.
|
|
131
|
-
maybeSpawnNotifyFlush({ env: input.env, cwd: trailCwd, event: trailEvent });
|
|
132
274
|
if (response.verdict === "DENY") {
|
|
133
|
-
return deny(`KYA denied ${
|
|
275
|
+
return { ...deny(`KYA denied ${toolName}: ${response.reasonCode}`), firstSeen };
|
|
134
276
|
}
|
|
135
277
|
if (input.strict && response.verdict === "REQUIRE_APPROVE") {
|
|
136
|
-
return deny(`KYA strict mode: ${
|
|
278
|
+
return { ...deny(`KYA strict mode: ${toolName} requires approval (${response.reasonCode})`), firstSeen };
|
|
137
279
|
}
|
|
138
|
-
return ALLOW;
|
|
280
|
+
return { ...ALLOW, firstSeen };
|
|
139
281
|
}
|
|
140
282
|
catch {
|
|
141
|
-
|
|
283
|
+
// Default fail-open: hook errors must never block the user's agent, with one
|
|
284
|
+
// exception: the never-list depends on the tool name only, so it still blocks
|
|
285
|
+
// when config parsing, arg hashing or anything else threw (a repo-shipped
|
|
286
|
+
// .kya/config.json or a deeply nested tool_input must not disable it).
|
|
287
|
+
// --fail-closed (hosted): enforcement must not silently lapse.
|
|
288
|
+
try {
|
|
289
|
+
// A never-list tool is logged as such in both modes (hosted counts stay right).
|
|
290
|
+
if (payload?.toolName && matchesNeverList(payload.toolName)) {
|
|
291
|
+
return auditedDeny(`KYA denied ${payload.toolName}: NEVER_EVENT`, "NEVER_EVENT", input, payload, true);
|
|
292
|
+
}
|
|
293
|
+
}
|
|
294
|
+
catch { /* fall through */ }
|
|
295
|
+
if (input.failClosed) {
|
|
296
|
+
return auditedDeny("KYA fail-closed: internal error, tool call denied", "FAIL_CLOSED", input, payload);
|
|
297
|
+
}
|
|
298
|
+
return ALLOW;
|
|
142
299
|
}
|
|
143
300
|
}
|
|
144
301
|
//# sourceMappingURL=hook.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAiC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3E,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QAClD,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,YAAY,GAAG,sBAAsB,CACzC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,IAAI,EAAE,EACvB,KAAK,CAAC,GAAG,CACV,CAAC;QACF,MAAM,UAAU,GAAG;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3D,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ;YAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrC,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;YACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,yEAAyE;QACzE,kDAAkD;QAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,oBAAoB,OAAO,CAAC,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAwC9D,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GACT,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC;QAC5D,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC;QACxD,SAAS,CAAC;IACZ,MAAM,YAAY,GAChB,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACvF,CAAC,CAAE,CAAC,CAAC,aAAyC;QAC9C,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;YACtF,CAAC,CAAE,CAAC,CAAC,YAAwC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,KAAK;QACL,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC;YAClD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,QAAQ,EACN,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC;YAC9C,SAAS;QACX,SAAS,EACP,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC;YACpD,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAChD,SAAS;QACX,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS;QACtC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAElE,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YACxB,kBAAkB,EAAE;gBAClB,aAAa,EAAE,YAAY;gBAC3B,kBAAkB,EAAE,MAAM;gBAC1B,wBAAwB,EAAE,MAAM;aACjC;SACF,CAAC,IAAI;QACN,MAAM,EAAE,GAAG,MAAM,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,EAAE,GAAG,QAAQ,CAAC;AAClC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,SAAiB,EAAE,SAA6B,EAAE,GAAsB;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,CAAC;YAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAChF,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,4DAA4D;QAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAQ,CAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC;YAClD,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW;wBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrF,CAAC;gBAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,IAAI,CAAiB,CAAC;IACtB,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACxG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,MAAc,EACd,UAAyC,EACzC,KAAgB,EAChB,OAAqB,EACrB,MAAM,GAAG,KAAK;IAEd,IAAI,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAI,MAAM,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;QACnD,MAAM,EAAE,GAAG;YACT,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5D,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS;YACtC,OAAO,EAAE,MAAM;YACf,UAAU;YACV,IAAI,EAAE,SAAkB;YACxB,UAAU,EAAE,UAAU,KAAK,aAAa;SACzC,CAAC;QACF,IAAI,CAAC;YAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAClF,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,MAAM,WAAW,GAAG,kLAAkL,CAAC;AAEvM,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAgB;IAC5C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,0CAA0C,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClH,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzF,kFAAkF;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,gDAAgD,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjI,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,6EAA6E;QAC7E,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,KAA6B,EAAE,EAAE,CAChD,aAAa,CAAC;YACZ,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK;YACL,kBAAkB,EAAE,IAAI;YACxB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACL,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,CAAC,CAAC;YAC9B,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC;QACnB,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;YACd,CAAC,KAAK,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE,CACvC,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU;YAC/B,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;YAC5D,CAAC,CAAC,MAAM,UAAU,CAAC;QAErB,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC;YAClD,2EAA2E;YAC3E,uEAAuE;YACvE,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1F,MAAM,UAAU,GAAG;gBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC3D,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ;gBACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;gBACrC,IAAI,EAAE,SAAkB;gBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,aAAa;gBACjD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F,CAAC;YACF,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrG,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;gBACD,yEAAyE;gBACzE,kDAAkD;gBAClD,qBAAqB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,QAAQ,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAC3D,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,QAAQ,uBAAuB,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,8EAA8E;QAC9E,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,CAAC;YACH,gFAAgF;YAChF,IAAI,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5D,OAAO,WAAW,CAAC,cAAc,OAAO,CAAC,QAAQ,eAAe,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,WAAW,CAAC,mDAAmD,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* kya import - convert foreign trace exports (LangSmith, Langfuse, Phoenix,
|
|
3
|
-
* OTel JSON) into local trail events so the receipt/certify sees them.
|
|
3
|
+
* OTel JSON, the AGT audit log) into local trail events so the receipt/certify sees them.
|
|
4
4
|
*/
|
|
5
5
|
import type { ParsedArgs } from "../parse-args.js";
|
|
6
6
|
import { type ImportSource } from "../importers/index.js";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,
|
|
1
|
+
{"version":3,"file":"import-traces.d.ts","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAI1E;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAC5D,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAWjB"}
|
|
@@ -1,18 +1,22 @@
|
|
|
1
1
|
import { flagString } from "../parse-args.js";
|
|
2
|
-
import { importTraces, renderImportSummary, } from "../importers/index.js";
|
|
3
|
-
const SOURCES = ["langsmith", "langfuse", "phoenix", "otel"];
|
|
2
|
+
import { defaultAgtAuditPath, importTraces, renderImportSummary, } from "../importers/index.js";
|
|
3
|
+
const SOURCES = ["langsmith", "langfuse", "phoenix", "otel", "agt"];
|
|
4
4
|
export function importOptionsFromArgs(parsed) {
|
|
5
5
|
const rawFrom = flagString(parsed.flags, "from")?.toLowerCase();
|
|
6
6
|
const from = SOURCES.find((s) => s === rawFrom);
|
|
7
|
-
return { from, file: parsed.positionals[0] };
|
|
7
|
+
return { from, file: flagString(parsed.flags, "file") ?? parsed.positionals[0] };
|
|
8
8
|
}
|
|
9
9
|
export async function runImport(opts, io, cwd, env) {
|
|
10
|
-
|
|
11
|
-
|
|
10
|
+
// agt reads AGT's own audit log, so --file is optional there.
|
|
11
|
+
const file = opts.file ?? (opts.from === "agt" ? defaultAgtAuditPath(env) : undefined);
|
|
12
|
+
if (!opts.from || !file) {
|
|
13
|
+
io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel|agt> <file> | --file <path>");
|
|
12
14
|
return 2;
|
|
13
15
|
}
|
|
14
|
-
const result = await importTraces({ from: opts.from, file
|
|
16
|
+
const result = await importTraces({ from: opts.from, file, cwd, env });
|
|
15
17
|
io.log(renderImportSummary(result));
|
|
18
|
+
for (const w of result.warnings ?? [])
|
|
19
|
+
io.error(`warning: ${w}`);
|
|
16
20
|
return result.imported === 0 && result.errors.length > 0 ? 1 : 0;
|
|
17
21
|
}
|
|
18
22
|
//# sourceMappingURL=import-traces.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"import-traces.js","sourceRoot":"","sources":["../../src/commands/import-traces.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,OAAO,GAA4B,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAO7F,MAAM,UAAU,qBAAqB,CAAC,MAAkB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,EAA4D,EAC5D,GAAW,EACX,GAAsB;IAEtB,8DAA8D;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,EAAE,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE;QAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAYnD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,qBAAqB,CAEpF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,qBAAqB,EAC3B,EAAE,EAAE;IAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EAChC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}
|
|
@@ -1,12 +1,16 @@
|
|
|
1
1
|
import { flagBool } from "../parse-args.js";
|
|
2
2
|
import { readTrail } from "../trail.js";
|
|
3
3
|
import { investigateTrail, renderInvestigateReport, } from "../investigate/index.js";
|
|
4
|
+
import { buildInvestigateLastRun, writeInvestigateLastRun, } from "../investigate/last-run.js";
|
|
4
5
|
export function investigateOptionsFromArgs(parsed) {
|
|
5
6
|
return { json: flagBool(parsed.flags, "json") };
|
|
6
7
|
}
|
|
7
8
|
export async function runInvestigate(opts, io, cwd, env) {
|
|
8
9
|
const events = readTrail(cwd, env);
|
|
9
10
|
const result = investigateTrail(events);
|
|
11
|
+
// Persist a compact summary for the report's Investigations section;
|
|
12
|
+
// best-effort, a failed write never changes the command outcome.
|
|
13
|
+
writeInvestigateLastRun(buildInvestigateLastRun(result, events), env);
|
|
10
14
|
if (opts.json) {
|
|
11
15
|
io.log(JSON.stringify({
|
|
12
16
|
findings: result.findings,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"investigate.js","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"investigate.js","sourceRoot":"","sources":["../../src/commands/investigate.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAMpC,MAAM,UAAU,0BAA0B,CAAC,MAAkB;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B,EAC3B,EAAgC,EAChC,GAAW,EACX,GAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,qEAAqE;IACrE,iEAAiE;IACjE,uBAAuB,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CACZ;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"notify-flush.d.ts","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAWA,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"notify-flush.d.ts","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAWA,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAsCjB"}
|
|
@@ -40,7 +40,7 @@ export async function runNotifyFlush(env, cwd) {
|
|
|
40
40
|
...(event.host ? { host: event.host } : {}),
|
|
41
41
|
...(event.tokensIn !== undefined ? { tokensIn: event.tokensIn } : {}),
|
|
42
42
|
...(event.tokensOut !== undefined ? { tokensOut: event.tokensOut } : {}),
|
|
43
|
-
}, otlp).catch(() => undefined);
|
|
43
|
+
}, otlp, env).catch(() => undefined);
|
|
44
44
|
}
|
|
45
45
|
return 0;
|
|
46
46
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"notify-flush.js","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8EAA8E;IAC9E,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,cAAc,CAAC,GAAG,CAAC;KACH,CAAC;IACtB,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,iBAAiB,CACrB;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,EACD,IAAI,
|
|
1
|
+
{"version":3,"file":"notify-flush.js","sourceRoot":"","sources":["../../src/commands/notify-flush.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAsB,EACtB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,8EAA8E;IAC9E,MAAM,UAAU,GAAG;QACjB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,cAAc,CAAC,GAAG,CAAC;KACH,CAAC;IACtB,MAAM,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,iBAAiB,CACrB;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,EACD,IAAI,EACJ,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import type { ImportResult } from "./index.js";
|
|
2
|
+
/** Override AGT itself honours for its audit path. */
|
|
3
|
+
export declare const AGT_AUDIT_PATH_ENV = "AGT_CLAUDE_AUDIT_PATH";
|
|
4
|
+
export declare function defaultAgtAuditPath(env?: NodeJS.ProcessEnv): string;
|
|
5
|
+
export type ChainResult = {
|
|
6
|
+
readonly ok: true;
|
|
7
|
+
} | {
|
|
8
|
+
readonly ok: false;
|
|
9
|
+
readonly index: number;
|
|
10
|
+
readonly reason: string;
|
|
11
|
+
};
|
|
12
|
+
/** Mirror of AGT's verifyAuditEntries, but reports the first bad index instead of a boolean. */
|
|
13
|
+
export declare function verifyAgtChain(entries: readonly unknown[], seamHash: string | null): ChainResult;
|
|
14
|
+
export interface AgtImportOptions {
|
|
15
|
+
/** Path, for messages only. */
|
|
16
|
+
readonly file: string;
|
|
17
|
+
/** File content, already read under the shared size cap and file-type rules. */
|
|
18
|
+
readonly text: string;
|
|
19
|
+
readonly cwd: string;
|
|
20
|
+
readonly env?: NodeJS.ProcessEnv;
|
|
21
|
+
}
|
|
22
|
+
/** Import one AGT audit log. Returns errors (never throws) on a bad or unreadable file. */
|
|
23
|
+
export declare function importAgt(opts: AgtImportOptions): ImportResult;
|
|
24
|
+
//# sourceMappingURL=agt.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agt.d.ts","sourceRoot":"","sources":["../../src/importers/agt.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ/C,sDAAsD;AACtD,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAE1D,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEhF;AAyBD,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqB5E,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAchG;AAsFD,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CAiF9D"}
|