impel-cli 0.16.3 → 0.16.5

package/src/sessionHooks.js

@@ -0,0 +1,242 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import path from "node:path";
+
+import { impelCliInvocation } from "./selfInvocation.js";
+
+const MANAGED_MARKER = "--impel-managed-session-hook-v1";
+const CODEX_TRUST_START = "# >>> impel managed session hook trust >>>";
+const CODEX_TRUST_END = "# <<< impel managed session hook trust <<<";
+
+export const CLAUDE_SESSION_EVENTS = Object.freeze([
+  "SessionStart",
+  "UserPromptSubmit",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "SubagentStart",
+  "SubagentStop",
+  "PreCompact",
+  "PostCompact",
+  "Stop",
+  "StopFailure",
+  "SessionEnd",
+]);
+
+export const CODEX_SESSION_EVENTS = Object.freeze([
+  "SessionStart",
+  "UserPromptSubmit",
+  "PostToolUse",
+  "SubagentStart",
+  "SubagentStop",
+  "PreCompact",
+  "PostCompact",
+  "Stop",
+]);
+
+function ensurePrivateDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  try {
+    fs.chmodSync(directory, 0o700);
+  } catch {
+    // Best effort on platforms where chmod is unavailable.
+  }
+}
+
+function readJsonObject(filePath) {
+  if (!fs.existsSync(filePath)) return {};
+  const raw = fs.readFileSync(filePath, "utf8").trim();
+  if (!raw) return {};
+  try {
+    const value = JSON.parse(raw);
+    if (!value || Array.isArray(value) || typeof value !== "object") throw new Error();
+    return value;
+  } catch {
+    throw new Error(`${filePath} exists but isn't a valid JSON object. Fix or remove it, then re-run.`);
+  }
+}
+
+function writePrivateJson(filePath, value) {
+  ensurePrivateDirectory(path.dirname(filePath));
+  const temporaryPath = `${filePath}.tmp-${process.pid}`;
+  try {
+    fs.writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(temporaryPath, filePath);
+    try {
+      fs.chmodSync(filePath, 0o600);
+    } catch {
+      // Best effort on platforms where chmod is unavailable.
+    }
+  } finally {
+    try {
+      fs.rmSync(temporaryPath, { force: true });
+    } catch {
+      // The successful rename already removed the temporary file.
+    }
+  }
+}
+
+function managedInvocation(provider, surface, tenantId) {
+  return impelCliInvocation([
+    "sessions",
+    "hook",
+    "--provider",
+    provider,
+    "--surface",
+    surface,
+    "--tenant",
+    tenantId,
+    MANAGED_MARKER,
+  ]);
+}
+
+function validTenantId(tenantId) {
+  return typeof tenantId === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(tenantId);
+}
+
+function handlerIsManaged(handler) {
+  if (!handler || typeof handler !== "object") return false;
+  if (Array.isArray(handler.args)) return handler.args.includes(MANAGED_MARKER);
+  return typeof handler.command === "string" && handler.command.includes(MANAGED_MARKER);
+}
+
+function mergeEventHook(existing, event, handler) {
+  const groups = Array.isArray(existing?.[event]) ? existing[event] : [];
+  const preserved = [];
+  for (const group of groups) {
+    if (!group || typeof group !== "object") {
+      preserved.push(group);
+      continue;
+    }
+    const hooks = Array.isArray(group.hooks)
+      ? group.hooks.filter((candidate) => !handlerIsManaged(candidate))
+      : [];
+    if (hooks.length > 0 || !Array.isArray(group.hooks)) preserved.push({ ...group, hooks });
+  }
+  preserved.push({ hooks: [handler] });
+  return preserved;
+}
+
+export function ensureClaudeSessionHooks(configDir, tenantId, surface = "claude_cli") {
+  const settingsPath = path.join(configDir, "settings.json");
+  if (!validTenantId(tenantId)) return { settingsPath, events: [], skipped: true };
+  const settings = readJsonObject(settingsPath);
+  const invocation = managedInvocation("claude_code", surface, tenantId);
+  const handler = {
+    type: "command",
+    command: invocation.command,
+    args: invocation.args,
+    timeout: 15,
+    async: true,
+  };
+  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks)
+    ? { ...settings.hooks }
+    : {};
+  for (const event of CLAUDE_SESSION_EVENTS) hooks[event] = mergeEventHook(hooks, event, handler);
+  settings.hooks = hooks;
+  writePrivateJson(settingsPath, settings);
+  return { settingsPath, events: [...CLAUDE_SESSION_EVENTS] };
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function windowsCommandQuote(value) {
+  const text = String(value);
+  if (/[\r\n\0%]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
+  return `"${text.replaceAll('"', '""')}"`;
+}
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalize(value[key])]));
+}
+
+function codexHookHash(event, handler) {
+  const command = process.platform === "win32" && handler.commandWindows
+    ? handler.commandWindows
+    : handler.command;
+  const identity = canonicalize({
+    event_name: event.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").toLowerCase(),
+    hooks: [{
+      type: "command",
+      command,
+      timeout: handler.timeout,
+      async: false,
+    }],
+  });
+  return `sha256:${crypto.createHash("sha256").update(JSON.stringify(identity)).digest("hex")}`;
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+function replaceManagedTrustBlock(configPath, entries) {
+  const current = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+  const start = current.indexOf(CODEX_TRUST_START);
+  let without = current;
+  if (start !== -1) {
+    const end = current.indexOf(CODEX_TRUST_END, start);
+    if (end === -1) throw new Error(`${configPath} has an incomplete Impel session-hook trust block`);
+    without = current.slice(0, start) + current.slice(end + CODEX_TRUST_END.length);
+  }
+  const block = [CODEX_TRUST_START];
+  for (const entry of entries) {
+    block.push(
+      `[hooks.state.${tomlString(entry.key)}]`,
+      `trusted_hash = ${tomlString(entry.hash)}`,
+      "",
+    );
+  }
+  block.push(CODEX_TRUST_END);
+  const next = `${without.trimEnd()}${without.trim() ? "\n\n" : ""}${block.join("\n")}\n`;
+  ensurePrivateDirectory(path.dirname(configPath));
+  const temporaryPath = `${configPath}.tmp-${process.pid}`;
+  try {
+    fs.writeFileSync(temporaryPath, next, { mode: 0o600 });
+    fs.renameSync(temporaryPath, configPath);
+    try { fs.chmodSync(configPath, 0o600); } catch { /* Best effort on Windows. */ }
+  } finally {
+    try { fs.rmSync(temporaryPath, { force: true }); } catch { /* Rename removed it. */ }
+  }
+}
+
+export function ensureCodexSessionHooks(codexHome, tenantId, surface = "codex_cli") {
+  const hooksPath = path.join(codexHome, "hooks.json");
+  if (!validTenantId(tenantId)) return { hooksPath, events: [], skipped: true };
+  const document = readJsonObject(hooksPath);
+  const invocation = managedInvocation("codex", surface, tenantId);
+  const unixCommand = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
+  const windowsTokens = [invocation.command, ...invocation.args].map(windowsCommandQuote).join(" ");
+  // Codex executes commandWindows with `cmd.exe /C`. The outer quote preserves
+  // a quoted executable path when it contains spaces.
+  const windowsCommand = `"${windowsTokens}"`;
+  const handler = {
+    type: "command",
+    command: unixCommand,
+    commandWindows: windowsCommand,
+    timeout: 15,
+  };
+  const hooks = document.hooks && typeof document.hooks === "object" && !Array.isArray(document.hooks)
+    ? { ...document.hooks }
+    : {};
+  const trustEntries = [];
+  for (const event of CODEX_SESSION_EVENTS) {
+    hooks[event] = mergeEventHook(hooks, event, handler);
+    const groupIndex = hooks[event].length - 1;
+    trustEntries.push({ event, groupIndex, hash: codexHookHash(event, handler) });
+  }
+  document.hooks = hooks;
+  writePrivateJson(hooksPath, document);
+  const canonicalHooksPath = fs.realpathSync(hooksPath);
+  for (const entry of trustEntries) {
+    entry.key = `${canonicalHooksPath}:${entry.event.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").toLowerCase()}:${entry.groupIndex}:0`;
+    delete entry.event;
+    delete entry.groupIndex;
+  }
+  const configPath = path.join(codexHome, "config.toml");
+  replaceManagedTrustBlock(configPath, trustEntries);
+  return { hooksPath, configPath, events: [...CODEX_SESSION_EVENTS], trustEntries };
+}