gentyr 1.3.0

package/.claude/hooks/credential-health-check.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+/**
+ * SessionStart Hook: Credential Health Check
+ *
+ * Checks if vault mappings are configured for all required credential keys.
+ * Outputs a message prompting the user to run /setup-gentyr if setup is incomplete.
+ *
+ * Reads:
+ * - .claude/vault-mappings.json (op:// references and direct values)
+ * - .claude/hooks/protected-actions.json (which servers need which keys)
+ *
+ * Output: JSON to stdout with systemMessage if setup is incomplete.
+ *
+ * @version 1.0.0
+ */
+
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+
+const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const mappingsPath = path.join(projectDir, '.claude', 'vault-mappings.json');
+const actionsPath = path.join(projectDir, '.claude', 'hooks', 'protected-actions.json');
+
+function output(message) {
+  if (message) {
+    console.log(JSON.stringify({
+      continue: true,
+      suppressOutput: false,
+      systemMessage: message,
+    }));
+  } else {
+    console.log(JSON.stringify({
+      continue: true,
+      suppressOutput: true,
+    }));
+  }
+}
+
+try {
+  // Skip for spawned sessions — don't clutter agent output
+  if (process.env.CLAUDE_SPAWNED_SESSION === 'true') {
+    output(null);
+    process.exit(0);
+  }
+
+  // Load required credential keys from protected-actions.json
+  const requiredKeys = new Set();
+  try {
+    const actions = JSON.parse(fs.readFileSync(actionsPath, 'utf8'));
+    for (const server of Object.values(actions.servers || {})) {
+      if (Array.isArray(server.credentialKeys)) {
+        for (const key of server.credentialKeys) {
+          requiredKeys.add(key);
+        }
+      }
+    }
+  } catch {
+    // No protected-actions.json — nothing to check
+    output(null);
+    process.exit(0);
+  }
+
+  if (requiredKeys.size === 0) {
+    output(null);
+    process.exit(0);
+  }
+
+  // Known alternative keys — only one of each pair needs to be configured
+  const ALTERNATIVES = {
+    'ELASTIC_CLOUD_ID': 'ELASTIC_ENDPOINT',
+    'ELASTIC_ENDPOINT': 'ELASTIC_CLOUD_ID',
+  };
+
+  // Check vault mappings
+  let configuredCount = 0;
+  let missingKeys = [];
+  let hasOpRefs = false;
+  const configuredKeys = new Set();
+
+  try {
+    const data = JSON.parse(fs.readFileSync(mappingsPath, 'utf8'));
+    const mappings = data.mappings || {};
+    for (const key of requiredKeys) {
+      if (mappings[key]) {
+        // Both op:// references and direct values count as configured
+        configuredCount++;
+        configuredKeys.add(key);
+        if (typeof mappings[key] === 'string' && mappings[key].startsWith('op://')) {
+          hasOpRefs = true;
+        }
+      } else {
+        missingKeys.push(key);
+      }
+    }
+  } catch {
+    // No vault-mappings.json — all keys are missing
+    missingKeys.push(...requiredKeys);
+  }
+
+  // Also check .mcp.json env blocks for missing keys (e.g. OP_SERVICE_ACCOUNT_TOKEN
+  // is injected into .mcp.json by the installer, not stored in vault-mappings).
+  // Always load OP_SERVICE_ACCOUNT_TOKEN from .mcp.json (source of truth) — the env
+  // may have a stale token from a previous session that predates a token rotation.
+  let opTokenDesync = false;
+  {
+    const shellOpToken = process.env.OP_SERVICE_ACCOUNT_TOKEN;
+    const mcpPath = path.join(projectDir, '.mcp.json');
+    try {
+      const mcpConfig = JSON.parse(fs.readFileSync(mcpPath, 'utf8'));
+      const mcpEnvKeys = new Set();
+      for (const server of Object.values(mcpConfig.mcpServers || {})) {
+        if (server.env) {
+          for (const k of Object.keys(server.env)) {
+            if (server.env[k]) mcpEnvKeys.add(k);
+          }
+          // Always prefer .mcp.json token — it's updated by reinstall.sh
+          if (server.env.OP_SERVICE_ACCOUNT_TOKEN) {
+            if (shellOpToken && shellOpToken !== server.env.OP_SERVICE_ACCOUNT_TOKEN) {
+              opTokenDesync = true;
+            }
+            process.env.OP_SERVICE_ACCOUNT_TOKEN = server.env.OP_SERVICE_ACCOUNT_TOKEN;
+          }
+        }
+      }
+      missingKeys = missingKeys.filter(k => !mcpEnvKeys.has(k));
+    } catch {
+      // .mcp.json not readable — skip this check
+    }
+  }
+
+  // Handle alternative keys — if one of a pair is configured, the other is not missing
+  if (missingKeys.length > 0) {
+    missingKeys = missingKeys.filter(key => {
+      const alt = ALTERNATIVES[key];
+      return !alt || !configuredKeys.has(alt);
+    });
+  }
+
+  // Build desync warning prefix if shell token differs from .mcp.json
+  const desyncPrefix = opTokenDesync
+    ? 'GENTYR: OP_SERVICE_ACCOUNT_TOKEN in shell differs from .mcp.json (source of truth). '
+    : '';
+
+  if (missingKeys.length > 0) {
+    output(`${desyncPrefix}GENTYR: ${missingKeys.length} credential mapping(s) not configured. Run /setup-gentyr to complete setup.`);
+  } else if (hasOpRefs) {
+    // Only test 1Password connectivity if there are op:// references to resolve
+    try {
+      execFileSync('op', ['whoami', '--format', 'json'], {
+        encoding: 'utf-8',
+        timeout: 5000,
+        env: process.env,
+      });
+      // Connected — emit desync warning if present, otherwise silent
+      output(desyncPrefix || null);
+    } catch {
+      output(`${desyncPrefix}GENTYR: 1Password is not authenticated. MCP servers will start without credentials.`);
+    }
+  } else {
+    // All mappings are direct values — no 1Password needed
+    output(desyncPrefix || null);
+  }
+} catch (err) {
+  // Don't block session — but log the error for debugging
+  console.error(`[credential-health-check] Unexpected error: ${err.message || err}`);
+  output(null);
+}

package/.claude/hooks/credential-sync-hook.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse Hook: Credential Sync (Throttled)
+ *
+ * Periodically re-checks credential sources during long sessions to detect
+ * account switches that happen between SessionStart events.
+ *
+ * Runs on Bash tool calls only. Throttled to once per 30 minutes via state file.
+ * Uses the shared key-sync module for multi-source credential detection.
+ *
+ * @version 1.0.0
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { syncKeys } from './key-sync.js';
+
+const PROJECT_DIR = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const STATE_FILE = path.join(PROJECT_DIR, '.claude', 'state', 'credential-sync-state.json');
+const COOLDOWN_MS = 30 * 60 * 1000; // 30 minutes
+
+function readState() {
+  try {
+    if (!fs.existsSync(STATE_FILE)) return { lastCheck: 0 };
+    return JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'));
+  } catch {
+    return { lastCheck: 0 };
+  }
+}
+
+function writeState(state) {
+  try {
+    const dir = path.dirname(STATE_FILE);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), 'utf8');
+  } catch {
+    // Non-fatal
+  }
+}
+
+async function main() {
+  // Skip for spawned sessions
+  if (process.env.CLAUDE_SPAWNED_SESSION === 'true') {
+    console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+    return;
+  }
+
+  // Throttle check
+  const state = readState();
+  const elapsed = Date.now() - state.lastCheck;
+  if (elapsed < COOLDOWN_MS) {
+    console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+    return;
+  }
+
+  // Run key sync
+  try {
+    const result = await syncKeys();
+    state.lastCheck = Date.now();
+    writeState(state);
+
+    if (result.keysAdded > 0) {
+      console.log(JSON.stringify({
+        continue: true,
+        suppressOutput: false,
+        systemMessage: `Credential sync: ${result.keysAdded} new key(s) discovered mid-session.`,
+      }));
+    } else {
+      console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+    }
+  } catch {
+    // Don't block on errors
+    console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+  }
+}
+
+main().catch(() => {
+  console.log(JSON.stringify({ continue: true, suppressOutput: true }));
+});