@wibeco/bridge 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,272 @@
+import { z } from 'zod';
+
+declare const agentSourceSchema: z.ZodEnum<{
+    cursor: "cursor";
+    "claude-code": "claude-code";
+    codex: "codex";
+}>;
+type AgentSource = z.infer<typeof agentSourceSchema>;
+declare const hookEventKindSchema: z.ZodEnum<{
+    "session.started": "session.started";
+    "session.ended": "session.ended";
+    "lifecycle.before": "lifecycle.before";
+    "lifecycle.after": "lifecycle.after";
+    "tool.started": "tool.started";
+    "tool.completed": "tool.completed";
+    "file.changed": "file.changed";
+    "shell.started": "shell.started";
+    "shell.completed": "shell.completed";
+    "mcp.started": "mcp.started";
+    "mcp.completed": "mcp.completed";
+    unknown: "unknown";
+}>;
+type HookEventKind = z.infer<typeof hookEventKindSchema>;
+declare const safeScalarSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+type SafeValue = z.infer<typeof safeScalarSchema> | SafeValue[] | {
+    [key: string]: SafeValue;
+};
+declare const safeValueSchema: z.ZodType<SafeValue>;
+declare const canonicalHookEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    version: z.ZodLiteral<1>;
+    source: z.ZodEnum<{
+        cursor: "cursor";
+        "claude-code": "claude-code";
+        codex: "codex";
+    }>;
+    kind: z.ZodEnum<{
+        "session.started": "session.started";
+        "session.ended": "session.ended";
+        "lifecycle.before": "lifecycle.before";
+        "lifecycle.after": "lifecycle.after";
+        "tool.started": "tool.started";
+        "tool.completed": "tool.completed";
+        "file.changed": "file.changed";
+        "shell.started": "shell.started";
+        "shell.completed": "shell.completed";
+        "mcp.started": "mcp.started";
+        "mcp.completed": "mcp.completed";
+        unknown: "unknown";
+    }>;
+    occurredAt: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    repo: z.ZodOptional<z.ZodObject<{
+        root: z.ZodString;
+        remote: z.ZodOptional<z.ZodString>;
+        branch: z.ZodOptional<z.ZodString>;
+        commit: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        unknown: "unknown";
+        success: "success";
+        failure: "failure";
+        cancelled: "cancelled";
+    }>>;
+    durationMs: z.ZodOptional<z.ZodNumber>;
+    metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<SafeValue, unknown, z.core.$ZodTypeInternals<SafeValue, unknown>>>>;
+}, z.core.$strip>;
+type CanonicalHookEvent = z.infer<typeof canonicalHookEventSchema>;
+declare function createHookEvent(input: Omit<CanonicalHookEvent, "id" | "version" | "occurredAt"> & Partial<Pick<CanonicalHookEvent, "id" | "occurredAt">>): CanonicalHookEvent;
+
+declare function mapClaudeCodeHook(eventName: string, input: unknown): {
+    id: string;
+    version: 1;
+    source: "cursor" | "claude-code" | "codex";
+    kind: "session.started" | "session.ended" | "lifecycle.before" | "lifecycle.after" | "tool.started" | "tool.completed" | "file.changed" | "shell.started" | "shell.completed" | "mcp.started" | "mcp.completed" | "unknown";
+    occurredAt: string;
+    metadata: Record<string, SafeValue>;
+    sessionId?: string | undefined;
+    repo?: {
+        root: string;
+        remote?: string | undefined;
+        branch?: string | undefined;
+        commit?: string | undefined;
+    } | undefined;
+    outcome?: "unknown" | "success" | "failure" | "cancelled" | undefined;
+    durationMs?: number | undefined;
+};
+
+declare function mapCodexHook(eventName: string, input: unknown): {
+    id: string;
+    version: 1;
+    source: "cursor" | "claude-code" | "codex";
+    kind: "session.started" | "session.ended" | "lifecycle.before" | "lifecycle.after" | "tool.started" | "tool.completed" | "file.changed" | "shell.started" | "shell.completed" | "mcp.started" | "mcp.completed" | "unknown";
+    occurredAt: string;
+    metadata: Record<string, SafeValue>;
+    sessionId?: string | undefined;
+    repo?: {
+        root: string;
+        remote?: string | undefined;
+        branch?: string | undefined;
+        commit?: string | undefined;
+    } | undefined;
+    outcome?: "unknown" | "success" | "failure" | "cancelled" | undefined;
+    durationMs?: number | undefined;
+};
+
+declare function mapCursorHook(eventName: string, input: unknown): {
+    id: string;
+    version: 1;
+    source: "cursor" | "claude-code" | "codex";
+    kind: "session.started" | "session.ended" | "lifecycle.before" | "lifecycle.after" | "tool.started" | "tool.completed" | "file.changed" | "shell.started" | "shell.completed" | "mcp.started" | "mcp.completed" | "unknown";
+    occurredAt: string;
+    metadata: Record<string, SafeValue>;
+    sessionId?: string | undefined;
+    repo?: {
+        root: string;
+        remote?: string | undefined;
+        branch?: string | undefined;
+        commit?: string | undefined;
+    } | undefined;
+    outcome?: "unknown" | "success" | "failure" | "cancelled" | undefined;
+    durationMs?: number | undefined;
+};
+
+declare const deviceAuthorizationSchema: z.ZodObject<{
+    device_code: z.ZodString;
+    user_code: z.ZodString;
+    verification_uri: z.ZodString;
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodString;
+    interval: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+declare const deviceTokenResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    accessToken: z.ZodString;
+    projectId: z.ZodString;
+    organizationId: z.ZodString;
+    repositoryId: z.ZodOptional<z.ZodString>;
+    deviceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<{
+        pending: "pending";
+        denied: "denied";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodEnum<{
+        expired: "expired";
+        invalid: "invalid";
+    }>;
+}, z.core.$strip>], "status">;
+type DeviceAuthorization = z.infer<typeof deviceAuthorizationSchema>;
+type DeviceTokenResponse = z.infer<typeof deviceTokenResponseSchema>;
+interface CredentialStore {
+    get(service: string, account: string): Promise<string | undefined>;
+    set(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+type StoredCredential = {
+    appUrl: string;
+    accessToken: string;
+    projectId: string;
+    organizationId: string;
+    repositoryId?: string;
+    deviceId: string;
+};
+declare class SystemCredentialStore implements CredentialStore {
+    get(service: string, account: string): Promise<string | undefined>;
+    set(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+declare function requestDeviceAuthorization(input: {
+    appUrl: string;
+    projectId: string;
+    deviceName: string;
+    agentName: AgentName;
+}): Promise<{
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    expires_at: string;
+    interval: number;
+    verification_uri_complete?: string | undefined;
+}>;
+declare function pollDeviceToken(input: {
+    appUrl: string;
+    deviceCode: string;
+}): Promise<{
+    status: "approved";
+    accessToken: string;
+    projectId: string;
+    organizationId: string;
+    deviceId: string;
+    repositoryId?: string | undefined;
+} | {
+    status: "pending" | "denied";
+} | {
+    status: "expired" | "invalid";
+}>;
+type AgentName = "cursor" | "claude-code" | "codex";
+
+interface OfflineQueue {
+    enqueue(events: readonly CanonicalHookEvent[]): Promise<void>;
+    peek(limit: number): Promise<CanonicalHookEvent[]>;
+    remove(ids: readonly string[]): Promise<void>;
+    size(): Promise<number>;
+}
+declare class MemoryOfflineQueue implements OfflineQueue {
+    private events;
+    enqueue(events: readonly CanonicalHookEvent[]): Promise<void>;
+    peek(limit: number): Promise<CanonicalHookEvent[]>;
+    remove(ids: readonly string[]): Promise<void>;
+    size(): Promise<number>;
+}
+declare class JsonFileOfflineQueue implements OfflineQueue {
+    private readonly filePath;
+    private operation;
+    constructor(filePath: string);
+    enqueue(events: readonly CanonicalHookEvent[]): Promise<void>;
+    peek(limit: number): Promise<CanonicalHookEvent[]>;
+    remove(ids: readonly string[]): Promise<void>;
+    size(): Promise<number>;
+    private read;
+    private update;
+}
+
+interface SignedBatchClientOptions {
+    endpoint: string;
+    accessToken: string;
+    organizationId: string;
+    projectId: string;
+    repositoryId?: string;
+    deviceId: string;
+    queue: OfflineQueue;
+    fetch?: typeof globalThis.fetch;
+    batchSize?: number;
+    timeoutMs?: number;
+}
+interface FlushResult {
+    sent: number;
+    remaining: number;
+    error?: string;
+}
+declare class SignedBatchClient {
+    private readonly options;
+    private readonly request;
+    private readonly batchSize;
+    private readonly timeoutMs;
+    constructor(options: SignedBatchClientOptions);
+    capture(event: CanonicalHookEvent): Promise<FlushResult>;
+    flush(): Promise<FlushResult>;
+}
+
+interface RedactionOptions {
+    allowContent?: boolean;
+    homeDirectory?: string;
+    replacement?: string;
+}
+declare function redact(value: unknown, options?: RedactionOptions): SafeValue;
+declare function safeMetadata(input: Record<string, unknown>, allowedKeys: readonly string[]): Record<string, SafeValue>;
+
+interface RepositoryInfo {
+    root: string;
+    remote?: string;
+    branch?: string;
+    commit?: string;
+}
+declare function detectRepository(cwd?: string): Promise<RepositoryInfo | undefined>;
+declare function sanitizeRemote(remote: string): string;
+declare function normalizeGitHubRepository(value: string): string | undefined;
+declare function matchesGitHubRepository(remote: string | undefined, expected: string): boolean;
+
+export { type AgentSource, type CanonicalHookEvent, type CredentialStore, type DeviceAuthorization, type DeviceTokenResponse, type FlushResult, type HookEventKind, JsonFileOfflineQueue, MemoryOfflineQueue, type OfflineQueue, type RedactionOptions, type RepositoryInfo, type SafeValue, SignedBatchClient, type SignedBatchClientOptions, type StoredCredential, SystemCredentialStore, agentSourceSchema, canonicalHookEventSchema, createHookEvent, detectRepository, deviceAuthorizationSchema, deviceTokenResponseSchema, hookEventKindSchema, mapClaudeCodeHook, mapCodexHook, mapCursorHook, matchesGitHubRepository, normalizeGitHubRepository, pollDeviceToken, redact, requestDeviceAuthorization, safeMetadata, safeValueSchema, sanitizeRemote };

package/dist/index.js

@@ -0,0 +1,48 @@
+import {
+  JsonFileOfflineQueue,
+  MemoryOfflineQueue,
+  SignedBatchClient,
+  SystemCredentialStore,
+  agentSourceSchema,
+  canonicalHookEventSchema,
+  createHookEvent,
+  detectRepository,
+  deviceAuthorizationSchema,
+  deviceTokenResponseSchema,
+  hookEventKindSchema,
+  mapClaudeCodeHook,
+  mapCodexHook,
+  mapCursorHook,
+  matchesGitHubRepository,
+  normalizeGitHubRepository,
+  pollDeviceToken,
+  redact,
+  requestDeviceAuthorization,
+  safeMetadata,
+  safeValueSchema,
+  sanitizeRemote
+} from "./chunk-BL74PDGC.js";
+export {
+  JsonFileOfflineQueue,
+  MemoryOfflineQueue,
+  SignedBatchClient,
+  SystemCredentialStore,
+  agentSourceSchema,
+  canonicalHookEventSchema,
+  createHookEvent,
+  detectRepository,
+  deviceAuthorizationSchema,
+  deviceTokenResponseSchema,
+  hookEventKindSchema,
+  mapClaudeCodeHook,
+  mapCodexHook,
+  mapCursorHook,
+  matchesGitHubRepository,
+  normalizeGitHubRepository,
+  pollDeviceToken,
+  redact,
+  requestDeviceAuthorization,
+  safeMetadata,
+  safeValueSchema,
+  sanitizeRemote
+};

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@wibeco/bridge",
+  "version": "0.1.0",
+  "description": "Privacy-first live activity bridge for Cursor, Claude Code, and Codex.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wibe-co/wibe.git",
+    "directory": "packages/bridge"
+  },
+  "homepage": "https://trywibe.com",
+  "bugs": {
+    "url": "https://github.com/wibe-co/wibe/issues"
+  },
+  "type": "module",
+  "bin": {
+    "wibe": "dist/cli.js",
+    "wibe-bridge": "dist/cli.js"
+  },
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/copy-templates.mjs && tsup src/index.ts src/cli.ts src/codex-hook.ts --format esm --target node20 --dts --clean --tsconfig tsconfig.json",
+    "prepack": "npm run build",
+    "test": "vitest run test --config vitest.config.ts"
+  },
+  "dependencies": {
+    "zod": "^4.0.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT"
+}

package/templates/claude-code/README.md

@@ -0,0 +1,14 @@
+# Claude Code template
+
+These files are inert examples. Review and merge `settings.json.example` into the appropriate
+Claude Code settings file. It uses command hooks because the local bridge must normalize and redact
+the payload before network delivery. Do not point an HTTP hook directly at a collector: Claude hook
+payloads can include prompts, tool inputs/results, and other raw content.
+
+Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the hook environment.
+Store the secret in an OS keychain/secret manager. The bridge allow-list excludes prompt, content,
+messages, command text, tool arguments/results, and transcripts.
+
+`mcp.json.example` is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
+executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
+MCP server.

package/templates/claude-code/mcp.json.example

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "wibe": {
+      "type": "http",
+      "url": "${WIBE_APP_URL}/api/mcp"
+    }
+  }
+}

package/templates/claude-code/settings.json.example

@@ -0,0 +1,77 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event session-start"
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event session-end"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event user-prompt-submit"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event pre-tool-use"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event post-tool-use"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event post-tool-use-failure"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter claude-code --event stop"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/codex/README.md

@@ -0,0 +1,13 @@
+# Codex template
+
+This is an inert config fragment. Review and merge `config.toml.example` into Codex's configuration.
+The `notify` command receives Codex's JSON notification argument, maps allow-listed fields in-process,
+and queues or sends only the canonical event. Prompt text, messages, tool data, command text, file
+content, and transcripts are not retained.
+
+Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the Codex environment,
+with the signing secret supplied by an OS keychain/secret manager.
+
+The MCP block is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
+executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
+MCP server. Codex notification coverage is narrower than Cursor or Claude Code lifecycle hooks.

package/templates/codex/config.toml.example

@@ -0,0 +1,6 @@
+# Codex passes one JSON notification argument to this command. The adapter only keeps allow-listed
+# operational metadata and never forwards the full argument.
+notify = ["npx", "-y", "@wibeco/bridge@latest", "emit", "--adapter", "codex", "--event", "notify"]
+
+[mcp_servers.wibe]
+url = "${WIBE_APP_URL}/api/mcp"

package/templates/codex/hooks.json.example

@@ -0,0 +1,76 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event session-start"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event user-prompt-submit"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event pre-tool-use"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event post-tool-use"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event subagent-start"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event subagent-stop"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y @wibeco/bridge@latest emit --adapter codex --event stop"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/cursor/README.md

@@ -0,0 +1,13 @@
+# Cursor template
+
+These files are inert examples. Review Cursor's hook schema for your installed release, then merge
+`hooks.json.example` into `.cursor/hooks.json`; hook names can change between releases. Commands use
+`npx --no-install`, so they never download packages during a hook.
+
+Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the process environment.
+Prefer an OS keychain/secret manager for the signing secret. The mapper drops prompt, content, file
+body, command text, tool arguments/results, and transcripts.
+
+`mcp.json.example` is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
+executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
+MCP server and this template must not be enabled unchanged.

package/templates/cursor/hooks.json.example

@@ -0,0 +1,60 @@
+{
+  "version": 1,
+  "hooks": {
+    "sessionStart": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-start"
+      }
+    ],
+    "sessionEnd": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-end"
+      }
+    ],
+    "beforeSubmitPrompt": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-submit-prompt"
+      }
+    ],
+    "afterAgentResponse": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-agent-response"
+      }
+    ],
+    "preToolUse": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-tool"
+      }
+    ],
+    "postToolUse": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-tool"
+      }
+    ],
+    "afterFileEdit": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-file-edit"
+      }
+    ],
+    "beforeShellExecution": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-shell-execution"
+      }
+    ],
+    "afterShellExecution": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-shell-execution"
+      }
+    ],
+    "beforeMCPExecution": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-mcp-execution"
+      }
+    ],
+    "afterMCPExecution": [
+      {
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-mcp-execution"
+      }
+    ]
+  }
+}

package/templates/cursor/mcp.json.example

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "wibe": {
+      "url": "${env:WIBE_APP_URL}/api/mcp"
+    }
+  }
+}