evolcore 0.0.24 → 0.0.25

package/bin/codex-managed-hook.mjs

@@ -1,212 +1,212 @@
-import fs from 'node:fs';
-import net from 'node:net';
-import os from 'node:os';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-
-const startedAt = Date.now();
-const runId = randomUUID();
-let logPath;
-let logFailed = false;
-let context = {};
-
-// This file is also copied into the Linux runtime; keep diagnostics self-contained.
-function diagnostic(event, details = {}) {
-  if (process.env.EVOLCORE_CODEX_HOOK_LOG === '0' || logFailed) return;
-  try {
-    if (!logPath) {
-      logPath = path.resolve(process.env.EVOLCORE_CODEX_HOOK_LOG
-        || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'log', 'evolcore-hook.jsonl'));
-      fs.mkdirSync(path.dirname(logPath), { recursive: true, mode: 0o700 });
-      // Rotation is best-effort when concurrent tool calls start together.
-      try {
-        if (fs.statSync(logPath).size >= 2 * 1024 * 1024) fs.renameSync(logPath, `${logPath}.1`);
-      } catch {}
-    }
-    fs.appendFileSync(logPath, JSON.stringify({
-      time: new Date().toISOString(), runId, pid: process.pid,
-      elapsedMs: Date.now() - startedAt, event, ...context, ...details,
-    }) + '\n', { mode: 0o600 });
-  } catch (error) {
-    logFailed = true;
-    process.stderr.write(`[evolcore] Hook diagnostic log unavailable (${error?.code || 'unknown'}): ${logPath || '(unresolved)'}\n`);
-  }
-}
-
-function errorDetails(error) {
-  // JSON parser messages and policy reasons can contain tool input. Omit them.
-  return {
-    errorName: error?.name,
-    errorCode: error?.code,
-    syscall: error?.syscall,
-    frames: typeof error?.stack === 'string'
-      ? error.stack.split('\n').filter(line => /^\s+at /.test(line)).slice(0, 6) : undefined,
-  };
-}
-
-process.on('uncaughtExceptionMonitor', error => diagnostic('uncaught_exception', errorDetails(error)));
-process.on('exit', code => diagnostic('exit', { exitCode: code }));
-diagnostic('start', {
-  nodeVersion: process.version, execPath: process.execPath, entrypoint: process.argv[1],
-  argumentCount: Math.max(0, process.argv.length - 2),
-  socketArgumentPresent: Boolean(process.argv[2]),
-  socketEnvironmentPresent: Boolean(process.env.EVOLCORE_INSTANCE_SOCKET),
-  socketArgumentUnexpanded: /^%EVOLCORE_INSTANCE_SOCKET%$/i.test(process.argv[2] || ''),
-  socketSource: process.argv[2] ? 'argument' : process.env.EVOLCORE_INSTANCE_SOCKET ? 'environment' : 'missing',
-});
-
-// Only bound socket establishment. Once connected, the official Codex hook
-// timeout owns the lifetime of this process; an application timeout here would
-// turn /pause into a denial/allow race.
-const connectTimeoutMs = 1500;
-
-function deny(reason, category) {
-  diagnostic('decision', { decision: 'deny', category });
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
-    },
-  }));
-  // Exit 2 is the documented blocking transport. Keep the structured JSON as
-  // well so Codex can surface the policy reason through the PreToolUse result.
-  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
-  process.exitCode = 2;
-}
-
-function queryDaemon(socketPath, payload) {
-  diagnostic('connect_start', { timeoutMs: connectTimeoutMs });
-  return new Promise(resolve => {
-    const socket = net.createConnection(socketPath);
-    let buffer = '';
-    let settled = false;
-    let timer;
-    let connected = false;
-    const finish = value => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      socket.destroy();
-      resolve(value);
-    };
-    timer = setTimeout(() => {
-      if (!connected) {
-        diagnostic('connect_timeout');
-        finish(null);
-      }
-    }, connectTimeoutMs);
-    timer.unref?.();
-    socket.once('error', error => {
-      diagnostic('socket_error', { connected, ...errorDetails(error) });
-      finish(null);
-    });
-    socket.once('close', () => {
-      if (!settled) diagnostic('socket_closed_without_response', { connected, responseBytes: Buffer.byteLength(buffer) });
-    });
-    socket.once('connect', () => {
-      connected = true;
-      clearTimeout(timer);
-      diagnostic('connected');
-      socket.write(JSON.stringify(payload) + '\n');
-    });
-    socket.on('data', chunk => {
-      buffer += String(chunk);
-      const index = buffer.indexOf('\n');
-      if (index < 0) return;
-      try {
-        const result = JSON.parse(buffer.slice(0, index));
-        diagnostic('response', {
-          ok: result?.ok === true, applicable: result?.applicable === true,
-          decision: ['allow', 'deny'].includes(result?.decision) ? result.decision : 'other',
-          reasonPresent: typeof result?.reason === 'string',
-        });
-        finish(result);
-      } catch (error) {
-        diagnostic('invalid_response', { responseBytes: Buffer.byteLength(buffer), ...errorDetails(error) });
-        finish(null);
-      }
-    });
-  });
-}
-
-// The Windows managed requirements are machine-wide, so unmanaged Codex
-// processes also reach this hook. EvolCore-owned threads carry a per-thread
-// credential (EVOLCORE_CODEX_SESSION_TOKEN, injected through the thread's
-// shell environment policy); unmanaged ones do not. Unmanaged calls are
-// allowed outright and never contact the daemon — EvolCore being stopped must
-// not break a standalone Codex. Credentialed calls always require an explicit
-// daemon allow: a credential without its daemon is an orphaned managed thread
-// and fails closed.
-async function main() {
-  // Windows managed requirements use one machine-wide command. Resolve the
-  // per-daemon named pipe from the inherited environment so multiple EvolCore
-  // homes can share the installed hook without rewriting requirements.toml.
-  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
-  let input;
-  try {
-    input = JSON.parse(fs.readFileSync(0, 'utf8'));
-  } catch (error) {
-    diagnostic('invalid_input', errorDetails(error));
-    deny('Invalid Codex PreToolUse payload.', 'invalid_input');
-    return;
-  }
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const startedAt = Date.now();
+const runId = randomUUID();
+let logPath;
+let logFailed = false;
+let context = {};
+
+// This file is also copied into the Linux runtime; keep diagnostics self-contained.
+function diagnostic(event, details = {}) {
+  if (process.env.EVOLCORE_CODEX_HOOK_LOG === '0' || logFailed) return;
+  try {
+    if (!logPath) {
+      logPath = path.resolve(process.env.EVOLCORE_CODEX_HOOK_LOG
+        || path.join(process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), 'log', 'evolcore-hook.jsonl'));
+      fs.mkdirSync(path.dirname(logPath), { recursive: true, mode: 0o700 });
+      // Rotation is best-effort when concurrent tool calls start together.
+      try {
+        if (fs.statSync(logPath).size >= 2 * 1024 * 1024) fs.renameSync(logPath, `${logPath}.1`);
+      } catch {}
+    }
+    fs.appendFileSync(logPath, JSON.stringify({
+      time: new Date().toISOString(), runId, pid: process.pid,
+      elapsedMs: Date.now() - startedAt, event, ...context, ...details,
+    }) + '\n', { mode: 0o600 });
+  } catch (error) {
+    logFailed = true;
+    process.stderr.write(`[evolcore] Hook diagnostic log unavailable (${error?.code || 'unknown'}): ${logPath || '(unresolved)'}\n`);
+  }
+}
+
+function errorDetails(error) {
+  // JSON parser messages and policy reasons can contain tool input. Omit them.
+  return {
+    errorName: error?.name,
+    errorCode: error?.code,
+    syscall: error?.syscall,
+    frames: typeof error?.stack === 'string'
+      ? error.stack.split('\n').filter(line => /^\s+at /.test(line)).slice(0, 6) : undefined,
+  };
+}
+
+process.on('uncaughtExceptionMonitor', error => diagnostic('uncaught_exception', errorDetails(error)));
+process.on('exit', code => diagnostic('exit', { exitCode: code }));
+diagnostic('start', {
+  nodeVersion: process.version, execPath: process.execPath, entrypoint: process.argv[1],
+  argumentCount: Math.max(0, process.argv.length - 2),
+  socketArgumentPresent: Boolean(process.argv[2]),
+  socketEnvironmentPresent: Boolean(process.env.EVOLCORE_INSTANCE_SOCKET),
+  socketArgumentUnexpanded: /^%EVOLCORE_INSTANCE_SOCKET%$/i.test(process.argv[2] || ''),
+  socketSource: process.argv[2] ? 'argument' : process.env.EVOLCORE_INSTANCE_SOCKET ? 'environment' : 'missing',
+});
+
+// Only bound socket establishment. Once connected, the official Codex hook
+// timeout owns the lifetime of this process; an application timeout here would
+// turn /pause into a denial/allow race.
+const connectTimeoutMs = 1500;
+
+function deny(reason, category) {
+  diagnostic('decision', { decision: 'deny', category });
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason || 'EvolCore policy denied this tool call.',
+    },
+  }));
+  // Exit 2 is the documented blocking transport. Keep the structured JSON as
+  // well so Codex can surface the policy reason through the PreToolUse result.
+  process.stderr.write(`${reason || 'EvolCore policy denied this tool call.'}\n`);
+  process.exitCode = 2;
+}
+
+function queryDaemon(socketPath, payload) {
+  diagnostic('connect_start', { timeoutMs: connectTimeoutMs });
+  return new Promise(resolve => {
+    const socket = net.createConnection(socketPath);
+    let buffer = '';
+    let settled = false;
+    let timer;
+    let connected = false;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    timer = setTimeout(() => {
+      if (!connected) {
+        diagnostic('connect_timeout');
+        finish(null);
+      }
+    }, connectTimeoutMs);
+    timer.unref?.();
+    socket.once('error', error => {
+      diagnostic('socket_error', { connected, ...errorDetails(error) });
+      finish(null);
+    });
+    socket.once('close', () => {
+      if (!settled) diagnostic('socket_closed_without_response', { connected, responseBytes: Buffer.byteLength(buffer) });
+    });
+    socket.once('connect', () => {
+      connected = true;
+      clearTimeout(timer);
+      diagnostic('connected');
+      socket.write(JSON.stringify(payload) + '\n');
+    });
+    socket.on('data', chunk => {
+      buffer += String(chunk);
+      const index = buffer.indexOf('\n');
+      if (index < 0) return;
+      try {
+        const result = JSON.parse(buffer.slice(0, index));
+        diagnostic('response', {
+          ok: result?.ok === true, applicable: result?.applicable === true,
+          decision: ['allow', 'deny'].includes(result?.decision) ? result.decision : 'other',
+          reasonPresent: typeof result?.reason === 'string',
+        });
+        finish(result);
+      } catch (error) {
+        diagnostic('invalid_response', { responseBytes: Buffer.byteLength(buffer), ...errorDetails(error) });
+        finish(null);
+      }
+    });
+  });
+}
+
+// The Windows managed requirements are machine-wide, so unmanaged Codex
+// processes also reach this hook. EvolCore-owned threads carry a per-thread
+// credential (EVOLCORE_CODEX_SESSION_TOKEN, injected through the thread's
+// shell environment policy); unmanaged ones do not. Unmanaged calls are
+// allowed outright and never contact the daemon — EvolCore being stopped must
+// not break a standalone Codex. Credentialed calls always require an explicit
+// daemon allow: a credential without its daemon is an orphaned managed thread
+// and fails closed.
+async function main() {
+  // Windows managed requirements use one machine-wide command. Resolve the
+  // per-daemon named pipe from the inherited environment so multiple EvolCore
+  // homes can share the installed hook without rewriting requirements.toml.
+  const socketPath = process.argv[2] || process.env.EVOLCORE_INSTANCE_SOCKET;
+  let input;
+  try {
+    input = JSON.parse(fs.readFileSync(0, 'utf8'));
+  } catch (error) {
+    diagnostic('invalid_input', errorDetails(error));
+    deny('Invalid Codex PreToolUse payload.', 'invalid_input');
+    return;
+  }
   context = {
-    sessionId: typeof input?.session_id === 'string' ? input.session_id.slice(0, 128) : undefined,
-    toolName: typeof input?.tool_name === 'string' ? input.tool_name.slice(0, 128) : undefined,
-    callId: typeof (input?.tool_use_id ?? input?.toolUseId ?? input?.item_id ?? input?.itemId) === 'string'
-      ? (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId).slice(0, 128) : undefined,
-  };
-  diagnostic('input', {
-    preToolUse: input?.hook_event_name === 'PreToolUse',
-    sessionIdPresent: typeof input?.session_id === 'string' && Boolean(input.session_id),
-    toolNamePresent: typeof input?.tool_name === 'string' && Boolean(input.tool_name),
-    toolInputPresent: input?.tool_input !== undefined,
-  });
+    sessionId: typeof input?.session_id === 'string' ? input.session_id.slice(0, 128) : undefined,
+    toolName: typeof input?.tool_name === 'string' ? input.tool_name.slice(0, 128) : undefined,
+    callId: typeof (input?.tool_use_id ?? input?.toolUseId ?? input?.item_id ?? input?.itemId) === 'string'
+      ? (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId).slice(0, 128) : undefined,
+  };
+  diagnostic('input', {
+    preToolUse: input?.hook_event_name === 'PreToolUse',
+    sessionIdPresent: typeof input?.session_id === 'string' && Boolean(input.session_id),
+    toolNamePresent: typeof input?.tool_name === 'string' && Boolean(input.tool_name),
+    toolInputPresent: input?.tool_input !== undefined,
+  });
   if (!socketPath
     || input?.hook_event_name !== 'PreToolUse'
     || typeof input?.session_id !== 'string'
-    || !input.session_id
-    || typeof input?.tool_name !== 'string'
-    || !input.tool_name) {
-    deny('Incomplete Codex PreToolUse payload.', 'incomplete_input');
-    return;
-  }
-
-  const sessionToken = typeof process.env.EVOLCORE_CODEX_SESSION_TOKEN === 'string'
-    && process.env.EVOLCORE_CODEX_SESSION_TOKEN
-    ? process.env.EVOLCORE_CODEX_SESSION_TOKEN
-    : undefined;
-
-  if (!sessionToken) {
-    // Unmanaged process: nothing to enforce, and no reason to pay the daemon
-    // round-trip (or its outage) for a call we would allow anyway.
-    return;
-  }
-  if (!socketPath) {
-    deny('EvolCore session credential is present but the policy service address is missing.');
-    return;
-  }
-
-  const result = await queryDaemon(socketPath, {
-    type: 'codex-pre-tool-use',
-    threadId: input.session_id,
-    toolName: input.tool_name,
-    toolInput: input.tool_input ?? null,
-    sessionToken,
-    ...(typeof (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId) === 'string'
-      ? { callId: input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId }
-      : {}),
-  });
-  if (!result) {
-    deny('EvolCore policy service is unavailable.', 'service_unavailable');
-    return;
-  }
-  if (result.ok === true && result.applicable === true && result.decision === 'allow') {
-    diagnostic('decision', { decision: 'allow' });
-    return;
-  }
-  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.', 'policy_denied');
-}
-
-void main();
+    || !input.session_id
+    || typeof input?.tool_name !== 'string'
+    || !input.tool_name) {
+    deny('Incomplete Codex PreToolUse payload.', 'incomplete_input');
+    return;
+  }
+
+  const sessionToken = typeof process.env.EVOLCORE_CODEX_SESSION_TOKEN === 'string'
+    && process.env.EVOLCORE_CODEX_SESSION_TOKEN
+    ? process.env.EVOLCORE_CODEX_SESSION_TOKEN
+    : undefined;
+
+  if (!sessionToken) {
+    // Unmanaged process: nothing to enforce, and no reason to pay the daemon
+    // round-trip (or its outage) for a call we would allow anyway.
+    return;
+  }
+  if (!socketPath) {
+    deny('EvolCore session credential is present but the policy service address is missing.');
+    return;
+  }
+
+  const result = await queryDaemon(socketPath, {
+    type: 'codex-pre-tool-use',
+    threadId: input.session_id,
+    toolName: input.tool_name,
+    toolInput: input.tool_input ?? null,
+    sessionToken,
+    ...(typeof (input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId) === 'string'
+      ? { callId: input.tool_use_id ?? input.toolUseId ?? input.item_id ?? input.itemId }
+      : {}),
+  });
+  if (!result) {
+    deny('EvolCore policy service is unavailable.', 'service_unavailable');
+    return;
+  }
+  if (result.ok === true && result.applicable === true && result.decision === 'allow') {
+    diagnostic('decision', { decision: 'allow' });
+    return;
+  }
+  deny(result.reason || 'EvolCore policy did not explicitly allow this tool call.', 'policy_denied');
+}
+
+void main();