gentyr 1.3.0

package/.claude/hooks/block-no-verify.js

@@ -0,0 +1,301 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse Hook: Block --no-verify flag
+ *
+ * This hook intercepts Bash tool calls and blocks any git commands
+ * that include --no-verify or -n flags, which would skip git hooks.
+ *
+ * Uses Claude Code's permissionDecision JSON output for hard blocking.
+ * Supports CTO bypass via bypass-approval-token.json.
+ *
+ * Input: JSON on stdin from Claude Code PreToolUse event
+ * Output: JSON on stdout with permissionDecision (deny/allow)
+ *
+ * SECURITY: This file should be root-owned via protect-framework.sh
+ *
+ * @version 3.0.0
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+// Patterns that indicate hook bypass attempts
+const forbiddenPatterns = [
+  { pattern: /--no-verify/i, reason: 'Using --no-verify skips pre-commit hooks (lint, deputy-cto review)' },
+  { pattern: /\bgit\b.*\s-n\s/, reason: 'The -n flag is shorthand for --no-verify, which skips pre-commit hooks' },
+  { pattern: /\bgit\b.*\s-n$/, reason: 'The -n flag is shorthand for --no-verify, which skips pre-commit hooks' },
+  { pattern: /--(no-)?gpg-sign/i, reason: 'Skipping GPG signing bypasses commit verification' },
+  { pattern: /\bgit\s+config\s+.*core\.hooksPath/i, reason: 'Changing core.hooksPath redirects or disables git hooks' },
+  { pattern: /\brm\s+(-rf?|--recursive)?\s+.*\.husky/i, reason: 'Deleting .husky/ removes the git hook infrastructure' },
+  { pattern: /\brm\s+(-rf?|--recursive)?\s+.*\.claude\/hooks/i, reason: 'Deleting .claude/hooks/ removes Claude Code hook enforcement' },
+];
+
+// Additional patterns for weakening lint
+const lintWeakeningPatterns = [
+  { pattern: /eslint.*--quiet/i, reason: 'The --quiet flag suppresses ESLint warnings' },
+  { pattern: /eslint.*--max-warnings\s+[1-9]/i, reason: 'Allowing warnings violates zero-tolerance lint policy' },
+  { pattern: /eslint.*--no-error-on-unmatched-pattern/i, reason: 'This flag can silently skip linting of files' },
+];
+
+// Patterns blocking direct credential/secret access via CLI tools
+// Even if OP_SERVICE_ACCOUNT_TOKEN is in the shell environment, agents cannot use
+// the 1Password CLI to extract secrets. Secrets flow only through MCP server env
+// fields (which are spawned by MCP infrastructure, not by Bash).
+const credentialAccessPatterns = [
+  { pattern: /\bop\s+(run|read|item|inject|signin|signout|whoami|vault|document|connect|account|group|user|service-account|events-api|plugin)\b/i,
+    reason: '1Password CLI access blocked — secrets must only flow through MCP server env fields, not Bash' },
+  { pattern: /\bop\s+--/i,
+    reason: '1Password CLI access blocked — global op flags indicate CLI usage' },
+  { pattern: /(?:^|[\/\s])op\s+(run|read|item|inject|signin|signout|whoami|vault|document|connect|account|group|user|service-account|events-api|plugin)\b/i,
+    reason: '1Password CLI access blocked (full-path variant) — secrets must only flow through MCP server env fields' },
+];
+
+/**
+ * Load the protection key for HMAC verification.
+ * @param {string} projectDir
+ * @returns {string|null} Base64-encoded key or null
+ */
+function loadProtectionKey(projectDir) {
+  try {
+    const keyPath = path.join(projectDir, '.claude', 'protection-key');
+    if (!fs.existsSync(keyPath)) {
+      return null;
+    }
+    return fs.readFileSync(keyPath, 'utf8').trim();
+  } catch (err) {
+    return null;
+  }
+}
+
+/**
+ * Compute HMAC-SHA256 over pipe-delimited fields.
+ * @param {string} key - Base64-encoded key
+ * @param {...string} fields - Fields to include in HMAC
+ * @returns {string} Hex-encoded HMAC
+ */
+function computeHmac(key, ...fields) {
+  const keyBuffer = Buffer.from(key, 'base64');
+  return crypto.createHmac('sha256', keyBuffer)
+    .update(fields.join('|'))
+    .digest('hex');
+}
+
+/**
+ * Check if a valid, HMAC-verified CTO bypass token exists.
+ * Consumes the token on successful verification (one-time use).
+ *
+ * SECURITY FIX (H1): Now verifies HMAC-SHA256 signature to prevent agent forgery.
+ * Previously only checked expiry, allowing agents to write fake tokens.
+ *
+ * SECURITY FIX (H2): Token is consumed (deleted) on use, preventing reuse
+ * across different blocked actions.
+ */
+function hasValidBypassToken(projectDir) {
+  try {
+    const tokenPath = path.join(projectDir, '.claude', 'bypass-approval-token.json');
+    const clearToken = () => { try { fs.writeFileSync(tokenPath, '{}'); } catch { /* ignore */ } };
+
+    if (!fs.existsSync(tokenPath)) {
+      return false;
+    }
+
+    const token = JSON.parse(fs.readFileSync(tokenPath, 'utf-8'));
+
+    // Empty object means token was consumed (overwrite pattern for sticky-bit compat)
+    if (!token.code && !token.request_id && !token.expires_timestamp) {
+      return false;
+    }
+
+    // Check expiry
+    if (token.expires_timestamp && Date.now() > token.expires_timestamp) {
+      // Clean up expired token
+      clearToken();
+      return false;
+    }
+    if (token.expires_at && new Date(token.expires_at).getTime() < Date.now()) {
+      clearToken();
+      return false;
+    }
+
+    // Verify required fields
+    if (!token.code || !token.request_id || !token.expires_timestamp) {
+      console.error('[block-no-verify] FORGERY DETECTED: Token missing required fields. Clearing.');
+      clearToken();
+      return false;
+    }
+
+    // HMAC verification: ensure token was created by the bypass-approval-hook
+    const key = loadProtectionKey(projectDir);
+    if (key) {
+      if (!token.hmac) {
+        console.error('[block-no-verify] FORGERY DETECTED: Token missing HMAC field. Clearing.');
+        clearToken();
+        return false;
+      }
+      const expectedHmac = computeHmac(key, token.code, token.request_id, String(token.expires_timestamp), 'bypass-approved');
+      if (token.hmac !== expectedHmac) {
+        console.error('[block-no-verify] FORGERY DETECTED: Invalid HMAC on bypass token. Clearing.');
+        clearToken();
+        return false;
+      }
+    } else {
+      // G001 Fail-Closed: No protection key available -- cannot verify token authenticity
+      console.error('[block-no-verify] G001 FAIL-CLOSED: Protection key missing, cannot verify bypass token. Rejecting.');
+      clearToken();
+      return false;
+    }
+
+    // Token is valid - consume it (one-time use)
+    clearToken();
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Block the tool call using Claude Code's permissionDecision system.
+ */
+function blockCommand(command, reason, category, bypassContext) {
+  const bypassInstructions = [
+    '',
+    '  HOW TO REQUEST A CTO BYPASS (if you have a valid reason):',
+    '',
+    '  1. Call: mcp__deputy-cto__request_bypass({',
+    `       reason: "${bypassContext}",`,
+    '       reporting_agent: "your-agent-name",',
+    '       blocked_by: "block-no-verify hook"',
+    '     })',
+    '',
+    '  2. You will receive a 6-character bypass code (e.g. X7K9M2)',
+    '',
+    '  3. STOP and ask the CTO to type in chat:',
+    '       APPROVE BYPASS <CODE>',
+    '',
+    '  4. After CTO approval, retry your command.',
+    '     The bypass token is valid for 5 minutes (one-time use).',
+  ].join('\n');
+
+  const fullReason = [
+    `BLOCKED: ${category}`,
+    '',
+    `Why: ${reason}`,
+    '',
+    `Command: ${command.substring(0, 100)}${command.length > 100 ? '...' : ''}`,
+    '',
+    bypassInstructions,
+  ].join('\n');
+
+  // Output JSON to stdout for Claude Code's permission system (hard deny)
+  console.log(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: fullReason,
+    },
+  }));
+
+  // Also output to stderr for visibility
+  console.error('');
+  console.error('══════════════════════════════════════════════════════════════');
+  console.error(`  COMMAND BLOCKED: ${category}`);
+  console.error('══════════════════════════════════════════════════════════════');
+  console.error('');
+  console.error(`  Why: ${reason}`);
+  console.error('');
+  console.error(`  Command: ${command.substring(0, 100)}${command.length > 100 ? '...' : ''}`);
+  console.error('');
+  console.error('  ──────────────────────────────────────────────────────────');
+  console.error(bypassInstructions);
+  console.error('  ──────────────────────────────────────────────────────────');
+  console.error('');
+  console.error('══════════════════════════════════════════════════════════════');
+  console.error('');
+
+  process.exit(0); // Exit 0 - the JSON output handles the deny
+}
+
+// Read JSON input from stdin
+let input = '';
+
+process.stdin.on('data', (chunk) => {
+  input += chunk.toString();
+});
+
+process.stdin.on('end', () => {
+  try {
+    const hookInput = JSON.parse(input);
+
+    const toolName = hookInput.tool_name;
+    const toolInput = hookInput.tool_input || {};
+    const projectDir = hookInput.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+
+    // Only check Bash commands
+    if (toolName !== 'Bash') {
+      process.exit(0);
+    }
+
+    const command = toolInput.command || '';
+
+    // Check if CTO has granted a bypass
+    if (hasValidBypassToken(projectDir)) {
+      console.error('[block-no-verify] Active CTO bypass token found - allowing command through');
+      process.exit(0);
+    }
+
+    // Check for forbidden patterns
+    for (const { pattern, reason } of forbiddenPatterns) {
+      if (pattern.test(command)) {
+        blockCommand(
+          command,
+          reason,
+          'Security Hook Bypass Attempt',
+          'Explain why --no-verify is needed'
+        );
+        return; // blockCommand calls process.exit, but just in case
+      }
+    }
+
+    // Check for lint weakening
+    for (const { pattern, reason } of lintWeakeningPatterns) {
+      if (pattern.test(command)) {
+        blockCommand(
+          command,
+          reason,
+          'Lint Enforcement Weakening Attempt',
+          'Explain why lint relaxation is needed'
+        );
+        return;
+      }
+    }
+
+    // Check for credential/secret access via CLI
+    for (const { pattern, reason } of credentialAccessPatterns) {
+      if (pattern.test(command)) {
+        blockCommand(
+          command,
+          reason,
+          'Credential Access Attempt',
+          'Explain why direct 1Password CLI access is needed'
+        );
+        return;
+      }
+    }
+
+    // Command is allowed
+    process.exit(0);
+  } catch (err) {
+    // G001: fail-closed on parse errors — output deny JSON so Claude Code blocks the action
+    console.error(`[block-no-verify] G001 FAIL-CLOSED: Error parsing input: ${err.message}`);
+    console.log(JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: `G001 FAIL-CLOSED: Hook error - ${err.message}`,
+      },
+    }));
+    process.exit(0);
+  }
+});

package/.claude/hooks/bypass-approval-hook.js

@@ -0,0 +1,313 @@
+#!/usr/bin/env node
+/**
+ * Bypass Approval Hook (UserPromptSubmit)
+ *
+ * Watches for CTO bypass approval messages in the format:
+ *   APPROVE BYPASS <6-char-code>
+ *
+ * When detected, validates the code exists in pending bypass requests
+ * and writes an approval token that execute_bypass can verify.
+ *
+ * This ensures only the CTO (human user) can approve bypasses by typing
+ * the approval phrase - agents cannot trigger UserPromptSubmit hooks.
+ *
+ * @version 1.0.0
+ */
+
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const PROJECT_DIR = process.env.CLAUDE_PROJECT_DIR || path.resolve(__dirname, '..', '..');
+const DEPUTY_CTO_DB = path.join(PROJECT_DIR, '.claude', 'deputy-cto.db');
+const APPROVAL_TOKEN_FILE = path.join(PROJECT_DIR, '.claude', 'bypass-approval-token.json');
+const PROTECTION_KEY_PATH = path.join(PROJECT_DIR, '.claude', 'protection-key');
+
+// Token expires after 5 minutes
+const TOKEN_EXPIRY_MS = 5 * 60 * 1000;
+
+// Pattern to match: APPROVE BYPASS XXXXXX (6 alphanumeric chars)
+const APPROVAL_PATTERN = /APPROVE\s+BYPASS\s+([A-Z0-9]{6})/i;
+
+// Pattern to match: APPROVE HOTFIX XXXXXX (6 alphanumeric chars)
+const HOTFIX_PATTERN = /APPROVE\s+HOTFIX\s+([A-Z0-9]{6})/i;
+const HOTFIX_APPROVAL_TOKEN_FILE = path.join(PROJECT_DIR, '.claude', 'hotfix-approval-token.json');
+
+/**
+ * Read user message from stdin (passed by Claude Code for UserPromptSubmit hooks)
+ */
+async function readUserMessage() {
+  return new Promise((resolve) => {
+    let data = '';
+
+    // Set a short timeout in case no data is available
+    const timeout = setTimeout(() => {
+      resolve(data.trim());
+    }, 100);
+
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on('end', () => {
+      clearTimeout(timeout);
+      resolve(data.trim());
+    });
+
+    // If stdin is not readable, resolve immediately
+    if (!process.stdin.readable) {
+      clearTimeout(timeout);
+      resolve('');
+    }
+  });
+}
+
+/**
+ * Try to import better-sqlite3 and check if bypass code is valid
+ */
+async function validateBypassCode(code) {
+  try {
+    const Database = (await import('better-sqlite3')).default;
+
+    if (!fs.existsSync(DEPUTY_CTO_DB)) {
+      return { valid: false, reason: 'Database not found' };
+    }
+
+    const db = new Database(DEPUTY_CTO_DB, { readonly: true });
+
+    // Look for pending bypass-request with this code in context field
+    const question = db.prepare(`
+      SELECT id, title, created_at FROM questions
+      WHERE type = 'bypass-request'
+      AND status = 'pending'
+      AND context = ?
+    `).get(code);
+
+    db.close();
+
+    if (!question) {
+      return { valid: false, reason: 'No pending bypass request with this code' };
+    }
+
+    return {
+      valid: true,
+      request_id: question.id,
+      title: question.title,
+      created_at: question.created_at
+    };
+  } catch (err) {
+    return { valid: false, reason: `Database error: ${err.message}` };
+  }
+}
+
+/**
+ * Try to import better-sqlite3 and check if hotfix code is valid
+ */
+async function validateHotfixCode(code) {
+  try {
+    const Database = (await import('better-sqlite3')).default;
+
+    if (!fs.existsSync(DEPUTY_CTO_DB)) {
+      return { valid: false, reason: 'Database not found' };
+    }
+
+    const db = new Database(DEPUTY_CTO_DB, { readonly: true });
+
+    const row = db.prepare(`
+      SELECT id, code, commits_json, created_at, expires_at FROM hotfix_requests
+      WHERE code = ? AND status = 'pending' AND expires_at > datetime('now')
+    `).get(code);
+
+    db.close();
+
+    if (!row) {
+      return { valid: false, reason: 'No pending hotfix request with this code' };
+    }
+
+    return {
+      valid: true,
+      request_id: row.id,
+      code: row.code,
+      expires_at: row.expires_at,
+    };
+  } catch (err) {
+    return { valid: false, reason: `Database error: ${err.message}` };
+  }
+}
+
+/**
+ * Write hotfix approval token with HMAC signature.
+ */
+function writeHotfixApprovalToken(code, requestId, expiresAt) {
+  const key = loadProtectionKey();
+  const hmac = key ? computeHmac(key, code, String(requestId), expiresAt, 'hotfix-approved') : undefined;
+
+  const token = {
+    code,
+    request_id: requestId,
+    created_at: new Date().toISOString(),
+    expires_at: expiresAt,
+    ...(hmac && { hmac }),
+  };
+
+  try {
+    fs.writeFileSync(HOTFIX_APPROVAL_TOKEN_FILE, JSON.stringify(token, null, 2));
+    return true;
+  } catch (err) {
+    console.error(`[bypass-approval] Failed to write hotfix token: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Mark the hotfix request as approved in the database.
+ */
+async function markHotfixApproved(requestId) {
+  try {
+    const Database = (await import('better-sqlite3')).default;
+    const db = new Database(DEPUTY_CTO_DB);
+    db.prepare("UPDATE hotfix_requests SET status = 'approved' WHERE id = ?").run(requestId);
+    db.close();
+  } catch (err) {
+    console.error(`[bypass-approval] Failed to mark hotfix approved: ${err.message}`);
+  }
+}
+
+/**
+ * Load the protection key for HMAC signing.
+ * @returns {string|null} Base64-encoded key or null
+ */
+function loadProtectionKey() {
+  try {
+    if (!fs.existsSync(PROTECTION_KEY_PATH)) {
+      return null;
+    }
+    return fs.readFileSync(PROTECTION_KEY_PATH, 'utf8').trim();
+  } catch (err) {
+    return null;
+  }
+}
+
+/**
+ * Compute HMAC-SHA256 over pipe-delimited fields.
+ * @param {string} key - Base64-encoded key
+ * @param {...string} fields - Fields to include in HMAC
+ * @returns {string} Hex-encoded HMAC
+ */
+function computeHmac(key, ...fields) {
+  const keyBuffer = Buffer.from(key, 'base64');
+  return crypto.createHmac('sha256', keyBuffer)
+    .update(fields.join('|'))
+    .digest('hex');
+}
+
+/**
+ * Write approval token with HMAC signature to prevent forgery.
+ *
+ * SECURITY FIX (H1): Token now includes HMAC-SHA256 signature computed from
+ * code, request_id, and expires_timestamp using the protection key.
+ * block-no-verify.js verifies this signature before accepting the token.
+ */
+function writeApprovalToken(code, requestId, userMessage) {
+  const now = Date.now();
+  const expiresTimestamp = now + TOKEN_EXPIRY_MS;
+
+  // Compute HMAC signature to prevent agent forgery
+  const key = loadProtectionKey();
+  const hmac = key ? computeHmac(key, code, requestId, String(expiresTimestamp), 'bypass-approved') : undefined;
+
+  const token = {
+    code,
+    request_id: requestId,
+    user_message: userMessage,
+    created_at: new Date(now).toISOString(),
+    expires_at: new Date(expiresTimestamp).toISOString(),
+    expires_timestamp: expiresTimestamp,
+    ...(hmac && { hmac }),
+  };
+
+  try {
+    fs.writeFileSync(APPROVAL_TOKEN_FILE, JSON.stringify(token, null, 2));
+    return true;
+  } catch (err) {
+    console.error(`[bypass-approval] Failed to write token: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Main entry point
+ */
+async function main() {
+  const userMessage = await readUserMessage();
+
+  if (!userMessage) {
+    // No message, nothing to do
+    process.exit(0);
+  }
+
+  // Skip for slash commands (contain GENTYR sentinel markers)
+  if (userMessage.includes('<!-- HOOK:GENTYR:')) {
+    process.exit(0);
+  }
+
+  // Check if message matches bypass approval pattern
+  const match = userMessage.match(APPROVAL_PATTERN);
+
+  if (match) {
+    const code = match[1].toUpperCase();
+
+    const validation = await validateBypassCode(code);
+
+    if (!validation.valid) {
+      console.error(`[bypass-approval] Invalid bypass code "${code}": ${validation.reason}`);
+      process.exit(0);
+    }
+
+    const written = writeApprovalToken(code, validation.request_id, userMessage);
+
+    if (written) {
+      console.error(`[bypass-approval] Bypass approved for code ${code}`);
+      console.error(`[bypass-approval] Request: ${validation.title}`);
+      console.error(`[bypass-approval] Token valid for 5 minutes`);
+    }
+
+    process.exit(0);
+  }
+
+  // Check if message matches hotfix approval pattern
+  const hotfixMatch = userMessage.match(HOTFIX_PATTERN);
+
+  if (hotfixMatch) {
+    const code = hotfixMatch[1].toUpperCase();
+
+    const validation = await validateHotfixCode(code);
+
+    if (!validation.valid) {
+      console.error(`[bypass-approval] Invalid hotfix code "${code}": ${validation.reason}`);
+      process.exit(0);
+    }
+
+    const written = writeHotfixApprovalToken(code, validation.request_id, validation.expires_at);
+
+    if (written) {
+      await markHotfixApproved(validation.request_id);
+      console.error(`[bypass-approval] Hotfix approved for code ${code}`);
+      console.error(`[bypass-approval] Token valid until ${validation.expires_at}`);
+    }
+
+    process.exit(0);
+  }
+
+  // Not an approval message, pass through silently
+  process.exit(0);
+}
+
+main().catch((err) => {
+  console.error(`[bypass-approval] Error: ${err.message}`);
+  process.exit(0); // Don't block on errors
+});