@wrongstack/core 0.313.0 → 0.316.1

package/dist/hooks/index.js

@@ -1,1141 +1,17 @@
-// src/utils/ip-guard.ts
-import * as dns from "node:dns/promises";
-import * as net from "node:net";
-function isPrivateIPv4(addr) {
-  const parts = addr.split(".").map((p) => Number.parseInt(p, 10));
-  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
-    return true;
-  }
-  const [a, b, c] = parts;
-  if (a === 0) return true;
-  if (a === 10) return true;
-  if (a === 127) return true;
-  if (a === 169 && b === 254) return true;
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  if (a === 192 && b === 168) return true;
-  if (a === 192 && b === 0 && c === 0) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true;
-  if (a >= 224) return true;
-  return false;
-}
-function isPrivateIPv6(raw) {
-  const lower = raw.toLowerCase();
-  if (lower === "::" || lower === "::1") return true;
-  const groups = expandIPv6(lower);
-  if (!groups) return true;
-  if (groups[0] === 100 && groups[1] === 65435 && groups[2] === 1) return true;
-  if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && groups[5] === 65535) {
-    const a = (groups[6] ?? 0) >> 8;
-    const b = (groups[6] ?? 0) & 255;
-    const c = (groups[7] ?? 0) >> 8;
-    const d = (groups[7] ?? 0) & 255;
-    return isPrivateIPv4(`${a}.${b}.${c}.${d}`);
-  }
-  const embedded = embeddedIPv4(groups);
-  if (embedded) return isPrivateIPv4(embedded);
-  const high = groups[0] ?? 0;
-  if ((high & 65024) === 64512) return true;
-  if ((high & 65472) === 65152) return true;
-  if ((high & 65280) === 65280) return true;
-  return false;
-}
-function quad(hi, lo) {
-  return `${(hi ?? 0) >> 8}.${(hi ?? 0) & 255}.${(lo ?? 0) >> 8}.${(lo ?? 0) & 255}`;
-}
-function embeddedIPv4(groups) {
-  const g = (i) => groups[i] ?? 0;
-  if (g(0) === 100 && g(1) === 65435) {
-    if (g(2) === 0 && g(3) === 0 && g(4) === 0 && g(5) === 0) {
-      return quad(g(6), g(7));
-    }
-  }
-  if (g(0) === 8194) return quad(g(1), g(2));
-  if (g(0) === 8193 && g(1) === 0) {
-    return quad(~g(6) & 65535, ~g(7) & 65535);
-  }
-  if ((g(4) === 0 || g(4) === 512) && g(5) === 24318) {
-    return quad(g(6), g(7));
-  }
-  const highZero = g(0) === 0 && g(1) === 0 && g(2) === 0 && g(3) === 0;
-  if (highZero && g(4) === 65535 && g(5) === 0) return quad(g(6), g(7));
-  if (highZero && g(4) === 0 && g(5) === 0) return quad(g(6), g(7));
-  return void 0;
-}
-function expandIPv6(addr) {
-  const parts = addr.split("::");
-  if (parts.length > 2) return null;
-  const parseGroups = (s) => {
-    if (s === "") return [];
-    const out = [];
-    for (const g of s.split(":")) {
-      if (g.length === 0 || g.length > 4) return null;
-      const n = Number.parseInt(g, 16);
-      if (Number.isNaN(n) || n < 0 || n > 65535) return null;
-      out.push(n);
-    }
-    return out;
-  };
-  if (parts.length === 1) {
-    const groups = parseGroups(parts[0] ?? "");
-    if (groups?.length !== 8) return null;
-    return groups;
-  }
-  const head = parseGroups(parts[0] ?? "");
-  const tail = parseGroups(parts[1] ?? "");
-  if (!head || !tail) return null;
-  const fill = 8 - head.length - tail.length;
-  if (fill < 0) return null;
-  return [...head, ...new Array(fill).fill(0), ...tail];
-}
-async function assertNotPrivateHost(hostname) {
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  if (host === "localhost" || host.endsWith(".localhost")) {
-    throw new Error("fetch: blocked localhost target");
-  }
-  const ipVersion = net.isIP(host);
-  if (ipVersion === 4) {
-    if (isPrivateIPv4(host)) {
-      throw new Error(`fetch: blocked private/loopback address "${host}"`);
-    }
-  } else if (ipVersion === 6) {
-    if (isPrivateIPv6(host)) {
-      throw new Error(`fetch: blocked private/loopback address "${host}"`);
-    }
-  } else {
-    try {
-      const records = await dns.lookup(host, { all: true });
-      for (const r of records) {
-        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
-        if (bad) {
-          throw new Error(`fetch: resolved to private address ${r.address}`);
-        }
-      }
-    } catch (err) {
-      if (err instanceof Error && err.message.startsWith("fetch:")) throw err;
-    }
-  }
-}
-
-// src/hooks/shell-executor.ts
-import { spawn } from "node:child_process";
-
-// src/utils/child-env.ts
-var ALLOWED_KEYS = /* @__PURE__ */ new Set([
-  "PATH",
-  "HOME",
-  "USER",
-  "USERNAME",
-  "LOGNAME",
-  "SHELL",
-  "LANG",
-  "LC_ALL",
-  "LC_CTYPE",
-  "TERM",
-  "TZ",
-  "TMPDIR",
-  "TEMP",
-  "TMP",
-  "PWD",
-  "OLDPWD",
-  "COMSPEC",
-  "SYSTEMROOT",
-  "SYSTEMDRIVE",
-  "WINDIR",
-  "PROGRAMFILES",
-  "PROGRAMFILES(X86)",
-  "PROGRAMDATA",
-  "APPDATA",
-  "LOCALAPPDATA",
-  "USERPROFILE",
-  "PUBLIC",
-  "PATHEXT"
-]);
-var SECRET_NAME_PARTS = [
-  "TOKEN",
-  "SECRET",
-  "PASSWORD",
-  "PASSWD",
-  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
-  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
-  // key that protects the credential vault was forwarded to every child process
-  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
-  "PASSPHRASE",
-  "AUTH",
-  "CRED",
-  "BEARER",
-  "COOKIE",
-  "PRIVATE"
-];
-function looksSecret(name) {
-  const upper = name.toUpperCase();
-  for (const p of SECRET_NAME_PARTS) {
-    if (upper.includes(p)) return true;
-  }
-  if (/(?:^|_)KEY(?:$|_|S$)/i.test(upper)) return true;
-  if (/API[_-]?KEY/i.test(upper)) return true;
-  if (/ACCESS[_-]?KEY/i.test(upper)) return true;
-  if (/SESSION[_-]?ID/i.test(upper) === false && /SESSION/i.test(upper)) {
-    return true;
-  }
-  return false;
-}
-function valueHasEmbeddedCredential(value) {
-  return /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:[^/\s@]+@/i.test(value);
-}
-var NODE_OPTIONS_INJECTION_FLAG = /^(?:--require|-r|--import|--loader|--experimental-loader)$/;
-var NODE_OPTIONS_INJECTION_FLAG_EQ = /^(?:--require|-r|--import|--loader|--experimental-loader)=/;
-function sanitizeNodeOptions(value) {
-  const tokens = value.split(/\s+/).filter(Boolean);
-  const kept = [];
-  for (let i = 0; i < tokens.length; i++) {
-    const tok = tokens[i];
-    if (NODE_OPTIONS_INJECTION_FLAG_EQ.test(tok)) continue;
-    if (NODE_OPTIONS_INJECTION_FLAG.test(tok)) {
-      i++;
-      continue;
-    }
-    kept.push(tok);
-  }
-  return kept.join(" ");
-}
-var gitIdentity = null;
-function buildChildEnv(optsOrSessionId) {
-  const opts = typeof optsOrSessionId === "string" ? { sessionId: optsOrSessionId } : optsOrSessionId ?? {};
-  const hasOwn = Object.hasOwn(process.env, "WRONGSTACK_CHILD_ENV_PASSTHROUGH");
-  const legacyHasOwn = Object.hasOwn(process.env, "WRONGSTACK_BASH_ENV_PASSTHROUGH");
-  const passthrough = hasOwn && process.env["WRONGSTACK_CHILD_ENV_PASSTHROUGH"] === "1" || legacyHasOwn && process.env["WRONGSTACK_BASH_ENV_PASSTHROUGH"] === "1";
-  if (passthrough && !process.env["CI"]) {
-    console.warn(
-      "[agent] WARNING: WRONGSTACK_*_ENV_PASSTHROUGH=1 is active \u2014\n  all parent env vars (including API keys) forwarded to child processes.\n  Do not use on shared or multi-tenant systems."
-    );
-  }
-  const out = {};
-  const nodeEnvDefaulted = process.env["WRONGSTACK_NODE_ENV_DEFAULTED"] === "1";
-  for (const [k, v] of Object.entries(process.env)) {
-    if (v === void 0) continue;
-    if (nodeEnvDefaulted && (k === "NODE_ENV" || k === "WRONGSTACK_NODE_ENV_DEFAULTED")) continue;
-    if (passthrough) {
-      out[k] = v;
-      continue;
-    }
-    const upper = k.toUpperCase();
-    if (valueHasEmbeddedCredential(v)) continue;
-    if (ALLOWED_KEYS.has(upper)) {
-      out[k] = v;
-      continue;
-    }
-    if (looksSecret(upper)) continue;
-    if (upper === "NODE_OPTIONS") {
-      const sanitized = sanitizeNodeOptions(v);
-      if (sanitized) out[k] = sanitized;
-      continue;
-    }
-    if (upper.startsWith("NODE_") || upper.startsWith("NPM_") || upper.startsWith("PNPM_") || upper.startsWith("YARN_") || upper.startsWith("GIT_") || upper.startsWith("CI") || upper.startsWith("XDG_") || // Our own non-secret knobs (WRONGSTACK_HOME, WRONGSTACK_SESSION_ID, …).
-    // Secrets never live in WRONGSTACK_* env vars (they're in the encrypted
-    // vault). Forwarding keeps child wstack processes — e.g. ones spawned
-    // by the test suite — inside the same redirected global root.
-    upper.startsWith("WRONGSTACK_") || upper === "EDITOR" || upper === "VISUAL" || upper === "PAGER") {
-      out[k] = v;
-    }
-  }
-  if (gitIdentity) {
-    if (gitIdentity.name) {
-      out["GIT_AUTHOR_NAME"] = gitIdentity.name;
-      out["GIT_COMMITTER_NAME"] = gitIdentity.name;
-    }
-    if (gitIdentity.email) {
-      out["GIT_AUTHOR_EMAIL"] = gitIdentity.email;
-      out["GIT_COMMITTER_EMAIL"] = gitIdentity.email;
-    }
-  }
-  if (opts.extra) {
-    Object.assign(out, opts.extra);
-  }
-  if (opts.sessionId) out["WRONGSTACK_SESSION_ID"] = opts.sessionId;
-  return out;
-}
-
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/hooks/shell-executor.ts
-var DEFAULT_TIMEOUT_MS = 5e3;
-var MAX_OUTPUT_BYTES = 64 * 1024;
-var ALLOWED_SHELL_COMMANDS = /* @__PURE__ */ new Set([
-  // POSIX shells + Windows shells
-  "bash",
-  "sh",
-  "dash",
-  "zsh",
-  "fish",
-  "pwsh",
-  "powershell",
-  "cmd",
-  // Script interpreters — hooks are routinely small node/python scripts
-  "node",
-  "deno",
-  "bun",
-  "npx",
-  "npm",
-  "pnpm",
-  "yarn",
-  "python",
-  "python3",
-  "perl",
-  "ruby",
-  // Utilities
-  "echo",
-  "cat",
-  "grep",
-  "sed",
-  "awk",
-  "find",
-  "sort",
-  "uniq",
-  "wc",
-  "head",
-  "tail",
-  "cut",
-  "tr",
-  "tee",
-  "xargs",
-  "printf",
-  "test",
-  "expr",
-  // File operations
-  "ls",
-  "stat",
-  "touch",
-  "mkdir",
-  "rm",
-  "cp",
-  "mv",
-  "chmod",
-  "chown",
-  // Network (read-only)
-  "curl",
-  "wget",
-  // Git (common operations)
-  "git",
-  "diff",
-  "merge",
-  // Process
-  "ps",
-  "kill",
-  "pgrep",
-  "pkill",
-  // Text processing
-  "jq",
-  "yq",
-  // System info
-  "uname",
-  "hostname",
-  "whoami",
-  "date"
-]);
-function isAbsoluteCommandPath(p) {
-  return p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
-}
-function isCommandAllowed(command) {
-  const argv = command.trim().split(/\s+/);
-  if (argv.length === 0 || argv[0].length === 0) return null;
-  const executable = argv[0];
-  if (isAbsoluteCommandPath(executable)) return argv;
-  const commandName = /[\\/]/.test(executable) ? executable.split(/[\\/]/).pop() ?? executable : executable;
-  if (ALLOWED_SHELL_COMMANDS.has(commandName)) return argv;
-  return null;
-}
-function killProcessTree(child) {
-  const pid = child.pid;
-  if (typeof pid === "number") {
-    if (process.platform === "win32") {
-      try {
-        const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
-          stdio: "ignore",
-          windowsHide: true
-        });
-        killer.unref();
-        return;
-      } catch {
-      }
-    } else {
-      try {
-        process.kill(-pid, "SIGKILL");
-        return;
-      } catch {
-      }
-    }
-  }
-  try {
-    child.kill("SIGKILL");
-  } catch {
-  }
-}
-async function runShellHook(spec, input, logger) {
-  const result = await runShellHookDetailed(spec, input, logger);
-  if (result.outcome && "action" in result.outcome) {
-    if (result.outcome.action === "deny") {
-      return { decision: "block", reason: result.outcome.reason };
-    }
-    if (result.outcome.action === "mutate") {
-      return { decision: "allow", modifiedInput: result.outcome.input };
-    }
-    return { decision: "allow" };
-  }
-  return result.outcome;
-}
-async function runShellHookDetailed(spec, input, logger, options = {}) {
-  const timeoutMs = Math.max(1, Math.min(spec.timeoutMs ?? DEFAULT_TIMEOUT_MS, 10 * 6e4));
-  const argv = isCommandAllowed(spec.command);
-  if (!argv) {
-    logger?.warn?.(`hook rejected: command not in allowlist: ${spec.command}`);
-    return {
-      outcome: null,
-      failure: { kind: "rejected", message: "command is not in the hook allowlist" }
-    };
-  }
-  return await new Promise((resolve) => {
-    let settled = false;
-    let timer;
-    const done = (v) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      options.signal?.removeEventListener("abort", onAbort);
-      resolve(v);
-    };
-    let child;
-    try {
-      const cmd = argv[0];
-      const args = argv.slice(1);
-      child = spawn(cmd, args, {
-        cwd: input.cwd,
-        env: buildChildEnv(),
-        stdio: ["pipe", "pipe", "pipe"],
-        windowsHide: true,
-        detached: process.platform !== "win32"
-      });
-    } catch (err2) {
-      logger?.warn?.(`hook spawn failed: ${toErrorMessage(err2)}`);
-      return resolve({
-        outcome: null,
-        failure: { kind: "error", message: `spawn failed: ${toErrorMessage(err2)}` }
-      });
-    }
-    const onAbort = () => {
-      killProcessTree(child);
-      done({ outcome: null, failure: { kind: "aborted", message: "hook invocation aborted" } });
-    };
-    if (options.signal?.aborted) {
-      onAbort();
-      return;
-    }
-    options.signal?.addEventListener("abort", onAbort, { once: true });
-    timer = setTimeout(() => {
-      logger?.warn?.(`hook command timed out after ${timeoutMs}ms: ${spec.command}`);
-      killProcessTree(child);
-      done({
-        outcome: null,
-        failure: { kind: "timeout", message: `timed out after ${timeoutMs}ms` }
-      });
-    }, timeoutMs);
-    let out = "";
-    let err = "";
-    let outTrunc = false;
-    child.stdout?.on("data", (d) => {
-      if (outTrunc) return;
-      out += d.toString("utf8");
-      if (Buffer.byteLength(out, "utf8") > MAX_OUTPUT_BYTES) {
-        out = out.slice(0, MAX_OUTPUT_BYTES);
-        outTrunc = true;
-      }
-    });
-    child.stderr?.on("data", (d) => {
-      if (err.length < MAX_OUTPUT_BYTES) err += d.toString("utf8");
-    });
-    child.on("error", (e) => {
-      logger?.warn?.(`hook command error: ${e instanceof Error ? e.message : String(e)}`);
-      done({
-        outcome: null,
-        failure: { kind: "error", message: e instanceof Error ? e.message : String(e) }
-      });
-    });
-    child.on("close", (code) => {
-      if (code === 2) {
-        const reason = (err.trim() || out.trim() || "blocked by hook").slice(0, 2e3);
-        return done({ outcome: { action: "deny", reason } });
-      }
-      if (code !== 0) {
-        return done({
-          outcome: null,
-          failure: {
-            kind: "exit",
-            message: (err.trim() || `hook exited with code ${String(code)}`).slice(0, 2e3)
-          }
-        });
-      }
-      if (!out.trim()) return done({ outcome: null });
-      const parsed = parseHookOutcome(out);
-      if (!parsed) {
-        return done({
-          outcome: null,
-          failure: { kind: "invalid_output", message: "hook stdout was not valid outcome JSON" }
-        });
-      }
-      done({ outcome: parsed });
-    });
-    try {
-      child.stdin?.end(`${JSON.stringify(input)}
-`);
-    } catch {
-    }
-  });
-}
-function parseHookOutcome(stdout) {
-  const trimmed = stdout.trim();
-  if (trimmed?.[0] !== "{") return null;
-  try {
-    const obj = JSON.parse(trimmed);
-    const outcome = {};
-    const common = {
-      ...typeof obj["additionalContext"] === "string" ? { additionalContext: obj["additionalContext"] } : {},
-      ...obj["contextAs"] === "inline" || obj["contextAs"] === "separate" ? { contextAs: obj["contextAs"] } : {}
-    };
-    if (obj["action"] === "allow" || obj["action"] === "deny" || obj["action"] === "mutate") {
-      if (obj["action"] === "deny") {
-        if (typeof obj["reason"] !== "string" || !obj["reason"].trim()) return null;
-        return { action: "deny", reason: obj["reason"], ...common };
-      }
-      if (obj["action"] === "mutate") {
-        if (!obj["input"] || typeof obj["input"] !== "object" || Array.isArray(obj["input"]))
-          return null;
-        return {
-          action: "mutate",
-          input: obj["input"],
-          ...typeof obj["reason"] === "string" ? { reason: obj["reason"] } : {},
-          ...common
-        };
-      }
-      return { action: "allow", ...common };
-    }
-    if (obj["decision"] === "block" || obj["decision"] === "allow") {
-      outcome.decision = obj["decision"];
-    }
-    if (typeof obj["reason"] === "string") outcome.reason = obj["reason"];
-    if (typeof obj["additionalContext"] === "string") {
-      outcome.additionalContext = obj["additionalContext"];
-    }
-    if (obj["modifiedInput"] && typeof obj["modifiedInput"] === "object") {
-      outcome.modifiedInput = obj["modifiedInput"];
-    }
-    if (obj["contextAs"] === "inline" || obj["contextAs"] === "separate") {
-      outcome.contextAs = obj["contextAs"];
-    }
-    return outcome;
-  } catch {
-    return null;
-  }
-}
-
-// src/hooks/http-executor.ts
-var DEFAULT_TIMEOUT_MS2 = 5e3;
-var MAX_OUTPUT_BYTES2 = 64 * 1024;
-async function isAllowedUrl(raw) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return false;
-  }
-  if (url.protocol === "https:") {
-    try {
-      await assertNotPrivateHost(url.hostname);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  if (url.protocol !== "http:") return false;
-  return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-}
-async function runHttpHookDetailed(spec, input, logger, options = {}) {
-  if (!await isAllowedUrl(spec.url)) {
-    return {
-      outcome: null,
-      failure: {
-        kind: "rejected",
-        message: "HTTP hooks require HTTPS, except for loopback HTTP endpoints"
-      }
-    };
-  }
-  const timeoutMs = Math.max(1, Math.min(spec.timeoutMs ?? DEFAULT_TIMEOUT_MS2, 10 * 6e4));
-  const timeoutController = new AbortController();
-  const timer = setTimeout(() => timeoutController.abort(new Error("hook timeout")), timeoutMs);
-  timer.unref?.();
-  const signal = options.signal ? AbortSignal.any([options.signal, timeoutController.signal]) : timeoutController.signal;
-  try {
-    const response = await fetch(spec.url, {
-      method: "POST",
-      headers: { ...spec.headers ?? {}, "content-type": "application/json" },
-      body: JSON.stringify(input),
-      redirect: "error",
-      signal
-    });
-    if (!response.ok) {
-      return {
-        outcome: null,
-        failure: { kind: "error", message: `HTTP hook returned ${response.status}` }
-      };
-    }
-    const text = await response.text();
-    if (Buffer.byteLength(text, "utf8") > MAX_OUTPUT_BYTES2) {
-      return {
-        outcome: null,
-        failure: { kind: "invalid_output", message: "HTTP hook response exceeded 64 KiB" }
-      };
-    }
-    if (!text.trim()) return { outcome: null };
-    const outcome = parseHookOutcome(text);
-    return outcome ? { outcome } : {
-      outcome: null,
-      failure: {
-        kind: "invalid_output",
-        message: "HTTP hook response was not valid outcome JSON"
-      }
-    };
-  } catch (err) {
-    const timedOut = timeoutController.signal.aborted && !options.signal?.aborted;
-    const kind = timedOut ? "timeout" : options.signal?.aborted ? "aborted" : "error";
-    const message = timedOut ? `timed out after ${timeoutMs}ms` : err instanceof Error ? err.message : String(err);
-    logger?.warn?.(`HTTP hook failed: ${message}`);
-    return { outcome: null, failure: { kind, message } };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/hooks/registry.ts
-function entryControls(event, fallbackName, options, legacyStage) {
-  return {
-    name: options.name?.trim() || fallbackName,
-    timeoutMs: options.timeoutMs,
-    failurePolicy: options.failurePolicy ?? "open",
-    // Legacy PreToolUse hooks may rewrite input, so preserve their old
-    // behavior unless the registration explicitly opts into final validation.
-    stage: event === "PreToolUse" ? options.stage ?? legacyStage : "validate",
-    policy: options.policy === true,
-    // `background` only applies to PostToolUse — PreToolUse hooks always block.
-    background: event === "PostToolUse" && options.background === true
-  };
-}
-var HookRegistry = class _HookRegistry {
-  entries = [];
-  /** Register an in-process hook. Returns an unsubscribe function. */
-  registerInProcess(event, matcher, hook, owner, options = {}) {
-    const entry = {
-      kind: "inprocess",
-      event,
-      matcher: matcher ?? "*",
-      hook,
-      owner,
-      ...entryControls(
-        event,
-        owner ? `${owner}:${event}` : `inprocess:${event}`,
-        options,
-        "mutate"
-      )
-    };
-    this.entries.push(entry);
-    return () => this.remove(entry);
-  }
-  /**
-   * Register a single shell hook. The hook is owned by the runtime (no plugin
-   * name) — it survives plugin uninstalls. Returns an unsubscribe function.
-   */
-  registerShell(event, hook) {
-    const entry = {
-      kind: "shell",
-      event,
-      matcher: hook.matcher ?? "*",
-      command: hook.command,
-      ...entryControls(event, hook.command, hook, "validate")
-    };
-    this.entries.push(entry);
-    return () => this.remove(entry);
-  }
-  /** Register a native HTTP hook. */
-  registerHttp(event, hook) {
-    const entry = {
-      kind: "http",
-      event,
-      matcher: hook.matcher ?? "*",
-      url: hook.url,
-      headers: hook.headers,
-      ...entryControls(event, hook.url, hook, "validate")
-    };
-    this.entries.push(entry);
-    return () => this.remove(entry);
-  }
-  /** Bulk-load command/HTTP hooks from a `config.hooks` map. */
-  loadShellHooks(hooks, options = {}) {
-    if (!hooks) return;
-    for (const [event, list] of Object.entries(hooks)) {
-      for (const h of list ?? []) {
-        if (options.policyOnly && h.policy !== true) continue;
-        if (h.type === "http") {
-          if (h.url) this.registerHttp(event, h);
-        } else if (h.command) {
-          this.registerShell(event, h);
-        }
-      }
-    }
-  }
-  /**
-   * Atomically replace the shell-hook set: drop every currently-registered
-   * shell entry, then load the supplied `config.hooks` map. In-process
-   * hooks (and their plugin owners) are untouched — only shell entries
-   * are touched, because they are the only entries sourced from
-   * `config.hooks`.
-   *
-   * Designed for hot-reload via `ConfigStore.watch`: when the operator
-   * edits `config.json` and the store fires its watcher, the CLI calls
-   * this with the new `config.hooks` value. Idempotent — calling twice
-   * with the same map yields the same registry state (callers should still
-   * guard at the change-detection layer to avoid wasted work).
-   */
-  replaceShellHooks(hooks, options = {}) {
-    const replacement = new _HookRegistry();
-    replacement.loadShellHooks(hooks, options);
-    const configuredEntries = replacement.entries.slice();
-    for (let i = this.entries.length - 1; i >= 0; i--) {
-      const e = this.entries[i];
-      if (e && e.kind !== "inprocess") this.entries.splice(i, 1);
-    }
-    this.entries.push(...configuredEntries);
-  }
-  /** All entries registered for an event, in registration order. */
-  list(event) {
-    return this.entries.filter((e) => e.event === event);
-  }
-  /** True when any entry is registered for the event. */
-  has(event) {
-    return this.entries.some((e) => e.event === event);
-  }
-  /** Every entry currently registered (across all events). */
-  all() {
-    return this.entries.slice();
-  }
-  /**
-   * Drop every in-process hook whose `owner` matches. Used by the plugin
-   * loader during teardown as a belt-and-braces backstop for the per-call
-   * unsubscribe functions pushed onto `pluginCleanupFns` — if a plugin
-   * `setup()` throws partway through after registering some hooks, the
-   * remaining unsubscribes may never run, and the registry would otherwise
-   * hold dangling references to a torn-down plugin's closures.
-   *
-   * Returns the number of hooks actually removed (useful for tests).
-   * Shell hooks are owned by the runtime, not a plugin, so they're never
-   * drained by owner.
-   */
-  drainByOwner(owner) {
-    let removed = 0;
-    for (let i = this.entries.length - 1; i >= 0; i--) {
-      const e = this.entries[i];
-      if (e && e.kind === "inprocess" && e.owner === owner) {
-        this.entries.splice(i, 1);
-        removed++;
-      }
-    }
-    return removed;
-  }
-  /** Count of in-process hooks currently registered by `owner`. */
-  countByOwner(owner) {
-    let n = 0;
-    for (const e of this.entries) {
-      if (e.kind === "inprocess" && e.owner === owner) n++;
-    }
-    return n;
-  }
-  /** Drop every registered hook (used in teardown / tests). */
-  clear() {
-    this.entries.length = 0;
-  }
-  remove(entry) {
-    const i = this.entries.indexOf(entry);
-    if (i >= 0) this.entries.splice(i, 1);
-  }
-};
-function hookMatcherMatches(matcher, toolName) {
-  if (!matcher || matcher === "*") return true;
-  if (toolName === void 0) return true;
-  const target = toolName.toLowerCase();
-  return matcher.split("|").map((s) => s.trim().toLowerCase()).filter(Boolean).includes(target);
-}
-
-// src/hooks/runner.ts
-var DEFAULT_TIMEOUT_MS3 = 5e3;
-var DEFAULT_BACKGROUND_TIMEOUT_MS = 6e4;
-var MAX_TIMEOUT_MS = 10 * 6e4;
-function hookTimeoutMs(entry) {
-  return entry.timeoutMs ?? (entry.background ? DEFAULT_BACKGROUND_TIMEOUT_MS : DEFAULT_TIMEOUT_MS3);
-}
-function contextFromOutcome(outcome) {
-  return {
-    ...outcome.additionalContext ? { additionalContext: outcome.additionalContext } : {},
-    ...outcome.contextAs ? { contextAs: outcome.contextAs } : {}
-  };
-}
-function normalizePreToolOutcome(outcome) {
-  const context = contextFromOutcome(outcome);
-  if ("action" in outcome) return { ...outcome, ...context };
-  if (outcome.decision === "block") {
-    return {
-      action: "deny",
-      reason: outcome.reason?.trim() || "blocked by PreToolUse hook",
-      ...context
-    };
-  }
-  if (outcome.modifiedInput && typeof outcome.modifiedInput === "object") {
-    return {
-      action: "mutate",
-      input: outcome.modifiedInput,
-      ...outcome.reason ? { reason: outcome.reason } : {},
-      ...context
-    };
-  }
-  return { action: "allow", ...context };
-}
-function malformedOutcome(outcome) {
-  if (!("action" in outcome)) return void 0;
-  if (outcome.action === "allow") return void 0;
-  if (outcome.action === "deny") {
-    return typeof outcome.reason === "string" && outcome.reason.trim() ? void 0 : "deny outcome requires a non-empty reason";
-  }
-  if (outcome.action === "mutate") {
-    return outcome.input && typeof outcome.input === "object" && !Array.isArray(outcome.input) ? void 0 : "mutate outcome requires an object input";
-  }
-  return `unknown hook action: ${String(outcome.action)}`;
-}
-var HookRunner = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.registry = opts.registry;
-  }
-  opts;
-  registry;
-  /**
-   * Background hooks are advisory and must never form an unbounded work queue.
-   * Keep at most one invocation running plus the latest pending payload for
-   * each registered hook.
-   */
-  backgroundRuns = /* @__PURE__ */ new Map();
-  /** Cheap guard so callers can skip building payloads when nothing listens. */
-  has(event) {
-    return this.registry.has(event);
-  }
-  async preToolUse(toolName, toolInput, env, toolMeta) {
-    const entries = this.matching("PreToolUse", toolName);
-    if (entries.length === 0) return {};
-    const declared = {
-      ...toolMeta?.capabilities ? { toolCapabilities: toolMeta.capabilities } : {},
-      ...toolMeta?.mutating === void 0 ? {} : { toolMutating: toolMeta.mutating }
-    };
-    let current = toolInput;
-    let mutated = false;
-    const contexts = [];
-    let contextAs;
-    const collectContext = (outcome) => {
-      if (outcome.additionalContext) contexts.push(outcome.additionalContext);
-      if (outcome.contextAs === "separate") contextAs = "separate";
-      else if (outcome.contextAs === "inline" && contextAs === void 0) contextAs = "inline";
-    };
-    const resultContext = () => ({
-      ...contexts.length > 0 ? { additionalContext: contexts.join("\n") } : {},
-      ...contextAs ? { contextAs } : {}
-    });
-    const mutators = entries.filter((entry) => entry.stage === "mutate");
-    const validators = entries.filter((entry) => entry.stage === "validate");
-    for (const entry of mutators) {
-      const payload = {
-        event: "PreToolUse",
-        toolName,
-        toolInput: current,
-        ...declared,
-        ...this.base(env)
-      };
-      const outcome = await this.invoke(entry, payload, env);
-      if (!outcome) continue;
-      const normalized = normalizePreToolOutcome(outcome);
-      collectContext(normalized);
-      if (normalized.action === "deny") {
-        return { block: true, reason: normalized.reason, ...resultContext() };
-      }
-      if (normalized.action === "mutate") {
-        current = normalized.input;
-        mutated = true;
-      }
-    }
-    for (const entry of validators) {
-      const payload = {
-        event: "PreToolUse",
-        toolName,
-        toolInput: current,
-        ...declared,
-        ...this.base(env)
-      };
-      const outcome = await this.invoke(entry, payload, env);
-      if (!outcome) continue;
-      const normalized = normalizePreToolOutcome(outcome);
-      collectContext(normalized);
-      if (normalized.action === "deny") {
-        return { block: true, reason: normalized.reason, ...resultContext() };
-      }
-      if (normalized.action === "mutate") {
-        const reason = `PreToolUse validator "${entry.name}" attempted to mutate tool arguments`;
-        this.opts.logger?.warn?.(reason);
-        if (entry.failurePolicy === "closed") {
-          return { block: true, reason, ...resultContext() };
-        }
-      }
-    }
-    return { ...mutated ? { input: current } : {}, ...resultContext() };
-  }
-  async postToolUse(toolName, toolInput, result, env) {
-    const payload = {
-      event: "PostToolUse",
-      toolName,
-      toolInput,
-      toolResult: result,
-      ...this.base(env)
-    };
-    const entries = this.matching("PostToolUse", toolName);
-    if (entries.length === 0) return {};
-    const foreground = [];
-    for (const entry of entries) {
-      if (entry.background) {
-        this.scheduleBackground(entry, payload, env);
-      } else {
-        foreground.push(entry);
-      }
-    }
-    if (foreground.length === 0) return {};
-    const results = await Promise.allSettled(
-      foreground.map((entry) => this.invoke(entry, payload, env))
-    );
-    const parts = [];
-    let separate = false;
-    for (const result2 of results) {
-      if (result2.status !== "fulfilled" || !result2.value?.additionalContext) continue;
-      parts.push(result2.value.additionalContext);
-      if (result2.value.contextAs === "separate") separate = true;
-    }
-    return parts.length ? { additionalContext: parts.join("\n"), contextAs: separate ? "separate" : "inline" } : {};
-  }
-  async userPromptSubmit(prompt, env) {
-    const entries = this.matching("UserPromptSubmit", void 0);
-    if (entries.length === 0) return {};
-    const payload = { event: "UserPromptSubmit", prompt, ...this.base(env) };
-    const parts = [];
-    for (const entry of entries) {
-      const outcome = await this.invoke(entry, payload, env);
-      if (!outcome) continue;
-      const denied = "action" in outcome ? outcome.action === "deny" : outcome.decision === "block";
-      if (denied) {
-        const reason = "reason" in outcome ? outcome.reason : void 0;
-        return { block: true, reason: reason ?? "Blocked by UserPromptSubmit hook" };
-      }
-      if (outcome.additionalContext) parts.push(outcome.additionalContext);
-    }
-    return parts.length ? { additionalContext: parts.join("\n") } : {};
-  }
-  async sessionStart(env) {
-    const payload = { event: "SessionStart", ...this.base(env) };
-    return {
-      additionalContext: await this.collectContext("SessionStart", void 0, payload, env)
-    };
-  }
-  async stop(env) {
-    const payload = { event: "Stop", ...this.base(env) };
-    await this.collectContext("Stop", void 0, payload, env);
-  }
-  // ── internals ──────────────────────────────────────────────────────
-  base(env) {
-    const sessionId = this.opts.sessionId?.();
-    return sessionId ? { cwd: env.cwd, sessionId } : { cwd: env.cwd };
-  }
-  matching(event, toolName) {
-    return this.registry.list(event).filter((e) => hookMatcherMatches(e.matcher, toolName));
-  }
-  scheduleBackground(entry, payload, env) {
-    const running = this.backgroundRuns.get(entry);
-    if (running !== void 0) {
-      running.pending = { payload, env };
-      return;
-    }
-    const state = { pending: null };
-    this.backgroundRuns.set(entry, state);
-    void (async () => {
-      let next = { payload, env };
-      while (next !== null) {
-        try {
-          await this.invoke(entry, next.payload, next.env);
-        } catch {
-        }
-        next = state.pending;
-        state.pending = null;
-      }
-    })().finally(() => {
-      this.backgroundRuns.delete(entry);
-    });
-  }
-  async invoke(entry, payload, env) {
-    const allowNonPolicy = this.opts.allowNonPolicy ?? true;
-    if (!allowNonPolicy && !entry.policy) return null;
-    let result;
-    if (entry.kind === "inprocess") {
-      result = await this.invokeInProcess(entry, payload, env);
-    } else {
-      result = entry.kind === "shell" ? await runShellHookDetailed(
-        { command: entry.command, timeoutMs: hookTimeoutMs(entry) },
-        payload,
-        this.opts.logger,
-        { signal: env.signal }
-      ) : await runHttpHookDetailed(
-        { url: entry.url, headers: entry.headers, timeoutMs: hookTimeoutMs(entry) },
-        payload,
-        this.opts.logger,
-        { signal: env.signal }
-      );
-    }
-    if (!result.failure && result.outcome) {
-      const malformed = malformedOutcome(result.outcome);
-      if (malformed) {
-        result = {
-          outcome: null,
-          failure: { kind: "invalid_output", message: malformed }
-        };
-      }
-    }
-    if (!result.failure) return result.outcome;
-    this.opts.logger?.warn?.(
-      `${payload.event} ${entry.background ? "background " : ""}hook "${entry.name}" failed (${result.failure.kind}): ${result.failure.message}`
-    );
-    return this.failureOutcome(entry, payload, result.failure);
-  }
-  async invokeInProcess(entry, payload, env) {
-    const timeoutMs = Math.max(1, Math.min(hookTimeoutMs(entry), MAX_TIMEOUT_MS));
-    const controller = new AbortController();
-    let timedOut = false;
-    const onParentAbort = () => controller.abort(env.signal?.reason);
-    if (env.signal?.aborted) {
-      return { outcome: null, failure: { kind: "aborted", message: "hook invocation aborted" } };
-    }
-    env.signal?.addEventListener("abort", onParentAbort, { once: true });
-    let timer;
-    const timeout = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        timedOut = true;
-        controller.abort(new Error("hook timeout"));
-        reject(new Error(`timed out after ${timeoutMs}ms`));
-      }, timeoutMs);
-      timer.unref?.();
-    });
-    const runtime = {
-      signal: controller.signal,
-      deadlineAt: Date.now() + timeoutMs
-    };
-    try {
-      const invocation = Promise.resolve().then(() => entry.hook(payload, runtime));
-      const outcome = await Promise.race([invocation, timeout]);
-      if (outcome === void 0) return { outcome: null };
-      if (!outcome || typeof outcome !== "object" || Array.isArray(outcome)) {
-        return {
-          outcome: null,
-          failure: {
-            kind: "invalid_output",
-            message: "in-process hook returned a non-object outcome"
-          }
-        };
-      }
-      return { outcome };
-    } catch (err) {
-      const aborted = env.signal?.aborted === true;
-      return {
-        outcome: null,
-        failure: {
-          kind: timedOut ? "timeout" : aborted ? "aborted" : "error",
-          message: toErrorMessage(err)
-        }
-      };
-    } finally {
-      if (timer) clearTimeout(timer);
-      env.signal?.removeEventListener("abort", onParentAbort);
-    }
-  }
-  failureOutcome(entry, payload, failure) {
-    if (entry.failurePolicy !== "closed") return null;
-    const reason = `${payload.event} policy hook "${entry.name}" failed (${failure.kind}); the action was denied by fail-closed policy. This is not an approval request.`;
-    if (payload.event === "PreToolUse") return { action: "deny", reason };
-    if (payload.event === "UserPromptSubmit") return { decision: "block", reason };
-    return null;
-  }
-  async collectContext(event, toolName, payload, env) {
-    const entries = this.matching(event, toolName);
-    if (entries.length === 0) return void 0;
-    const results = await Promise.allSettled(
-      entries.map((entry) => this.invoke(entry, payload, env))
-    );
-    const parts = [];
-    for (const result of results) {
-      if (result.status === "fulfilled" && result.value?.additionalContext) {
-        parts.push(result.value.additionalContext);
-      }
-    }
-    return parts.length ? parts.join("\n") : void 0;
-  }
-};
-
-// src/hooks/shell-hooks-equal.ts
-function stableJson(value) {
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  if (value && typeof value === "object") {
-    const entries = Object.entries(value).filter(([, child]) => child !== void 0).sort(([a], [b]) => a.localeCompare(b));
-    return `{${entries.map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? "null";
-}
-function shellHooksEqual(a, b) {
-  if (a === b) return true;
-  if (!a || !b) return !a && !b;
-  const aKeys = Object.keys(a);
-  const bKeys = Object.keys(b);
-  if (aKeys.length !== bKeys.length) return false;
-  for (const k of aKeys) {
-    const event = k;
-    const aList = a[event];
-    const bList = b[event];
-    if (aList === bList) continue;
-    if (!aList || !bList) return false;
-    if (aList.length !== bList.length) return false;
-    for (let i = 0; i < aList.length; i++) {
-      const x = aList[i];
-      const y = bList[i];
-      if (!x || !y) return !x && !y;
-      if (stableJson(x) !== stableJson(y)) return false;
-    }
-  }
-  return true;
-}
-function countShellHooks(hooks) {
-  if (!hooks) return 0;
-  let n = 0;
-  for (const list of Object.values(hooks)) {
-    if (list) n += list.length;
-  }
-  return n;
-}
+import {
+  HookRegistry,
+  HookRunner,
+  countShellHooks,
+  hookMatcherMatches,
+  parseHookOutcome,
+  runHttpHookDetailed,
+  runShellHook,
+  runShellHookDetailed,
+  shellHooksEqual
+} from "../chunk-TWJMGXCI.js";
+import "../chunk-LA7CLDRW.js";
+import "../chunk-6NWEVFEL.js";
+import "../chunk-TBRL2RCC.js";
 export {
   HookRegistry,
   HookRunner,