@webpieces/ai-hook-rules 0.4.622 → 0.4.624

package/templates/guarantee-root.sh

@@ -1,113 +0,0 @@
-#!/bin/sh
-# webpieces L-1 hook — GUARANTEE ROOT. Generated by renderGuaranteeRoot(); do not hand-edit.
-#
-# Registered ABSOLUTE in .claude/settings.json, matcher "Bash":
-#   sh "$CLAUDE_PROJECT_DIR/.claude/webpieces/guarantee-root.sh"
-#
-# It exists because the GUARD hooks beside it are registered RELATIVE, so that each git tree is
-# governed by its own @webpieces release. A relative hook that cannot resolve does not block — the
-# harness logs it and lets the tool call proceed UNGUARDED. This file makes that unreachable by
-# refusing any cd that would park the shell where the relative hooks cannot launch.
-#
-# Three tests, no config, no binary, no network:
-#   1. destination holds .git                     -> ALLOW (tree root, worktree, or foreign clone)
-#   2. destination is outside $CLAUDE_PROJECT_DIR -> ALLOW (the harness resets the cwd next call)
-#   3. otherwise                                  -> DENY  (sticky AND unguarded)
-#
-# A denied cd never runs, so the shell never leaves the root and there is nothing to recover from.
-
-PAYLOAD="$(cat)"
-CWD="$(printf '%s' "$PAYLOAD" | sed -n 's/.*"cwd"[[:space:]]*:[[:space:]]*"\([^"\\]*\)".*/\1/p')"
-TOOL="$(printf '%s' "$PAYLOAD" | sed -n 's/.*"tool_name"[[:space:]]*:[[:space:]]*"\([^"\\]*\)".*/\1/p')"
-
-# The command PREFIX, not the whole command — note there is no closing " in this pattern.
-# WHY: a JSON payload escapes an embedded double quote as \", and `[^"\\]*` stops dead at that
-# backslash, so the usual "capture between quotes" form yields the EMPTY STRING for any command
-# containing a quote at all (measured: `cd /a/b && echo "hi"` -> ''). An empty CMD here would mean
-# "no cd found" -> ALLOW, i.e. this guard would fail OPEN for every quoted command — the exact hazard
-# it exists to close. Capturing only up to the first quote/backslash is enough, because everything
-# L-1 needs (is the FIRST word a cd, and what is its target) lives in the prefix; a quote can only
-# appear later, in the part we do not need.
-CMD="$(printf '%s' "$PAYLOAD" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\([^"\\]*\).*/\1/p')"
-
-# Only Bash can move the shell. Anything else, and any payload we cannot read, is not ours.
-[ "$TOOL" = "Bash" ] || exit 0
-[ -n "$CMD" ] || exit 0
-
-# --- cd audit (best-effort; never blocks, never touches stdout) --------------------------------
-SID="$(printf '%s' "$PAYLOAD" | sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"\\]*\)".*/\1/p')"
-AID="$(printf '%s' "$PAYLOAD" | sed -n 's/.*"agent_id"[[:space:]]*:[[:space:]]*"\([^"\\]*\)".*/\1/p')"
-# Untrusted payload values are used as path segments, so anything outside [A-Za-z0-9._-] collapses to _
-# and a leading dot is neutralised — ../../etc can never escape the logs directory.
-clean() { printf '%s' "$1" | tr -c 'A-Za-z0-9._-' '_' \
-  | sed -e 's/\.\{2,\}/_/g' -e 's/^\.\{1,\}/_/' | cut -c1-64; }
-wp_cd_log() {              # $1 = verdict, $2 = destination (may be empty)
-  {
-    [ -n "$CLAUDE_PROJECT_DIR" ] || return 0
-    _d="$CLAUDE_PROJECT_DIR/.webpieces/logs/L-1-cd"
-    mkdir -p "$_d" 2>/dev/null || return 0
-    # The LAYER is the directory; this is the WRITER, keyed exactly like LogStream.writerFile():
-    # <session>-<agent|coordinator>-guarantee-root.log. ALWAYS keyed; a missing session_id renders as
-    # 'unknown'. No bare-name branch anywhere.
-    _p="$(clean "${SID:-unknown}")-$(clean "${AID:-coordinator}")-guarantee-root"
-    _f="$_d/${_p}.log"
-    _sz="$(wc -c < "$_f" 2>/dev/null | tr -d ' ')"
-    case "$_sz" in ''|*[!0-9]*) _sz=0 ;; esac
-    [ "$_sz" -gt 524288 ] && mv -f "$_f" "$_d/${_p}.1.log" 2>/dev/null
-    # fault=- is a constant here: L-1 detects no L0 fault. It is present so ONE grep spans every
-    # hook-written stream rather than needing a different field list per layer.
-    printf '%s\t%s\tfault=-\tdest=%s\tcwd=%s\t%s\n' \
-      "$(date '+%Y-%m-%dT%H:%M:%S%z' 2>/dev/null)" "$1" "$2" "$CWD" "$CMD" >> "$_f"
-  } 2>/dev/null || true
-}
-
-
-# Does the command OPEN with cd/pushd? Only a LEADING cd counts — the same rule effective-tree.ts
-# enforces, because a later cd cannot retroactively move a command that has already run.
-FIRST="$(printf '%s' "$CMD" | sed -n 's/^[[:space:]]*\([^[:space:]]\{1,\}\).*/\1/p')"
-case "$FIRST" in
-  cd|pushd) ;;
-  *) exit 0 ;;                 # no leading cd: nothing to audit, nothing to judge
-esac
-
-# The target: a single-quoted path first (that is how a path with spaces is spelled), else a bare word.
-DEST="$(printf '%s' "$CMD" | sed -n "s/^[[:space:]]*[a-z]\{2,5\}[[:space:]]\{1,\}'\([^']*\)'.*/\1/p")"
-[ -n "$DEST" ] || DEST="$(printf '%s' "$CMD" | sed -n 's/^[[:space:]]*[a-z]\{2,5\}[[:space:]]\{1,\}\([^[:space:];&|]\{1,\}\).*/\1/p')"
-
-REASON=""
-if [ -z "$DEST" ] || [ "$DEST" = "-" ]; then
-  REASON='A bare cd (or cd -) moves the shell somewhere the guards cannot predict - a bare cd goes to your home directory, where the webpieces hooks do not exist and every later tool call would run UNGUARDED. Name the directory: cd /abs/path && <your command>.'
-else
-  # A target the guard cannot expand is a target it cannot judge. sh has no regex here, so test the
-  # four unexpandable shapes directly.
-  case "$DEST" in
-    *'$'*|*'`'*|'~'|'~/'*) REASON='This cd target is not a literal path, so the guards cannot tell where the shell will end up. Use a literal absolute path: cd /abs/path && <your command>. A $VAR, ~, $(...) or backtick is never expanded by the guard.' ;;
-  esac
-fi
-
-if [ -z "$REASON" ]; then
-  # Resolve against the shell's real cwd. A destination that does not exist needs no verdict: the cd
-  # itself will fail and the shell stays exactly where it is.
-  ABS="$(CDPATH= cd -- "${CWD:-.}" 2>/dev/null && CDPATH= cd -- "$DEST" 2>/dev/null && pwd)"
-  if [ -z "$ABS" ]; then wp_cd_log ALLOW-NO-SUCH-DIR "$DEST"; exit 0; fi
-
-  # TEST 1 — a git tree of any kind. A worktree's .git is a FILE, a clone's is a DIR; -e covers both.
-  if [ -e "$ABS/.git" ]; then wp_cd_log ALLOW-GIT-TREE "$ABS"; exit 0; fi
-
-  # TEST 2 — outside the governed project. The harness resets the cwd before the next call, so at most
-  # one command runs there, on paths we do not govern anyway.
-  case "$ABS/" in
-    "$CLAUDE_PROJECT_DIR"/*) ;;
-    *) wp_cd_log ALLOW-OUTSIDE "$ABS"; exit 0 ;;
-  esac
-
-  # TEST 3 — inside a governed tree with no shim beside it: sticky AND unguarded.
-  REASON="$(printf 'The webpieces guard hooks are registered RELATIVE (.claude/webpieces/ai-hook.sh) so that each git tree is governed by its own release. %s has no .claude/webpieces/ai-hook.sh, so a shell parked there launches NO hooks at all and every later tool call runs UNGUARDED - and a cd that stays inside the project PERSISTS to your next call. Run it from the tree root instead: cd %s && <your command>. Tools that take their own directory (git -C, pnpm -C, pnpm --filter, nx) need no cd at all.' "$ABS" "$CLAUDE_PROJECT_DIR")"
-fi
-
-wp_cd_log DENY "${ABS:-$DEST}"
-
-BS='\'                      # one literal backslash, so the \u001b escape never sits in this source
-ESC="${BS}u001b"           # the 6 chars: backslash u 0 0 1 b — Claude Code parses \u001b -> ESC
-printf '{"systemMessage":"%s🛑 %s%s","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"%s"}}\n' "${ESC}[31;1m" "$REASON" "${ESC}[0m" "$REASON"
-exit 0                       # the decision is carried by permissionDecision deny, not the exit code