javi-forge 1.39.3 → 1.39.5

package/assets/claude-hooks/javi-forge-skillguard-pre-tool-use.mjs

@@ -11,6 +11,10 @@ export const SUPPORTED_TOOLS = Object.freeze(["Bash", "PowerShell", "Read", "Wri
 export const POLICY_REGISTRY = Object.freeze({ schemaVersion: 1, policyVersion: 2, diagnosticsMaxBytes: 240 });
 export function resolvePlatformSupport(platform = process.platform) { return platform === "linux" || platform === "win32" ? { supported: true } : { supported: false, reason: "unsupported-platform" }; }
 const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+// The global Codex targets are anchored to the hook process's current-user home,
+// never to an event field or a command token. This is intentionally an exact,
+// two-file allowlist rather than a whole-home or whole-.codex policy.
+const HOST_HOME = os.homedir();
 // Per-agent adapter config (S0 core-extraction): every agent-specific input the guard needs
 // (the isManaged protected-path set, the project-dir source, the managed marker) is resolved by
 // the --agent selector instead of a baked-in literal. The pure evaluate*/utility engine stays
@@ -18,7 +22,8 @@ const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)),
 // byte-identical; codex is defined so the map is agent-generic but wired end-to-end only in a later slice.
 const CLAUDE_MANAGED_SET = Object.freeze({ exact: Object.freeze([".claude/settings.json", ".claude/settings.local.json", ".claude/CLAUDE.md", "CLAUDE.md", ".javi-forge/ci.yaml"]), prefixes: Object.freeze([".claude/hooks/", ".claude/agents/", ".claude/skills/"]), caseFoldExact: Object.freeze(["claude.md", ".claude/claude.md"]) });
 const CODEX_MANAGED_SET = Object.freeze({ exact: Object.freeze([".codex/hooks.json", ".claude/settings.json", ".claude/settings.local.json", ".claude/CLAUDE.md", "CLAUDE.md", ".javi-forge/ci.yaml"]), prefixes: Object.freeze([".claude/hooks/", ".claude/agents/", ".claude/skills/"]), caseFoldExact: Object.freeze(["claude.md", ".claude/claude.md"]) });
-export const AGENT_CONFIGS = Object.freeze({ claude: Object.freeze({ id: "claude", managedSet: CLAUDE_MANAGED_SET, projectDir: Object.freeze({ envVar: "CLAUDE_PROJECT_DIR", fallback: "asset-root" }), marker: MANAGED_MARKER }), codex: Object.freeze({ id: "codex", managedSet: CODEX_MANAGED_SET, projectDir: Object.freeze({ envVar: null, fallback: "cwd" }), marker: "// javi-forge-managed: codex-pretooluse v1" }) });
+const CODEX_GLOBAL_MANAGED_PATHS = Object.freeze([".codex/hooks.json", ".codex/config.toml"]);
+export const AGENT_CONFIGS = Object.freeze({ claude: Object.freeze({ id: "claude", managedSet: CLAUDE_MANAGED_SET, globalManagedPaths: Object.freeze([]), projectDir: Object.freeze({ envVar: "CLAUDE_PROJECT_DIR", fallback: "asset-root" }), marker: MANAGED_MARKER }), codex: Object.freeze({ id: "codex", managedSet: CODEX_MANAGED_SET, globalManagedPaths: CODEX_GLOBAL_MANAGED_PATHS, projectDir: Object.freeze({ envVar: null, fallback: "cwd" }), marker: "// javi-forge-managed: codex-pretooluse v1" }) });
 // Fail-closed agent selector: a missing/unknown --agent means we cannot know what to protect, so refuse.
 function resolveAgentConfig(argv) { const arg = argv.find((value) => typeof value === "string" && value.startsWith("--agent=")); const id = arg === undefined ? undefined : arg.slice("--agent=".length); const config = id === undefined ? undefined : AGENT_CONFIGS[id]; if (!config) fail("invalid-config"); return config; }
 // Project root per agent: the env var when set (Claude = CLAUDE_PROJECT_DIR); otherwise the per-agent
@@ -135,7 +140,8 @@ export function isSensitivePolicyKey(key, platform = process.platform) {
 	if (SENSITIVE_DIRECTORY_SUFFIXES.some((directory) => key.endsWith(directory) || key.includes(`${directory}/`))) return true;
 	return platform === "win32" ? basename.toLowerCase() === "serviceaccountkey.json" : basename === "serviceAccountKey.json";
 }
-function isManaged(key, managedSet = CLAUDE_MANAGED_SET, projectRoot = PROJECT_ROOT) {
+function isManaged(key, managedSet = CLAUDE_MANAGED_SET, projectRoot = PROJECT_ROOT, globalManagedPaths = []) {
+	if (globalManagedPaths.some((relative) => key === canonicalizePolicyPath(path.join(HOST_HOME, relative)))) return true;
 	const project = canonicalizePolicyPath(projectRoot);
 	if (!key.startsWith(`${project}/`) && key !== project) return false;
 	const relative = key.slice(project.length + 1);
@@ -148,7 +154,7 @@ function isManaged(key, managedSet = CLAUDE_MANAGED_SET, projectRoot = PROJECT_R
 function evaluateFile(toolName, filePath, config = AGENT_CONFIGS.claude, projectRoot = PROJECT_ROOT) {
 	const keys = policyPathKeys(filePath);
 	if (keys.some((key) => isSensitivePolicyKey(key))) return { allowed: false, ruleId: "path.sensitive" };
-	if (toolName !== "Read" && keys.some((key) => isManaged(key, config.managedSet, projectRoot))) return { allowed: false, ruleId: "path.managed-config" };
+	if (toolName !== "Read" && keys.some((key) => isManaged(key, config.managedSet, projectRoot, config.globalManagedPaths))) return { allowed: false, ruleId: "path.managed-config" };
 	return { allowed: true };
 }
 function lex(command, powershell = false) {
@@ -753,7 +759,7 @@ function hasManagedLiteral(tokens, cwd, config = AGENT_CONFIGS.claude, projectRo
 	return tokens.some((token) => {
 		if ((token.startsWith("-") && !/^-(?:LiteralPath|Path):/i.test(token)) || !/[\\/.]/.test(token)) return false;
 		try {
-			return isManaged(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot }), config.managedSet, projectRoot);
+			return isManaged(canonicalizePolicyPath(token.replace(/^(?:-LiteralPath:|-Path:)/i, "").replace(/[;,]$/, ""), { base: cwd, projectRoot }), config.managedSet, projectRoot, config.globalManagedPaths);
 		} catch {
 			return false;
 		}
@@ -857,6 +863,7 @@ function evaluateBash(command, cwd, config = AGENT_CONFIGS.claude, projectRoot =
 		if (reduced.ambiguity) return ambiguityDecision(reduced.ambiguity);
 		const tokens = reduced.tokens;
 		const executable = (tokens[0] ?? "").toLowerCase();
+		const executableName = path.basename(executable.replaceAll("\\", "/"));
 		const identity = normalizeLiteralUtilityIdentity(tokens[0] ?? "");
 		const rmOptions = tokens.filter((token) => token.startsWith("-")).join("");
 		if ((executable === "rm" && /r/i.test(rmOptions) && /f/i.test(rmOptions) && tokens.some(isCriticalTarget)) || /^mkfs/.test(executable) || (executable === "dd" && tokens.some((token) => /^of=\/dev\/(?:sd|nvme|vd|disk)/.test(token)))) return { allowed: false, ruleId: "shell.destructive-root" };
@@ -880,8 +887,8 @@ function evaluateBash(command, cwd, config = AGENT_CONFIGS.claude, projectRoot =
 		if (["cat", "less", "more", "head", "tail", "bat", "grep", "rg", "sed", "awk", "source", ".", "cp", "install"].includes(executable) && hasSensitiveLiteral(tokens.slice(1), cwd, projectRoot)) return { allowed: false, ruleId: "shell.sensitive-read" };
 		if (tokens.some((token) => token === "<") && hasSensitiveLiteral(tokens, cwd, projectRoot)) return { allowed: false, ruleId: "shell.sensitive-read" };
 		if (executable === "git" && tokens[1]?.toLowerCase() === "push" && tokens.some((token) => ["-f", "--force", "--force-with-lease"].includes(token.toLowerCase()))) return { allowed: false, ruleId: "shell.force-push" };
-		if (["rm", "mv", "cp", "install", "truncate", "touch", "chmod", "chown", "tee"].includes(executable) && hasManagedLiteral(tokens.slice(1), cwd, config, projectRoot)) return { allowed: false, ruleId: "shell.managed-config-tamper" };
-		if ((/^(?:sed|perl)$/.test(executable) && tokens.some((token) => token.startsWith("-i")) && hasManagedLiteral(tokens, cwd, config, projectRoot)) || (tokens.includes(">") && hasManagedLiteral(tokens, cwd, config, projectRoot))) return { allowed: false, ruleId: "shell.managed-config-tamper" };
+		if (["rm", "mv", "cp", "install", "truncate", "touch", "chmod", "chown", "tee"].includes(executableName) && hasManagedLiteral(tokens.slice(1), cwd, config, projectRoot)) return { allowed: false, ruleId: "shell.managed-config-tamper" };
+		if ((/^(?:sed|perl)$/.test(executableName) && tokens.some((token) => token.startsWith("-i")) && hasManagedLiteral(tokens, cwd, config, projectRoot)) || (tokens.includes(">") && hasManagedLiteral(tokens, cwd, config, projectRoot))) return { allowed: false, ruleId: "shell.managed-config-tamper" };
 		if (/^(?:powershell|pwsh)(?:\.exe)?$/i.test(executable) && tokens.some((token) => /^-(?:enc|encodedcommand)$/i.test(token))) return { allowed: false, ruleId: "shell.obfuscated-interpreter" };
 		if (/^(?:bash|sh|zsh|dash|ksh)$/.test(executable)) {
 			const flag = tokens.findIndex((token) => /^-[^-]*c[^-]*$/.test(token));

package/assets/claude-hooks/manifest.json

@@ -4,7 +4,7 @@
 		"name": "javi-forge-skillguard-pre-tool-use.mjs",
 		"version": 1,
 		"policyVersion": 2,
-		"sha256": "507a57a15f1b967103bb1eefe701a74813d5a9603fa7bcc15579a215b03621e3",
+		"sha256": "f55ece1aea76251ec005f2b731fa44a58b6245fef8150b58486ae062167a2377",
 		"historical": [
 			"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc",
 			"5dc2a5c31131f4ac7d8657c78b950de52776aad6eaefe78ea0d764a9963c4425",
@@ -13,7 +13,8 @@
 			"54a270f28b068450b79547a88ec6f2d4854514392fd5f38ed1d6174ea093d7aa",
 			"9a565cec31d9e091e3fb9420b86685f824733bc1ebe479f086b2b955aba6ef3e",
 			"59fc4224975ad64cfc85bab50ec60d9bd4948070e9d41f42ab43e6d8231c19a1",
-			"6edfbb31ce0551b27e38ae1ffd1daf9cc4bea54f2c86687c5124132af5b8c0af"
+			"6edfbb31ce0551b27e38ae1ffd1daf9cc4bea54f2c86687c5124132af5b8c0af",
+			"507a57a15f1b967103bb1eefe701a74813d5a9603fa7bcc15579a215b03621e3"
 		]
 	},
 	"settingsEntries": {

package/dist/lib/__fixtures__/fake-secure-fs.d.ts

@@ -13,6 +13,8 @@ interface FakeFile {
 }
 /** Per-call fault predicates; every one defaults to "no fault". */
 export interface FakeFaults {
+    closeRefuse?: (dirPath: string) => boolean;
+    reuseFirstHandle?: (dirPath: string) => boolean;
     /** Refuse revalidateIdentity for a path on its Nth (1-based) call. */
     revalidateRefuse?: (target: string, callIndex: number) => boolean;
     /** Refuse proveOwnershipAndMode for a path on its Nth call. */
@@ -57,8 +59,11 @@ export interface FakeSecureFs extends PlatformSecureFs {
     readonly dirs: Set<string>;
     readonly files: Map<string, FakeFile>;
     readonly dirModes: Map<string, number>;
+    readonly events: string[];
+    readonly closeAttempts: string[];
     faults: FakeFaults;
     seedDir(dirPath: string): void;
+    shareDirIdentity(target: string, source: string): void;
     seedFile(filePath: string, bytes: Buffer, mode?: number): void;
     fileText(filePath: string): string | undefined;
     hasBackup(dirPath: string): boolean;

package/dist/lib/__fixtures__/fake-secure-fs.js

@@ -34,6 +34,9 @@ export function makeFakeSecureFs() {
     const endangeringCounts = new Map();
     const writeCounts = new Map();
     const managedCounts = new Map();
+    const events = [];
+    const closeAttempts = [];
+    let handleSeq = 0, firstHandle;
     const inoFor = (p) => {
         let ino = inos.get(p);
         if (ino === undefined) {
@@ -47,11 +50,23 @@ export function makeFakeSecureFs() {
         m.set(key, next);
         return next;
     };
-    const handleFor = (p) => ({
-        path: p,
-        identity: { dev: 1, ino: inoFor(p) },
-        close: async () => { },
-    });
+    const handleFor = (p) => {
+        if (firstHandle && fake.faults.reuseFirstHandle?.(p))
+            return firstHandle;
+        const token = `${p}#${++handleSeq}`;
+        const handle = {
+            path: p,
+            identity: { dev: 1, ino: inoFor(p) },
+            close: async () => {
+                events.push(`close ${token}`);
+                closeAttempts.push(token);
+                if (fake.faults.closeRefuse?.(p))
+                    throw new Error(`close failed ${p}`);
+            },
+        };
+        firstHandle ??= handle;
+        return handle;
+    };
     const isEmptyDir = (p) => {
         const prefix = `${p}/`;
         for (const f of files.keys())
@@ -66,10 +81,15 @@ export function makeFakeSecureFs() {
         dirs,
         files,
         dirModes,
+        events,
+        closeAttempts,
         faults: {},
         seedDir(dirPath) {
             dirs.add(dirPath);
         },
+        shareDirIdentity(target, source) {
+            inos.set(target, inoFor(source));
+        },
         seedFile(filePath, bytes, mode = 0o644) {
             files.set(filePath, { bytes, mode });
         },
@@ -94,6 +114,7 @@ export function makeFakeSecureFs() {
             return okValue(handleFor(dirPath));
         },
         async revalidateIdentity(target, held) {
+            events.push(`revalidate ${target}`);
             const idx = bump(revalidateCounts, target);
             if (fake.faults.revalidateRefuse?.(target, idx)) {
                 return unsafe(`identity drift ${target}`);
@@ -135,6 +156,7 @@ export function makeFakeSecureFs() {
         },
         async createDirExclusive(parent, name, mode) {
             const full = path.join(parent.path, name);
+            events.push(`create ${full}`);
             if (dirs.has(full) || files.has(full))
                 return unsafe(`EEXIST ${full}`);
             dirs.add(full);
@@ -199,6 +221,7 @@ export function makeFakeSecureFs() {
             return ok();
         },
         async rmdirIfIdentityEmpty(handle) {
+            events.push(`rmdir ${handle.path}`);
             if (!dirs.has(handle.path))
                 return unsafe(`rmdir enoent ${handle.path}`);
             if (inoFor(handle.path) !== handle.identity.ino) {

package/dist/lib/secure-fs-transaction.js

@@ -120,11 +120,15 @@ export async function runTransaction(input) {
     // refuse ANY extended entry (lenient-gated THEN strict-managed); only ancestor-
     // only segments loosen. No `process.platform` here — role is expressed by which
     // dirs get proveManagedContainer'd (the managedContainers set).
+    function hold(dirPath, handle) {
+        heldByPath.set(dirPath, handle);
+        if (!heldOrder.includes(handle))
+            heldOrder.push(handle);
+    }
     async function gate(dirPath, handle) {
         // Transfer ownership before refusal-capable proofs so `finally` closes a
         // successfully opened handle even when either proof fails.
-        heldByPath.set(dirPath, handle);
-        heldOrder.push(handle);
+        hold(dirPath, handle);
         must(`ownership ${dirPath}`, await secureFs.proveOwnershipAndMode(dirPath));
         must(`acl ${dirPath}`, await secureFs.proveNoEndangeringAcl(dirPath));
     }
@@ -164,6 +168,7 @@ export async function runTransaction(input) {
         // Own the created segment before post-create validation so any refusal rolls
         // it back and closes its handle.
         createdDirs.push(created);
+        hold(fullPath, created);
         // Post-create identity revalidation + full gate on the new segment.
         must(`revalidate-created ${fullPath}`, await secureFs.revalidateIdentity(fullPath, created.identity));
         await gate(fullPath, created);
@@ -191,6 +196,8 @@ export async function runTransaction(input) {
         }
         return true;
     }
+    let workSucceeded = false;
+    const errors = [];
     try {
         // --- PREFLIGHT: gate the existing chain root..projectDir ---
         for (const dirPath of ancestorChain(projectDir)) {
@@ -240,7 +247,14 @@ export async function runTransaction(input) {
             must(`stage-mode ${tName}`, await secureFs.applyExactMode(path.join(dir.path, tName), prior ? prior.mode : 0o600));
             // Identity revalidation after each writeExclusive (JD-B-005).
             must(`revalidate-staged ${parentPath}`, await secureFs.revalidateIdentity(dir.path, dir.identity));
-            staged.push({ dir, tempName: tName, target: component, prior });
+            const stagedEntry = {
+                dir,
+                tempName: tName,
+                target: component,
+                prior,
+            };
+            staged.push(stagedEntry);
+            stagedEntry.identity = must(`capture-staged ${tName}`, await secureFs.captureFile(path.join(dir.path, tName))).identity;
         }
         // --- PRE-FIRST-RENAME FULL-GATE RE-PROVE (JD-007) ---
         for (const handle of heldOrder) {
@@ -259,7 +273,8 @@ export async function runTransaction(input) {
             }
         }
         // --- COMMIT: asset first, settings second ---
-        for (const entry of staged) {
+        while (staged.length > 0) {
+            const entry = staged[0];
             const base = path.basename(entry.target.path);
             must(`pre-rename ${entry.dir.path}`, await secureFs.revalidateIdentity(entry.dir.path, entry.dir.identity));
             const wroteHash = sha256(entry.target.desired);
@@ -273,6 +288,7 @@ export async function runTransaction(input) {
                     wasAbsent: entry.target.wasAbsent,
                     prior: entry.prior,
                 });
+                staged.shift();
             }
             else if (renamed.mutation === "unknown") {
                 unknownRenameTarget = entry.target.path;
@@ -280,35 +296,38 @@ export async function runTransaction(input) {
             must(`rename ${base}`, renamed);
             must(`post-rename ${entry.dir.path}`, await secureFs.revalidateIdentity(entry.dir.path, entry.dir.identity));
         }
-        return {
-            ok: true,
-            committed: committed.map((c) => c.path),
-            backups,
-            errors: [],
-        };
+        workSucceeded = true;
     }
     catch (error) {
-        const errors = [
-            error instanceof TxAbort ? error.message : String(error),
-        ];
+        errors.push(error instanceof TxAbort ? error.message : String(error));
         if (unknownRenameTarget) {
             errors.push(`STOP: unknown rename outcome at ${unknownRenameTarget}; manual recovery; no rollback or directory cleanup`);
         }
         else {
-            await rollback(committed, createdDirs, errors);
+            try {
+                await rollback(committed, staged, createdDirs, errors);
+            }
+            catch (rollbackError) {
+                errors.push(`rollback: ${String(rollbackError)}`);
+            }
         }
-        return {
-            ok: false,
-            committed: committed.map((c) => c.path),
-            backups,
-            errors,
-        };
     }
     finally {
-        for (const handle of new Set([...createdDirs, ...heldOrder])) {
-            await handle.close().catch(() => { });
+        for (const handle of heldOrder) {
+            try {
+                await handle.close();
+            }
+            catch (error) {
+                errors.push(`close ${handle.path}: ${String(error)}`);
+            }
         }
     }
+    return {
+        ok: workSucceeded && errors.length === 0,
+        committed: committed.map((c) => c.path),
+        backups,
+        errors,
+    };
     /** A rejected or malformed rename reply never proves absence of mutation. */
     async function observeRename(dir, from, to) {
         try {
@@ -340,7 +359,7 @@ export async function runTransaction(input) {
         }
         throw new TxAbort("backup", `no exclusive backup name after ${BACKUP_NONCE_CANDIDATES}`);
     }
-    async function rollback(done, created, errors) {
+    async function rollback(done, pending, created, errors) {
         for (const entry of [...done].reverse()) {
             if (!(await gateStillValid())) {
                 errors.push(`STOP: lost parent-chain proof; manual recovery at ${entry.path}`);
@@ -393,6 +412,14 @@ export async function runTransaction(input) {
                 }
             }
         }
+        for (const entry of pending) {
+            const identity = entry.identity ??
+                must(`recapture-staged ${entry.tempName}`, await secureFs.captureFile(path.join(entry.dir.path, entry.tempName))).identity;
+            const removed = await secureFs.unlinkIfIdentity(entry.dir, entry.tempName, identity);
+            const detail = removed.detail ?? removed.refusal;
+            if (!removed.ok)
+                errors.push(`cleanup ${entry.tempName}: ${detail}`);
+        }
         // Remove only tx-created, identity-matched, still-empty segments, child-first.
         for (const handle of [...created].reverse()) {
             await secureFs.rmdirIfIdentityEmpty(handle);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.39.3",
+	"version": "1.39.5",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {