failproofai 0.0.6-beta.3 → 0.0.6-beta.4

package/.next/standalone/src/hooks/custom-hooks-loader.ts

@@ -1,205 +0,0 @@
-/**
- * Loads user-authored policy files with ESM import rewriting.
- * Supports transitive local imports and `import { ... } from 'failproofai'`.
- *
- * Two loading modes:
- * 1. Explicit: a single file via `customPoliciesPath` in policies-config.json
- * 2. Convention: auto-discovered *policies.{js,mjs,ts} files from
- *    .failproofai/policies/ at project and user level (git-hooks style)
- *
- * Fail-open: any error (file not found, syntax error, import failure) is logged
- * and results in an empty hook list for that file. Builtins continue normally.
- */
-import { resolve, isAbsolute, basename } from "node:path";
-import { existsSync, readdirSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import { homedir } from "node:os";
-import { hookLogWarn, hookLogError, hookLogInfo } from "./hook-logger";
-import { getCustomHooks, clearCustomHooks } from "./custom-hooks-registry";
-import { findDistIndex, rewriteFileTree, TMP_SUFFIX, cleanupTmpFiles } from "./loader-utils";
-import type { CustomHook } from "./policy-types";
-
-const LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__";
-
-/** Regex matching convention policy filenames: *policies.{js,mjs,ts} */
-const CONVENTION_FILE_RE = /policies\.(js|mjs|ts)$/;
-
-/**
- * Scan a directory for convention policy files (*policies.{js,mjs,ts}).
- * Returns sorted absolute paths. Returns [] if the directory doesn't exist.
- */
-export function discoverPolicyFiles(dir: string): string[] {
-  if (!existsSync(dir)) return [];
-  try {
-    const entries = readdirSync(dir, { withFileTypes: true });
-    return entries
-      .filter((e) => e.isFile() && CONVENTION_FILE_RE.test(e.name))
-      .sort((a, b) => a.name.localeCompare(b.name))
-      .map((e) => resolve(dir, e.name));
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Load a single policy file into the globalThis custom hooks registry.
- * Does NOT clear the registry — caller is responsible for that.
- */
-async function loadSingleFile(absPath: string, opts?: { strict?: boolean }): Promise<void> {
-  const g = globalThis as Record<string, unknown>;
-  g[LOADING_KEY] = true;
-
-  let tmpFiles: string[] = [];
-  try {
-    const distIndex = await findDistIndex();
-    const distUrl = distIndex ? pathToFileURL(distIndex).href : null;
-
-    tmpFiles = await rewriteFileTree(absPath, distUrl, distIndex);
-
-    const entryTmp = absPath + TMP_SUFFIX;
-    const fileUrl = pathToFileURL(entryTmp).href;
-    await import(/* webpackIgnore: true */ fileUrl);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (opts?.strict) throw new Error(`Failed to load custom hooks from ${absPath}: ${msg}`);
-    hookLogError(`failed to load custom hooks from ${absPath}: ${msg}`);
-  } finally {
-    g[LOADING_KEY] = false;
-    await cleanupTmpFiles(tmpFiles);
-  }
-}
-
-/**
- * Load a single explicit custom hooks file (legacy API).
- * Clears the registry, loads the file, returns registered hooks.
- */
-export async function loadCustomHooks(
-  customPoliciesPath: string | undefined,
-  opts?: { strict?: boolean; sessionCwd?: string },
-): Promise<CustomHook[]> {
-  if (!customPoliciesPath) return [];
-
-  const absPath = isAbsolute(customPoliciesPath)
-    ? customPoliciesPath
-    : resolve(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-
-  if (!existsSync(absPath)) {
-    if (opts?.strict) throw new Error(`Custom hooks file not found: ${absPath}`);
-    hookLogWarn(`customPoliciesPath not found: ${absPath}`);
-    return [];
-  }
-
-  clearCustomHooks();
-  await loadSingleFile(absPath, opts);
-  return getCustomHooks();
-}
-
-/** Source metadata for a loaded convention policy file. */
-export interface ConventionSource {
-  scope: "project" | "user";
-  file: string;
-  hookNames: string[];
-}
-
-/** Result of loadAllCustomHooks with source metadata. */
-export interface LoadAllResult {
-  hooks: CustomHook[];
-  conventionSources: ConventionSource[];
-}
-
-/**
- * Load ALL custom hooks: explicit customPoliciesPath + convention-discovered files.
- *
- * Load order:
- * 1. Explicit customPoliciesPath (if configured)
- * 2. Project convention: {cwd}/.failproofai/policies/*policies.{js,mjs,ts} (alphabetical)
- * 3. User convention: ~/.failproofai/policies/*policies.{js,mjs,ts} (alphabetical)
- *
- * Each file is loaded independently (fail-open per file).
- * Convention hooks are tagged with __conventionScope so the handler can build scoped prefixes.
- */
-export async function loadAllCustomHooks(
-  customPoliciesPath: string | undefined,
-  opts?: { sessionCwd?: string },
-): Promise<LoadAllResult> {
-  clearCustomHooks();
-
-  const conventionSources: ConventionSource[] = [];
-
-  // 1. Explicit customPoliciesPath (existing behavior)
-  if (customPoliciesPath) {
-    const absPath = isAbsolute(customPoliciesPath)
-      ? customPoliciesPath
-      : resolve(opts?.sessionCwd ?? process.cwd(), customPoliciesPath);
-    if (existsSync(absPath)) {
-      await loadSingleFile(absPath);
-    } else {
-      hookLogWarn(`customPoliciesPath not found: ${absPath}`);
-    }
-  }
-
-  const hooksBeforeConvention = getCustomHooks().length;
-
-  // 2. Project convention: {cwd}/.failproofai/policies/*policies.{js,mjs,ts}
-  const projectDir = resolve(opts?.sessionCwd ?? process.cwd(), ".failproofai", "policies");
-  const projectFiles = discoverPolicyFiles(projectDir);
-  for (const file of projectFiles) {
-    const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file);
-    const newHooks = getCustomHooks().slice(hooksBefore);
-    if (newHooks.length > 0) {
-      conventionSources.push({
-        scope: "project",
-        file: basename(file),
-        hookNames: newHooks.map((h) => h.name),
-      });
-    }
-  }
-
-  // 3. User convention: ~/.failproofai/policies/*policies.{js,mjs,ts}
-  const userDir = resolve(homedir(), ".failproofai", "policies");
-  const userFiles = discoverPolicyFiles(userDir);
-  for (const file of userFiles) {
-    const hooksBefore = getCustomHooks().length;
-    await loadSingleFile(file);
-    const newHooks = getCustomHooks().slice(hooksBefore);
-    if (newHooks.length > 0) {
-      conventionSources.push({
-        scope: "user",
-        file: basename(file),
-        hookNames: newHooks.map((h) => h.name),
-      });
-    }
-  }
-
-  const allHooks = getCustomHooks();
-  const conventionCount = allHooks.length - hooksBeforeConvention;
-
-  if (projectFiles.length > 0 || userFiles.length > 0) {
-    hookLogInfo(
-      `convention policies: ${projectFiles.length} project file(s), ${userFiles.length} user file(s), ${conventionCount} hook(s)`,
-    );
-  }
-
-  // Tag convention hooks with their scope so the handler can build scoped prefixes.
-  // Build a name→scope map from conventionSources, then tag by object reference
-  // to avoid mis-tagging an explicit custom hook that shares the same name.
-  const hookNameToScope = new Map<string, string>();
-  for (const source of conventionSources) {
-    for (const name of source.hookNames) {
-      hookNameToScope.set(name, source.scope);
-    }
-  }
-  const conventionHookRefs = new Set<CustomHook>();
-  for (const hook of allHooks.slice(hooksBeforeConvention)) {
-    conventionHookRefs.add(hook);
-  }
-  for (const hook of allHooks) {
-    if (conventionHookRefs.has(hook)) {
-      (hook as CustomHook & { __conventionScope?: string }).__conventionScope =
-        hookNameToScope.get(hook.name) ?? "project";
-    }
-  }
-
-  return { hooks: allHooks, conventionSources };
-}

package/.next/standalone/src/hooks/custom-hooks-registry.ts

@@ -1,30 +0,0 @@
-/**
- * GlobalThis-backed registry for custom hooks.
- * Shared via globalThis so that the user's hook file (which imports customPolicies
- * from 'failproofai') and the hook handler (which reads from this file) share the
- * same in-process state when running within the same Node.js process.
- */
-import type { CustomHook } from "./policy-types";
-
-const REGISTRY_KEY = "__failproofai_custom_hooks__";
-
-function getRegistry(): CustomHook[] {
-  const g = globalThis as Record<string, unknown>;
-  if (!Array.isArray(g[REGISTRY_KEY])) g[REGISTRY_KEY] = [];
-  return g[REGISTRY_KEY] as CustomHook[];
-}
-
-export const customPolicies = {
-  add(hook: CustomHook): void {
-    getRegistry().push(hook);
-  },
-};
-
-export function getCustomHooks(): CustomHook[] {
-  return getRegistry();
-}
-
-export function clearCustomHooks(): void {
-  const g = globalThis as Record<string, unknown>;
-  g[REGISTRY_KEY] = [];
-}

package/.next/standalone/src/hooks/handler.ts

@@ -1,222 +0,0 @@
-/**
- * Hook event handler — invoked when Claude Code triggers a hook.
- *
- * Reads the JSON payload from stdin, loads enabled policies from
- * ~/.failproofai/policies-config.json, evaluates matching policies, persists
- * activity to disk, and returns the appropriate exit code + stdout response.
- */
-import type { HookEventType, SessionMetadata } from "./types";
-import type { PolicyFunction, PolicyResult } from "./policy-types";
-import { readMergedHooksConfig } from "./hooks-config";
-import { registerBuiltinPolicies } from "./builtin-policies";
-import { evaluatePolicies } from "./policy-evaluator";
-import { clearPolicies, registerPolicy } from "./policy-registry";
-import { loadAllCustomHooks } from "./custom-hooks-loader";
-import type { CustomHook } from "./policy-types";
-import { persistHookActivity } from "./hook-activity-store";
-import { trackHookEvent } from "./hook-telemetry";
-import { getInstanceId } from "../../lib/telemetry-id";
-import { hookLogInfo, hookLogWarn } from "./hook-logger";
-
-export async function handleHookEvent(eventType: string): Promise<number> {
-  const startTime = performance.now();
-
-  // Read stdin payload (Claude passes JSON)
-  const MAX_STDIN_BYTES = 1_048_576; // 1 MB
-  let payload = "";
-  try {
-    payload = await new Promise<string>((resolve, reject) => {
-      const chunks: string[] = [];
-      let totalBytes = 0;
-      process.stdin.setEncoding("utf8");
-      process.stdin.on("data", (chunk: string) => {
-        totalBytes += Buffer.byteLength(chunk);
-        if (totalBytes > MAX_STDIN_BYTES) {
-          hookLogWarn(`stdin payload exceeds 1 MB for ${eventType}, discarding`);
-          process.stdin.destroy();
-          resolve("");
-          return;
-        }
-        chunks.push(chunk);
-      });
-      process.stdin.on("end", () => resolve(chunks.join("")));
-      process.stdin.on("error", reject);
-      // If stdin is already closed or not piped, resolve immediately
-      if (process.stdin.readableEnded) resolve("");
-    });
-  } catch {
-    hookLogWarn(`stdin read failed for ${eventType}`);
-  }
-
-  let parsed: Record<string, unknown> = {};
-  if (payload) {
-    try {
-      parsed = JSON.parse(payload) as Record<string, unknown>;
-    } catch {
-      hookLogWarn(`payload parse failed for ${eventType} (${payload.length} bytes)`);
-    }
-  }
-
-  // Extract session metadata from payload
-  const session: SessionMetadata = {
-    sessionId: parsed.session_id as string | undefined,
-    transcriptPath: parsed.transcript_path as string | undefined,
-    cwd: parsed.cwd as string | undefined,
-    permissionMode: parsed.permission_mode as string | undefined,
-    hookEventName: parsed.hook_event_name as string | undefined,
-  };
-
-  // Load enabled policies (merge across project/local/global scopes)
-  const config = readMergedHooksConfig(session.cwd);
-  clearPolicies();
-  registerBuiltinPolicies(config.enabledPolicies);
-
-  // Load and register custom hooks (layer 2, after builtins)
-  const loadResult = await loadAllCustomHooks(config.customPoliciesPath, { sessionCwd: session.cwd });
-  const customHooksList = loadResult.hooks;
-  const conventionHookNames = new Set(loadResult.conventionSources.flatMap((s) => s.hookNames));
-
-  for (const hook of customHooksList) {
-    const hookName = hook.name;
-    const conventionScope = (hook as CustomHook & { __conventionScope?: string }).__conventionScope;
-    const isConvention = !!conventionScope;
-    const prefix = isConvention ? `.failproofai-${conventionScope}` : "custom";
-    const fn: PolicyFunction = async (ctx): Promise<PolicyResult> => {
-      try {
-        const result = await Promise.race([
-          hook.fn(ctx),
-          new Promise<PolicyResult>((_, reject) =>
-            setTimeout(() => reject(new Error("timeout")), 10_000),
-          ),
-        ]);
-        return result;
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        const isTimeout = msg === "timeout";
-        hookLogWarn(`${prefix} hook "${hookName}" failed: ${msg}`);
-        void trackHookEvent(getInstanceId(), "custom_hook_error", {
-          hook_name: hookName,
-          error_type: isTimeout ? "timeout" : "exception",
-          event_type: eventType,
-          is_convention_policy: isConvention,
-          convention_scope: conventionScope ?? null,
-        });
-        return { decision: "allow" };
-      }
-    };
-    registerPolicy(
-      `${prefix}/${hookName}`,
-      hook.description ?? "",
-      fn,
-      hook.match ?? {},
-      -1, // Custom hooks run after builtins (priority 0)
-    );
-  }
-
-  // Fire telemetry once per invocation for custom hook loads
-  if (customHooksList.length > 0) {
-    void trackHookEvent(getInstanceId(), "custom_hooks_loaded", {
-      custom_hooks_count: customHooksList.length,
-      custom_hook_names: customHooksList.map((h) => h.name),
-      event_types_covered: [...new Set(customHooksList.flatMap((h) => h.match?.events ?? []))],
-    });
-  }
-
-  // Fire telemetry for convention-based policy discovery
-  if (loadResult.conventionSources.length > 0) {
-    void trackHookEvent(getInstanceId(), "convention_policies_loaded", {
-      event_type: eventType,
-      project_file_count: loadResult.conventionSources.filter((s) => s.scope === "project").length,
-      user_file_count: loadResult.conventionSources.filter((s) => s.scope === "user").length,
-      convention_hook_count: conventionHookNames.size,
-      convention_hook_names: [...conventionHookNames],
-    });
-  }
-
-  hookLogInfo(`event=${eventType} policies=${config.enabledPolicies.length} custom=${customHooksList.length} convention=${conventionHookNames.size}`);
-
-  // Evaluate policies
-  const result = await evaluatePolicies(eventType as HookEventType, parsed, session, config);
-  const durationMs = Math.round(performance.now() - startTime);
-  hookLogInfo(`result=${result.decision} policy=${result.policyName ?? "none"} duration=${durationMs}ms`);
-
-  if (result.stdout) {
-    process.stdout.write(result.stdout);
-  }
-  if (result.stderr) {
-    process.stderr.write(result.stderr);
-  }
-
-  // Persist activity to disk (visible in /policies activity tab)
-  const activityEntry = {
-    timestamp: Date.now(),
-    eventType,
-    toolName: (parsed.tool_name as string) ?? null,
-    policyName: result.policyName,
-    policyNames: result.policyNames,
-    decision: result.decision,
-    reason: result.reason,
-    durationMs,
-    sessionId: session.sessionId,
-    transcriptPath: session.transcriptPath,
-    cwd: session.cwd,
-    permissionMode: session.permissionMode,
-    hookEventName: session.hookEventName,
-  };
-  try {
-    persistHookActivity(activityEntry);
-  } catch {
-    hookLogWarn("activity persistence failed");
-  }
-
-  // Enqueue for server relay — fire-and-forget, never blocks hook.
-  // queue.ts is a no-op if the user is not logged in (no auth.json), and
-  // sanitizes the entry before persisting (drops toolInput/transcriptPath,
-  // hashes cwd, redacts known secret patterns in `reason`).
-  try {
-    const { appendToServerQueue } = await import("../relay/queue");
-    appendToServerQueue(activityEntry);
-  } catch {
-    // Server queue is best-effort; fail-open
-  }
-
-  // Lazy-start relay daemon if user is logged in — ~1ms when already running
-  try {
-    const { ensureRelayRunning } = await import("../relay/daemon");
-    ensureRelayRunning();
-  } catch {
-    // Relay is best-effort; hook must succeed regardless
-  }
-
-  // Fire PostHog telemetry for decisions that affect Claude's behavior
-  if (result.decision === "deny" || result.decision === "instruct") {
-    try {
-      const isCustomHook = result.policyName?.startsWith("custom/") ?? false;
-      const isConventionPolicy = result.policyName?.startsWith(".failproofai-") ?? false;
-      const conventionScope = isConventionPolicy
-        ? result.policyName!.match(/^\.failproofai-(project|user)\//)?.[1] ?? null
-        : null;
-      const hasCustomParams =
-        !isCustomHook && !isConventionPolicy && !!(result.policyName && config.policyParams?.[result.policyName]);
-      const paramKeysOverridden = hasCustomParams
-        ? Object.keys(config.policyParams![result.policyName!])
-        : [];
-      const distinctId = getInstanceId();
-      await trackHookEvent(distinctId, "hook_policy_triggered", {
-        event_type: eventType,
-        tool_name: (parsed.tool_name as string) ?? null,
-        policy_name: result.policyName,
-        decision: result.decision,
-        is_custom_hook: isCustomHook,
-        is_convention_policy: isConventionPolicy,
-        convention_scope: conventionScope,
-        has_custom_params: hasCustomParams,
-        param_keys_overridden: paramKeysOverridden,
-      });
-    } catch {
-      // Telemetry is best-effort — never block the hook
-    }
-  }
-
-  return result.exitCode;
-}