@theokit/agents 9.0.1 → 9.1.1

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @theokit/agents
 
+## 9.1.1
+
+### Patch Changes
+
+- **`readSecureJson` passa a recusar um store que outro usuario local pode ESCREVER.**
+
+  `ensureSecureDir` segurava o diretorio em owner-only e a leitura entao abria o arquivo sem olhar o
+  modo dele. Um `hook-approvals.json` deixado group- ou world-writable — por uma versao antiga, por um
+  umask ruim, por quem tivesse acesso de escrita — era lido como autoritativo. Esse arquivo decide
+  quais linhas de comando chegam ao `spawn(cmd, { shell: true })`.
+
+  Falha FECHADA e reporta, em vez de lancar: um store ilegivel ja significa "nada aprovado", o turno
+  do chamador nao deve terminar por causa disso, e `lastReadError` e como o operador descobre que as
+  aprovacoes dele pararam de valer. Silencio tornaria um store adulterado indistinguivel de um vazio.
+
+  Recusado em vez de reparado: apertar o modo em silencio esconderia que algo o mudou, que e o fato
+  que importa saber.
+
+  Achado por um teste do consumidor (B-019) falhando enquanto ele migrava para este helper.
+
+## 9.1.0
+
+### Minor Changes
+
+- **`HookApprovalStore.approvals(scope)` — os registros, nao so os fingerprints.**
+
+  `approvedFingerprints` responde "quais hashes estao aprovados aqui", que e o que `buildHookHandlers`
+  precisa e mais nada. Uma tela de consentimento precisa dizer QUAL comando foi aprovado e quando — e
+  o consumidor medido mantem a propria store exatamente por isso: sem os registros, adotar a nossa
+  custaria a tela dele.
+
+  `ApprovalRecord` passa a ser exportado pela mesma razao. Devolve copias, nao o mapa interno: um
+  chamador que mutasse o retorno mudaria o que o proximo `stateOf` responde sem nunca escrever em
+  disco.
+
 ## 9.0.1
 
 ### Patch Changes

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";

package/dist/{chunk-AJIQS3WB.js → chunk-QXGSF6WX.js}

@@ -34,6 +34,13 @@ function readSecureJson(filePath, parse, empty) {
       value: empty
     };
   }
+  const fileMode = statSync(filePath).mode & 511;
+  if ((fileMode & FORBIDDEN_WRITE_BITS) !== 0) {
+    return {
+      value: empty,
+      error: new Error(`${filePath} is mode ${fileMode.toString(8)} \u2014 group or world writable, so another local user can decide what it says. It is being treated as empty: every entry in it has stopped applying. Fix with \`chmod 600 ${filePath}\`.`)
+    };
+  }
   if (raw.trim().length === 0) return {
     value: empty
   };
@@ -70,4 +77,4 @@ export {
   readSecureJson,
   writeSecureJson
 };
-//# sourceMappingURL=chunk-AJIQS3WB.js.map
+//# sourceMappingURL=chunk-QXGSF6WX.js.map

package/dist/chunk-QXGSF6WX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAUA,QAAMI,WAAWX,SAASN,QAAAA,EAAUK,OAAO;AAC3C,OAAKY,WAAWrB,0BAA0B,GAAG;AAC3C,WAAO;MACLoB,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,YAAoBiB,SAASP,SAAS,CAAA,CAAA,8KAEGV,QAAAA,KAAa;IAE7D;EACF;AAGA,MAAIc,IAAIK,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEJ,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASO,OAAO;AACd,WAAO;MACLL,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,kIACiDqB,iBAAiBZ,QAAQY,MAAMC,UAAUC,OAAOF,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AAhDgBV;AAiET,SAASa,YAAYxB,UAAgB;AAC1C,SAAOyB,KAAKvB,QAAQF,QAAAA,GAAW,IAAI0B,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB3B,UAAkB4B,WAAuB;AACvE7B,kBAAgBC,QAAAA;AAChB,QAAM6B,MAAML,YAAYxB,QAAAA;AAExB8B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQ1B,MAAMP;EAAU,CAAA;AAEpEkC,aAAWH,KAAK7B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB6B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","fileMode","error","trim","length","cause","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}

package/dist/config.js

@@ -1,6 +1,6 @@
 import {
   ensureSecureDir
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";

package/dist/hooks.d.ts

@@ -330,6 +330,30 @@ declare function hooksPlugin(handlers: HookHandlers): CodePlugin | undefined;
 
 /** What the store can say about a hook it is asked to judge. */
 type ApprovalState = 'approved' | 'unknown' | 'modified';
+/**
+ * One approval, as persisted.
+ *
+ * Exported because a consent screen has to say WHICH command was approved and when. A store that
+ * answers only "these hashes are approved" forces the product to keep its own copy just to render
+ * that sentence — measured against the closest consumer, which did exactly that.
+ */
+interface ApprovalRecord {
+    readonly fingerprint: string;
+    /**
+     * Canonical project directory this approval belongs to.
+     *
+     * Approvals are per PROJECT, not per machine: a hook approved while working on one repository
+     * must not be pre-approved when the operator opens a different one they just cloned. Measured
+     * against the closest real consumer, which keys by `hooks[dir][fingerprint]` for exactly that
+     * reason — and could not adopt this store until it did the same, because adopting would have
+     * WIDENED its posture.
+     */
+    readonly scope: string;
+    readonly command: string;
+    readonly event: string;
+    readonly matcher?: string;
+    readonly approvedAt: string;
+}
 interface HookApprovalStoreOptions {
     /** Root under which `.theokit/hook-approvals.json` lives. Injectable so tests never touch `~`. */
     readonly home: string;
@@ -348,9 +372,16 @@ declare class HookApprovalStore {
     constructor(options: HookApprovalStoreOptions);
     /** The set `buildHookHandlers` takes as `approved`, for ONE project. */
     approvedFingerprints(scope: string): ReadonlySet<string>;
+    /**
+     * Every approval recorded for one project, newest first is NOT promised — the order is the file's.
+     *
+     * A copy, not the internal map: a caller that mutated it would change what the next `stateOf`
+     * answers without ever writing to disk.
+     */
+    approvals(scope: string): readonly ApprovalRecord[];
     stateOf(identity: HookIdentity, scope: string): ApprovalState;
     approve(identity: HookIdentity, scope: string): void;
     revoke(identity: HookIdentity, scope: string): void;
 }
 
-export { type ApprovalState, type BuildHookHandlersOptions, CHAIN_BUDGET_MULTIPLIER, type CodePlugin, DEFAULT_CONTINUATION_BUDGET, DEFAULT_HOOK_TIMEOUT_MS, DRAIN_BUDGET_MS, HOOK_EVENTS, HookApprovalStore, type HookApprovalStoreOptions, type HookEvent, type HookIdentity, type HookRunInput, type HookRunResult, type HookSpec, HookSpecError, MAX_OUTPUT_BYTES, buildHookHandlers, fenceHookOutput, hookFingerprint, hookSpecSchema, hooksPlugin, inheritHooks, parseHookSpecs, runHookCommand };
+export { type ApprovalRecord, type ApprovalState, type BuildHookHandlersOptions, CHAIN_BUDGET_MULTIPLIER, type CodePlugin, DEFAULT_CONTINUATION_BUDGET, DEFAULT_HOOK_TIMEOUT_MS, DRAIN_BUDGET_MS, HOOK_EVENTS, HookApprovalStore, type HookApprovalStoreOptions, type HookEvent, type HookIdentity, type HookRunInput, type HookRunResult, type HookSpec, HookSpecError, MAX_OUTPUT_BYTES, buildHookHandlers, fenceHookOutput, hookFingerprint, hookSpecSchema, hooksPlugin, inheritHooks, parseHookSpecs, runHookCommand };

package/dist/hooks.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   hooksPlugin,
   inheritHooks
@@ -429,6 +429,20 @@ var HookApprovalStore = class {
       ...this.#load().values()
     ].filter((r) => r.scope === key).map((r) => r.fingerprint));
   }
+  /**
+  * Every approval recorded for one project, newest first is NOT promised — the order is the file's.
+  *
+  * A copy, not the internal map: a caller that mutated it would change what the next `stateOf`
+  * answers without ever writing to disk.
+  */
+  approvals(scope) {
+    const key = canonicalScope(scope);
+    return [
+      ...this.#load().values()
+    ].filter((r) => r.scope === key).map((r) => ({
+      ...r
+    }));
+  }
   stateOf(identity, scope) {
     const key = canonicalScope(scope);
     const inScope = [

package/dist/hooks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/hooks/hook-spec.ts","../src/hooks/hook-fingerprint.ts","../src/hooks/hook-runner.ts","../src/hooks/approval-store.ts"],"mappings":";;;;;;;;;;;;;AAAA,SAASA,mBAAmB;AAG5B,SAASC,yBAAyB;AAClC,SAASC,SAAS;;;ACJlB,SAASC,kBAAkB;AAsC3B,IAAMC,kBAAkB;AASjB,SAASC,gBAAgBC,UAAsB;AACpD,QAAMC,YAAY;IAChBD,SAASE;IACTF,SAASG;IACTH,SAASI,WAAW;IACpBC,OAAOL,SAASM,SAAS;IACzBC,KAAKT,eAAAA;AACP,SAAOU,WAAW,QAAA,EAAUC,OAAOR,WAAW,MAAA,EAAQS,OAAO,KAAA;AAC/D;AARgBX;;;AC/ChB,SAASY,aAAa;AA+Bf,IAAMC,mBAAmB;AAQzB,IAAMC,kBAAkB;AAGxB,IAAMC,0BAA0B;AAgCvC,eAAsBC,eAAeC,OAAmB;AACtD,SAAO,IAAIC,QAAuB,CAACC,aAAAA;AAcjC,UAAMC,QAAQC,MAAMJ,MAAMK,SAAS;MACjCC,KAAKN,MAAMM;MACXC,OAAO;;MAEPC,UAAU;MACVC,KAAKT,MAAMS;MACXC,OAAO;QAAC;QAAQ;QAAQ;;IAC1B,CAAA;AAEA,QAAIC,SAAS;AACb,QAAIC,SAAS;AACb,QAAIC,YAAY;AAChB,QAAIC,WAAW;AACf,QAAIC,UAAU;AAEd,UAAMC,UAAU,wBAACC,SAAiBC,UAAAA;AAChC,UAAID,QAAQE,UAAUvB,kBAAkB;AACtCiB,oBAAY;AACZ,eAAOI;MACT;AACA,YAAMG,OAAOH,UAAUC,MAAMG,SAAS,MAAA;AACtC,UAAID,KAAKD,UAAUvB,iBAAkB,QAAOwB;AAC5CP,kBAAY;AACZ,aAAOO,KAAKE,MAAM,GAAG1B,gBAAAA;IACvB,GATgB;AAWhBO,UAAMQ,OAAOY,GAAG,QAAQ,CAACL,UAAAA;AACvBP,eAASK,QAAQL,QAAQO,KAAAA;IAC3B,CAAA;AACAf,UAAMS,OAAOW,GAAG,QAAQ,CAACL,UAAAA;AACvBN,eAASI,QAAQJ,QAAQM,KAAAA;IAC3B,CAAA;AAEA,UAAMM,SAAS,wBAACC,aAAAA;AACd,UAAIV,QAAS;AACbA,gBAAU;AACVW,mBAAaC,KAAAA;AACbD,mBAAaE,UAAAA;AACb1B,MAAAA,SAAQ;QAAEuB;QAAUd;QAAQC;QAAQC;QAAWC;MAAS,CAAA;IAC1D,GANe;AAQf,UAAMa,QAAQE,WAAW,MAAA;AACvBf,iBAAW;AACXgB,gBAAU3B,MAAM4B,GAAG;IACrB,GAAG/B,MAAMgC,SAAS;AAIlB,QAAIJ,aAA4CC,WAAW,MAAMI,QAAW,CAAA;AAC5E9B,UAAMoB,GAAG,QAAQ,CAACW,SAAAA;AAEhBN,mBAAaC,WAAW,MAAA;AACtBL,eAAOU,IAAAA;MACT,GAAGrC,eAAAA;IACL,CAAA;AACAM,UAAMoB,GAAG,SAAS,CAACW,SAAAA;AACjBV,aAAOU,IAAAA;IACT,CAAA;AACA/B,UAAMoB,GAAG,SAAS,MAAA;AAChBC,aAAO,IAAA;IACT,CAAA;AAYArB,UAAMgC,MAAMZ,GAAG,SAAS,MAAMU,MAAAA;AAC9B,QAAIjC,MAAMmC,UAAUF,OAAW9B,OAAMgC,MAAMC,IAAIpC,MAAMmC,KAAK;QACrDhC,OAAMgC,MAAMC,IAAG;EACtB,CAAA;AACF;AA3FsBrC;AAoGtB,SAAS+B,UAAUC,KAAuB;AACxC,MAAIA,QAAQE,OAAW;AACvB,MAAI;AACFI,YAAQC,KAAK,CAACP,KAAK,SAAA;EACrB,QAAQ;EAER;AACF;AAPSD;;;AF1IF,IAAMS,cAAc;EACzB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAMK,IAAMC,0BAA0B;AAQhC,IAAMC,8BAA8B;AAQpC,IAAMC,iBAAiBC,EAC3BC,OAAO;EACNC,OAAOF,EAAEG,KAAKP,WAAAA;EACdQ,SAASJ,EACNK,OAAM,EACNC,IAAI,CAAA,EAQJC,OAAO,CAACC,UAAU,CAAC,wBAAwBC,KAAKD,KAAAA,GAAQ;IACvDE,SAAS;EACX,CAAA;;EAEFC,SAASX,EAAEK,OAAM,EAAGO,SAAQ;EAC5BC,YAAYb,EAAEc,OAAM,EAAGC,IAAG,EAAGC,SAAQ,EAAGC,QAAQpB,uBAAAA;AAClD,CAAA,EACCqB,OAAM;AAWF,IAAMC,gBAAN,cAA4BC,kBAAAA;EAjGnC,OAiGmCA;;;EACfC,OAAO;EACzB,YAAYX,SAAiB;AAC3B,UAAMA,SAAS;MACbY,MAAM;;MAENC,aAAa;IACf,CAAA;EACF;AACF;AASO,SAASC,eAAeC,OAAc;AAC3C,QAAMC,SAAS1B,EAAE2B,MAAM5B,cAAAA,EAAgB6B,UAAUH,KAAAA;AACjD,MAAI,CAACC,OAAOG,SAAS;AACnB,UAAM,IAAIV,cACR,+BAA+BO,OAAOI,MAAMC,OACzCC,IAAI,CAACC,UAAU,GAAGA,MAAMC,KAAKC,KAAK,GAAA,CAAA,KAASF,MAAMvB,OAAO,EAAE,EAC1DyB,KAAK,IAAA,CAAA,EAAO;EAEnB;AACA,SAAOT,OAAOU;AAChB;AAVgBZ;AAuEhB,IAAMa,iBAAiB,6BAAYC,QAAZ;AAUvB,IAAMC,eAAe,oBAAIC,IAAe;EACtC;EACA;EACA;EACA;EACA;CACD;AAQM,SAASC,kBACdC,OACAC,SAAiC;AAEjC,QAAMC,OAAOD,QAAQE,UAAUR;AAC/B,MAAI,CAACM,QAAQG,SAAS;AACpB,QAAIJ,MAAMK,SAAS,GAAG;AACpBH,WACE,GAAGI,OAAON,MAAMK,MAAM,CAAA,0EAAsE;IAEhG;AACA,WAAO,CAAC;EACV;AAEA,QAAME,gBAAgBN,QAAQO,eAAeC;AAC7C,QAAMC,WAAWV,MAAMW,OAAO,CAACC,SAAAA;AAC7B,UAAMC,WAAWZ,QAAQY,SAASC,IAAIP,cAAcQ,WAAWH,IAAAA,CAAAA,CAAAA;AAC/D,QAAI,CAACC,UAAU;AACbX,WACE,wCAAwCU,KAAKlD,OAAO,QAAQkD,KAAKpD,KAAK,sGACa;IAEvF;AACA,WAAOqD;EACT,CAAA;AACA,MAAIH,SAASL,WAAW,EAAG,QAAO,CAAC;AASnC,aAAWO,QAAQF,UAAU;AAC3B,QAAI,CAACb,aAAaiB,IAAIF,KAAKpD,KAAK,GAAG;AACjC0C,WACE,qBAAqBU,KAAKpD,KAAK,sCAC1B;WAAIqC;QAAcJ,KAAK,OAAA,CAAA,4GAC0B;IAE1D;EACF;AAEA,QAAMuB,WAAyB,CAAC;AAChC,QAAMC,gBACJC,KAAKC,IAAG,GAAIT,SAASpB,IAAI,CAACsB,SAASA,KAAKzC,UAAU,CAAA,IAAKiD;AAMzD,QAAMC,WAAWX,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,eAAA;AAC1D,MAAI6D,SAAShB,SAAS,GAAG;AACvBW,aAASM,gBAAgB,OAAOC,QAAAA;AAC9B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWd,QAAQS,UAAU;AAC3B,YAAII,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxC,gBAAMjD,UAAU;AAGhBiC,kBAAQ0B,SAAS;YAAEC,MAAML,IAAI5C;YAAMkD,QAAQ7D;UAAQ,CAAA;AACnD,iBAAO;YAAE8D,OAAO;YAAM9D;UAAQ;QAChC;AACA,YAAI,CAAC+D,QAAQnB,MAAMW,IAAI5C,IAAI,EAAG;AAC9B,cAAMqD,SAAS,MAAMC,eAAe;UAClCvE,SAASkD,KAAKlD;UACdwE,KAAKjC,QAAQiC;UACbC,WAAWvB,KAAKzC;UAChBiE,OAAOC,KAAKC,UAAU;YAAEV,MAAML,IAAI5C;YAAM4D,MAAMhB,IAAIgB;UAAK,CAAA;UACvD,GAAItC,QAAQuC,QAAQ5C,UAAa;YAAE4C,KAAKvC,QAAQuC;UAAI;QACtD,CAAA;AACA,YAAIR,OAAOS,aAAa,GAAG;AACzB,gBAAMzE,UAAU0E,gBACdV,OAAOW,UAAUX,OAAOY,UAAU,eAAetC,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;AAE5ExC,kBAAQ0B,SAAS;YAAEC,MAAML,IAAI5C;YAAMkD,QAAQ7D;UAAQ,CAAA;AACnD,iBAAO;YAAE8D,OAAO;YAAM9D;UAAQ;QAChC;MACF;AACA,aAAO4B;IACT;EACF;AAEA,QAAMiD,YAAYnC,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,gBAAA;AAC3D,MAAIqF,UAAUxC,SAAS,GAAG;AACxBW,aAAS8B,iBAAiB,OAAOvB,QAAAA;AAC/B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWd,QAAQiC,WAAW;AAC5B,YAAIpB,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,eAAK,wEAAA;AACL;QACF;AACA,YAAI,CAAC6B,QAAQnB,MAAMW,IAAI5C,IAAI,EAAG;AAC9B,YAAI;AACF,gBAAMqD,SAAS,MAAMC,eAAe;YAClCvE,SAASkD,KAAKlD;YACdwE,KAAKjC,QAAQiC;YACbC,WAAWvB,KAAKzC;YAChBiE,OAAOC,KAAKC,UAAU;cAAEV,MAAML,IAAI5C;cAAM4D,MAAMhB,IAAIgB;cAAMP,QAAQT,IAAIS;YAAO,CAAA;YAC3E,GAAI/B,QAAQuC,QAAQ5C,UAAa;cAAE4C,KAAKvC,QAAQuC;YAAI;UACtD,CAAA;AACA,cAAIR,OAAOS,aAAa,GAAG;AAEzBvC,iBAAK,cAAcU,KAAKlD,OAAO,YAAY4C,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;UACtE;AACA,cAAIT,OAAOe,UAAW7C,MAAK,cAAcU,KAAKlD,OAAO,wBAAwB;QAC/E,SAAS0B,OAAO;AACdc,eAAK,cAAcU,KAAKlD,OAAO,aAAc0B,MAAgBpB,OAAO,EAAE;QACxE;MACF;IACF;EACF;AAEA,QAAMgF,iBAAiBtC,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,uBAAA;AAChE,MAAIwF,eAAe3C,SAAS,GAAG;AAC7BW,aAASiC,wBAAwBC,sBAC/BF,gBACA/C,SACAC,MACAe,aAAAA;EAEJ;AAEA,aAAWzD,SAAS2F,sBAAsB;AACxC,UAAMC,OAAO1C,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAUA,KAAAA;AACtD,QAAI4F,KAAK/C,WAAW,EAAG;AACvB,UAAMgD,OAAOC,0BAA0B9F,OAAO4F,MAAMnD,SAASC,MAAMe,aAAAA;AACnE,QAAIzD,UAAU,mBAAoBwD,UAASuC,mBAAmBF;QACzDrC,UAASwC,uBAAuBH;EACvC;AAEA,SAAOrC;AACT;AArIgBjB;AAwIhB,SAASgB,WAAWH,MAAc;AAChC,SAAO;IACLlD,SAASkD,KAAKlD;IACdF,OAAOoD,KAAKpD;IACZ,GAAIoD,KAAK3C,YAAY2B,UAAa;MAAE3B,SAAS2C,KAAK3C;IAAQ;IAC1DkE,WAAWvB,KAAKzC;EAClB;AACF;AAPS4C;AAoBT,SAASgB,QAAQnB,MAAgB6C,UAAgB;AAC/C,MAAI7C,KAAK3C,YAAY2B,OAAW,QAAO;AACvC,MAAI;AAEF,WAAO,IAAI8D,OAAO9C,KAAK3C,OAAO,EAAEF,KAAK0F,QAAAA;EACvC,QAAQ;AACN,WAAO;EACT;AACF;AARS1B;AAsBF,SAASW,gBAAgBiB,QAAc;AAC5C,QAAMC,QAAQC,YAAY,CAAA,EAAGC,SAAS,KAAA;AACtC,QAAMC,OAAO,uBAAuBH,KAAAA;AACpC,QAAMI,QAAQ,wBAAwBJ,KAAAA;AAGtC,QAAMK,UAAUN,OAAOO,WAAWF,OAAOA,MAAMG,QAAQ,KAAK,MAAA,CAAA;AAC5D,SAAO,GAAGJ,IAAAA;EAASE,OAAAA;EAAYD,KAAAA;AACjC;AARgBtB;AAWhB,IAAMS,uBAAuB;EAAC;EAAoB;;AAYlD,SAASD,sBACPF,gBACA/C,SACAC,MACAe,eAAqB;AAErB,MAAImD,YAAYnE,QAAQoE,sBAAsBjH;AAE9C,SAAO,OAAUkH,SAAY/C,QAAAA;AAC3B,QAAI6C,aAAa,GAAG;AAClBlE,WACE,6JACqE;AAEvE,aAAOoE;IACT;AACAF,iBAAa;AAEb,QAAIG,MAAMD;AACV,UAAM9C,UAAUC,KAAKC,IAAG;AACxB,eAAWd,QAAQoC,gBAAgB;AACjC,UAAIvB,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,aAAK,+EAAA;AACL;MACF;AAUA,YAAMsE,UACJ5D,KAAK3C,YAAY2B,UAAa2B,IAAIkD,UAAUpE,WAAW,IACnD;QAACT;UACD2B,IAAIkD,UAAU9D,OAAO,CAAC+D,SAAS3C,QAAQnB,MAAM8D,KAAK/F,IAAI,CAAA;AAE5D,iBAAW+F,QAAQF,SAAS;AAC1B,cAAMxC,SAAS,MAAMC,eAAe;UAClCvE,SAASkD,KAAKlD;UACdwE,KAAKjC,QAAQiC;UACbC,WAAWvB,KAAKzC;UAChBiE,OAAOC,KAAKC,UAAU;YACpBV,MAAM8C,MAAM/F;;;;;YAKZA,MAAM+F,MAAM/F;YACZ4D,MAAMmC,MAAMnC,QAAQ,CAAC;YACrBP,QAAQuC;UACV,CAAA;UACA,GAAItE,QAAQuC,QAAQ5C,UAAa;YAAE4C,KAAKvC,QAAQuC;UAAI;QACtD,CAAA;AAGA,YAAIR,OAAOS,aAAa,GAAG;AACzBvC,eAAK,uDAAuDU,KAAKlD,OAAO,GAAG;AAC3E;QACF;AACA,cAAMiH,WAAW3C,OAAOW,OAAOiC,KAAI;AACnC,YAAID,SAAStE,SAAS,EACpBkE,OAAM,GAAGjE,OAAOiE,GAAAA,CAAAA;EAAS7B,gBAAgBiC,QAAAA,CAAAA;MAC7C;IACF;AACA,WAAOJ;EACT;AACF;AArESrB;AA6ET,SAASI,0BACP9F,OACA4F,MACAnD,SACAC,MACAe,eAAqB;AAErB,SAAO,YAAA;AACL,UAAMO,UAAUC,KAAKC,IAAG;AACxB,eAAWd,QAAQwC,MAAM;AACvB,UAAI3B,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,aAAK,GAAG1C,KAAAA,0DAA+D;AACvE;MACF;AACA,YAAMwE,SAAS,MAAMC,eAAe;QAClCvE,SAASkD,KAAKlD;QACdwE,KAAKjC,QAAQiC;QACbC,WAAWvB,KAAKzC;QAChB,GAAI8B,QAAQuC,QAAQ5C,UAAa;UAAE4C,KAAKvC,QAAQuC;QAAI;MACtD,CAAA;AACA,UAAIR,OAAOS,aAAa,GAAG;AACzBvC,aACE,GAAG1C,KAAAA,kCAAuCoD,KAAKlD,OAAO,YAAY4C,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;MAE/F;IACF;EACF;AACF;AA3BSa;;;AGhdT,SAASuB,oBAAoB;AAC7B,SAASC,MAAMC,eAAe;AAiC9B,SAASC,OAAOC,UAAiD;AAC/D,SAAO,GAAGA,SAASC,KAAK,IAAID,SAASE,WAAW,EAAA;AAClD;AAFSH;AAeT,SAASI,eAAeC,KAAW;AACjC,MAAI;AAEF,WAAOC,aAAaD,GAAAA;EACtB,QAAQ;AACN,WAAOE,QAAQF,GAAAA;EACjB;AACF;AAPSD;AASF,IAAMI,oBAAN,MAAMA;EAlFb,OAkFaA;;;;EAEFC;;;;;;;EAQTC;EAEA;EAEA,YAAYC,SAAmC;AAC7C,SAAKF,OAAOG,KAAKD,QAAQE,MAAM,YAAY,qBAAA;EAC7C;;EAGAC,qBAAqBC,OAAoC;AACvD,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,WAAO,IAAIE,IACT;SAAI,KAAK,MAAK,EAAGC,OAAM;MAAIC,OAAO,CAACC,MAAMA,EAAEL,UAAUC,GAAAA,EAAKK,IAAI,CAACD,MAAMA,EAAEE,WAAW,CAAA;EAEtF;EAEAC,QAAQtB,UAAwBc,OAA8B;AAC5D,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,UAAMS,UAAU;SAAI,KAAK,MAAK,EAAGN,OAAM;MAAIC,OAAO,CAACC,MAAMA,EAAEL,UAAUC,GAAAA;AACrE,QAAIQ,QAAQC,KAAK,CAACL,MAAMA,EAAEE,gBAAgBI,gBAAgBzB,QAAAA,CAAAA,EAAY,QAAO;AAO7E,UAAM0B,OAAO3B,OAAOC,QAAAA;AACpB,eAAW2B,UAAUJ,SAAS;AAC5B,UAAIxB,OAAO4B,MAAAA,MAAYD,QAAQC,OAAOC,YAAY5B,SAAS4B,QAAS,QAAO;IAC7E;AACA,WAAO;EACT;EAEAC,QAAQ7B,UAAwBc,OAAqB;AACnD,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,UAAMgB,UAAU,KAAK,MAAK;AAC1BA,YAAQC,IAAI,GAAGhB,GAAAA,KAAYU,gBAAgBzB,QAAAA,CAAAA,IAAa;MACtDqB,aAAaI,gBAAgBzB,QAAAA;MAC7Bc,OAAOC;MACPa,SAAS5B,SAAS4B;MAClB3B,OAAOD,SAASC;MAChB,GAAID,SAASE,YAAY8B,SAAY,CAAC,IAAI;QAAE9B,SAASF,SAASE;MAAQ;MACtE+B,aAAY,oBAAIC,KAAAA,GAAOC,YAAW;IACpC,CAAA;AACA,SAAK,SAASL,OAAAA;EAChB;EAEAM,OAAOpC,UAAwBc,OAAqB;AAClD,UAAMgB,UAAU,KAAK,MAAK;AAC1B,QAAIA,QAAQO,OAAO,GAAGlC,eAAeW,KAAAA,CAAAA,KAAeW,gBAAgBzB,QAAAA,CAAAA,EAAW,GAAG;AAChF,WAAK,SAAS8B,OAAAA;IAChB;EACF;;;;;;;EAQA,QAAK;AACH,UAAM,EAAEQ,OAAOC,MAAK,IAAKC,eACvB,KAAKhC,MACL,CAACiC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAIK,MAAM,uCAAA;AAC5C,aAAOL;IACT,GACA,CAAA,CAAE;AAEJ,SAAKjC,gBAAgB8B;AAErB,SAAK,WAAW,IAAIS,IAAIV,MAAMlB,IAAI,CAACD,MAAM;MAAC,GAAGA,EAAEL,KAAK,KAASK,EAAEE,WAAW;MAAIF;KAAE,CAAA;AAChF,WAAO,KAAK;EACd;EAEA,SAASW,SAAoC;AAC3CmB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGmC,KAAKO,UAAU;SAAIpB,QAAQb,OAAM;OAAK,MAAM,CAAA,CAAA;CAAM;EACxF;AACF;","names":["randomBytes","TheokitAgentError","z","createHash","FIELD_SEPARATOR","hookFingerprint","identity","canonical","command","event","matcher","String","timeoutMs","join","createHash","update","digest","spawn","MAX_OUTPUT_BYTES","DRAIN_BUDGET_MS","CHAIN_BUDGET_MULTIPLIER","runHookCommand","input","Promise","resolve","child","spawn","command","cwd","shell","detached","env","stdio","stdout","stderr","truncated","timedOut","settled","capture","current","chunk","length","next","toString","slice","on","settle","exitCode","clearTimeout","timer","drainTimer","setTimeout","killGroup","pid","timeoutMs","undefined","code","stdin","end","process","kill","HOOK_EVENTS","DEFAULT_HOOK_TIMEOUT_MS","DEFAULT_CONTINUATION_BUDGET","hookSpecSchema","z","object","event","enum","command","string","min","refine","value","test","message","matcher","optional","timeout_ms","number","int","positive","default","strict","HookSpecError","TheokitAgentError","name","code","isRetryable","parseHookSpecs","input","parsed","array","safeParse","success","error","issues","map","issue","path","join","data","IGNORE_WARNING","undefined","WIRED_EVENTS","Set","buildHookHandlers","specs","options","warn","onWarn","trusted","length","String","fingerprintOf","fingerprint","hookFingerprint","runnable","filter","spec","approved","has","identityOf","handlers","chainBudgetMs","Math","max","CHAIN_BUDGET_MULTIPLIER","preHooks","pre_tool_call","ctx","started","Date","now","onVeto","tool","reason","block","matches","result","runHookCommand","cwd","timeoutMs","stdin","JSON","stringify","args","env","exitCode","fenceHookOutput","stdout","stderr","postHooks","post_tool_call","truncated","transformHooks","transform_tool_result","buildTransformHandler","OBSERVATIONAL_EVENTS","list","fire","buildObservationalHandler","on_session_start","post_assistant_reply","toolName","RegExp","output","nonce","randomBytes","toString","open","close","escaped","replaceAll","replace","remaining","continuationBudget","results","out","targets","toolCalls","call","feedback","trim","realpathSync","join","resolve","slotOf","identity","event","matcher","canonicalScope","dir","realpathSync","resolve","HookApprovalStore","path","lastReadError","options","join","home","approvedFingerprints","scope","key","Set","values","filter","r","map","fingerprint","stateOf","inScope","some","hookFingerprint","slot","record","command","approve","records","set","undefined","approvedAt","Date","toISOString","revoke","delete","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","Error","Map","writeSecureJson","stringify"]}
+{"version":3,"sources":["../src/hooks/hook-spec.ts","../src/hooks/hook-fingerprint.ts","../src/hooks/hook-runner.ts","../src/hooks/approval-store.ts"],"mappings":";;;;;;;;;;;;;AAAA,SAASA,mBAAmB;AAG5B,SAASC,yBAAyB;AAClC,SAASC,SAAS;;;ACJlB,SAASC,kBAAkB;AAsC3B,IAAMC,kBAAkB;AASjB,SAASC,gBAAgBC,UAAsB;AACpD,QAAMC,YAAY;IAChBD,SAASE;IACTF,SAASG;IACTH,SAASI,WAAW;IACpBC,OAAOL,SAASM,SAAS;IACzBC,KAAKT,eAAAA;AACP,SAAOU,WAAW,QAAA,EAAUC,OAAOR,WAAW,MAAA,EAAQS,OAAO,KAAA;AAC/D;AARgBX;;;AC/ChB,SAASY,aAAa;AA+Bf,IAAMC,mBAAmB;AAQzB,IAAMC,kBAAkB;AAGxB,IAAMC,0BAA0B;AAgCvC,eAAsBC,eAAeC,OAAmB;AACtD,SAAO,IAAIC,QAAuB,CAACC,aAAAA;AAcjC,UAAMC,QAAQC,MAAMJ,MAAMK,SAAS;MACjCC,KAAKN,MAAMM;MACXC,OAAO;;MAEPC,UAAU;MACVC,KAAKT,MAAMS;MACXC,OAAO;QAAC;QAAQ;QAAQ;;IAC1B,CAAA;AAEA,QAAIC,SAAS;AACb,QAAIC,SAAS;AACb,QAAIC,YAAY;AAChB,QAAIC,WAAW;AACf,QAAIC,UAAU;AAEd,UAAMC,UAAU,wBAACC,SAAiBC,UAAAA;AAChC,UAAID,QAAQE,UAAUvB,kBAAkB;AACtCiB,oBAAY;AACZ,eAAOI;MACT;AACA,YAAMG,OAAOH,UAAUC,MAAMG,SAAS,MAAA;AACtC,UAAID,KAAKD,UAAUvB,iBAAkB,QAAOwB;AAC5CP,kBAAY;AACZ,aAAOO,KAAKE,MAAM,GAAG1B,gBAAAA;IACvB,GATgB;AAWhBO,UAAMQ,OAAOY,GAAG,QAAQ,CAACL,UAAAA;AACvBP,eAASK,QAAQL,QAAQO,KAAAA;IAC3B,CAAA;AACAf,UAAMS,OAAOW,GAAG,QAAQ,CAACL,UAAAA;AACvBN,eAASI,QAAQJ,QAAQM,KAAAA;IAC3B,CAAA;AAEA,UAAMM,SAAS,wBAACC,aAAAA;AACd,UAAIV,QAAS;AACbA,gBAAU;AACVW,mBAAaC,KAAAA;AACbD,mBAAaE,UAAAA;AACb1B,MAAAA,SAAQ;QAAEuB;QAAUd;QAAQC;QAAQC;QAAWC;MAAS,CAAA;IAC1D,GANe;AAQf,UAAMa,QAAQE,WAAW,MAAA;AACvBf,iBAAW;AACXgB,gBAAU3B,MAAM4B,GAAG;IACrB,GAAG/B,MAAMgC,SAAS;AAIlB,QAAIJ,aAA4CC,WAAW,MAAMI,QAAW,CAAA;AAC5E9B,UAAMoB,GAAG,QAAQ,CAACW,SAAAA;AAEhBN,mBAAaC,WAAW,MAAA;AACtBL,eAAOU,IAAAA;MACT,GAAGrC,eAAAA;IACL,CAAA;AACAM,UAAMoB,GAAG,SAAS,CAACW,SAAAA;AACjBV,aAAOU,IAAAA;IACT,CAAA;AACA/B,UAAMoB,GAAG,SAAS,MAAA;AAChBC,aAAO,IAAA;IACT,CAAA;AAYArB,UAAMgC,MAAMZ,GAAG,SAAS,MAAMU,MAAAA;AAC9B,QAAIjC,MAAMmC,UAAUF,OAAW9B,OAAMgC,MAAMC,IAAIpC,MAAMmC,KAAK;QACrDhC,OAAMgC,MAAMC,IAAG;EACtB,CAAA;AACF;AA3FsBrC;AAoGtB,SAAS+B,UAAUC,KAAuB;AACxC,MAAIA,QAAQE,OAAW;AACvB,MAAI;AACFI,YAAQC,KAAK,CAACP,KAAK,SAAA;EACrB,QAAQ;EAER;AACF;AAPSD;;;AF1IF,IAAMS,cAAc;EACzB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAMK,IAAMC,0BAA0B;AAQhC,IAAMC,8BAA8B;AAQpC,IAAMC,iBAAiBC,EAC3BC,OAAO;EACNC,OAAOF,EAAEG,KAAKP,WAAAA;EACdQ,SAASJ,EACNK,OAAM,EACNC,IAAI,CAAA,EAQJC,OAAO,CAACC,UAAU,CAAC,wBAAwBC,KAAKD,KAAAA,GAAQ;IACvDE,SAAS;EACX,CAAA;;EAEFC,SAASX,EAAEK,OAAM,EAAGO,SAAQ;EAC5BC,YAAYb,EAAEc,OAAM,EAAGC,IAAG,EAAGC,SAAQ,EAAGC,QAAQpB,uBAAAA;AAClD,CAAA,EACCqB,OAAM;AAWF,IAAMC,gBAAN,cAA4BC,kBAAAA;EAjGnC,OAiGmCA;;;EACfC,OAAO;EACzB,YAAYX,SAAiB;AAC3B,UAAMA,SAAS;MACbY,MAAM;;MAENC,aAAa;IACf,CAAA;EACF;AACF;AASO,SAASC,eAAeC,OAAc;AAC3C,QAAMC,SAAS1B,EAAE2B,MAAM5B,cAAAA,EAAgB6B,UAAUH,KAAAA;AACjD,MAAI,CAACC,OAAOG,SAAS;AACnB,UAAM,IAAIV,cACR,+BAA+BO,OAAOI,MAAMC,OACzCC,IAAI,CAACC,UAAU,GAAGA,MAAMC,KAAKC,KAAK,GAAA,CAAA,KAASF,MAAMvB,OAAO,EAAE,EAC1DyB,KAAK,IAAA,CAAA,EAAO;EAEnB;AACA,SAAOT,OAAOU;AAChB;AAVgBZ;AAuEhB,IAAMa,iBAAiB,6BAAYC,QAAZ;AAUvB,IAAMC,eAAe,oBAAIC,IAAe;EACtC;EACA;EACA;EACA;EACA;CACD;AAQM,SAASC,kBACdC,OACAC,SAAiC;AAEjC,QAAMC,OAAOD,QAAQE,UAAUR;AAC/B,MAAI,CAACM,QAAQG,SAAS;AACpB,QAAIJ,MAAMK,SAAS,GAAG;AACpBH,WACE,GAAGI,OAAON,MAAMK,MAAM,CAAA,0EAAsE;IAEhG;AACA,WAAO,CAAC;EACV;AAEA,QAAME,gBAAgBN,QAAQO,eAAeC;AAC7C,QAAMC,WAAWV,MAAMW,OAAO,CAACC,SAAAA;AAC7B,UAAMC,WAAWZ,QAAQY,SAASC,IAAIP,cAAcQ,WAAWH,IAAAA,CAAAA,CAAAA;AAC/D,QAAI,CAACC,UAAU;AACbX,WACE,wCAAwCU,KAAKlD,OAAO,QAAQkD,KAAKpD,KAAK,sGACa;IAEvF;AACA,WAAOqD;EACT,CAAA;AACA,MAAIH,SAASL,WAAW,EAAG,QAAO,CAAC;AASnC,aAAWO,QAAQF,UAAU;AAC3B,QAAI,CAACb,aAAaiB,IAAIF,KAAKpD,KAAK,GAAG;AACjC0C,WACE,qBAAqBU,KAAKpD,KAAK,sCAC1B;WAAIqC;QAAcJ,KAAK,OAAA,CAAA,4GAC0B;IAE1D;EACF;AAEA,QAAMuB,WAAyB,CAAC;AAChC,QAAMC,gBACJC,KAAKC,IAAG,GAAIT,SAASpB,IAAI,CAACsB,SAASA,KAAKzC,UAAU,CAAA,IAAKiD;AAMzD,QAAMC,WAAWX,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,eAAA;AAC1D,MAAI6D,SAAShB,SAAS,GAAG;AACvBW,aAASM,gBAAgB,OAAOC,QAAAA;AAC9B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWd,QAAQS,UAAU;AAC3B,YAAII,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxC,gBAAMjD,UAAU;AAGhBiC,kBAAQ0B,SAAS;YAAEC,MAAML,IAAI5C;YAAMkD,QAAQ7D;UAAQ,CAAA;AACnD,iBAAO;YAAE8D,OAAO;YAAM9D;UAAQ;QAChC;AACA,YAAI,CAAC+D,QAAQnB,MAAMW,IAAI5C,IAAI,EAAG;AAC9B,cAAMqD,SAAS,MAAMC,eAAe;UAClCvE,SAASkD,KAAKlD;UACdwE,KAAKjC,QAAQiC;UACbC,WAAWvB,KAAKzC;UAChBiE,OAAOC,KAAKC,UAAU;YAAEV,MAAML,IAAI5C;YAAM4D,MAAMhB,IAAIgB;UAAK,CAAA;UACvD,GAAItC,QAAQuC,QAAQ5C,UAAa;YAAE4C,KAAKvC,QAAQuC;UAAI;QACtD,CAAA;AACA,YAAIR,OAAOS,aAAa,GAAG;AACzB,gBAAMzE,UAAU0E,gBACdV,OAAOW,UAAUX,OAAOY,UAAU,eAAetC,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;AAE5ExC,kBAAQ0B,SAAS;YAAEC,MAAML,IAAI5C;YAAMkD,QAAQ7D;UAAQ,CAAA;AACnD,iBAAO;YAAE8D,OAAO;YAAM9D;UAAQ;QAChC;MACF;AACA,aAAO4B;IACT;EACF;AAEA,QAAMiD,YAAYnC,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,gBAAA;AAC3D,MAAIqF,UAAUxC,SAAS,GAAG;AACxBW,aAAS8B,iBAAiB,OAAOvB,QAAAA;AAC/B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWd,QAAQiC,WAAW;AAC5B,YAAIpB,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,eAAK,wEAAA;AACL;QACF;AACA,YAAI,CAAC6B,QAAQnB,MAAMW,IAAI5C,IAAI,EAAG;AAC9B,YAAI;AACF,gBAAMqD,SAAS,MAAMC,eAAe;YAClCvE,SAASkD,KAAKlD;YACdwE,KAAKjC,QAAQiC;YACbC,WAAWvB,KAAKzC;YAChBiE,OAAOC,KAAKC,UAAU;cAAEV,MAAML,IAAI5C;cAAM4D,MAAMhB,IAAIgB;cAAMP,QAAQT,IAAIS;YAAO,CAAA;YAC3E,GAAI/B,QAAQuC,QAAQ5C,UAAa;cAAE4C,KAAKvC,QAAQuC;YAAI;UACtD,CAAA;AACA,cAAIR,OAAOS,aAAa,GAAG;AAEzBvC,iBAAK,cAAcU,KAAKlD,OAAO,YAAY4C,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;UACtE;AACA,cAAIT,OAAOe,UAAW7C,MAAK,cAAcU,KAAKlD,OAAO,wBAAwB;QAC/E,SAAS0B,OAAO;AACdc,eAAK,cAAcU,KAAKlD,OAAO,aAAc0B,MAAgBpB,OAAO,EAAE;QACxE;MACF;IACF;EACF;AAEA,QAAMgF,iBAAiBtC,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAU,uBAAA;AAChE,MAAIwF,eAAe3C,SAAS,GAAG;AAC7BW,aAASiC,wBAAwBC,sBAC/BF,gBACA/C,SACAC,MACAe,aAAAA;EAEJ;AAEA,aAAWzD,SAAS2F,sBAAsB;AACxC,UAAMC,OAAO1C,SAASC,OAAO,CAACC,SAASA,KAAKpD,UAAUA,KAAAA;AACtD,QAAI4F,KAAK/C,WAAW,EAAG;AACvB,UAAMgD,OAAOC,0BAA0B9F,OAAO4F,MAAMnD,SAASC,MAAMe,aAAAA;AACnE,QAAIzD,UAAU,mBAAoBwD,UAASuC,mBAAmBF;QACzDrC,UAASwC,uBAAuBH;EACvC;AAEA,SAAOrC;AACT;AArIgBjB;AAwIhB,SAASgB,WAAWH,MAAc;AAChC,SAAO;IACLlD,SAASkD,KAAKlD;IACdF,OAAOoD,KAAKpD;IACZ,GAAIoD,KAAK3C,YAAY2B,UAAa;MAAE3B,SAAS2C,KAAK3C;IAAQ;IAC1DkE,WAAWvB,KAAKzC;EAClB;AACF;AAPS4C;AAoBT,SAASgB,QAAQnB,MAAgB6C,UAAgB;AAC/C,MAAI7C,KAAK3C,YAAY2B,OAAW,QAAO;AACvC,MAAI;AAEF,WAAO,IAAI8D,OAAO9C,KAAK3C,OAAO,EAAEF,KAAK0F,QAAAA;EACvC,QAAQ;AACN,WAAO;EACT;AACF;AARS1B;AAsBF,SAASW,gBAAgBiB,QAAc;AAC5C,QAAMC,QAAQC,YAAY,CAAA,EAAGC,SAAS,KAAA;AACtC,QAAMC,OAAO,uBAAuBH,KAAAA;AACpC,QAAMI,QAAQ,wBAAwBJ,KAAAA;AAGtC,QAAMK,UAAUN,OAAOO,WAAWF,OAAOA,MAAMG,QAAQ,KAAK,MAAA,CAAA;AAC5D,SAAO,GAAGJ,IAAAA;EAASE,OAAAA;EAAYD,KAAAA;AACjC;AARgBtB;AAWhB,IAAMS,uBAAuB;EAAC;EAAoB;;AAYlD,SAASD,sBACPF,gBACA/C,SACAC,MACAe,eAAqB;AAErB,MAAImD,YAAYnE,QAAQoE,sBAAsBjH;AAE9C,SAAO,OAAUkH,SAAY/C,QAAAA;AAC3B,QAAI6C,aAAa,GAAG;AAClBlE,WACE,6JACqE;AAEvE,aAAOoE;IACT;AACAF,iBAAa;AAEb,QAAIG,MAAMD;AACV,UAAM9C,UAAUC,KAAKC,IAAG;AACxB,eAAWd,QAAQoC,gBAAgB;AACjC,UAAIvB,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,aAAK,+EAAA;AACL;MACF;AAUA,YAAMsE,UACJ5D,KAAK3C,YAAY2B,UAAa2B,IAAIkD,UAAUpE,WAAW,IACnD;QAACT;UACD2B,IAAIkD,UAAU9D,OAAO,CAAC+D,SAAS3C,QAAQnB,MAAM8D,KAAK/F,IAAI,CAAA;AAE5D,iBAAW+F,QAAQF,SAAS;AAC1B,cAAMxC,SAAS,MAAMC,eAAe;UAClCvE,SAASkD,KAAKlD;UACdwE,KAAKjC,QAAQiC;UACbC,WAAWvB,KAAKzC;UAChBiE,OAAOC,KAAKC,UAAU;YACpBV,MAAM8C,MAAM/F;;;;;YAKZA,MAAM+F,MAAM/F;YACZ4D,MAAMmC,MAAMnC,QAAQ,CAAC;YACrBP,QAAQuC;UACV,CAAA;UACA,GAAItE,QAAQuC,QAAQ5C,UAAa;YAAE4C,KAAKvC,QAAQuC;UAAI;QACtD,CAAA;AAGA,YAAIR,OAAOS,aAAa,GAAG;AACzBvC,eAAK,uDAAuDU,KAAKlD,OAAO,GAAG;AAC3E;QACF;AACA,cAAMiH,WAAW3C,OAAOW,OAAOiC,KAAI;AACnC,YAAID,SAAStE,SAAS,EACpBkE,OAAM,GAAGjE,OAAOiE,GAAAA,CAAAA;EAAS7B,gBAAgBiC,QAAAA,CAAAA;MAC7C;IACF;AACA,WAAOJ;EACT;AACF;AArESrB;AA6ET,SAASI,0BACP9F,OACA4F,MACAnD,SACAC,MACAe,eAAqB;AAErB,SAAO,YAAA;AACL,UAAMO,UAAUC,KAAKC,IAAG;AACxB,eAAWd,QAAQwC,MAAM;AACvB,UAAI3B,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCf,aAAK,GAAG1C,KAAAA,0DAA+D;AACvE;MACF;AACA,YAAMwE,SAAS,MAAMC,eAAe;QAClCvE,SAASkD,KAAKlD;QACdwE,KAAKjC,QAAQiC;QACbC,WAAWvB,KAAKzC;QAChB,GAAI8B,QAAQuC,QAAQ5C,UAAa;UAAE4C,KAAKvC,QAAQuC;QAAI;MACtD,CAAA;AACA,UAAIR,OAAOS,aAAa,GAAG;AACzBvC,aACE,GAAG1C,KAAAA,kCAAuCoD,KAAKlD,OAAO,YAAY4C,OAAO0B,OAAOS,QAAQ,CAAA,EAAG;MAE/F;IACF;EACF;AACF;AA3BSa;;;AGhdT,SAASuB,oBAAoB;AAC7B,SAASC,MAAMC,eAAe;AAuC9B,SAASC,OAAOC,UAAiD;AAC/D,SAAO,GAAGA,SAASC,KAAK,IAAID,SAASE,WAAW,EAAA;AAClD;AAFSH;AAeT,SAASI,eAAeC,KAAW;AACjC,MAAI;AAEF,WAAOC,aAAaD,GAAAA;EACtB,QAAQ;AACN,WAAOE,QAAQF,GAAAA;EACjB;AACF;AAPSD;AASF,IAAMI,oBAAN,MAAMA;EAxFb,OAwFaA;;;;EAEFC;;;;;;;EAQTC;EAEA;EAEA,YAAYC,SAAmC;AAC7C,SAAKF,OAAOG,KAAKD,QAAQE,MAAM,YAAY,qBAAA;EAC7C;;EAGAC,qBAAqBC,OAAoC;AACvD,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,WAAO,IAAIE,IACT;SAAI,KAAK,MAAK,EAAGC,OAAM;MAAIC,OAAO,CAACC,MAAMA,EAAEL,UAAUC,GAAAA,EAAKK,IAAI,CAACD,MAAMA,EAAEE,WAAW,CAAA;EAEtF;;;;;;;EAQAC,UAAUR,OAA0C;AAClD,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,WAAO;SAAI,KAAK,MAAK,EAAGG,OAAM;MAAIC,OAAO,CAACC,MAAMA,EAAEL,UAAUC,GAAAA,EAAKK,IAAI,CAACD,OAAO;MAAE,GAAGA;IAAE,EAAA;EACtF;EAEAI,QAAQvB,UAAwBc,OAA8B;AAC5D,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,UAAMU,UAAU;SAAI,KAAK,MAAK,EAAGP,OAAM;MAAIC,OAAO,CAACC,MAAMA,EAAEL,UAAUC,GAAAA;AACrE,QAAIS,QAAQC,KAAK,CAACN,MAAMA,EAAEE,gBAAgBK,gBAAgB1B,QAAAA,CAAAA,EAAY,QAAO;AAO7E,UAAM2B,OAAO5B,OAAOC,QAAAA;AACpB,eAAW4B,UAAUJ,SAAS;AAC5B,UAAIzB,OAAO6B,MAAAA,MAAYD,QAAQC,OAAOC,YAAY7B,SAAS6B,QAAS,QAAO;IAC7E;AACA,WAAO;EACT;EAEAC,QAAQ9B,UAAwBc,OAAqB;AACnD,UAAMC,MAAMZ,eAAeW,KAAAA;AAC3B,UAAMiB,UAAU,KAAK,MAAK;AAC1BA,YAAQC,IAAI,GAAGjB,GAAAA,KAAYW,gBAAgB1B,QAAAA,CAAAA,IAAa;MACtDqB,aAAaK,gBAAgB1B,QAAAA;MAC7Bc,OAAOC;MACPc,SAAS7B,SAAS6B;MAClB5B,OAAOD,SAASC;MAChB,GAAID,SAASE,YAAY+B,SAAY,CAAC,IAAI;QAAE/B,SAASF,SAASE;MAAQ;MACtEgC,aAAY,oBAAIC,KAAAA,GAAOC,YAAW;IACpC,CAAA;AACA,SAAK,SAASL,OAAAA;EAChB;EAEAM,OAAOrC,UAAwBc,OAAqB;AAClD,UAAMiB,UAAU,KAAK,MAAK;AAC1B,QAAIA,QAAQO,OAAO,GAAGnC,eAAeW,KAAAA,CAAAA,KAAeY,gBAAgB1B,QAAAA,CAAAA,EAAW,GAAG;AAChF,WAAK,SAAS+B,OAAAA;IAChB;EACF;;;;;;;EAQA,QAAK;AACH,UAAM,EAAEQ,OAAOC,MAAK,IAAKC,eACvB,KAAKjC,MACL,CAACkC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAIK,MAAM,uCAAA;AAC5C,aAAOL;IACT,GACA,CAAA,CAAE;AAEJ,SAAKlC,gBAAgB+B;AAErB,SAAK,WAAW,IAAIS,IAAIV,MAAMnB,IAAI,CAACD,MAAM;MAAC,GAAGA,EAAEL,KAAK,KAASK,EAAEE,WAAW;MAAIF;KAAE,CAAA;AAChF,WAAO,KAAK;EACd;EAEA,SAASY,SAAoC;AAC3CmB,oBAAgB,KAAK1C,MAAM,MAAM,GAAGoC,KAAKO,UAAU;SAAIpB,QAAQd,OAAM;OAAK,MAAM,CAAA,CAAA;CAAM;EACxF;AACF;","names":["randomBytes","TheokitAgentError","z","createHash","FIELD_SEPARATOR","hookFingerprint","identity","canonical","command","event","matcher","String","timeoutMs","join","createHash","update","digest","spawn","MAX_OUTPUT_BYTES","DRAIN_BUDGET_MS","CHAIN_BUDGET_MULTIPLIER","runHookCommand","input","Promise","resolve","child","spawn","command","cwd","shell","detached","env","stdio","stdout","stderr","truncated","timedOut","settled","capture","current","chunk","length","next","toString","slice","on","settle","exitCode","clearTimeout","timer","drainTimer","setTimeout","killGroup","pid","timeoutMs","undefined","code","stdin","end","process","kill","HOOK_EVENTS","DEFAULT_HOOK_TIMEOUT_MS","DEFAULT_CONTINUATION_BUDGET","hookSpecSchema","z","object","event","enum","command","string","min","refine","value","test","message","matcher","optional","timeout_ms","number","int","positive","default","strict","HookSpecError","TheokitAgentError","name","code","isRetryable","parseHookSpecs","input","parsed","array","safeParse","success","error","issues","map","issue","path","join","data","IGNORE_WARNING","undefined","WIRED_EVENTS","Set","buildHookHandlers","specs","options","warn","onWarn","trusted","length","String","fingerprintOf","fingerprint","hookFingerprint","runnable","filter","spec","approved","has","identityOf","handlers","chainBudgetMs","Math","max","CHAIN_BUDGET_MULTIPLIER","preHooks","pre_tool_call","ctx","started","Date","now","onVeto","tool","reason","block","matches","result","runHookCommand","cwd","timeoutMs","stdin","JSON","stringify","args","env","exitCode","fenceHookOutput","stdout","stderr","postHooks","post_tool_call","truncated","transformHooks","transform_tool_result","buildTransformHandler","OBSERVATIONAL_EVENTS","list","fire","buildObservationalHandler","on_session_start","post_assistant_reply","toolName","RegExp","output","nonce","randomBytes","toString","open","close","escaped","replaceAll","replace","remaining","continuationBudget","results","out","targets","toolCalls","call","feedback","trim","realpathSync","join","resolve","slotOf","identity","event","matcher","canonicalScope","dir","realpathSync","resolve","HookApprovalStore","path","lastReadError","options","join","home","approvedFingerprints","scope","key","Set","values","filter","r","map","fingerprint","approvals","stateOf","inScope","some","hookFingerprint","slot","record","command","approve","records","set","undefined","approvedAt","Date","toISOString","revoke","delete","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","Error","Map","writeSecureJson","stringify"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "9.0.1",
+  "version": "9.1.1",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "license": "Apache-2.0",
   "type": "module",

package/dist/chunk-AJIQS3WB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAGA,MAAIC,IAAIG,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEF,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASK,OAAO;AACd,WAAO;MACLH,OAAOH;MACPO,OAAO,IAAIX,MACT,GAAGT,QAAAA,kIACiDmB,iBAAiBV,QAAQU,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AA5BgBR;AA6CT,SAASY,YAAYvB,UAAgB;AAC1C,SAAOwB,KAAKtB,QAAQF,QAAAA,GAAW,IAAIyB,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB1B,UAAkB2B,WAAuB;AACvE5B,kBAAgBC,QAAAA;AAChB,QAAM4B,MAAML,YAAYvB,QAAAA;AAExB6B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQzB,MAAMP;EAAU,CAAA;AAEpEiC,aAAWH,KAAK5B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB4B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","trim","length","cause","error","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}