avorelo 0.3.8 → 0.4.0-rc.2

package/scripts/cco-pretooluse.js

@@ -0,0 +1,381 @@
+"use strict";
+
+const {
+  readStdinJson,
+  ensureCcoDirs,
+  getEffectiveConfig,
+  latestSecurityScanMeta,
+  safeWriteJson,
+  nowIso,
+} = require("./lib/fsx");
+const { normalizeHookInput, outPermission } = require("./lib/hook-contracts");
+const { readSecurityAllowlist } = require("./lib/config");
+const { logMetric, recordToolCallAndDetectLoop } = require("./lib/metrics");
+const { extractRuntimeEvidence } = require("./lib/attribution");
+const { detectRiskyBash, runBaselineSecurityScan } = require("./lib/security-scan");
+const { runTrustAudit } = require("./lib/trust-audit");
+const { selectMicroProofs } = require("./lib/micro-proof");
+const { writeLatestIntervention, formatInterventionMessage } = require("./lib/intervention-guidance");
+const { evaluatePreToolRuntimeDecision } = require("./lib/runtime-decision-policy");
+const { createCanonicalProof, withCanonicalProof } = require("./lib/proof-canonical");
+
+function decisionForProfile(profile, securityMode) {
+  if (securityMode === "block") return "deny";
+  if (securityMode === "ask") return "ask";
+  if (securityMode === "suggest") return "allow";
+  if (profile === "quality") return "ask";
+  return "ask";
+}
+
+function maybeRunSkillPrerunScan(cwd, freshnessHours, allowlist) {
+  const latest = latestSecurityScanMeta(cwd);
+  const now = Date.now();
+  const scanFreshnessMs = Math.max(1, Number(freshnessHours || 24)) * 60 * 60 * 1000;
+  const stale = !latest || now - latest.mtimeMs > scanFreshnessMs;
+  if (!stale) return { stale: false, scan: null, path: latest.relPath };
+
+  const scan = runBaselineSecurityScan({ cwd, allowlist });
+  const outPath = `.claude/cco/security/${nowIso().replace(/[:.]/g, "-")}-prerun-scan.json`;
+  safeWriteJson(cwd, outPath, scan);
+  return { stale: true, scan, path: outPath };
+}
+
+function blockedByTeamPolicy(patterns, text) {
+  if (!Array.isArray(patterns)) return false;
+  return patterns.some((pat) => {
+    try {
+      return new RegExp(pat, "i").test(text || "");
+    } catch {
+      return false;
+    }
+  });
+}
+
+function sourcePolicyDecision(toolInput, teamPolicy) {
+  const source = String(toolInput?.source || toolInput?.marketplace || "unknown");
+  const allowed = Array.isArray(teamPolicy?.allowedSkillSources) && teamPolicy.allowedSkillSources.includes(source);
+  if (source === "unknown") return { source, allowed: false, unknown: true };
+  return { source, allowed, unknown: false };
+}
+
+function severityToRiskLevel(severity, numericScore) {
+  if (typeof severity === "string") return severity;
+  const score = Number(numericScore || 0);
+  if (score >= 70) return "high";
+  if (score >= 40) return "medium";
+  if (score > 0) return "low";
+  return null;
+}
+
+function logControlDecision(cwd, params) {
+  const canonical = createCanonicalProof("control_decision", params.proof || {});
+  logMetric(cwd, {
+    ...(params.runtimeEvidence || {}),
+    sessionId: params.sessionId,
+    event: "PreToolUse",
+    tool: params.tool,
+    action: params.action,
+    reasonCodes: params.reasonCodes || [],
+    meta: withCanonicalProof(params.meta || {}, canonical),
+  });
+}
+
+async function main() {
+  const raw = await readStdinJson();
+  const input = normalizeHookInput(raw);
+  const cwd = input.cwd;
+  const sessionId = input.session_id;
+  const toolName = input.tool_name;
+  const toolInput = input.tool_input;
+  const runtimeEvidence = extractRuntimeEvidence({
+    tool: toolName,
+    event: "PreToolUse",
+    toolInput,
+  }) || {};
+
+  ensureCcoDirs(cwd);
+  const { config, teamPolicy } = getEffectiveConfig(cwd);
+  const allowlist = readSecurityAllowlist(cwd, config);
+  const persistIntervention = (payload) => {
+    try {
+      writeLatestIntervention(cwd, { sessionId, ...payload });
+    } catch {}
+  };
+
+  if (config.loopGuardEnabled) {
+    const loop = recordToolCallAndDetectLoop(cwd, sessionId, toolName);
+    if (loop && loop.shouldInterrupt) {
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: toolName,
+        action: "deny",
+        reasonCodes: ["LOOP_REPEATED_TOOL"],
+        meta: { profile: config.profile },
+        proof: {
+          decision: "deny",
+          source: "loop_guard",
+          reason_codes: ["LOOP_REPEATED_TOOL"],
+          approval_required: false,
+          risk_level: "medium",
+          policy_boundary: "repeat-tool-loop",
+          scope_status: "loop_interrupt",
+          blocked: true,
+          downgraded: false,
+          user_visible_proof_supported: false,
+        },
+      });
+      try {
+        selectMicroProofs(["LOOP_REPEATED_TOOL"], cwd, sessionId, {
+          proofEnabled: config.proofSystem?.enabled !== false,
+        });
+      } catch {}
+      return process.stdout.write(
+        JSON.stringify(
+          outPermission(
+            "deny",
+            "Possible loop detected: repeated tool invocation. Please summarize progress and re-plan before running this again."
+          )
+        )
+      );
+    }
+  }
+
+  if (toolName === "Skill" || toolName === "Agent") {
+    const sourceCheck = sourcePolicyDecision(toolInput, teamPolicy);
+    if (!sourceCheck.allowed) {
+      const decision = config.securityMode === "block" || config.trustMode === "strict" ? "deny" : "ask";
+      const reasonCode = sourceCheck.unknown ? "SEC_SKILL_SOURCE_UNKNOWN" : "SEC_SKILL_SOURCE_UNAPPROVED";
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: toolName,
+        action: decision,
+        reasonCodes: [reasonCode],
+        meta: {
+          source: sourceCheck.source,
+          allowedSources: teamPolicy.allowedSkillSources || [],
+          profile: config.profile,
+          securityMode: config.securityMode,
+        },
+        proof: {
+          decision,
+          source: "policy",
+          reason_codes: [reasonCode],
+          approval_required: decision === "ask",
+          risk_level: "medium",
+          policy_boundary: "allowed-skill-sources",
+          scope_status: "violations_handled",
+          blocked: decision === "deny",
+          downgraded: decision === "ask",
+          user_visible_proof_supported: false,
+          evidence_refs: [],
+        },
+      });
+      return process.stdout.write(
+        JSON.stringify(
+          outPermission(
+            decision,
+            `Source '${sourceCheck.source}' is not in team allowedSkillSources. Review team policy and run intake scan first.`
+          )
+        )
+      );
+    }
+
+    const runtimeDecision = evaluatePreToolRuntimeDecision({
+      cwd,
+      sessionId,
+      toolName,
+      toolInput,
+      runtimeEvidence,
+      config,
+    });
+    if (runtimeDecision) {
+      const message = formatInterventionMessage({
+        sessionId,
+        ...runtimeDecision.intervention,
+      });
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: toolName,
+        action: runtimeDecision.action,
+        reasonCodes: runtimeDecision.reasonCodes,
+        meta: runtimeDecision.meta,
+        proof: {
+          decision: runtimeDecision.action,
+          source: "runtime_decision_policy",
+          reason_codes: runtimeDecision.reasonCodes,
+          approval_required: runtimeDecision.action === "ask",
+          risk_level: runtimeDecision.action === "deny" ? "high" : "medium",
+          policy_boundary: "runtime-evidence-guard",
+          scope_status: "violations_handled",
+          blocked: runtimeDecision.action === "deny",
+          downgraded: runtimeDecision.action === "ask",
+          user_visible_proof_supported: false,
+        },
+      });
+      persistIntervention(runtimeDecision.intervention);
+      return process.stdout.write(JSON.stringify(outPermission(runtimeDecision.action, message)));
+    }
+
+    const pre = maybeRunSkillPrerunScan(cwd, config.scanFreshnessHours, allowlist);
+    const trustAudit = runTrustAudit({ cwd, teamPolicy, writeSnapshot: false });
+    const unknownOrUntrusted = (trustAudit.unknownFiles || []).concat(trustAudit.untrustedFiles || []);
+
+    if (pre.stale) {
+      const reasons = pre.scan?.topReasons || [];
+      const reasonCodes = ["SEC_PRERUN_SCAN_STALE", ...reasons];
+      if (unknownOrUntrusted.length && (pre.scan?.riskScore || 0) >= 70) {
+        reasonCodes.push("SEC_TRUST_UNKNOWN_HIGH");
+      }
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: toolName,
+        action: "scan",
+        reasonCodes,
+        meta: {
+          path: pre.path,
+          riskScore: pre.scan?.riskScore ?? 0,
+          changedFiles: unknownOrUntrusted.slice(0, 5),
+        },
+        proof: {
+          decision: "scan",
+          source: "security",
+          reason_codes: reasonCodes,
+          approval_required: false,
+          risk_level: severityToRiskLevel(null, pre.scan?.riskScore),
+          policy_boundary: "skill-prerun-scan",
+          scope_status: unknownOrUntrusted.length ? "violations_handled" : "no_violations_detected",
+          user_visible_proof_supported: false,
+          evidence_refs: pre.path ? [pre.path] : [],
+        },
+      });
+
+      if (unknownOrUntrusted.length && ((pre.scan?.riskScore || 0) >= 70 || config.trustMode === "strict")) {
+        return process.stdout.write(
+          JSON.stringify(
+            outPermission(
+              "ask",
+              `Trust audit requires confirmation before ${toolName} run. Changed files: ${unknownOrUntrusted
+                .slice(0, 3)
+                .join(", ")}. Review ${pre.path} first.`
+            )
+          )
+        );
+      }
+
+      if ((pre.scan?.riskScore ?? 0) >= 85 && (config.profile === "quality" || config.securityMode === "block")) {
+        return process.stdout.write(
+          JSON.stringify(
+            outPermission(
+              "ask",
+              `Pre-run security scan found high risk (${reasons.join(", ")}). Review ${pre.path} before proceeding.`
+            )
+          )
+        );
+      }
+    } else {
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: toolName,
+        action: "allow",
+        reasonCodes: ["SEC_PRERUN_SCAN_FRESH"],
+        meta: { path: pre.path },
+        proof: {
+          decision: "allow",
+          source: "security",
+          reason_codes: ["SEC_PRERUN_SCAN_FRESH"],
+          approval_required: false,
+          risk_level: "low",
+          policy_boundary: "skill-prerun-scan",
+          scope_status: "no_violations_detected",
+          blocked: false,
+          downgraded: false,
+          user_visible_proof_supported: false,
+          evidence_refs: pre.path ? [pre.path] : [],
+        },
+      });
+    }
+  }
+
+  if (toolName === "Bash" && typeof toolInput.command === "string") {
+    if (blockedByTeamPolicy(teamPolicy?.blockedPatterns, toolInput.command)) {
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: "Bash",
+        action: "deny",
+        reasonCodes: ["TEAM_BLOCK_PATTERN"],
+        meta: { profile: config.profile, securityMode: config.securityMode },
+        proof: {
+          decision: "deny",
+          source: "policy",
+          reason_codes: ["TEAM_BLOCK_PATTERN"],
+          approval_required: false,
+          risk_level: "high",
+          policy_boundary: "team-block-pattern",
+          scope_status: "violations_handled",
+          blocked: true,
+          downgraded: false,
+          user_visible_proof_supported: false,
+        },
+      });
+      return process.stdout.write(JSON.stringify(outPermission("deny", "Blocked by team policy pattern.")));
+    }
+
+    const finding = detectRiskyBash(toolInput.command);
+    if (finding) {
+      const mode = decisionForProfile(config.profile, config.securityMode);
+      const decision = finding.severity === "high" ? "deny" : mode;
+      logControlDecision(cwd, {
+        runtimeEvidence,
+        sessionId,
+        tool: "Bash",
+        action: decision,
+        reasonCodes: [finding.code],
+        meta: { profile: config.profile, securityMode: config.securityMode },
+        proof: {
+          decision,
+          source: "security",
+          reason_codes: [finding.code],
+          approval_required: decision === "ask",
+          risk_level: severityToRiskLevel(finding.severity),
+          policy_boundary: "risky-bash",
+          scope_status: "violations_handled",
+          blocked: decision === "deny",
+          downgraded: decision === "ask",
+          user_visible_proof_supported: false,
+        },
+      });
+      return process.stdout.write(JSON.stringify(outPermission(decision, `${finding.message} (${finding.code})`)));
+    }
+  }
+
+  logControlDecision(cwd, {
+    runtimeEvidence,
+    sessionId,
+    tool: toolName,
+    action: "allow",
+    reasonCodes: [],
+    meta: { profile: config.profile, securityMode: config.securityMode, tier: config.tier },
+    proof: {
+      decision: "allow",
+      source: "pretooluse",
+      reason_codes: [],
+      approval_required: false,
+      risk_level: "low",
+      policy_boundary: "current-policy",
+      scope_status: "within_policy",
+      blocked: false,
+      downgraded: false,
+      user_visible_proof_supported: false,
+    },
+  });
+
+  process.stdout.write(JSON.stringify({}));
+}
+
+main().catch(() => process.stdout.write(JSON.stringify({})));