create-claude-cabinet 0.47.0 → 0.48.0

package/templates/engagement-server/server.mjs

@@ -102,6 +102,64 @@ function resolveExternalUser(engagementId, email, roleMapping) {
   return null;
 }
 
+// SECURITY (security-0003): pick EXACTLY ONE external engagement to forward a
+// bearer token to — NEVER fan out across tenants. Scope by the X-Engagement-Id
+// header; if it is absent, only a single-external-engagement deployment is
+// unambiguous. A header naming an unknown/non-external engagement gets no
+// fallback (returns null). Fanning the raw token out to every external
+// engagement's validate_url leaked tenant A's credential to tenant B's infra
+// and let an anonymous caller trigger N outbound HTTPS fetches.
+function selectExternalTarget(externals, requestedId) {
+  if (requestedId) return externals.find((e) => e.id === requestedId) || null;
+  if (externals.length === 1) return externals[0];
+  return null;
+}
+
+// Forward the token to ONE engagement's validate_url and resolve the user.
+// Returns the authenticated user object or null (never throws).
+async function validateTokenAgainstEngagement(eng, raw) {
+  try {
+    const config = JSON.parse(eng.auth_config);
+    if (!config.validate_url) return null;
+
+    const resp = await fetch(config.validate_url, {
+      headers: { 'Authorization': `Bearer ${raw}` },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!resp.ok) return null;
+
+    const identity = await resp.json();
+    const email = identity.email;
+    if (!email) return null;
+
+    // Map platform role to engagement role via role_mapping
+    const roleMapping = config.role_mapping || {};
+    const mappedRole = roleMapping[identity.role] || identity.role;
+
+    // Find matching local user by email for message attribution
+    const user = resolveExternalUser(eng.id, email, roleMapping);
+    if (user) return { ...user, auth_mode: 'external' };
+
+    // User authenticated with platform but no local user record —
+    // auto-create so messages are properly attributed
+    const userId = `usr_${randomBytes(6).toString('hex')}`;
+    const engRole = ['consultant', 'client'].includes(mappedRole) ? mappedRole : 'client';
+    db.prepare(`INSERT INTO users (id, engagement_id, name, email, role) VALUES (?, ?, ?, ?, ?)`)
+      .run(userId, eng.id, email.split('@')[0], email, engRole);
+
+    return {
+      user_id: userId,
+      engagement_id: eng.id,
+      role: engRole,
+      user_name: email.split('@')[0],
+      auth_mode: 'external',
+    };
+  } catch (err) {
+    console.error(`External auth failed for engagement ${eng.id}: ${err.message}`);
+    return null;
+  }
+}
+
 async function authenticateRequest(req) {
   const authHeader = req.headers['authorization'];
   if (!authHeader || !authHeader.startsWith('Bearer ')) return null;
@@ -112,47 +170,14 @@ async function authenticateRequest(req) {
   const localData = resolveLocalToken(hashToken(raw));
   if (localData && localData.auth_mode === 'local') return localData;
 
-  // Path 2: external auth — forward token to client app's validate_url
+  // Path 2: external auth — forward the token to a SINGLE client app's
+  // validate_url (never a cross-tenant fan-out; see selectExternalTarget).
   const externals = getExternalEngagements();
-  for (const eng of externals) {
-    try {
-      const config = JSON.parse(eng.auth_config);
-      if (!config.validate_url) continue;
-
-      const resp = await fetch(config.validate_url, {
-        headers: { 'Authorization': `Bearer ${raw}` },
-        signal: AbortSignal.timeout(5000),
-      });
-      if (!resp.ok) continue;
-
-      const identity = await resp.json();
-      const email = identity.email;
-      if (!email) continue;
-
-      // Map platform role to engagement role via role_mapping
-      const roleMapping = config.role_mapping || {};
-      const mappedRole = roleMapping[identity.role] || identity.role;
-
-      // Find matching local user by email for message attribution
-      const user = resolveExternalUser(eng.id, email, roleMapping);
-      if (user) return { ...user, auth_mode: 'external' };
-
-      // User authenticated with platform but no local user record —
-      // auto-create so messages are properly attributed
-      const userId = `usr_${randomBytes(6).toString('hex')}`;
-      const engRole = ['consultant', 'client'].includes(mappedRole) ? mappedRole : 'client';
-      db.prepare(`INSERT INTO users (id, engagement_id, name, email, role) VALUES (?, ?, ?, ?, ?)`)
-        .run(userId, eng.id, email.split('@')[0], email, engRole);
-
-      return {
-        user_id: userId,
-        engagement_id: eng.id,
-        role: engRole,
-        user_name: email.split('@')[0],
-        auth_mode: 'external',
-      };
-    } catch (err) {
-      console.error(`External auth failed for engagement ${eng.id}: ${err.message}`);
+  if (externals.length > 0) {
+    const target = selectExternalTarget(externals, req.headers['x-engagement-id']);
+    if (target) {
+      const authed = await validateTokenAgainstEngagement(target, raw);
+      if (authed) return authed;
     }
   }
 

package/templates/hooks/action-completion-gate.sh

@@ -14,6 +14,16 @@
 # (the pib_complete_action args) is under `tool_input` (fall back to
 # top-level for older payload shapes).
 INPUT=$(cat)
+
+# Fired-at-least-once telemetry (act:ff693d4c). Record that this gate's matcher
+# actually matched and the hook ran — a dead matcher (the bare
+# `pib_complete_action` spelling that never matched the real
+# `mcp__pib-db__pib_complete_action` MCP tool name) leaves this file empty
+# forever. Env-overridable for tests; fail-open so telemetry never breaks the gate.
+FIRED_LOG="${CC_HOOK_FIRED_LOG:-${CLAUDE_PROJECT_DIR:-.}/.claude/state/hooks-fired.jsonl}"
+mkdir -p "$(dirname "$FIRED_LOG")" 2>/dev/null \
+  && printf '{"hook":"action-completion-gate","fired_at":"%s"}\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$FIRED_LOG" 2>/dev/null || true
+
 FID=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); ti=d.get('tool_input', d); print(ti.get('fid',''))" 2>/dev/null)
 
 if [ -z "$FID" ]; then

package/templates/hooks/action-quality-gate.sh

@@ -17,6 +17,16 @@
 # top-level for older payload shapes). stdin is read ONCE — reuse $INPUT.
 INPUT=$(cat)
 
+# Fired-at-least-once telemetry (act:ff693d4c). Record that this gate's matcher
+# actually matched and the hook ran. A dead matcher (the bare `pib_create_action`
+# spelling that never matched the real `mcp__pib-db__pib_create_action` MCP tool
+# name) leaves this file empty forever — which is what let this gate stay
+# silently dead since it shipped. Env-overridable for tests; fail-open so
+# telemetry can never break the gate.
+FIRED_LOG="${CC_HOOK_FIRED_LOG:-${CLAUDE_PROJECT_DIR:-.}/.claude/state/hooks-fired.jsonl}"
+mkdir -p "$(dirname "$FIRED_LOG")" 2>/dev/null \
+  && printf '{"hook":"action-quality-gate","fired_at":"%s"}\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$FIRED_LOG" 2>/dev/null || true
+
 NOTES=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); ti=d.get('tool_input', d); print(ti.get('notes',''))" 2>/dev/null)
 TEXT=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); ti=d.get('tool_input', d); print(ti.get('text',''))" 2>/dev/null)
 

package/templates/hooks/skill-telemetry.sh

@@ -46,13 +46,18 @@ if [[ "$PROMPT" =~ ^/([a-z-]+) ]]; then
     for skill in $SKILLS; do
         if [[ "$COMMAND" == "$skill" ]]; then
             TIMESTAMP=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-            python3 -c "
-import json
+            # SECURITY (security-0004): env-pass values; never interpolate hook
+            # payload fields into the python3 -c source (same class as
+            # skill-tool-telemetry.sh). COMMAND is regex-constrained to [a-z-]+
+            # here, but session_id is passed through raw — os.environ keeps both
+            # inert.
+            SKILL="$COMMAND" SESSION_ID="$SESSION_ID" TIMESTAMP="$TIMESTAMP" python3 -c "
+import json, os
 record = {
-    'ts': '$TIMESTAMP',
+    'ts': os.environ['TIMESTAMP'],
     'event': 'skill-invoke',
-    'skill': '$COMMAND',
-    'session_id': '$SESSION_ID'
+    'skill': os.environ['SKILL'],
+    'session_id': os.environ['SESSION_ID'],
 }
 print(json.dumps(record))
 " >> "$TELEMETRY_FILE"

package/templates/hooks/skill-tool-telemetry.sh

@@ -37,14 +37,20 @@ except:
 
 if [[ -n "$SKILL" ]]; then
     TIMESTAMP=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-    python3 -c "
-import json
+    # SECURITY (security-0004): pass values via ENV, never concatenate hook
+    # payload fields into the python3 -c source. Interpolating '$SKILL' into the
+    # program let a skill value with a quote/newline (model-composed from
+    # tool_input.skill, reachable via prompt injection) break out of the string
+    # literal and execute arbitrary Python — command execution in a PostToolUse
+    # hook. os.environ reads them as inert data.
+    SKILL="$SKILL" SESSION_ID="$SESSION_ID" TIMESTAMP="$TIMESTAMP" python3 -c "
+import json, os
 record = {
-    'ts': '$TIMESTAMP',
+    'ts': os.environ['TIMESTAMP'],
     'event': 'skill-invoke',
-    'skill': '$SKILL',
+    'skill': os.environ['SKILL'],
     'source': 'tool',
-    'session_id': '$SESSION_ID'
+    'session_id': os.environ['SESSION_ID'],
 }
 print(json.dumps(record))
 " >> "$TELEMETRY_FILE"

package/templates/mcp/pib-db.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "pib-db": {
       "command": "node",
-      "args": ["scripts/pib-db-mcp-server.mjs"]
+      "args": ["${CLAUDE_PROJECT_DIR:-.}/scripts/pib-db-mcp-server.mjs"]
     }
   }
 }

package/templates/rules/enforcement-pipeline.md

@@ -141,15 +141,3 @@ The audit skill's triage history tracks which findings recur. The
 enforcement pipeline's pattern files track which recurring findings are
 ready for promotion. Together, they create a feedback loop from
 observation to prevention.
-
-## Current State
-
-<!--
-Track your project's enforcement pipeline state here:
-
-- **N pattern files** in memory/patterns/
-- **N raw observations** in memory/archive/ (or wherever you store them)
-- **N rules files** in .claude/rules/
-- **N hooks** in .claude/settings.json
-- **N promotion candidates** identified
--->

package/templates/scripts/__tests__/api-usage-idle-gate.test.mjs

@@ -0,0 +1,81 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import {
+  recordApiUsage, readApiUsageRecords, summarizeApiUsage, API_PRICING,
+  computeActivitySignature, shouldRunIdlePass, markIdlePassRan, RING2_IDLE_FLOOR_MS,
+} from '../watchtower-lib.mjs';
+
+function tmpWt() { return mkdtempSync(join(tmpdir(), 'wt-usage-')); }
+
+test('summarizeApiUsage: totals + $ estimate + window filter', () => {
+  const now = new Date('2026-07-12T12:00:00Z').getTime();
+  const recs = [
+    { ts: '2026-07-12T11:00:00Z', ring: 'ring3', model: 'claude-sonnet-4-6', input_tokens: 1_000_000, output_tokens: 100_000 },
+    { ts: '2026-07-12T11:30:00Z', ring: 'ring2', model: 'claude-sonnet-4-6', input_tokens: 500_000, output_tokens: 10_000 },
+    { ts: '2026-07-01T00:00:00Z', ring: 'ring2', model: 'claude-sonnet-4-6', input_tokens: 9_999_999, output_tokens: 9_999_999 }, // outside 1d window
+  ];
+  const s = summarizeApiUsage(recs, { nowMs: now, windowDays: 1 });
+  assert.equal(s.calls, 2, 'old record excluded by window');
+  assert.equal(s.input_tokens, 1_500_000);
+  assert.equal(s.output_tokens, 110_000);
+  // ring3: 1M*$3 + 100k*$15 = $3 + $1.5 = $4.50 ; ring2: 500k*$3 + 10k*$15 = $1.5 + $0.15 = $1.65
+  assert.equal(s.est_cost_usd, 6.15);
+  assert.equal(s.by_ring.ring3, 4.5);
+  assert.equal(s.by_ring.ring2, 1.65);
+});
+
+test('summarizeApiUsage: empty + unknown model falls back to sonnet pricing', () => {
+  assert.equal(summarizeApiUsage([]).calls, 0);
+  const s = summarizeApiUsage([{ ts: new Date().toISOString(), model: 'mystery', input_tokens: 1_000_000, output_tokens: 0 }], { windowDays: 3650 });
+  assert.equal(s.est_cost_usd, 3, 'unknown model priced as sonnet-4-6 ($3/M in)');
+});
+
+test('recordApiUsage → readApiUsageRecords round-trips, fail-open on bad dir', () => {
+  const wt = tmpWt();
+  try {
+    recordApiUsage({ ring: 'ring3', model: 'claude-sonnet-4-6', usage: { input_tokens: 42, output_tokens: 7 } }, { watchtowerDir: wt });
+    const recs = readApiUsageRecords(wt);
+    assert.equal(recs.length, 1);
+    assert.equal(recs[0].input_tokens, 42);
+    assert.equal(recs[0].ring, 'ring3');
+    // fail-open: a nonsense dir must not throw
+    assert.doesNotThrow(() => recordApiUsage({ usage: {} }, { watchtowerDir: '/nonexistent/\0/x' }));
+  } finally { rmSync(wt, { recursive: true, force: true }); }
+});
+
+test('shouldRunIdlePass: first-run runs; unchanged+in-floor skips; changed runs; floor elapsed runs', () => {
+  const wt = tmpWt();
+  try {
+    const t0 = 1_000_000_000_000;
+    // never ran → run
+    assert.equal(shouldRunIdlePass('p', { watchtowerDir: wt, signature: 'A', nowMs: t0 }).run, true);
+    markIdlePassRan('p', { watchtowerDir: wt, signature: 'A', nowMs: t0 });
+    // same signature, within floor → skip
+    const g1 = shouldRunIdlePass('p', { watchtowerDir: wt, signature: 'A', nowMs: t0 + 60_000 });
+    assert.equal(g1.run, false);
+    assert.equal(g1.reason, 'idle-skip');
+    // changed signature → run
+    assert.equal(shouldRunIdlePass('p', { watchtowerDir: wt, signature: 'B', nowMs: t0 + 60_000 }).reason, 'activity');
+    // floor elapsed → run
+    const g3 = shouldRunIdlePass('p', { watchtowerDir: wt, signature: 'A', nowMs: t0 + RING2_IDLE_FLOOR_MS + 1 });
+    assert.equal(g3.run, true);
+    assert.equal(g3.reason, 'idle-floor');
+  } finally { rmSync(wt, { recursive: true, force: true }); }
+});
+
+test('computeActivitySignature: stable when nothing changes, reflects ring3-health', () => {
+  const wt = tmpWt();
+  try {
+    const s1 = computeActivitySignature(wt); // no files → empty-ish, must not throw
+    assert.equal(typeof s1, 'string');
+    // writing a ring3-health changes the signature
+    mkdirSync(join(wt, 'state'), { recursive: true });
+    writeFileSync(join(wt, 'state', 'ring3-health.json'), JSON.stringify({ last_run: '2026-07-12T00:00:00Z', session_id: 'abc' }));
+    const s2 = computeActivitySignature(wt);
+    assert.notEqual(s1, s2);
+    assert.equal(computeActivitySignature(wt), s2, 'stable when unchanged');
+  } finally { rmSync(wt, { recursive: true, force: true }); }
+});

package/templates/scripts/__tests__/bsql-loader-verify.test.mjs

@@ -0,0 +1,47 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { loadBetterSqlite3, verifyDatabaseConstructor } from '../watchtower-lib.mjs';
+
+// better-sqlite3 loads its native addon lazily at the first `new Database()`,
+// not at require() — so a candidate that resolves to an ABI-mismatched copy
+// (e.g. a stray ~/node_modules install built under a different node) passes a
+// bare require and then explodes in the caller. verifyDatabaseConstructor
+// forces the addon load inside the loader's per-candidate try so the
+// candidate chain falls through instead (act:b9414039).
+
+test('verifyDatabaseConstructor throws when construction throws (ABI-mismatch shape)', () => {
+  class Broken {
+    constructor() {
+      throw new Error(
+        "The module 'better_sqlite3.node' was compiled against a different Node.js version"
+      );
+    }
+  }
+  assert.throws(() => verifyDatabaseConstructor(Broken), /different Node\.js version/);
+});
+
+test('verifyDatabaseConstructor returns the constructor when construction works', () => {
+  const opened = [];
+  class Working {
+    constructor(name) { opened.push(name); }
+    close() { opened.pop(); }
+  }
+  const result = verifyDatabaseConstructor(Working);
+  assert.equal(result, Working);
+  // The throwaway :memory: db was opened and closed, not leaked.
+  assert.deepEqual(opened, []);
+});
+
+test('loadBetterSqlite3 returns a verified, working constructor in this repo', () => {
+  const Database = loadBetterSqlite3(process.cwd());
+  assert.ok(Database, 'expected a candidate to resolve (repo node_modules has better-sqlite3)');
+  const db = new Database(':memory:');
+  try {
+    db.exec('CREATE TABLE t (id INTEGER PRIMARY KEY, v TEXT)');
+    db.prepare('INSERT INTO t (v) VALUES (?)').run('ok');
+    assert.equal(db.prepare('SELECT v FROM t').get().v, 'ok');
+  } finally {
+    db.close();
+  }
+});