nemonix-cli 1.0.0

package/src/config/claude-code-config/scripts/claude-code-ai/claude.ts

@@ -0,0 +1,56 @@
+import { createAnthropic } from "@ai-sdk/anthropic";
+import { generateText } from "ai";
+import { getClaudeCodeToken } from "./helper/credentials";
+
+export {
+	getClaudeCodeToken,
+	getClaudeCodeTokenSafe,
+} from "./helper/credentials";
+
+const SYSTEM_PROMPT =
+	"You are Claude Code, Anthropic's official CLI for Claude.";
+
+export type Model = "haiku" | "sonnet" | "opus";
+
+const MODEL_MAP: Record<Model, string> = {
+	haiku: "claude-haiku-4-5-20251001",
+	sonnet: "claude-sonnet-4-5-20250929",
+	opus: "claude-opus-4-5-20251101",
+};
+
+export async function generateTextCC({
+	prompt,
+	system,
+	model = "sonnet",
+}: {
+	prompt: string;
+	system?: string;
+	model?: Model;
+}): Promise<string> {
+	const token = await getClaudeCodeToken();
+
+	const anthropic = createAnthropic({
+		apiKey: "oauth-token",
+		headers: {
+			"anthropic-beta":
+				"claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14",
+			"anthropic-dangerous-direct-browser-access": "true",
+			"x-app": "cli",
+			"User-Agent": "claude-cli/2.0.76 (external, cli)",
+		},
+		fetch: (async (url: RequestInfo | URL, options?: RequestInit) => {
+			const headers = new Headers(options?.headers);
+			headers.delete("x-api-key");
+			headers.set("Authorization", `Bearer ${token}`);
+			return fetch(url, { ...options, headers });
+		}) as typeof fetch,
+	});
+
+	const result = await generateText({
+		model: anthropic(MODEL_MAP[model]),
+		system,
+		prompt,
+	});
+
+	return result.text;
+}

package/src/config/claude-code-config/scripts/claude-code-ai/cli.ts

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+import { parseArgs } from "util";
+import { generateTextCC, type Model } from "./claude";
+
+const { values, positionals } = parseArgs({
+	args: Bun.argv.slice(2),
+	options: {
+		model: {
+			type: "string",
+			short: "m",
+			default: "sonnet",
+		},
+		system: {
+			type: "string",
+			short: "s",
+		},
+	},
+	allowPositionals: true,
+});
+
+const prompt = positionals.join(" ");
+
+if (!prompt) {
+	console.error(
+		"Usage: bun run cli.ts <prompt> [-m opus|sonnet|haiku] [-s system_prompt]",
+	);
+	process.exit(1);
+}
+
+const model = values.model as Model;
+if (!["haiku", "sonnet", "opus"].includes(model)) {
+	console.error(`Invalid model: ${model}. Use: opus, sonnet, or haiku`);
+	process.exit(1);
+}
+
+try {
+	const response = await generateTextCC({
+		prompt,
+		model,
+		system: values.system,
+	});
+	console.log(response);
+} catch (error) {
+	console.error("Error:", error);
+	process.exit(1);
+}

package/src/config/claude-code-config/scripts/claude-code-ai/helper/credentials.ts

@@ -0,0 +1,76 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { $ } from "bun";
+
+interface Credentials {
+	claudeAiOauth: {
+		accessToken: string;
+		refreshToken: string;
+		expiresAt: number;
+		scopes: string[];
+		subscriptionType: string;
+	};
+}
+
+function getHomeDir(): string {
+	return homedir();
+}
+
+function getCredentialsFilePath(): string {
+	const home = getHomeDir();
+	return join(home, ".claude", ".credentials.json");
+}
+
+async function getMacOSKeychainCredentials(): Promise<string> {
+	const result =
+		// ank-121221
+		await $`security find-generic-password -s "Claude Code-credentials" -w`
+			.quiet()
+			.text();
+	const creds: Credentials = JSON.parse(result.trim());
+	return creds.claudeAiOauth.accessToken;
+}
+
+async function getFileCredentials(): Promise<string> {
+	const credentialsPath = getCredentialsFilePath();
+
+	if (!existsSync(credentialsPath)) {
+		throw new Error(`Credentials file not found at ${credentialsPath}`);
+	}
+
+	const content = await readFile(credentialsPath, "utf-8");
+	const creds: Credentials = JSON.parse(content);
+	return creds.claudeAiOauth.accessToken;
+}
+
+export async function getClaudeCodeToken(): Promise<string> {
+	const platform = process.platform;
+
+	if (platform === "darwin") {
+		try {
+			return await getMacOSKeychainCredentials();
+		} catch {
+			return await getFileCredentials();
+		}
+	}
+
+	if (platform === "linux") {
+		return await getFileCredentials();
+	}
+
+	if (platform === "win32") {
+		return await getFileCredentials();
+	}
+
+	throw new Error(`Unsupported platform: ${platform}`);
+}
+
+export async function getClaudeCodeTokenSafe(): Promise<string | null> {
+	try {
+		return await getClaudeCodeToken();
+	} catch {
+		return null;
+	}
+}

package/src/config/claude-code-config/scripts/claude-code-ai/helper/index.ts

@@ -0,0 +1,9 @@
+export { getClaudeCodeToken, getClaudeCodeTokenSafe } from "./credentials";
+export {
+	encodeProjectPath,
+	getClaudeConfigDir,
+	getClaudeCredentialsPath,
+	getClaudeProjectsDir,
+	getClaudeSettingsPath,
+	getHomeDir,
+} from "./paths";

package/src/config/claude-code-config/scripts/claude-code-ai/helper/paths.ts

@@ -0,0 +1,51 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function getHomeDir(): string {
+	return homedir();
+}
+
+export function getClaudeConfigDir(): string {
+	const home = getHomeDir();
+
+	const newPath = join(home, ".config", "claude");
+	if (existsSync(newPath)) {
+		return newPath;
+	}
+
+	const legacyPath = join(home, ".claude");
+	if (existsSync(legacyPath)) {
+		return legacyPath;
+	}
+
+	return newPath;
+}
+
+export function getClaudeCredentialsPath(): string {
+	const home = getHomeDir();
+	return join(home, ".claude", ".credentials.json");
+}
+
+export function getClaudeSettingsPath(): string {
+	return join(getClaudeConfigDir(), "settings.json");
+}
+
+export function getClaudeProjectsDir(): string {
+	return join(getClaudeConfigDir(), "projects");
+}
+
+export function encodeProjectPath(absolutePath: string): string {
+	const normalizedPath = absolutePath.replace(/[/\\]+$/, "");
+
+	const claudeProjectsDir = getClaudeProjectsDir();
+	if (normalizedPath.includes(join(".claude", "projects"))) {
+		return normalizedPath;
+	}
+
+	const encoded = normalizedPath
+		.replace(/[/\\]/g, "-")
+		.replace(/\./g, "-")
+		.replace(/:/g, "");
+	return join(claudeProjectsDir, encoded);
+}

package/src/config/claude-code-config/scripts/command-validator/CLAUDE.md

@@ -0,0 +1,112 @@
+# Command Validator - CLAUDE.md
+
+This file provides guidance to Claude Code when working with the command-validator security package.
+
+## Project Purpose
+
+**Command Validator** is a security validation package for Claude Code's PreToolUse hook. It validates bash commands before execution to prevent dangerous operations like:
+- System destruction (rm -rf /, dd, mkfs)
+- Privilege escalation (sudo, chmod, passwd)
+- Network attacks (nc, nmap, telnet)
+- Malicious patterns (fork bombs, backdoors)
+- Sensitive file access (/etc/passwd, /etc/shadow)
+
+The validator is integrated as a hook in Claude Code settings and blocks dangerous commands while allowing safe operations.
+
+## CRITICAL: This Project Uses BUN
+
+**NEVER use npm or node commands. This project exclusively uses BUN.**
+
+## Development Commands
+
+**CRITICAL**: Only use these BUN commands:
+
+### Testing (Primary Workflow)
+- `bun test` - Run all tests with Vitest
+- `bun test:ui` - Run tests with UI interface
+- `bun run test` - Alternative test command
+
+### Code Quality
+- `bun run lint` - Run Biome linter and auto-fix
+- `bun run format` - Format code with Biome
+- `bunx tsc --noEmit` - TypeScript type checking (no build)
+
+### Execution
+- `bun src/cli.ts` - Run CLI validator directly
+- `bun install` - Install dependencies
+
+## Development Workflow
+
+**CRITICAL**: The majority of work on this project follows this simple cycle:
+
+### Test-Driven Development Cycle
+1. **Run tests**: `bun test`
+2. **Read errors**: Analyze test failures carefully
+3. **Fix the problem**: Make minimal changes to pass tests
+4. **Re-run tests**: `bun test` until ALL tests pass
+5. **Repeat**: Continue cycle until all tests are green
+
+**ALWAYS follow this workflow:**
+```bash
+bun test          # See what's broken
+# Fix the code
+bun test          # Verify fix works
+# Repeat until green
+```
+
+## Architecture Overview
+
+```
+src/
+├── cli.ts                 # CLI entry point (used by Claude Code hook)
+├── lib/
+│   ├── types.ts           # TypeScript interfaces
+│   ├── security-rules.ts  # Security rules database
+│   └── validator.ts       # Core validation logic
+└── __tests__/
+    └── validator.test.ts  # Comprehensive test suite (82+ tests)
+```
+
+### Key Files
+- **@scripts/command-validator/src/lib/validator.ts** - Core CommandValidator class
+- **@scripts/command-validator/src/lib/security-rules.ts** - Security rules database
+- **@scripts/command-validator/src/__tests__/validator.test.ts** - All test cases
+
+## Code Conventions
+
+- **TypeScript**: Strict mode enabled
+- **Testing**: Vitest with comprehensive coverage (82+ tests)
+- **Linting**: Biome for formatting and linting
+- **Imports**: ESM module format only
+
+## Security Test Categories
+
+The test suite validates:
+1. **Safe Commands**: ls, git, npm, cat, cp, mv, mkdir (must allow)
+2. **Dangerous Commands**: rm -rf /, dd, sudo, passwd (must block)
+3. **Special Cases**: rm -rf safety rules, protected paths, command chains
+4. **Malicious Patterns**: Fork bombs, backdoors, log manipulation
+
+## IMPORTANT: Workflow Rules
+
+- **BEFORE making changes**: Run `bun test` to see current state
+- **AFTER any code change**: Run `bun test` to verify
+- **NEVER assume tests pass**: Always verify with `bun test`
+- **Fix one test at a time**: Make minimal changes, then re-test
+- **Use Bun ONLY**: No npm, node, or yarn commands
+
+## Common Modifications
+
+Most changes involve:
+1. **Adding new security rules** → Update @scripts/command-validator/src/lib/security-rules.ts
+2. **Modifying validation logic** → Update @scripts/command-validator/src/lib/validator.ts
+3. **Adding test cases** → Update @scripts/command-validator/src/__tests__/validator.test.ts
+4. **Run tests after each change** → `bun test`
+
+## Test Execution Priority
+
+**ALWAYS use the test-driven approach:**
+- Tests define the requirements
+- Code changes must make tests pass
+- All 82+ tests must be green before committing
+- Use `bun test` continuously during development

package/src/config/claude-code-config/scripts/command-validator/README.md

@@ -0,0 +1,147 @@
+# Command Validator
+
+A secure command validation package for Claude Code's PreToolUse hook. This package validates bash commands before execution to prevent dangerous operations.
+
+## Features
+
+- **Comprehensive Security Rules**: Blocks dangerous commands (rm -rf /, dd, mkfs, etc.)
+- **Pattern Matching**: Detects malicious patterns like fork bombs, backdoors, and data exfiltration
+- **Path Protection**: Prevents writes to system directories (/etc, /usr, /bin, etc.)
+- **Command Chaining**: Validates chained commands (&&, ||, ;)
+- **Fully Tested**: 82+ tests with Vitest ensuring reliable validation
+
+## Installation
+
+```bash
+bun install
+```
+
+## Usage
+
+### As a Claude Code Hook
+
+The validator is configured as a PreToolUse hook in Claude Code settings:
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bun /Users/melvynx/.claude/scripts/command-validator/src/cli.ts"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+### Programmatic Usage
+
+```typescript
+import { CommandValidator } from "./src/lib/validator";
+
+const validator = new CommandValidator();
+const result = validator.validate("rm -rf /");
+
+if (!result.isValid) {
+  console.log(`Blocked: ${result.violations.join(", ")}`);
+  console.log(`Severity: ${result.severity}`);
+}
+```
+
+## Testing
+
+```bash
+# Run all tests
+bun test
+
+# Run tests with UI
+bun test:ui
+```
+
+## Test Coverage
+
+The test suite includes:
+
+### Safe Commands (Must Allow)
+- Standard utilities: ls, git, npm, pnpm, node, python
+- File operations: cat, cp, mv, mkdir, touch
+- Safe command chains with &&
+
+### Dangerous Commands (Must Block)
+- System destruction: rm -rf /, dd, mkfs, fdisk
+- Privilege escalation: sudo, chmod, chown, passwd
+- Network attacks: nc, nmap, telnet
+- Malicious patterns: fork bombs, backdoors, log manipulation
+- Sensitive file access: /etc/passwd, /etc/shadow, /etc/sudoers
+
+### Special Cases
+- rm -rf safety: Allows deletions in safe paths (/Users/melvynx/Developer/, /tmp/)
+- Protected paths: Blocks dangerous operations on /etc, /usr, /bin, etc.
+- Binary content detection
+- Command length limits
+
+## Architecture
+
+```
+src/
+├── cli.ts                 # CLI entry point (used by Claude Code hook)
+├── lib/
+│   ├── types.ts           # TypeScript interfaces
+│   ├── security-rules.ts  # Security rules database
+│   └── validator.ts       # Core validation logic
+└── __tests__/
+    └── validator.test.ts  # Comprehensive test suite
+```
+
+## Security Rules
+
+### Critical Commands
+- `del`, `format`, `mkfs`, `shred`, `dd`, `fdisk`, `parted`
+
+### Privilege Escalation
+- `sudo`, `su`, `passwd`, `chpasswd`, `usermod`, `chmod`, `chown`
+
+### Network Commands
+- `nc`, `netcat`, `nmap`, `telnet`, `ssh-keygen`, `iptables`
+
+### System Manipulation
+- `systemctl`, `service`, `kill`, `killall`, `mount`, `umount`
+
+### Protected Paths
+- `/etc/`, `/usr/`, `/sbin/`, `/boot/`, `/sys/`, `/proc/`, `/dev/`, `/root/`
+
+## Security Logs
+
+Security events are logged to `data/security.log` inside the package directory. The log file contains:
+- Timestamp
+- Session ID
+- Tool name
+- Command (truncated to 500 chars)
+- Blocked/allowed status
+- Severity level
+- Violations detected
+
+The `data/` folder is gitignored to prevent committing sensitive log data.
+
+## Development
+
+```bash
+# Run linter
+bun run lint
+
+# Format code
+bun run format
+
+# Type check
+bunx tsc --noEmit
+```
+
+## License
+
+MIT

package/src/config/claude-code-config/scripts/command-validator/src/__tests__/validator.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "bun:test";
+import { CommandValidator } from "../lib/validator";
+
+describe("CommandValidator", () => {
+	const validator = new CommandValidator();
+
+	describe("Commands that MUST be ALLOWED (action: allow)", () => {
+		const allowedCommands = [
+			"ls -la",
+			"pwd",
+			"git status",
+			"git add -A && git commit -m 'Clé API Google gérée côté client'",
+			"npm install",
+			"rm file.txt",
+			"rm -r folder",
+			"rm -f file.txt",
+			"echo 'éàù accents français'",
+			"git commit -m '🚀 emoji test'",
+			"cat /etc/passwd",
+			"curl http://example.com",
+		];
+
+		for (const command of allowedCommands) {
+			it(`should ALLOW: ${command}`, () => {
+				const result = validator.validate(command);
+				expect(result.isValid).toBe(true);
+				expect(result.action).toBe("allow");
+				expect(result.violations).toHaveLength(0);
+			});
+		}
+	});
+
+	describe("Commands that MUST be DENIED (action: deny) - rm -rf ONLY", () => {
+		const deniedCommands = [
+			"rm -rf /",
+			"rm -rf folder",
+			"rm -rf .",
+			"rm -rf /tmp/test",
+			"rm -fr folder",
+			"rm -r -f folder",
+			"rm -f -r folder",
+			"rm -rf /Users/test/.claude/skills",
+			"mkdir test && rm -rf test",
+		];
+
+		for (const command of deniedCommands) {
+			it(`should DENY: ${command}`, () => {
+				const result = validator.validate(command);
+				expect(result.isValid).toBe(false);
+				expect(result.action).toBe("deny");
+				expect(result.severity).toBe("CRITICAL");
+				expect(result.violations[0]).toContain("rm -rf is forbidden");
+			});
+		}
+	});
+
+	describe("Commands that MUST ASK permission (action: ask)", () => {
+		const askCommands = [
+			{ cmd: "sudo apt install", expected: "sudo" },
+			{ cmd: "sudo rm something", expected: "sudo" },
+			{ cmd: "chmod 777 file.txt", expected: "chmod" },
+			{ cmd: "chown root file.txt", expected: "chown" },
+			{ cmd: "dd if=/dev/zero of=test.img", expected: "dd" },
+			{ cmd: "kill -9 1234", expected: "kill" },
+			{ cmd: "killall node", expected: "killall" },
+			{ cmd: "su root", expected: "su" },
+		];
+
+		for (const { cmd, expected } of askCommands) {
+			it(`should ASK for: ${cmd}`, () => {
+				const result = validator.validate(cmd);
+				expect(result.isValid).toBe(false);
+				expect(result.action).toBe("ask");
+				expect(result.severity).toBe("HIGH");
+				expect(result.violations[0]).toContain(expected);
+			});
+		}
+	});
+
+	describe("Edge cases", () => {
+		it("should DENY empty commands", () => {
+			const result = validator.validate("");
+			expect(result.isValid).toBe(false);
+			expect(result.action).toBe("deny");
+		});
+
+		it("should ALLOW commands with accented characters", () => {
+			const result = validator.validate("git commit -m 'éàùç accents'");
+			expect(result.isValid).toBe(true);
+			expect(result.action).toBe("allow");
+		});
+
+		it("should ALLOW commands with emojis", () => {
+			const result = validator.validate("echo '🚀🎉'");
+			expect(result.isValid).toBe(true);
+			expect(result.action).toBe("allow");
+		});
+	});
+});