kcp-harness 0.5.0 → 0.5.1

package/dist/cli.js

@@ -36,7 +36,7 @@ governance for any agent. It intercepts tool calls, classifies them
 as knowledge-navigation or pass-through, and routes governed calls
 through the kcp-agent planner before execution.
 `;
-const VERSION = "0.4.1";
+const VERSION = "0.5.1";
 const TEMPLATE = `# kcp-harness configuration
 version: "1.0"
 

package/dist/integrations/claude-code.js

@@ -20,19 +20,99 @@ export function generateClaudeCode(options) {
             hooks: {
                 PreToolUse: [
                     {
-                        matcher: "Read|Edit|Write|Glob|Grep",
+                        matcher: "Bash|Read|Edit|Write|Glob|Grep",
                         hooks: [
                             {
                                 type: "command",
                                 command: "node",
                                 args: ["-e", `
-const args = JSON.parse(process.env.TOOL_INPUT || '{}');
-const path = args.file_path || args.path || '';
-const governed = ${JSON.stringify(paths)}.some(p => path.startsWith(p) || path.includes('/' + p));
-if (governed) {
-  console.log(JSON.stringify({ decision: "block", reason: "Use kcp_load to access governed knowledge at " + path }));
-  process.exit(2);
-}
+const deny = (reason) => {
+  console.log(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  }));
+  process.exit(0);
+};
+// Path matching mirrors src/classifier.ts so native file tools can't slip past
+// with a Bash command, a Glob/Grep pattern, a case variant, or a backslash
+// separator. Plain string ops only — this runs as an inline node script.
+const BS = String.fromCharCode(92);
+const GOV = ${JSON.stringify(paths)}.map((p) => {
+  let b = String(p).split(BS).join("/").toLowerCase();
+  while (b.slice(-1) === "/") b = b.slice(0, -1);
+  return b;
+}).filter(Boolean);
+const norm = (p) => {
+  let n = String(p == null ? "" : p).split(BS).join("/");
+  while (n.indexOf("//") >= 0) n = n.split("//").join("/");
+  if (n.slice(0, 2) === "./") n = n.slice(2);
+  const parts = n.split("/"), out = [];
+  for (let i = 0; i < parts.length; i++) {
+    const s = parts[i];
+    if (s === "..") { if (out.length && out[out.length - 1] !== "..") out.pop(); }
+    else if (s !== "." && s !== "") out.push(s);
+  }
+  return out.join("/").toLowerCase();
+};
+const isGoverned = (t) => {
+  if (!t) return false;
+  const n = norm(t);
+  return GOV.some((b) => n === b || n.indexOf(b + "/") === 0 || n.indexOf("/" + b + "/") >= 0);
+};
+const globPrefix = (pattern) => {
+  const s = String(pattern || "");
+  let idx = -1;
+  for (let i = 0; i < s.length; i++) { if ("*?[{".indexOf(s[i]) >= 0) { idx = i; break; } }
+  if (idx <= 0) return "";
+  const pre = s.slice(0, idx), ls = pre.lastIndexOf("/");
+  if (ls > 0) return pre.slice(0, ls);
+  if (pre.length > 0 && pre.indexOf(".") < 0) { let r = pre; while (r.slice(-1) === "/") r = r.slice(0, -1); return r; }
+  return "";
+};
+const tokens = (cmd) => {
+  const s = String(cmd || ""), seps = " " + String.fromCharCode(9) + String.fromCharCode(10) + ";|&<>()" + String.fromCharCode(34) + String.fromCharCode(39);
+  let cur = "", out = [];
+  for (let i = 0; i < s.length; i++) { const ch = s[i]; if (seps.indexOf(ch) >= 0) { if (cur) { out.push(cur); cur = ""; } } else cur += ch; }
+  if (cur) out.push(cur);
+  return out;
+};
+const bashTarget = (cmd) => {
+  const toks = tokens(cmd);
+  const readCmds = ["cat","head","tail","less","more","vi","vim","nano","code","cp","mv","ln","tar","zip","scp","rsync"];
+  for (let i = 0; i < toks.length; i++) {
+    if (readCmds.indexOf(toks[i]) >= 0) {
+      for (let j = i + 1; j < toks.length; j++) { if (toks[j][0] !== "-" && isGoverned(toks[j])) return toks[j]; }
+    }
+  }
+  if (String(cmd || "").indexOf(">") >= 0) { for (let j = 0; j < toks.length; j++) { if (isGoverned(toks[j])) return toks[j]; } }
+  return "";
+};
+let raw = "";
+process.stdin.on("data", (d) => { raw += d; });
+process.stdin.on("end", () => {
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    // Fail-closed: an unreadable payload means we cannot prove the target is
+    // ungoverned, so we must not let it through.
+    deny("kcp-harness: could not parse PreToolUse input — failing closed");
+    return;
+  }
+  const tool = input.tool_name || "";
+  const a = input.tool_input || {};
+  let targets;
+  if (tool === "Glob" || tool === "Grep") targets = [a.path || "", globPrefix(a.pattern)];
+  else if (tool === "Bash") targets = [bashTarget(a.command)];
+  else targets = [a.file_path || a.path || ""];
+  const hit = targets.filter(Boolean).find(isGoverned);
+  if (hit) {
+    deny("Use kcp_load to access governed knowledge at " + hit);
+  }
+});
                   `.trim()],
                             },
                         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kcp-harness",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "mcpName": "no.cantara/kcp-harness",
   "description": "KCP Compliance Harness — MCP proxy that enforces deterministic knowledge governance for any agent",
   "type": "module",