codehere 1.0.1 → 1.0.3

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -1,1018 +0,0 @@
-/**
- * Claude Agent SDK Hook Handler
- *
- * Intercepts every Claude Code tool call via PreToolUse/PostToolUse hooks.
- * Runs Layer 0 security scan (local, no API, <50ms) before any tool executes.
- *
- * Claude Code hook contract:
- * - stdin:  JSON event { session_id, hook_event_name, tool_name, tool_input }
- * - stdout: optional JSON { decision: 'block'|'approve', reason?: string, suppressOutput?: boolean }
- * - stderr: human-readable messages shown to user
- * - exit 0: allow (default)
- * - exit non-0: block with stderr shown to user
- *
- * Docs: https://docs.anthropic.com/en/docs/claude-code/hooks
- */
-import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, readSync, statSync, unlinkSync, } from 'fs';
-import { join } from 'path';
-import { homedir, tmpdir } from 'os';
-import { createHash } from 'crypto';
-// P18 slice 2 — Tier 1 hook honors per-cwd permissions.yaml.
-import { filterAllowed } from '../security/permissions-config.js';
-/**
- * Instruction-level scan pattern bank used by `scanPayload()`. Exported so
- * docs and the landing page can quote `PATTERNS.length` instead of hardcoding
- * a number that silently drifts (May 2026 audit found 50 / 47 / 60+ all in
- * the same PRD). Pair this with `CODE_PATTERNS` from `trust-scorer.ts` — the
- * two banks are scanned in different passes and counted separately.
- */
-export const PATTERNS = [
-    // Sensitive-destination writes (MED #18, atomic audit) · the Write/Edit
-    // scan payload carries ONLY the destination path (content is data) — but
-    // no pattern matched a bare path, so a Write straight at ~/.ssh/id_rsa
-    // scanned clean. Match the canonical credential/key destinations in a
-    // file_path-shaped payload. Path-only by design: a Bash command touching
-    // these is caught by the command patterns below.
-    {
-        regex: /file_path[^}]{0,200}?(\.ssh\/(id_[a-z0-9]+|authorized_keys|known_hosts)|\.aws\/credentials|\.gnupg\/|\.netrc|\.npmrc|\.pypirc|\.docker\/config\.json|\.kube\/config|\.git-credentials)/i,
-        severity: 'critical',
-        category: 'Sensitive File Write',
-        description: 'Write/Edit aimed at a credential or key file (~/.ssh, ~/.aws/credentials, …)',
-    },
-    // Prompt Injection
-    // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
-    {
-        regex: /ignore\s+(?:(?:previous|prior|above|all|your|the)\s+){1,4}(?:instructions?|rules?|prompts?|guidelines?)/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Attempts to override system instructions',
-    },
-    {
-        regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Disregard instruction override',
-    },
-    {
-        regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Context clearing attempt',
-    },
-    {
-        regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Role hijacking attempt',
-    },
-    {
-        regex: /\bsystem\s+prompt\b|<\/?system>|(?<!['"\\])<\/?instruction>/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'System prompt injection',
-    },
-    {
-        regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Instruction override attempt',
-    },
-    {
-        regex: /\bjailbreak\b|\bDAN\s+mode\b|\bdeveloper\s+mode\s+enabled\b/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Jailbreak attempt',
-    },
-    {
-        regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Safety bypass attempt',
-    },
-    {
-        regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i,
-        severity: 'high',
-        category: 'Prompt Injection',
-        description: 'Prompt template injection',
-    },
-    {
-        regex: /override\s+(safety|security|policy|restrictions?)/i,
-        severity: 'critical',
-        category: 'Prompt Injection',
-        description: 'Policy override attempt',
-    },
-    // Credential Theft
-    {
-        regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'Reads credential files',
-    },
-    {
-        regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'Exfiltrates env secrets',
-    },
-    {
-        regex: /\bprintenv\b|\benv\s*\|\s*(grep|curl|wget|nc)\b/i,
-        severity: 'high',
-        category: 'Credential Theft',
-        description: 'Environment variable exfiltration',
-    },
-    {
-        regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'API key exfiltration via curl',
-    },
-    // Reading SSH private keys is never benign in dev workflow — promote to critical.
-    // ssh-keygen alone (key generation) stays 'high' since it's also a legitimate setup operation.
-    {
-        regex: /cat\s+~?\/?\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'Reads SSH private key',
-    },
-    {
-        regex: /ssh-keygen|cat\s+~?\/?\.ssh\/authorized_keys/i,
-        severity: 'high',
-        category: 'Credential Theft',
-        description: 'SSH key tooling access',
-    },
-    {
-        regex: /\bkeychain\b|\bsecurity\s+find-generic-password\b/i,
-        severity: 'high',
-        category: 'Credential Theft',
-        description: 'macOS keychain access attempt',
-    },
-    {
-        regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i,
-        severity: 'high',
-        category: 'Credential Theft',
-        description: 'Known API key reference',
-    },
-    {
-        regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i,
-        severity: 'medium',
-        category: 'Credential Theft',
-        description: 'Secret key reference',
-    },
-    {
-        regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'Credential webhook exfiltration',
-    },
-    {
-        regex: /\/proc\/\d+\/environ|\/etc\/shadow/i,
-        severity: 'critical',
-        category: 'Credential Theft',
-        description: 'System credential file access',
-    },
-    // Destructive Operations
-    // Block rm -rf against system roots or a user's whole home — but allow
-    // routine deletion under /tmp, ~/Library/Caches, node_modules, etc.
-    // Previous pattern included bare `\/` which matched any path starting
-    // with `/` (so `rm -rf /tmp/foo` was blocked). The alternatives below
-    // require an explicit system target or a bare home reference.
-    {
-        regex: /rm\s+-rf?\s+(?:\/(?:["'\s]|$|\*)|\/(?:home|etc|var|usr|bin|sbin|System|Library|opt|root|boot|dev)\b|~(?:["'\s]|$|\/(?:["'\s]|$|\*))|\$HOME(?:["'\s]|$|\/(?:["'\s]|$|\*))|\.\.(?:["'\s]|$))/im,
-        severity: 'critical',
-        category: 'Destructive',
-        description: 'Recursive deletion of system/home directories',
-    },
-    {
-        regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i,
-        severity: 'critical',
-        category: 'Destructive',
-        description: 'Mass file deletion',
-    },
-    {
-        regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i,
-        severity: 'critical',
-        category: 'Destructive',
-        description: 'Raw disk write attempt',
-    },
-    {
-        regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i,
-        severity: 'critical',
-        category: 'Destructive',
-        description: 'Database destruction',
-    },
-    // Force-push or hard reset against main/master/production is irreversible loss of shared history — critical.
-    // Force-push to other branches stays 'high' since rebase-and-force-push to feature branches is routine.
-    {
-        regex: /git\s+(?:push\s+(?:--force|-f)|reset\s+--hard)\s+\S*origin\s+(main|master|production|release|prod)\b/i,
-        severity: 'critical',
-        category: 'Destructive',
-        description: 'Force push or hard reset to a protected branch',
-    },
-    {
-        regex: /git\s+(push\s+(?:--force|-f)|reset\s+--hard)\s+origin/i,
-        severity: 'high',
-        category: 'Destructive',
-        description: 'Force push or hard reset to remote',
-    },
-    {
-        regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i,
-        severity: 'high',
-        category: 'Destructive',
-        description: 'System shutdown/reboot',
-    },
-    {
-        regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i,
-        severity: 'medium',
-        category: 'Destructive',
-        description: 'Process mass termination',
-    },
-    {
-        regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i,
-        severity: 'high',
-        category: 'Destructive',
-        description: 'Scheduled destruction',
-    },
-    // Code/Command Injection
-    // NOTE: patterns match execution intent, not grep/search of these strings.
-    // A command starting with "grep", "rg", "ag", or "find" is a search, not execution —
-    // those are pre-filtered in buildScanPayload before patterns run.
-    {
-        regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'Remote script piped directly to shell',
-    },
-    {
-        regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'Remote code execution via wget',
-    },
-    {
-        regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'Inline node eval execution',
-    },
-    {
-        regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'eval() with external or env input',
-    },
-    {
-        regex: /exec\s*\(\s*['"]\s*system/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'System shell from code',
-    },
-    {
-        regex: /python\s+-c\s+["']import\s+os;os\.system/i,
-        severity: 'high',
-        category: 'Code Injection',
-        description: 'Python shell injection',
-    },
-    // Reverse shell forms:
-    //   nc -e /bin/bash 1.2.3.4 4444   (binary between -e and IP)
-    //   nc -e 1.2.3.4 4444             (IP directly after -e)
-    //   bash -i >& /dev/tcp/host/port  (bash builtin)
-    {
-        regex: /nc\s+-[eln]+(?:\s+\S+)?\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'Reverse shell attempt',
-    },
-    {
-        regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i,
-        severity: 'critical',
-        category: 'Code Injection',
-        description: 'Base64-encoded code execution',
-    },
-    {
-        regex: /\$\(curl|subprocess\.run\(['"]curl/i,
-        severity: 'high',
-        category: 'Code Injection',
-        description: 'Command substitution with curl',
-    },
-    // Supply Chain
-    {
-        regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i,
-        severity: 'high',
-        category: 'Supply Chain',
-        description: 'Suspicious package version pattern',
-    },
-    {
-        regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i,
-        severity: 'high',
-        category: 'Supply Chain',
-        description: 'Typosquatting package pattern',
-    },
-    {
-        regex: /preinstall|postinstall|prepare/i,
-        severity: 'medium',
-        category: 'Supply Chain',
-        description: 'Lifecycle script reference',
-    },
-    {
-        regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i,
-        severity: 'critical',
-        category: 'Supply Chain',
-        description: 'Direct npm tarball execution',
-    },
-    // OWASP / Security Misconfig
-    {
-        regex: /Access-Control-Allow-Origin:\s*\*/i,
-        severity: 'medium',
-        category: 'OWASP',
-        description: 'Wildcard CORS header',
-    },
-    {
-        regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i,
-        severity: 'high',
-        category: 'OWASP',
-        description: 'SSL certificate verification disabled',
-    },
-    {
-        regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i,
-        severity: 'medium',
-        category: 'OWASP',
-        description: 'Hardcoded credential',
-    },
-    {
-        regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i,
-        severity: 'high',
-        category: 'OWASP',
-        description: 'Potential XSS via user input',
-    },
-    {
-        regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i,
-        severity: 'critical',
-        category: 'OWASP',
-        description: 'SQL injection pattern',
-    },
-    // Data Exfiltration
-    {
-        regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i,
-        severity: 'high',
-        category: 'Data Exfiltration',
-        description: 'File upload via curl',
-    },
-    {
-        regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i,
-        severity: 'high',
-        category: 'Data Exfiltration',
-        description: 'SCP to external IP',
-    },
-    {
-        regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i,
-        severity: 'medium',
-        category: 'Data Exfiltration',
-        description: 'Mass file sync to remote',
-    },
-];
-// ── Risk scoring ────────────────────────────────────────────────────────────
-const SEVERITY_SCORES = {
-    critical: 40,
-    high: 20,
-    medium: 10,
-    low: 5,
-};
-/**
- * Scans a text payload against all Layer 0 patterns.
- * Returns findings and a 0-100 risk score.
- * Average run time: < 5ms on a modern CPU.
- */
-export function scanPayload(text) {
-    const findings = [];
-    for (const pattern of PATTERNS) {
-        const match = text.match(pattern.regex);
-        if (match) {
-            findings.push({
-                severity: pattern.severity,
-                category: pattern.category,
-                description: pattern.description,
-                matched: match[0].substring(0, 120), // truncate for audit log
-            });
-        }
-    }
-    return findings;
-}
-export function calculateRiskScore(findings) {
-    let score = 0;
-    for (const f of findings) {
-        score += SEVERITY_SCORES[f.severity] ?? 5;
-    }
-    return Math.min(100, score);
-}
-// ── Audit log ───────────────────────────────────────────────────────────────
-/**
- * Audit log path — defaults to ~/.codehere/audit/hook-events.jsonl.
- * Override at process start with CODEHERE_AUDIT_FILE env var (used by tests, optional for users).
- * Honors CODEHERE_HOME like sessions/config/threads — found via the v1 stranger
- * walk: an "isolated" daemon (verify-all's :3779, the walk's scratch home) was
- * writing mock audit entries into the REAL ~/.codehere/audit while verify-all
- * printed "Real ~/.codehere untouched" (the footer showed 162 entries · 51
- * agents in a brand-new home — all of them pollution from past mock runs).
- */
-/**
- * S9 · practice mode leaves no marks: a CODEHERE_MOCK=1 process never writes
- * the REAL audit chain. Mock isolated spend but not the chain — the atomic
- * audit proved it by landing probe entries in ~/.codehere (seq ~11862). The
- * mock chain lives at a STABLE tmp path (one sign-state key, not one per
- * boot) and the daemon wipes it + prunes its sign-state key at boot, so
- * every practice session starts clean and leaves zero residue. An explicit
- * CODEHERE_AUDIT_FILE still wins (tests point it at their own scratch).
- */
-export const MOCK_AUDIT_FILE = join(tmpdir(), 'codehere-mock', 'audit', 'hook-events.jsonl');
-export const AUDIT_FILE = process.env.CODEHERE_AUDIT_FILE ||
-    (process.env.CODEHERE_MOCK === '1'
-        ? MOCK_AUDIT_FILE
-        : join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'audit', 'hook-events.jsonl'));
-const GENESIS_PREV_HASH = '0'.repeat(64);
-/**
- * Canonicalize an audit entry for hashing. We sort keys alphabetically and
- * stringify with no whitespace so the hash is reproducible across writers.
- * The `entryHash` field is excluded from its own hash input (chicken-and-egg).
- */
-function canonicalizeForHash(entry) {
-    const { entryHash: _entryHash, ...rest } = entry;
-    void _entryHash; // referenced to satisfy lint; the destructure is the point
-    const keys = Object.keys(rest).sort();
-    const ordered = {};
-    for (const k of keys) {
-        ordered[k] = rest[k];
-    }
-    return JSON.stringify(ordered);
-}
-/** SHA-256 hex of an entry's canonical form (entryHash excluded). */
-export function computeEntryHash(entry) {
-    return createHash('sha256').update(canonicalizeForHash(entry)).digest('hex');
-}
-/**
- * Read the chain tip (seq + entryHash of the last chained entry) from disk.
- * Walks BACKWARD from EOF looking for the most recent line that carries
- * chain fields. Pre-fix this only checked the last line — if that line was
- * legacy (no chain fields), the chain restarted at seq=0 producing a fake
- * hash_mismatch in verifyAuditChain. Walking backward keeps the chain
- * continuous across legacy-entry interleavings (rare but possible when
- * an out-of-band script appends raw JSON to the audit file).
- */
-/**
- * The actual backward-walk: most recent line carrying chain fields wins.
- * Pure over a set of lines so both the bounded and full readers share it.
- */
-export function tipFromLines(lines) {
-    for (let i = lines.length - 1; i >= 0; i--) {
-        const raw = lines[i];
-        if (!raw.trim())
-            continue;
-        try {
-            const entry = JSON.parse(raw);
-            if (typeof entry.seq === 'number' && typeof entry.entryHash === 'string') {
-                return { seq: entry.seq, hash: entry.entryHash };
-            }
-            // Legacy entry — keep walking backward
-        }
-        catch {
-            // Parse failure — skip and continue
-        }
-    }
-    return null;
-}
-function readChainTipFull(filepath) {
-    let content;
-    try {
-        content = readFileSync(filepath, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-    return tipFromLines(content.split('\n'));
-}
-/**
- * Read the chain tip (seq + entryHash of the last chained entry) from disk.
- *
- * Hot path: appendAuditLog calls this on every tool call to compute the next
- * seq/prevHash. Reading the whole file each time is O(filesize), and the audit
- * log grows unbounded (one line per tool call), so a heavy user eventually
- * pays a multi-MB read on every call — enough to blow the <50ms hook budget.
- *
- * So we read only the last `tailBytes` and run the SAME backward-walk on that
- * window. The window starts mid-file, so its first line is probably truncated
- * — we drop it (dropping the OLDEST line in the window never changes the most
- * recent chain entry, which is what we return). If the window holds no chain
- * entry (e.g. a long run of legacy entries, or the only entry was the dropped
- * partial line), we fall back to a full read. The bounded read is therefore a
- * pure optimization: it can never return a different tip than the full read,
- * only reach it faster. Proven by the property test in
- * test/unit/chain-tip-bounded.test.ts.
- */
-export function readChainTip(filepath, tailBytes = 65536) {
-    if (!existsSync(filepath))
-        return null;
-    let size;
-    try {
-        size = statSync(filepath).size;
-    }
-    catch {
-        return null;
-    }
-    if (size === 0)
-        return null;
-    if (size <= tailBytes)
-        return readChainTipFull(filepath);
-    // Bounded tail read: last `tailBytes` ending at EOF (so the final line is
-    // never truncated; only the first line in the window may be).
-    let fd;
-    try {
-        fd = openSync(filepath, 'r');
-        const buf = Buffer.alloc(tailBytes);
-        const bytesRead = readSync(fd, buf, 0, tailBytes, size - tailBytes);
-        const lines = buf.toString('utf-8', 0, bytesRead).split('\n');
-        lines.shift(); // drop the possibly-truncated first line
-        const tip = tipFromLines(lines);
-        if (tip)
-            return tip;
-    }
-    catch {
-        // fall through to the full read
-    }
-    finally {
-        if (fd !== undefined)
-            closeSync(fd);
-    }
-    // Pathological: no chain entry in the tail window. Pay the full read.
-    return readChainTipFull(filepath);
-}
-/**
- * R1.2 · hook-process audit queue. The PreToolUse hook runs as its own
- * process (codehere scan-tool); its DECISION path is synchronous, so it can't
- * await the daemon there. Instead: the scan-tool command enables queue mode
- * at start, every append in the hook process queues instead of writing, and
- * the command FLUSHES before exit — each entry is offered to the daemon
- * (POST /api/audit/append, 250ms abort so a hung daemon can never stall the
- * user's tool call; connection-refused costs ~25ms in a fresh hook process —
- * undici's lazy init — and <2ms warm) and falls back to the direct append
- * marked writer:'hook-direct' (visible provenance, never silent). The abort
- * is CLIENT-side: the daemon may have written before a timeout fired, so the
- * fallback DEDUPES against the audit tail on (timestamp, sessionId, toolName)
- * — one tool call must never mint two audit rows (refuter-demonstrated).
- * Fail-open end to end per core value #5. Known durability delta: entries
- * sit in memory between append and flush; a kill mid-flush can lose one —
- * the old write-at-append path had no such window (accepted, bounded ≤2
- * entries). The daemon process never enables queue mode.
- */
-let hookQueueMode = false;
-const hookQueue = [];
-export function enableHookAuditQueue() {
-    hookQueueMode = true;
-}
-/** @internal test seam — inspect/clear the queue without flushing. */
-export function __testOnlyHookQueue() {
-    return hookQueue;
-}
-export async function flushHookAuditQueue(daemonUrl = 'http://127.0.0.1:3773') {
-    while (hookQueue.length > 0) {
-        const entry = hookQueue.shift();
-        let viaDaemon;
-        try {
-            const res = await fetch(daemonUrl + '/api/audit/append', {
-                method: 'POST',
-                headers: { 'content-type': 'application/json' },
-                // Declare which audit file this hook process is recording into. A
-                // daemon writing a DIFFERENT file (an isolated test, a second home)
-                // is not the right recorder for this entry — it 409s and we fall back
-                // direct, so routing can never silently divert entries to the wrong
-                // chain (caught by hook-e2e while a real daemon was live).
-                body: JSON.stringify({ ...entry, auditFile: AUDIT_FILE }),
-                signal: AbortSignal.timeout(250),
-            });
-            viaDaemon = res.ok;
-        }
-        catch {
-            viaDaemon = false; // daemon down / slow / refused — fall back, never throw
-        }
-        if (!viaDaemon) {
-            try {
-                if (!auditTailHas(entry)) {
-                    appendAuditLogDirect({ ...entry, writer: 'hook-direct' });
-                }
-            }
-            catch {
-                /* audit failure must never break the hook */
-            }
-        }
-    }
-}
-/** True if an entry with the same (timestamp, sessionId, toolName) is already
- *  in the audit tail — the daemon may have written it before a client-side
- *  abort/500. Scans the last 10 lines (same window as the daemon's confirm). */
-function auditTailHas(entry) {
-    try {
-        if (!existsSync(AUDIT_FILE))
-            return false;
-        const lines = readFileSync(AUDIT_FILE, 'utf-8').trim().split('\n');
-        for (let i = lines.length - 1; i >= 0 && i >= lines.length - 10; i--) {
-            try {
-                const e = JSON.parse(lines[i]);
-                if (e.timestamp === entry.timestamp && e.sessionId === entry.sessionId && e.toolName === entry.toolName) {
-                    return true;
-                }
-            }
-            catch {
-                /* skip malformed */
-            }
-        }
-    }
-    catch {
-        /* unreadable → treat as absent (the append itself is fail-open) */
-    }
-    return false;
-}
-export function appendAuditLog(entry) {
-    if (hookQueueMode) {
-        hookQueue.push(entry);
-        return;
-    }
-    appendAuditLogDirect(entry);
-}
-/** The direct writer — the DAEMON path uses this explicitly (it IS the sole
- *  writer; queue mode must never be able to defer it, even if both layers
- *  ever share a process — the embedded-server tests do exactly that). */
-export function appendAuditLogDirect(entry) {
-    // Cross-process file locking. Multiple Claude Code sessions (e.g., two
-    // terminals, or IDE + terminal) can trigger PreToolUse concurrently.
-    // Without a lock, two hook processes read the same chain tip and both
-    // write seq 43 — corrupting the hash chain. We use an exclusive-create
-    // lock file (+O_EXCL) which is atomic on all POSIX systems.
-    const LOCK_FILE = AUDIT_FILE + '.lock';
-    const lockAcquired = () => {
-        for (let attempt = 0; attempt < 20; attempt++) {
-            try {
-                const fd = openSync(LOCK_FILE, 'wx');
-                closeSync(fd);
-                return true;
-            }
-            catch {
-                // Lock held by another process — spin-wait ~10ms
-                const deadline = Date.now() + 10;
-                while (Date.now() < deadline) {
-                    /* busy-wait — sync context */
-                }
-            }
-        }
-        return false;
-    };
-    const lockReleased = () => {
-        try {
-            unlinkSync(LOCK_FILE);
-        }
-        catch {
-            /* best effort */
-        }
-    };
-    if (!lockAcquired()) {
-        // Fall through unlocked rather than drop the entry. The entry still
-        // appends; verification may flag a chain break, but the audit data
-        // is preserved.
-    }
-    try {
-        const dir = AUDIT_FILE.substring(0, AUDIT_FILE.lastIndexOf('/'));
-        if (dir && !existsSync(dir)) {
-            // mode 0o700 — owner-only directory. The audit log records every tool call
-            // including bash commands and file paths; on multi-user systems a default
-            // 0o755 dir would let other users walk in and read the file. Surfaced by
-            // the May 1 2026 /cso security audit (Finding #1, MEDIUM).
-            mkdirSync(dir, { recursive: true, mode: 0o700 });
-        }
-        // Compute chain fields. Read tip from file (cheap tail read). If no chain
-        // exists (fresh file, or last line is pre-chain legacy), start at genesis.
-        const tip = readChainTip(AUDIT_FILE);
-        const seq = tip ? tip.seq + 1 : 0;
-        const prevHash = tip ? tip.hash : GENESIS_PREV_HASH;
-        const chainedEntry = { ...entry, seq, prevHash };
-        chainedEntry.entryHash = computeEntryHash(chainedEntry);
-        // mode 0o600 — owner-only file. Same reasoning as the dir above. Only takes
-        // effect on first write (file creation); existing files are chmod'd below
-        // for backwards compatibility with audit logs created before this fix.
-        appendFileSync(AUDIT_FILE, JSON.stringify(chainedEntry) + '\n', { mode: 0o600 });
-        // Idempotent: if the file existed pre-fix with 0o644, tighten it now. The
-        // chmod is cheap and silent on already-0o600 files.
-        try {
-            chmodSync(AUDIT_FILE, 0o600);
-        }
-        catch {
-            /* fall through — chmod failure shouldn't block the audit append */
-        }
-    }
-    catch {
-        // Audit log failure must not block tool execution
-    }
-    finally {
-        lockReleased();
-    }
-}
-/**
- * Walk the audit file and verify the hash chain. Returns:
- *   - valid: true iff every chained entry's prevHash matches predecessor's
- *            entryHash, and every entry's entryHash matches recomputed value
- *   - totalEntries / chainedEntries / legacyEntries: line counts
- *   - errors: every detected break (verifier doesn't stop at first failure;
- *             reporter shows ALL tampering points so a forensic reviewer can
- *             see the full picture)
- *
- * Legacy preamble: pre-2026-05-06 entries (no seq/prevHash/entryHash) are
- * counted as legacyEntries and skipped. The chain starts at the FIRST entry
- * with seq=0 — every subsequent chained entry must continue from there.
- */
-export function verifyAuditChain(filepath = AUDIT_FILE) {
-    const result = {
-        valid: true,
-        totalEntries: 0,
-        chainedEntries: 0,
-        legacyEntries: 0,
-        writerMix: { daemon: 0, hookDirect: 0, unattributed: 0 },
-        errors: [],
-    };
-    if (!existsSync(filepath))
-        return result;
-    let content;
-    try {
-        content = readFileSync(filepath, 'utf-8');
-    }
-    catch {
-        // The log exists but can't be read — that is an unknown state, not "intact".
-        result.valid = false;
-        result.errors.push({ lineNumber: 0, reason: 'unreadable', detail: 'audit log exists but could not be read' });
-        return result;
-    }
-    const lines = content.split('\n');
-    let prevHash = null; // null until we hit the first chained entry
-    let prevSeq = null;
-    for (let i = 0; i < lines.length; i++) {
-        const raw = lines[i];
-        if (!raw.trim())
-            continue;
-        const lineNumber = i + 1;
-        result.totalEntries++;
-        let entry;
-        try {
-            entry = JSON.parse(raw);
-        }
-        catch {
-            result.valid = false;
-            result.errors.push({
-                lineNumber,
-                reason: 'parse_failure',
-                detail: 'JSON parse failed',
-            });
-            continue;
-        }
-        const hasChainFields = typeof entry.seq === 'number' && typeof entry.prevHash === 'string' && typeof entry.entryHash === 'string';
-        if (!hasChainFields) {
-            result.legacyEntries++;
-            continue;
-        }
-        result.chainedEntries++;
-        const w = entry.writer;
-        if (w === 'daemon')
-            result.writerMix.daemon++;
-        else if (w === 'hook-direct')
-            result.writerMix.hookDirect++;
-        else
-            result.writerMix.unattributed++;
-        // Recompute entryHash and check it matches what was stored
-        const recomputed = computeEntryHash(entry);
-        if (recomputed !== entry.entryHash) {
-            result.valid = false;
-            result.errors.push({
-                lineNumber,
-                seq: entry.seq,
-                reason: 'self_hash_mismatch',
-                detail: `entryHash field does not match recomputed hash; entry was modified after writing`,
-            });
-            // Continue checking — we still want to report the chain link below,
-            // but using the STORED hash so cascading errors are honest about the
-            // physical state of the file.
-        }
-        // Chain link check
-        if (prevHash === null) {
-            // First chained entry: must be genesis (seq=0, prevHash=64x0)
-            if (entry.seq !== 0 || entry.prevHash !== GENESIS_PREV_HASH) {
-                result.valid = false;
-                result.errors.push({
-                    lineNumber,
-                    seq: entry.seq,
-                    reason: 'genesis_violation',
-                    detail: `first chained entry must have seq=0 and prevHash=${GENESIS_PREV_HASH.slice(0, 8)}…; got seq=${entry.seq}, prevHash=${entry.prevHash?.slice(0, 8)}…`,
-                });
-            }
-        }
-        else {
-            if (entry.seq !== (prevSeq ?? -1) + 1) {
-                result.valid = false;
-                result.errors.push({
-                    lineNumber,
-                    seq: entry.seq,
-                    reason: 'seq_gap',
-                    detail: `expected seq=${(prevSeq ?? -1) + 1}, got seq=${entry.seq}`,
-                });
-            }
-            if (entry.prevHash !== prevHash) {
-                result.valid = false;
-                result.errors.push({
-                    lineNumber,
-                    seq: entry.seq,
-                    reason: 'hash_mismatch',
-                    detail: `prevHash=${entry.prevHash?.slice(0, 12)}… does not match predecessor entryHash=${prevHash.slice(0, 12)}…`,
-                });
-            }
-        }
-        // Move forward using the STORED entryHash. Even if recomputed mismatched,
-        // the next entry's prevHash was written against the stored value, so we
-        // chain on stored. The self-hash error above already flagged the breach.
-        prevHash = entry.entryHash;
-        prevSeq = entry.seq;
-    }
-    return result;
-}
-/**
- * Record a trust-override event in the audit log. Used when the scanner is
- * bypassed for any reason (stdin failure, parse failure, --log-only mode,
- * scan exception). Per CC frontier Q1 (auditable permission trails) — the
- * audit MUST capture bypasses, not just block/allow decisions, so a reviewer
- * can see EVERY case where the safety policy didn't run normally.
- *
- * Best-effort: never throws. The bypass already happened by the time we get
- * here; failure to write the audit just means the bypass is undocumented.
- *
- * Fields default to safe minimums: empty toolInput, zero risk, blocked=false
- * (because the tool DID run). Caller can override what it knows.
- */
-export function appendOverrideAudit(reason, partial = {}) {
-    const entry = {
-        timestamp: new Date().toISOString(),
-        sessionId: partial.sessionId ?? 'unknown',
-        toolName: partial.toolName ?? 'unknown',
-        toolInput: partial.toolInput ?? '',
-        riskScore: partial.riskScore ?? 0,
-        blocked: false, // override = scanner didn't block, regardless of what it would have decided
-        findings: partial.findings ?? 0,
-        criticalFindings: partial.criticalFindings ?? 0,
-        overrideReason: reason,
-    };
-    if (partial.note && partial.note.trim())
-        entry.overrideNote = partial.note.trim().slice(0, 500);
-    appendAuditLog(entry);
-}
-// ── Main hook handler ────────────────────────────────────────────────────────
-/**
- * Process a Claude Code hook event.
- * Called with the parsed stdin JSON from Claude Code's hook system.
- *
- * Returns:
- * - null: allow the tool call, print nothing
- * - HookDecision with decision:'block': reject the tool call
- */
-/**
- * Build a scan payload that is appropriate for the tool type.
- *
- * Bash / NotebookEdit: the command IS the executable — scan everything.
- *   Exception: commands that start with grep/rg/find/ag are search operations,
- *   not execution — strip the search term so pattern strings in args don't
- *   trigger the scanner.
- *
- * Write / Edit / MultiEdit: the content is DATA being written to disk, not
- *   a command being executed. Only scan the file path (destination) — that's
- *   enough to catch writes to sensitive files (~/.ssh/id_rsa, ~/.aws/credentials).
- *   Do NOT scan content: it produces false positives on legitimate source code
- *   that mentions attack-shaped strings (i18n with "system prompt", README docs
- *   describing what we block, LLM-prompt-engineering code, security tests).
- *   The Bash surface is the right place to catch prompt-injection / code-injection
- *   patterns; Edit-time content is data, not execution intent.
- */
-function buildScanPayload(toolName, toolInput) {
-    if (toolName === 'Bash') {
-        const cmd = String(toolInput.command ?? '');
-        // Search commands — only scan the binary name and flags, not the pattern argument.
-        // grep/rg/ag/find searching FOR dangerous strings is not dangerous.
-        if (/^\s*(grep|rg|ag|find|awk|sed)\s/.test(cmd)) {
-            const binary = cmd.match(/^\s*(\S+)/)?.[1] ?? cmd;
-            return JSON.stringify({ command: binary });
-        }
-        return JSON.stringify({ command: cmd });
-    }
-    if (toolName === 'Write') {
-        // Only scan the destination path — content is data, not a command
-        return JSON.stringify({ file_path: toolInput.file_path ?? '' });
-    }
-    if (toolName === 'Edit') {
-        // Same model as Write: scan only the destination. The old_string is
-        // EXISTING file content (data), not execution intent — scanning it
-        // produced false positives on legitimate edits to files containing
-        // attack-shaped strings (e.g. i18n.js with a "system prompt" key).
-        return JSON.stringify({ file_path: toolInput.file_path ?? '' });
-    }
-    if (toolName === 'MultiEdit') {
-        // Scan file paths only
-        const edits = Array.isArray(toolInput.edits) ? toolInput.edits : [];
-        return JSON.stringify({ file_paths: edits.map((e) => e.file_path ?? '') });
-    }
-    // Unknown tool — scan everything
-    return JSON.stringify(toolInput);
-}
-export function processHookEvent(event) {
-    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown' } = event;
-    // Only intercept PreToolUse events
-    if (hook_event_name !== 'PreToolUse') {
-        return null;
-    }
-    // Build context-appropriate scan payload (Bash = full, Write/Edit = path only)
-    const payload = buildScanPayload(tool_name, tool_input);
-    // Layer 0 scan — local, no API, ~2ms
-    const rawFindings = scanPayload(payload);
-    // P18 slice 2 — Tier 1 hook now honors per-cwd permissions.yaml.
-    // The hook subprocess inherits Claude Code's cwd when spawned, so
-    // process.cwd() points at the project root where .codehere/
-    // permissions.yaml would live. Allow-listed findings are dropped
-    // from the BLOCK calculation but still recorded in the audit entry
-    // so a forensic reviewer sees what was suppressed and why.
-    const cwd = process.cwd();
-    const { surviving: findings, allowed } = filterAllowed(rawFindings, cwd);
-    const riskScore = calculateRiskScore(findings);
-    const criticalFindings = findings.filter((f) => f.severity === 'critical');
-    // Blocking threshold: critical finding OR risk score too high
-    const blocked = criticalFindings.length > 0 || riskScore >= 60;
-    // Build audit entry — record what got allow-listed for the trail
-    const auditEntry = {
-        timestamp: new Date().toISOString(),
-        sessionId: session_id,
-        toolName: tool_name,
-        toolInput: payload.substring(0, 500), // truncate long inputs
-        riskScore,
-        blocked,
-        findings: findings.length,
-        criticalFindings: criticalFindings.length,
-    };
-    if (allowed.length > 0) {
-        // Add to the audit row's toolInput JSON so the audit feed can render
-        // "X findings allow-listed by permissions.yaml" badges later.
-        try {
-            const parsed = JSON.parse(auditEntry.toolInput);
-            parsed.allowedByPermissions = allowed.map((a) => ({
-                category: a.finding.category,
-                matched: a.finding.matched,
-                reason: a.entry.reason ?? '(no reason given)',
-            }));
-            auditEntry.toolInput = JSON.stringify(parsed).substring(0, 800);
-        }
-        catch {
-            // toolInput wasn't JSON (rare path); skip enrichment
-        }
-    }
-    appendAuditLog(auditEntry);
-    if (!blocked) {
-        return null; // allow
-    }
-    // Build human-readable block reason
-    const topFinding = criticalFindings[0] ?? findings[0];
-    const categoryVoice = {
-        'Prompt Injection': 'Caught a prompt injection attempt',
-        'Credential Theft': "Stopped — this looks like it's trying to access credentials",
-        Destructive: 'Stopped — this could delete or destroy data',
-        'Code Injection': 'Blocked — this pattern looks like code injection',
-        'Supply Chain': 'Blocked — suspicious package or dependency pattern',
-        OWASP: 'Blocked — security misconfiguration pattern',
-        'Data Exfiltration': "Blocked — this looks like it's trying to send data out",
-    };
-    const reason = topFinding
-        ? `[codehere] ${categoryVoice[topFinding.category] ?? 'Blocked'} — ${topFinding.description}. (matched: "${topFinding.matched}")`
-        : `[codehere] Blocked — risk score ${riskScore}/100 is too high to allow this through`;
-    return {
-        decision: 'block',
-        reason,
-    };
-}
-// ── Hook configuration generator ────────────────────────────────────────────
-/**
- * Returns the JSON config block to add to ~/.claude/settings.json
- * under the "hooks" key.
- */
-export function generateHookConfig(options = {}) {
-    const command = options.logOnly
-        ? 'codehere scan-tool --log-only'
-        : `codehere scan-tool${options.blockMode === 'all' ? ' --block-all' : ''}`;
-    // Cover every tool that can mutate the filesystem or run code.
-    // NotebookEdit added to catch Jupyter notebook writes.
-    const hook = { type: 'command', command };
-    return {
-        PreToolUse: [
-            { matcher: 'Bash', hooks: [hook] },
-            { matcher: 'Edit', hooks: [hook] },
-            { matcher: 'Write', hooks: [hook] },
-            { matcher: 'MultiEdit', hooks: [hook] },
-            { matcher: 'NotebookEdit', hooks: [hook] },
-        ],
-    };
-}
-//# sourceMappingURL=claude-sdk-hook.js.map