copyrun 0.0.0-stage → 0.2.0

package/dist/live.js

@@ -0,0 +1,298 @@
+#!/usr/bin/env node
+
+// src/live-hook.ts
+import { spawn } from "child_process";
+import { readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { basename, dirname, join as join2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/live-logic.ts
+import { createHash } from "crypto";
+var LIVE_STATE_FILE = "live.json";
+function gateHeaders(env) {
+  const h = {};
+  const prelaunch = env.COPYRUN_PRELAUNCH_KEY?.trim();
+  if (prelaunch) h["x-copyrun-prelaunch"] = prelaunch;
+  const beta = env.COPYRUN_BETA?.trim();
+  if (beta && beta.includes(":")) h["x-copyrun-beta"] = beta;
+  return h;
+}
+var liveId = (secret, sessionId) => createHash("sha256").update(`copyrun-live-v1:${secret}:${sessionId}`).digest("hex").slice(0, 24);
+var TEST_RE = /(^|[\s;&|])(npm|pnpm|yarn|bun)\s+(run\s+)?test\b|(^|[\s;&|])(vitest|jest|pytest|mocha|cargo test|go test|node --test|rspec|phpunit|mix test|dotnet test|gradle test|mvn test|make test)\b/;
+var FAILED_RE = /(\d+\s+(failed|failing)\b|FAIL\b|Tests:\s+\d+ failed|AssertionError|Traceback \(most recent call last\)|error TS\d+|npm ERR!)/;
+var EXT_RE = /\.([a-z0-9]{1,12})$/i;
+var str = (v) => typeof v === "string" ? v : void 0;
+function extOf(path) {
+  if (!path) return void 0;
+  const base = path.replace(/\\/g, "/").split("/").pop() ?? "";
+  const m = base.match(EXT_RE);
+  return m ? m[1].toLowerCase() : void 0;
+}
+function summarizeHook(input) {
+  if (input.hook_event_name === "Stop") return { kind: "stop" };
+  const name = input.tool_name;
+  if (!name) return void 0;
+  const ti = input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {};
+  const file = str(ti.file_path) ?? str(ti.notebook_path) ?? str(ti.path);
+  const ext = extOf(file);
+  switch (name) {
+    case "Read":
+      return { kind: "read", ...ext ? { ext } : {} };
+    case "Write":
+      return { kind: "write", ...ext ? { ext } : {} };
+    case "Edit":
+    case "MultiEdit":
+    case "NotebookEdit":
+      return { kind: "edit", ...ext ? { ext } : {} };
+    case "Bash": {
+      const command = str(ti.command) ?? "";
+      if (!TEST_RE.test(command)) return { kind: "bash" };
+      const out = testOutput(input.tool_response);
+      return { kind: "test", ...out === void 0 ? {} : { ok: !FAILED_RE.test(out) } };
+    }
+    case "Grep":
+    case "Glob":
+    case "LS":
+      return { kind: "search" };
+    case "WebFetch":
+    case "WebSearch":
+      return { kind: "web" };
+    case "Task":
+    case "Agent":
+      return { kind: "agent" };
+    case "Skill":
+      return { kind: "skill" };
+    default:
+      return { kind: "tool" };
+  }
+}
+function testOutput(resp) {
+  if (typeof resp === "string") return resp.slice(-4e3);
+  if (resp && typeof resp === "object") {
+    const r = resp;
+    if (r.interrupted === true) return "FAIL interrupted";
+    const parts = [str(r.stdout), str(r.stderr), str(r.output)].filter((s) => !!s);
+    if (parts.length) return parts.join("\n").slice(-4e3);
+  }
+  return void 0;
+}
+var streamMessage = (url) => `\u{1F534} Streaming this session's steps (kinds and extensions only) at ${url} \xB7 npx copyrun live off stops it`;
+function recordStep(state, sessionId, id, now, project) {
+  const sessions = { ...state.sessions ?? {} };
+  const cur = sessions[sessionId];
+  const first = !cur;
+  sessions[sessionId] = cur ? { ...cur, lastAt: now, steps: cur.steps + 1 } : { liveId: id, startedAt: now, lastAt: now, steps: 1, ...project ? { project } : {} };
+  const keep = Object.entries(sessions).sort((a, b) => b[1].lastAt.localeCompare(a[1].lastAt)).slice(0, 50);
+  return { state: { ...state, sessions: Object.fromEntries(keep) }, first };
+}
+
+// src/managed.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var GATED_CAPABILITIES = ["shell", "install", "network", "settings"];
+var SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
+var HANDLE = /^[a-z0-9][a-z0-9-]{0,38}$/;
+function parseManaged(v) {
+  const problems = [];
+  const config = {};
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { config, problems: ["not a JSON object"] };
+  const o = v;
+  const bool = (k) => {
+    if (o[k] === void 0) return;
+    if (typeof o[k] !== "boolean") problems.push(`${k} must be true or false`);
+    else config[k] = o[k];
+  };
+  if (o.apiHost !== void 0) {
+    try {
+      const u = new URL(String(o.apiHost));
+      const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+      if (u.protocol !== "https:" && !(local && u.protocol === "http:")) problems.push("apiHost must be an https URL");
+      else config.apiHost = u.origin;
+    } catch {
+      problems.push("apiHost must be a URL");
+    }
+  }
+  if (o.org !== void 0) {
+    const s = typeof o.org === "string" ? o.org.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("org must be an org slug");
+    else config.org = s;
+  }
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
+  if (o.autopilotOrg !== void 0) {
+    const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
+    else config.autopilotOrg = s;
+  }
+  if (o.autopilotContent !== void 0) {
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
+    else config.autopilotContent = o.autopilotContent;
+  }
+  if (o.allowedCloneSources !== void 0) {
+    const a = o.allowedCloneSources;
+    if (a === "any" || a === "org-playbook") config.allowedCloneSources = a;
+    else if (Array.isArray(a) && a.every((x) => typeof x === "string" && HANDLE.test(x.trim().replace(/^@/, "").toLowerCase())))
+      config.allowedCloneSources = [...new Set(a.map((x) => x.trim().replace(/^@/, "").toLowerCase()))];
+    else problems.push('allowedCloneSources must be "any", "org-playbook" or a list of handles and org slugs');
+  }
+  if (o.extraRedactTerms !== void 0) {
+    if (!Array.isArray(o.extraRedactTerms) || !o.extraRedactTerms.every((t) => typeof t === "string")) problems.push("extraRedactTerms must be a list of strings");
+    else config.extraRedactTerms = [...new Set(o.extraRedactTerms.map((t) => t.trim()).filter((t) => t.length >= 2 && t.length <= 100))].slice(0, 200);
+  }
+  if (o.profile !== void 0) {
+    if (o.profile !== "finance" && o.profile !== "hipaa") problems.push('profile must be "finance" or "hipaa"');
+    else config.profile = o.profile;
+  }
+  if (o.archive !== void 0) {
+    const a = o.archive;
+    const org = a && typeof a.org === "string" ? a.org.trim().toLowerCase() : "";
+    if (!a || typeof a !== "object" || !SLUG.test(org) || a.required !== void 0 && typeof a.required !== "boolean") problems.push("archive must be { org: <slug>, required: true|false }");
+    else config.archive = { org, required: a.required === true };
+  }
+  if (o.restrictOrgs !== void 0) {
+    const list = typeof o.restrictOrgs === "string" ? o.restrictOrgs.split(",") : o.restrictOrgs;
+    if (!Array.isArray(list) || !list.every((x) => typeof x === "string" && SLUG.test(x.trim().toLowerCase()))) problems.push("restrictOrgs must be a list of org slugs");
+    else config.restrictOrgs = [...new Set(list.map((x) => x.trim().toLowerCase()))];
+  }
+  if (o.restrictMode !== void 0) {
+    if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
+    else config.restrictMode = o.restrictMode;
+  }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
+  if (o.allowCloneYesWith !== void 0) {
+    const l = o.allowCloneYesWith;
+    if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
+    else config.allowCloneYesWith = [...new Set(l)];
+  }
+  return { config, problems };
+}
+function systemManagedPaths(platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return [
+      { path: "/Library/Application Support/copyrun/managed.json", kind: "json" },
+      // a configuration profile (Jamf, Kandji, Intune for Mac) lands here; it wins over the file
+      { path: "/Library/Managed Preferences/ai.copyrun.cli.plist", kind: "plist" }
+    ];
+  if (platform === "win32") return [{ path: join(env.ProgramData || env.PROGRAMDATA || "C:\\ProgramData", "copyrun", "managed.json"), kind: "json" }];
+  return [{ path: "/etc/copyrun/managed.json", kind: "json" }];
+}
+function plutil(p) {
+  try {
+    return execFileSync("/usr/bin/plutil", ["-convert", "json", "-o", "-", p], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+}
+function loadManaged(deps = {}) {
+  const env = deps.env ?? process.env;
+  const exists = deps.exists ?? existsSync;
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
+  const plist = deps.plistToJson ?? plutil;
+  const system = systemManagedPaths(deps.platform ?? process.platform, env).filter((f) => exists(f.path));
+  const files = system.length ? system : env.COPYRUN_MANAGED_CONFIG ? [{ path: env.COPYRUN_MANAGED_CONFIG, kind: "json" }] : [];
+  const state = { config: {}, sources: [], errors: [] };
+  for (const f of files) {
+    let text;
+    try {
+      text = f.kind === "plist" ? plist(f.path) : read(f.path);
+    } catch (e) {
+      state.errors.push(`${f.path}: can't be read (${e.message})`);
+      continue;
+    }
+    if (text === void 0) {
+      if (f.kind === "plist" && files.some((x) => x.kind === "json")) continue;
+      state.errors.push(`${f.path}: can't be read (plutil unavailable)`);
+      continue;
+    }
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      state.errors.push(`${f.path}: not valid JSON`);
+      continue;
+    }
+    const { config, problems } = parseManaged(json);
+    if (problems.length) state.errors.push(`${f.path}: ${problems.join("; ")}`);
+    state.config = { ...state.config, ...config };
+    state.sources.push(f.path);
+  }
+  if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
+  if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
+  return state;
+}
+var cached;
+function managed() {
+  return cached ??= loadManaged();
+}
+
+// src/live-hook.ts
+var DIR = dirname(fileURLToPath(import.meta.url));
+var SELF = fileURLToPath(import.meta.url);
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = "";
+    const t = setTimeout(() => resolve(data), 1500);
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (d) => {
+      data += d;
+      if (data.length > 1e6) process.stdin.destroy();
+    });
+    process.stdin.on("end", () => (clearTimeout(t), resolve(data)));
+    process.stdin.on("error", () => (clearTimeout(t), resolve(data)));
+  });
+}
+async function send(api, payload, headers) {
+  try {
+    const gate = headers ? JSON.parse(headers) : {};
+    await fetch(`${api}/api/v1/live`, { method: "POST", headers: { ...gate, "content-type": "application/json" }, body: payload, signal: AbortSignal.timeout(6e3) });
+  } catch {
+  }
+}
+async function main() {
+  if (process.argv[2] === "--send") return send(process.argv[3], process.argv[4], process.argv[5]);
+  const config = readJson(join2(DIR, "config.json"));
+  if (config?.live !== true || managed().config.disableLive) return;
+  const statePath = join2(DIR, LIVE_STATE_FILE);
+  const state = readJson(statePath) ?? {};
+  if (!state.secret || !state.api) return;
+  const input = JSON.parse(await readStdin());
+  if (!input.session_id) return;
+  const draft = summarizeHook(input);
+  if (!draft) return;
+  const id = liveId(state.secret, input.session_id);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const { state: next, first } = recordStep(state, input.session_id, id, now, input.cwd ? basename(input.cwd) : void 0);
+  const tmp = `${statePath}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(next), { mode: 384 });
+  renameSync(tmp, statePath);
+  const payload = JSON.stringify({ liveId: id, tool: "claude-code", kind: draft.kind, ...draft.ext ? { ext: draft.ext } : {}, ...draft.ok === void 0 ? {} : { ok: draft.ok } });
+  const gate = { ...state.gate, ...gateHeaders(process.env) };
+  const child = spawn(process.execPath, [SELF, "--send", state.api, payload, ...Object.keys(gate).length ? [JSON.stringify(gate)] : []], { detached: true, stdio: "ignore", windowsHide: true });
+  child.on("error", () => {
+  });
+  child.unref();
+  if (first) process.stdout.write(JSON.stringify({ systemMessage: streamMessage(`${state.api}/live/${id}`) }) + "\n");
+}
+main().catch(() => {
+}).finally(() => process.exit(0));