@zeroroot-ai/zerocool-claude 0.6.2 → 0.7.0

package/dist/hook-run.js

@@ -16,9 +16,12 @@ export async function runHook(input, env, deps = { readFile }) {
             return JSON.stringify({ hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: block } });
         }
         case "SessionEnd": {
-            const live = await readLive(dir, cwd);
-            if (!live || !input.transcript_path || !input.session_id)
+            const read = await readLive(dir, cwd);
+            if (!read || !input.transcript_path || !input.session_id)
                 return "";
+            if ("refused" in read)
+                return JSON.stringify({ systemMessage: `zerocool: session checkpoint skipped: ${read.refused}` });
+            const live = read.state;
             let data;
             try {
                 data = await deps.readFile(input.transcript_path);

package/dist/index.d.ts

@@ -1,2 +1 @@
 export * from "./state.js";
-export { runHook, type HookInput } from "./hook-run.js";

package/dist/index.js

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: Elastic-2.0
 // Copyright 2026 Zero Root AI
-// @zeroroot-ai/zerocool-claude: the Claude Code host adapter (ADR-0008).
+// @zeroroot-ai/zerocool-claude: the Claude Code host adapter (ADR-0158).
 //
 // The tools are not here. They come from the Gibson MCP server, which the
 // bundle's `.mcp.json` names. This package is the bundle around it: the
 // plugin manifest, the marketplace entry, and two hooks. The only bin is
-// the hook.
+// the hook, and it imports `hook-run.ts` itself: nothing reaches the hook
+// through this module.
 export * from "./state.js";
-export { runHook } from "./hook-run.js";

package/dist/state.d.ts

@@ -4,13 +4,13 @@
  * A hook runs as its own process and cannot reach the server's session, so
  * the server writes one small file per working directory in `~/.zerocool/`:
  * the ambient knowledge block for SessionStart, and the live-mission
- * coordinates for SessionEnd (ADR-0007's consequence, now served by the
- * server, ADR-0008).
+ * coordinates for SessionEnd (ADR-0157's consequence, now served by the
+ * server, ADR-0158).
  *
  * This file is the read half of that format, kept here because a hook must
  * not depend on the server package: the format is the contract, not the
- * import. It matches `@zeroroot-ai/gibson-mcp`'s `state.ts` exactly, and the
- * key is a hash of the working directory.
+ * import. It reads the files that `@zeroroot-ai/gibson-mcp`'s `state.ts`
+ * writes, and the key is a hash of the working directory.
  */
 export interface LiveState {
     missionId: string;
@@ -25,5 +25,31 @@ export declare function stateDir(env?: NodeJS.ProcessEnv): string;
 export declare function keyFor(cwd: string): string;
 /** The block SessionStart injects. Empty when the server wrote none. */
 export declare function readAmbient(dir: string, cwd: string): Promise<string>;
-/** The live mission SessionEnd checkpoints under. Undefined when there is none. */
-export declare function readLive(dir: string, cwd: string): Promise<LiveState | undefined>;
+/** A live state file that passed the checks, or the reason it did not. */
+export type LiveRead = {
+    state: LiveState;
+} | {
+    refused: string;
+};
+/**
+ * The host of an endpoint, which is `host:port` or an `https://` URL. Empty
+ * when the endpoint has another shape, for example an `http://` URL.
+ */
+export declare function endpointHost(endpoint: string): string;
+/**
+ * Why the hook must not upload a transcript under this state, or "" when it
+ * may. The hook sends the whole session transcript to `endpoint` with
+ * `token`, so the file must be the server's own: owned by this user, readable
+ * by nobody else, and naming a TLS endpoint. TLS verification may be off only
+ * for a loopback endpoint.
+ */
+export declare function liveRefusal(live: LiveState, file: {
+    uid: number;
+    mode: number;
+}, uid: number | undefined): string;
+/**
+ * The live mission SessionEnd checkpoints under. Undefined when there is none
+ * or the file does not parse. A file that parses but fails liveRefusal comes
+ * back as `refused`, so the hook can say why it uploaded nothing.
+ */
+export declare function readLive(dir: string, cwd: string, uid?: number | undefined): Promise<LiveRead | undefined>;

package/dist/state.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Elastic-2.0
 // Copyright 2026 Zero Root AI
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
@@ -19,12 +19,72 @@ export async function readAmbient(dir, cwd) {
         return "";
     }
 }
-/** The live mission SessionEnd checkpoints under. Undefined when there is none. */
-export async function readLive(dir, cwd) {
+const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]", "::1"];
+/**
+ * The host of an endpoint, which is `host:port` or an `https://` URL. Empty
+ * when the endpoint has another shape, for example an `http://` URL.
+ */
+export function endpointHost(endpoint) {
+    if (endpoint.includes("://")) {
+        let u;
+        try {
+            u = new URL(endpoint);
+        }
+        catch {
+            return "";
+        }
+        return u.protocol === "https:" ? u.hostname : "";
+    }
+    // host:port. The port is read from the text: URL drops a default port.
+    if (!/^[^/?#@\s]+:\d{1,5}$/.test(endpoint))
+        return "";
     try {
-        return JSON.parse(await readFile(join(dir, `live-${keyFor(cwd)}.json`), "utf8"));
+        return new URL(`https://${endpoint}`).hostname;
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Why the hook must not upload a transcript under this state, or "" when it
+ * may. The hook sends the whole session transcript to `endpoint` with
+ * `token`, so the file must be the server's own: owned by this user, readable
+ * by nobody else, and naming a TLS endpoint. TLS verification may be off only
+ * for a loopback endpoint.
+ */
+export function liveRefusal(live, file, uid) {
+    if (uid !== undefined && file.uid !== uid)
+        return "the live state file is owned by another user";
+    if ((file.mode & 0o077) !== 0)
+        return "the live state file is readable or writable by other users; its mode must be 0600";
+    if (typeof live.endpoint !== "string" || typeof live.token !== "string" || typeof live.insecure !== "boolean") {
+        return "the live state file has the wrong shape";
+    }
+    const host = endpointHost(live.endpoint);
+    if (!host)
+        return `the endpoint ${JSON.stringify(live.endpoint)} is not host:port or an https URL`;
+    if (live.insecure && !LOOPBACK_HOSTS.includes(host))
+        return `TLS verification is off for the endpoint ${host}, which is not loopback`;
+    return "";
+}
+/**
+ * The live mission SessionEnd checkpoints under. Undefined when there is none
+ * or the file does not parse. A file that parses but fails liveRefusal comes
+ * back as `refused`, so the hook can say why it uploaded nothing.
+ */
+export async function readLive(dir, cwd, uid = process.getuid?.()) {
+    const path = join(dir, `live-${keyFor(cwd)}.json`);
+    let live;
+    let file;
+    try {
+        file = await stat(path);
+        live = JSON.parse(await readFile(path, "utf8"));
     }
     catch {
         return undefined;
     }
+    if (typeof live !== "object" || live === null)
+        return undefined;
+    const refused = liveRefusal(live, file, uid);
+    return refused ? { refused } : { state: live };
 }

package/hooks/zerocool-claude-hook.mjs

@@ -17,7 +17,7 @@
 // node_modules.
 import { spawn } from "node:child_process"
 
-const VERSION = "0.6.2" // x-release-please-version
+const VERSION = "0.7.0" // x-release-please-version
 const PACKAGE = `@zeroroot-ai/zerocool-claude@${VERSION}`
 const BIN = "zerocool-claude-hook"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeroroot-ai/zerocool-claude",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Claude Code host adapter for Gibson (zerocool): the plugin bundle around the Gibson MCP server, plus SessionStart and SessionEnd hooks. The model stays on your Claude login.",
   "license": "Elastic-2.0",
   "repository": {