optimus-tool-call 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +191 -0
- package/dist/index.d.ts +9 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +128 -0
- package/dist/index.js.map +1 -0
- package/dist/lib/classify/builtins.d.ts +7 -0
- package/dist/lib/classify/builtins.d.ts.map +1 -0
- package/dist/lib/classify/builtins.js +107 -0
- package/dist/lib/classify/builtins.js.map +1 -0
- package/dist/lib/classify/constants.d.ts +36 -0
- package/dist/lib/classify/constants.d.ts.map +1 -0
- package/dist/lib/classify/constants.js +35 -0
- package/dist/lib/classify/constants.js.map +1 -0
- package/dist/lib/classify/dispatch.d.ts +8 -0
- package/dist/lib/classify/dispatch.d.ts.map +1 -0
- package/dist/lib/classify/dispatch.js +95 -0
- package/dist/lib/classify/dispatch.js.map +1 -0
- package/dist/lib/classify/flags.d.ts +6 -0
- package/dist/lib/classify/flags.d.ts.map +1 -0
- package/dist/lib/classify/flags.js +19 -0
- package/dist/lib/classify/flags.js.map +1 -0
- package/dist/lib/classify/handlers/database-cli.d.ts +3 -0
- package/dist/lib/classify/handlers/database-cli.d.ts.map +1 -0
- package/dist/lib/classify/handlers/database-cli.js +68 -0
- package/dist/lib/classify/handlers/database-cli.js.map +1 -0
- package/dist/lib/classify/handlers/docker.d.ts +6 -0
- package/dist/lib/classify/handlers/docker.d.ts.map +1 -0
- package/dist/lib/classify/handlers/docker.js +27 -0
- package/dist/lib/classify/handlers/docker.js.map +1 -0
- package/dist/lib/classify/handlers/fs-delete.d.ts +6 -0
- package/dist/lib/classify/handlers/fs-delete.d.ts.map +1 -0
- package/dist/lib/classify/handlers/fs-delete.js +14 -0
- package/dist/lib/classify/handlers/fs-delete.js.map +1 -0
- package/dist/lib/classify/handlers/git.d.ts +6 -0
- package/dist/lib/classify/handlers/git.d.ts.map +1 -0
- package/dist/lib/classify/handlers/git.js +83 -0
- package/dist/lib/classify/handlers/git.js.map +1 -0
- package/dist/lib/classify/handlers/network-http.d.ts +10 -0
- package/dist/lib/classify/handlers/network-http.d.ts.map +1 -0
- package/dist/lib/classify/handlers/network-http.js +46 -0
- package/dist/lib/classify/handlers/network-http.js.map +1 -0
- package/dist/lib/classify/handlers/packages.d.ts +6 -0
- package/dist/lib/classify/handlers/packages.d.ts.map +1 -0
- package/dist/lib/classify/handlers/packages.js +18 -0
- package/dist/lib/classify/handlers/packages.js.map +1 -0
- package/dist/lib/classify/handlers/sed-awk.d.ts +10 -0
- package/dist/lib/classify/handlers/sed-awk.d.ts.map +1 -0
- package/dist/lib/classify/handlers/sed-awk.js +40 -0
- package/dist/lib/classify/handlers/sed-awk.js.map +1 -0
- package/dist/lib/classify/handlers/shell-and-runtime.d.ts +14 -0
- package/dist/lib/classify/handlers/shell-and-runtime.d.ts.map +1 -0
- package/dist/lib/classify/handlers/shell-and-runtime.js +75 -0
- package/dist/lib/classify/handlers/shell-and-runtime.js.map +1 -0
- package/dist/lib/classify/index.d.ts +6 -0
- package/dist/lib/classify/index.d.ts.map +1 -0
- package/dist/lib/classify/index.js +6 -0
- package/dist/lib/classify/index.js.map +1 -0
- package/dist/lib/classify/interpreter.d.ts +5 -0
- package/dist/lib/classify/interpreter.d.ts.map +1 -0
- package/dist/lib/classify/interpreter.js +16 -0
- package/dist/lib/classify/interpreter.js.map +1 -0
- package/dist/lib/classify/pipeline.d.ts +10 -0
- package/dist/lib/classify/pipeline.d.ts.map +1 -0
- package/dist/lib/classify/pipeline.js +105 -0
- package/dist/lib/classify/pipeline.js.map +1 -0
- package/dist/lib/classify.d.ts +2 -0
- package/dist/lib/classify.d.ts.map +1 -0
- package/dist/lib/classify.js +2 -0
- package/dist/lib/classify.js.map +1 -0
- package/dist/lib/streaming.d.ts +17 -0
- package/dist/lib/streaming.d.ts.map +1 -0
- package/dist/lib/streaming.js +166 -0
- package/dist/lib/streaming.js.map +1 -0
- package/dist/lib/telemetry/build-event.d.ts +6 -0
- package/dist/lib/telemetry/build-event.d.ts.map +1 -0
- package/dist/lib/telemetry/build-event.js +115 -0
- package/dist/lib/telemetry/build-event.js.map +1 -0
- package/dist/lib/telemetry/command-tokenize.d.ts +6 -0
- package/dist/lib/telemetry/command-tokenize.d.ts.map +1 -0
- package/dist/lib/telemetry/command-tokenize.js +38 -0
- package/dist/lib/telemetry/command-tokenize.js.map +1 -0
- package/dist/lib/telemetry/index.d.ts +9 -0
- package/dist/lib/telemetry/index.d.ts.map +1 -0
- package/dist/lib/telemetry/index.js +9 -0
- package/dist/lib/telemetry/index.js.map +1 -0
- package/dist/lib/telemetry/sensitivity.d.ts +7 -0
- package/dist/lib/telemetry/sensitivity.d.ts.map +1 -0
- package/dist/lib/telemetry/sensitivity.js +81 -0
- package/dist/lib/telemetry/sensitivity.js.map +1 -0
- package/dist/lib/telemetry/serialize.d.ts +3 -0
- package/dist/lib/telemetry/serialize.d.ts.map +1 -0
- package/dist/lib/telemetry/serialize.js +17 -0
- package/dist/lib/telemetry/serialize.js.map +1 -0
- package/dist/lib/telemetry/types.d.ts +36 -0
- package/dist/lib/telemetry/types.d.ts.map +1 -0
- package/dist/lib/telemetry/types.js +14 -0
- package/dist/lib/telemetry/types.js.map +1 -0
- package/dist/lib/telemetry.d.ts +2 -0
- package/dist/lib/telemetry.d.ts.map +1 -0
- package/dist/lib/telemetry.js +2 -0
- package/dist/lib/telemetry.js.map +1 -0
- package/dist/test/classify.test.d.ts +2 -0
- package/dist/test/classify.test.d.ts.map +1 -0
- package/dist/test/classify.test.js +210 -0
- package/dist/test/classify.test.js.map +1 -0
- package/dist/test/index.test.d.ts +2 -0
- package/dist/test/index.test.d.ts.map +1 -0
- package/dist/test/index.test.js +376 -0
- package/dist/test/index.test.js.map +1 -0
- package/dist/test/pipeline.test.d.ts +2 -0
- package/dist/test/pipeline.test.d.ts.map +1 -0
- package/dist/test/pipeline.test.js +139 -0
- package/dist/test/pipeline.test.js.map +1 -0
- package/dist/test/sensitivity.test.d.ts +2 -0
- package/dist/test/sensitivity.test.d.ts.map +1 -0
- package/dist/test/sensitivity.test.js +192 -0
- package/dist/test/sensitivity.test.js.map +1 -0
- package/dist/test/streaming.test.d.ts +2 -0
- package/dist/test/streaming.test.d.ts.map +1 -0
- package/dist/test/streaming.test.js +202 -0
- package/dist/test/streaming.test.js.map +1 -0
- package/dist/test/telemetry.test.d.ts +2 -0
- package/dist/test/telemetry.test.d.ts.map +1 -0
- package/dist/test/telemetry.test.js +204 -0
- package/dist/test/telemetry.test.js.map +1 -0
- package/dist/test/tokenize.test.d.ts +2 -0
- package/dist/test/tokenize.test.d.ts.map +1 -0
- package/dist/test/tokenize.test.js +157 -0
- package/dist/test/tokenize.test.js.map +1 -0
- package/package.json +47 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Optimus Labs
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,191 @@
|
|
|
1
|
+
# optimus-tool-call
|
|
2
|
+
|
|
3
|
+
Passive, non-blocking audit sensor for tool calls from coding agents (Claude Code, Cursor, GitHub Copilot, etc.).
|
|
4
|
+
|
|
5
|
+
## Features
|
|
6
|
+
|
|
7
|
+
- **50+ command classifiers** - Full nah taxonomy coverage
|
|
8
|
+
- **40+ action types** - Comprehensive security categorization
|
|
9
|
+
- **Real-time telemetry** - Async event streaming to backend
|
|
10
|
+
- **Zero developer friction** - <50ms p99 latency, never blocks execution
|
|
11
|
+
- **Smart parsing** - Handles pipes, redirects, command chains, shell builtins
|
|
12
|
+
- **Flag-based detection** - Context-aware classification (sed -i, curl -X POST, make --dry-run, etc.)
|
|
13
|
+
|
|
14
|
+
## How It Works
|
|
15
|
+
|
|
16
|
+
1. **Hook Integration**: Integrates with Claude Code PreToolUse hooks
|
|
17
|
+
2. **Command Classification**: Parses and classifies each tool call into an action type
|
|
18
|
+
3. **Telemetry Event**: Creates event with classified action, file paths, session info
|
|
19
|
+
4. **Async Streaming**: Non-blocking queue sends events to backend in batches
|
|
20
|
+
5. **Backend Severity**: Django backend assigns severity (critical/high/medium/low/info)
|
|
21
|
+
6. **Frontend Dashboard**: Real-time audit log with 2-second polling
|
|
22
|
+
|
|
23
|
+
## Installation
|
|
24
|
+
|
|
25
|
+
```bash
|
|
26
|
+
npm install @optimus/tool-call
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Usage
|
|
30
|
+
|
|
31
|
+
Via PreToolUse hook (automatic in Claude Code):
|
|
32
|
+
|
|
33
|
+
```json
|
|
34
|
+
{
|
|
35
|
+
"preToolUse": {
|
|
36
|
+
"matcher": "*",
|
|
37
|
+
"command": "node path/to/optimus-tool-call/dist/index.js"
|
|
38
|
+
}
|
|
39
|
+
}
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
The hook:
|
|
43
|
+
- Classifies the tool call
|
|
44
|
+
- Extracts relevant metadata (files, commands, patterns)
|
|
45
|
+
- Queues telemetry event
|
|
46
|
+
- Returns `{"continue": true, "permission": "allow"}` (never blocks)
|
|
47
|
+
|
|
48
|
+
## Command Coverage
|
|
49
|
+
|
|
50
|
+
See [COMMAND_COVERAGE.md](./COMMAND_COVERAGE.md) for complete list of 50+ supported commands and their classifications.
|
|
51
|
+
|
|
52
|
+
### Quick Examples
|
|
53
|
+
|
|
54
|
+
```
|
|
55
|
+
Filesystem:
|
|
56
|
+
read: cat, grep, ls, find, head, tail, which
|
|
57
|
+
write: echo, touch, mkdir, cp, mv, chmod
|
|
58
|
+
delete: rm
|
|
59
|
+
|
|
60
|
+
Git:
|
|
61
|
+
safe: log, status, diff, branch
|
|
62
|
+
write: add, commit, checkout, pull
|
|
63
|
+
history_rewrite: push --force, reset --hard, rebase
|
|
64
|
+
|
|
65
|
+
Network:
|
|
66
|
+
outbound: curl, wget, ssh
|
|
67
|
+
write: curl --data, scp, rsync
|
|
68
|
+
|
|
69
|
+
Language Execution:
|
|
70
|
+
python, node, ruby, bash, source, gdb
|
|
71
|
+
|
|
72
|
+
Text Processing:
|
|
73
|
+
sed -i → filesystem_write
|
|
74
|
+
awk with system() → lang_exec
|
|
75
|
+
|
|
76
|
+
And 30+ more...
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
## Action Types
|
|
80
|
+
|
|
81
|
+
| Type | Examples | Severity |
|
|
82
|
+
|------|----------|----------|
|
|
83
|
+
| `filesystem_read` | cat, grep, ls, find, head | low |
|
|
84
|
+
| `filesystem_write` | echo, touch, mkdir, cp, mv | medium |
|
|
85
|
+
| `filesystem_delete` | rm | medium |
|
|
86
|
+
| `git_safe` | git log, git status | low |
|
|
87
|
+
| `git_write` | git add, git commit | medium |
|
|
88
|
+
| `git_remote_write` | git push | medium |
|
|
89
|
+
| `git_discard` | git branch -d | medium |
|
|
90
|
+
| `git_history_rewrite` | git push --force, git rebase | critical |
|
|
91
|
+
| `network_outbound` | curl GET, wget | low |
|
|
92
|
+
| `network_write` | curl POST, scp, rsync | high |
|
|
93
|
+
| `network_diagnostic` | ping, traceroute | low |
|
|
94
|
+
| `package_install` | npm install, pip install | high |
|
|
95
|
+
| `package_run` | npm run | medium |
|
|
96
|
+
| `lang_exec` | python, node, bash, gdb | high |
|
|
97
|
+
| `process_signal` | kill, pkill | high |
|
|
98
|
+
| `container_read` | docker ps, docker logs | low |
|
|
99
|
+
| `container_write` | docker build, docker create | medium |
|
|
100
|
+
| `container_exec` | docker run, docker exec | medium |
|
|
101
|
+
| `container_destructive` | docker rm, docker stop | high |
|
|
102
|
+
| `service_write` | systemctl start, service restart | high |
|
|
103
|
+
| `agent_exec_bypass` | (reserved for future) | critical |
|
|
104
|
+
| `obfuscated` | (reserved for future) | critical |
|
|
105
|
+
|
|
106
|
+
## Configuration
|
|
107
|
+
|
|
108
|
+
Environment variables (optional):
|
|
109
|
+
|
|
110
|
+
```bash
|
|
111
|
+
OPTIMUS_API_URL=http://localhost:8080 # Backend URL (default: http://localhost:8080)
|
|
112
|
+
OPTIMUS_API_TOKEN=<bearer-token> # Auth token (optional)
|
|
113
|
+
OPTIMUS_BATCH_SIZE=50 # Batch size before flush (default: 1 for testing, 50 for prod)
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
## Architecture
|
|
117
|
+
|
|
118
|
+
```
|
|
119
|
+
┌─────────────────────────────────────────────┐
|
|
120
|
+
│ Coding Agent (Claude Code, Cursor, etc.) │
|
|
121
|
+
└────────────────────┬────────────────────────┘
|
|
122
|
+
│ PreToolUse hook
|
|
123
|
+
▼
|
|
124
|
+
┌─────────────────────────────────────────────┐
|
|
125
|
+
│ optimus-tool-call (TypeScript) │
|
|
126
|
+
│ ├─ Classify command into action type │
|
|
127
|
+
│ ├─ Extract file paths, patterns, etc. │
|
|
128
|
+
│ ├─ Create telemetry event │
|
|
129
|
+
│ └─ Queue for async streaming │
|
|
130
|
+
└────────────────────┬────────────────────────┘
|
|
131
|
+
│ Non-blocking async
|
|
132
|
+
▼
|
|
133
|
+
┌─────────────────────────────────────────────┐
|
|
134
|
+
│ Django Backend (optimus_security) │
|
|
135
|
+
│ ├─ Receive batched events │
|
|
136
|
+
│ ├─ Calculate severity │
|
|
137
|
+
│ ├─ Store in SQLite │
|
|
138
|
+
│ └─ Expose via REST API │
|
|
139
|
+
└────────────────────┬────────────────────────┘
|
|
140
|
+
│ /api/tool-calls/events/recent/
|
|
141
|
+
▼
|
|
142
|
+
┌─────────────────────────────────────────────┐
|
|
143
|
+
│ Frontend Dashboard (React) │
|
|
144
|
+
│ ├─ Real-time audit log (2s polling) │
|
|
145
|
+
│ ├─ Color-coded severity/agent │
|
|
146
|
+
│ └─ Expandable command details │
|
|
147
|
+
└─────────────────────────────────────────────┘
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
## Development
|
|
151
|
+
|
|
152
|
+
```bash
|
|
153
|
+
npm install
|
|
154
|
+
npm run build
|
|
155
|
+
npm run test
|
|
156
|
+
```
|
|
157
|
+
|
|
158
|
+
## Testing
|
|
159
|
+
|
|
160
|
+
E2E test with various commands:
|
|
161
|
+
|
|
162
|
+
```bash
|
|
163
|
+
./test-e2e.sh
|
|
164
|
+
```
|
|
165
|
+
|
|
166
|
+
This will:
|
|
167
|
+
1. Clear the audit log
|
|
168
|
+
2. Run 50+ diverse commands (filesystem, git, network, package, etc.)
|
|
169
|
+
3. Verify correct classification for each
|
|
170
|
+
4. Display coverage summary
|
|
171
|
+
|
|
172
|
+
## Performance
|
|
173
|
+
|
|
174
|
+
- **Classification latency**: <1ms per command
|
|
175
|
+
- **Telemetry overhead**: <50ms p99 (async, non-blocking)
|
|
176
|
+
- **Memory**: ~10MB resident (minimal buffering)
|
|
177
|
+
- **CPU**: Negligible (event-driven)
|
|
178
|
+
|
|
179
|
+
## Safety
|
|
180
|
+
|
|
181
|
+
- ✅ Never blocks agent execution
|
|
182
|
+
- ✅ Always returns `permission: "allow"`
|
|
183
|
+
- ✅ Errors logged but never thrown
|
|
184
|
+
- ✅ Graceful degradation if backend unavailable
|
|
185
|
+
- ✅ Batch timeout ensures events flush (5s default)
|
|
186
|
+
|
|
187
|
+
## References
|
|
188
|
+
|
|
189
|
+
- Based on nah taxonomy: https://github.com/manuelschipper/nah
|
|
190
|
+
- Integrated with Optimus Labs security platform
|
|
191
|
+
- Part of agent compliance and audit infrastructure
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/**
|
|
3
|
+
* optimus-tool-call — agentic audit sensor entry point
|
|
4
|
+
*
|
|
5
|
+
* Reads hook JSON from stdin, classifies tool call, builds telemetry event,
|
|
6
|
+
* streams to backend, returns allow response.
|
|
7
|
+
*/
|
|
8
|
+
export {};
|
|
9
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG"}
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,128 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/**
|
|
3
|
+
* optimus-tool-call — agentic audit sensor entry point
|
|
4
|
+
*
|
|
5
|
+
* Reads hook JSON from stdin, classifies tool call, builds telemetry event,
|
|
6
|
+
* streams to backend, returns allow response.
|
|
7
|
+
*/
|
|
8
|
+
import { buildTelemetryEvent, eventToDict } from "./lib/telemetry.js";
|
|
9
|
+
import { queueEvent, ensureShutdown } from "./lib/streaming.js";
|
|
10
|
+
async function main() {
|
|
11
|
+
// Setup shutdown handling
|
|
12
|
+
ensureShutdown();
|
|
13
|
+
// Read stdin
|
|
14
|
+
const stdinData = await readStdin();
|
|
15
|
+
// Parse JSON hook payload
|
|
16
|
+
let invocation;
|
|
17
|
+
try {
|
|
18
|
+
const raw = JSON.parse(stdinData);
|
|
19
|
+
invocation = parseHookPayload(raw);
|
|
20
|
+
}
|
|
21
|
+
catch (error) {
|
|
22
|
+
// Invalid JSON or parse error — allow and return
|
|
23
|
+
const response = { continue: true, permission: "allow" };
|
|
24
|
+
console.log(JSON.stringify(response));
|
|
25
|
+
return;
|
|
26
|
+
}
|
|
27
|
+
// Build telemetry event
|
|
28
|
+
const agentIdentity = detectAgent();
|
|
29
|
+
const event = buildTelemetryEvent(invocation, agentIdentity, undefined);
|
|
30
|
+
if (event && event.tool_call_metadata.action_type !== "unknown") {
|
|
31
|
+
// Queue event for streaming to backend
|
|
32
|
+
await queueEvent(event);
|
|
33
|
+
if (process.env.OPTIMUS_DEBUG) {
|
|
34
|
+
const eventDict = eventToDict(event);
|
|
35
|
+
console.error(`[optimus-tool-call] Queued event: ${JSON.stringify(eventDict)}`);
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
// Always return allow (never block)
|
|
39
|
+
const response = { continue: true, permission: "allow" };
|
|
40
|
+
console.log(JSON.stringify(response));
|
|
41
|
+
}
|
|
42
|
+
async function readStdin() {
|
|
43
|
+
/**
|
|
44
|
+
* Read all of stdin until EOF.
|
|
45
|
+
*/
|
|
46
|
+
return new Promise((resolve, reject) => {
|
|
47
|
+
let data = "";
|
|
48
|
+
process.stdin.setEncoding("utf8");
|
|
49
|
+
process.stdin.on("readable", () => {
|
|
50
|
+
let chunk;
|
|
51
|
+
while ((chunk = process.stdin.read()) !== null) {
|
|
52
|
+
data += chunk;
|
|
53
|
+
}
|
|
54
|
+
});
|
|
55
|
+
process.stdin.on("end", () => {
|
|
56
|
+
resolve(data);
|
|
57
|
+
});
|
|
58
|
+
process.stdin.on("error", (err) => {
|
|
59
|
+
reject(err);
|
|
60
|
+
});
|
|
61
|
+
});
|
|
62
|
+
}
|
|
63
|
+
function parseHookPayload(raw) {
|
|
64
|
+
/**
|
|
65
|
+
* Normalize raw hook payload to ToolInvocation.
|
|
66
|
+
* Handles different hook formats (preToolUse, beforeShellExecution, etc.).
|
|
67
|
+
*/
|
|
68
|
+
const getObj = (value) => value && typeof value === "object" && !Array.isArray(value)
|
|
69
|
+
? value
|
|
70
|
+
: null;
|
|
71
|
+
const getStr = (value) => typeof value === "string" && value.length > 0 ? value : null;
|
|
72
|
+
const toolUse = getObj(raw.toolUse);
|
|
73
|
+
const tool = getObj(raw.tool);
|
|
74
|
+
const toolInput = getObj(raw.tool_input) ??
|
|
75
|
+
getObj(raw.toolInput) ??
|
|
76
|
+
getObj(toolUse?.input) ??
|
|
77
|
+
getObj(tool?.input) ??
|
|
78
|
+
{};
|
|
79
|
+
const hookEventName = getStr(raw.hook_event_name) ?? getStr(raw.hookEventName) ?? getStr(raw.hook_event);
|
|
80
|
+
const commandFromTop = getStr(raw.command);
|
|
81
|
+
const commandFromInput = getStr(toolInput.command) ?? getStr(toolInput.cmd);
|
|
82
|
+
const inferredShellCommand = commandFromTop ?? commandFromInput;
|
|
83
|
+
const toolName = getStr(raw.tool_name) ??
|
|
84
|
+
getStr(raw.toolName) ??
|
|
85
|
+
getStr(toolUse?.name) ??
|
|
86
|
+
getStr(tool?.name) ??
|
|
87
|
+
(hookEventName === "beforeShellExecution" || inferredShellCommand ? "Bash" : "Unknown");
|
|
88
|
+
const normalizedToolInput = inferredShellCommand && !("command" in toolInput)
|
|
89
|
+
? { ...toolInput, command: inferredShellCommand }
|
|
90
|
+
: toolInput;
|
|
91
|
+
return {
|
|
92
|
+
tool_name: toolName,
|
|
93
|
+
tool_input: normalizedToolInput,
|
|
94
|
+
tool_use_id: getStr(raw.tool_use_id) ?? getStr(raw.toolUseId),
|
|
95
|
+
cwd: getStr(raw.cwd),
|
|
96
|
+
hook_event_name: hookEventName,
|
|
97
|
+
model: getStr(raw.model),
|
|
98
|
+
agent_message: getStr(raw.agent_message) ?? getStr(raw.agentMessage),
|
|
99
|
+
raw_event: raw,
|
|
100
|
+
};
|
|
101
|
+
}
|
|
102
|
+
function detectAgent() {
|
|
103
|
+
/**
|
|
104
|
+
* Detect which agent is running this hook.
|
|
105
|
+
* Can be extended with environment variables or other signals.
|
|
106
|
+
*/
|
|
107
|
+
// Check environment variables for agent identification
|
|
108
|
+
if (process.env.CLAUDE_CODE_SESSION_ID) {
|
|
109
|
+
return "claude-code";
|
|
110
|
+
}
|
|
111
|
+
if (process.env.CURSOR_SESSION_ID || process.env.CURSOR) {
|
|
112
|
+
return "cursor";
|
|
113
|
+
}
|
|
114
|
+
if (process.env.GITHUB_COPILOT) {
|
|
115
|
+
return "copilot";
|
|
116
|
+
}
|
|
117
|
+
// Default to claude for Claude Code CLI
|
|
118
|
+
return "claude";
|
|
119
|
+
}
|
|
120
|
+
// Run
|
|
121
|
+
main().catch((err) => {
|
|
122
|
+
console.error("[optimus-tool-call] Fatal error:", err);
|
|
123
|
+
// Always return allow on error
|
|
124
|
+
const response = { continue: true, permission: "allow" };
|
|
125
|
+
console.log(JSON.stringify(response));
|
|
126
|
+
process.exit(0); // Never exit non-zero (never block)
|
|
127
|
+
});
|
|
128
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAuB,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEhE,KAAK,UAAU,IAAI;IACjB,0BAA0B;IAC1B,cAAc,EAAE,CAAC;IAEjB,aAAa;IACb,MAAM,SAAS,GAAG,MAAM,SAAS,EAAE,CAAC;IAEpC,0BAA0B;IAC1B,IAAI,UAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iDAAiD;QACjD,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,wBAAwB;IACxB,MAAM,aAAa,GAAG,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAExE,IAAI,KAAK,IAAI,KAAK,CAAC,kBAAkB,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChE,uCAAuC;QACvC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QAExB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,SAAS;IACtB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAElC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YAChC,IAAI,KAAoB,CAAC;YACzB,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA4B;IACpD;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAkC,EAAE,CAChE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAC/C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GACb,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QACnB,EAAE,CAAC;IAEL,MAAM,aAAa,GACjB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAErF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,cAAc,IAAI,gBAAgB,CAAC;IAEhE,MAAM,QAAQ,GACZ,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAClB,CAAC,aAAa,KAAK,sBAAsB,IAAI,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE1F,MAAM,mBAAmB,GACvB,oBAAoB,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC/C,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE;QACjD,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC7D,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACpB,eAAe,EAAE,aAAa;QAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACpE,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB;;;OAGG;IACH,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACvC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wCAAwC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM;AACN,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACvD,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,oCAAoC;AACvD,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
import { type ActionType } from "./constants.js";
|
|
2
|
+
/**
|
|
3
|
+
* Classify common builtins and system utilities (after primary dispatch
|
|
4
|
+
* for rm, git, interpreters, package managers, docker, sudo, and cd).
|
|
5
|
+
*/
|
|
6
|
+
export declare function tryClassifyBuiltin(cmd: string, components: string[]): ActionType | null;
|
|
7
|
+
//# sourceMappingURL=builtins.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"builtins.d.ts","sourceRoot":"","sources":["../../../src/lib/classify/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAKxB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CA6HvF"}
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
import { FILESYSTEM_READ, FILESYSTEM_WRITE, LANG_EXEC, NETWORK_DIAGNOSTIC, NETWORK_OUTBOUND, NETWORK_WRITE, PROCESS_SIGNAL, SERVICE_WRITE, UNKNOWN, } from "./constants.js";
|
|
2
|
+
import { classifyAwk, classifySed } from "./handlers/sed-awk.js";
|
|
3
|
+
import { classifyHttpie } from "./handlers/network-http.js";
|
|
4
|
+
import { classifyMake } from "./handlers/shell-and-runtime.js";
|
|
5
|
+
/**
|
|
6
|
+
* Classify common builtins and system utilities (after primary dispatch
|
|
7
|
+
* for rm, git, interpreters, package managers, docker, sudo, and cd).
|
|
8
|
+
*/
|
|
9
|
+
export function tryClassifyBuiltin(cmd, components) {
|
|
10
|
+
if (["grep", "rg", "egrep", "fgrep"].includes(cmd)) {
|
|
11
|
+
return FILESYSTEM_READ;
|
|
12
|
+
}
|
|
13
|
+
if (["cat", "less", "more", "head", "tail", "wc"].includes(cmd)) {
|
|
14
|
+
if (components.includes(">") || components.includes(">>")) {
|
|
15
|
+
return FILESYSTEM_WRITE;
|
|
16
|
+
}
|
|
17
|
+
return FILESYSTEM_READ;
|
|
18
|
+
}
|
|
19
|
+
if (["ls", "find", "lsof", "netstat"].includes(cmd)) {
|
|
20
|
+
return FILESYSTEM_READ;
|
|
21
|
+
}
|
|
22
|
+
if (["source", "."].includes(cmd)) {
|
|
23
|
+
return LANG_EXEC;
|
|
24
|
+
}
|
|
25
|
+
if (["echo", "printf", "print"].includes(cmd)) {
|
|
26
|
+
if (components.includes(">") || components.includes(">>")) {
|
|
27
|
+
return FILESYSTEM_WRITE;
|
|
28
|
+
}
|
|
29
|
+
return UNKNOWN;
|
|
30
|
+
}
|
|
31
|
+
if (["which", "type", "command"].includes(cmd)) {
|
|
32
|
+
return FILESYSTEM_READ;
|
|
33
|
+
}
|
|
34
|
+
if (["sort", "uniq", "nl", "tac", "rev", "column", "fmt", "fold", "paste", "pr", "split", "expand", "unexpand"].includes(cmd)) {
|
|
35
|
+
return FILESYSTEM_READ;
|
|
36
|
+
}
|
|
37
|
+
if (["touch", "mkdir", "mkfifo"].includes(cmd)) {
|
|
38
|
+
return FILESYSTEM_WRITE;
|
|
39
|
+
}
|
|
40
|
+
if (["chmod", "chown", "chgrp"].includes(cmd)) {
|
|
41
|
+
return FILESYSTEM_WRITE;
|
|
42
|
+
}
|
|
43
|
+
if (["cp", "mv"].includes(cmd)) {
|
|
44
|
+
return FILESYSTEM_WRITE;
|
|
45
|
+
}
|
|
46
|
+
if (["tar", "zip", "unzip", "gzip", "bzip2"].includes(cmd)) {
|
|
47
|
+
const args = components.slice(1);
|
|
48
|
+
if (args.includes("-x") || args.includes("--extract") ||
|
|
49
|
+
args.includes("-c") || args.includes("--create")) {
|
|
50
|
+
return FILESYSTEM_WRITE;
|
|
51
|
+
}
|
|
52
|
+
return FILESYSTEM_READ;
|
|
53
|
+
}
|
|
54
|
+
if (cmd === "sed") {
|
|
55
|
+
return classifySed(components);
|
|
56
|
+
}
|
|
57
|
+
if (["awk", "gawk", "mawk", "nawk"].includes(cmd)) {
|
|
58
|
+
return classifyAwk(components);
|
|
59
|
+
}
|
|
60
|
+
if (["make", "gmake"].includes(cmd)) {
|
|
61
|
+
return classifyMake(components);
|
|
62
|
+
}
|
|
63
|
+
if (["http", "https", "httpie"].includes(cmd)) {
|
|
64
|
+
return classifyHttpie(components);
|
|
65
|
+
}
|
|
66
|
+
if (["ssh", "ssh-keygen"].includes(cmd)) {
|
|
67
|
+
return NETWORK_OUTBOUND;
|
|
68
|
+
}
|
|
69
|
+
if (["scp", "rsync"].includes(cmd)) {
|
|
70
|
+
return NETWORK_WRITE;
|
|
71
|
+
}
|
|
72
|
+
if (["kill", "pkill", "killall"].includes(cmd)) {
|
|
73
|
+
return PROCESS_SIGNAL;
|
|
74
|
+
}
|
|
75
|
+
if (["ping", "traceroute", "tracert", "mtr"].includes(cmd)) {
|
|
76
|
+
return NETWORK_DIAGNOSTIC;
|
|
77
|
+
}
|
|
78
|
+
if (["mount", "umount"].includes(cmd)) {
|
|
79
|
+
return FILESYSTEM_WRITE;
|
|
80
|
+
}
|
|
81
|
+
if (cmd === "dd") {
|
|
82
|
+
return FILESYSTEM_WRITE;
|
|
83
|
+
}
|
|
84
|
+
if (["nc", "netcat", "ncat", "socat"].includes(cmd)) {
|
|
85
|
+
return NETWORK_WRITE;
|
|
86
|
+
}
|
|
87
|
+
if (["strace", "ltrace", "dtrace"].includes(cmd)) {
|
|
88
|
+
return FILESYSTEM_READ;
|
|
89
|
+
}
|
|
90
|
+
if (["ldd", "nm", "objdump", "readelf"].includes(cmd)) {
|
|
91
|
+
return FILESYSTEM_READ;
|
|
92
|
+
}
|
|
93
|
+
if (["gdb", "lldb"].includes(cmd)) {
|
|
94
|
+
return LANG_EXEC;
|
|
95
|
+
}
|
|
96
|
+
if (["iptables", "ufw", "firewall-cmd"].includes(cmd)) {
|
|
97
|
+
return FILESYSTEM_WRITE;
|
|
98
|
+
}
|
|
99
|
+
if (["systemctl", "service"].includes(cmd)) {
|
|
100
|
+
return SERVICE_WRITE;
|
|
101
|
+
}
|
|
102
|
+
if (["sleep", "wait", "true", "false", "nop"].includes(cmd)) {
|
|
103
|
+
return UNKNOWN;
|
|
104
|
+
}
|
|
105
|
+
return null;
|
|
106
|
+
}
|
|
107
|
+
//# sourceMappingURL=builtins.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"builtins.js","sourceRoot":"","sources":["../../../src/lib/classify/builtins.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,aAAa,EACb,OAAO,GAER,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAoB;IAClE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Action type constants (from nah's taxonomy).
|
|
3
|
+
* Reference: https://github.com/manuelschipper/nah/blob/main/src/nah/taxonomy.py
|
|
4
|
+
*/
|
|
5
|
+
export declare const FILESYSTEM_READ = "filesystem_read";
|
|
6
|
+
export declare const FILESYSTEM_WRITE = "filesystem_write";
|
|
7
|
+
export declare const FILESYSTEM_DELETE = "filesystem_delete";
|
|
8
|
+
export declare const GIT_SAFE = "git_safe";
|
|
9
|
+
export declare const GIT_WRITE = "git_write";
|
|
10
|
+
export declare const GIT_REMOTE_WRITE = "git_remote_write";
|
|
11
|
+
export declare const GIT_DISCARD = "git_discard";
|
|
12
|
+
export declare const GIT_HISTORY_REWRITE = "git_history_rewrite";
|
|
13
|
+
export declare const NETWORK_OUTBOUND = "network_outbound";
|
|
14
|
+
export declare const NETWORK_WRITE = "network_write";
|
|
15
|
+
export declare const NETWORK_DIAGNOSTIC = "network_diagnostic";
|
|
16
|
+
export declare const WEBFETCH = "webfetch";
|
|
17
|
+
export declare const WEBSEARCH = "websearch";
|
|
18
|
+
export declare const PACKAGE_INSTALL = "package_install";
|
|
19
|
+
export declare const PACKAGE_RUN = "package_run";
|
|
20
|
+
export declare const PACKAGE_UNINSTALL = "package_uninstall";
|
|
21
|
+
export declare const LANG_EXEC = "lang_exec";
|
|
22
|
+
export declare const PROCESS_SIGNAL = "process_signal";
|
|
23
|
+
export declare const DB_READ = "db_read";
|
|
24
|
+
export declare const DB_WRITE = "db_write";
|
|
25
|
+
export declare const CONTAINER_READ = "container_read";
|
|
26
|
+
export declare const CONTAINER_WRITE = "container_write";
|
|
27
|
+
export declare const CONTAINER_EXEC = "container_exec";
|
|
28
|
+
export declare const CONTAINER_DESTRUCTIVE = "container_destructive";
|
|
29
|
+
export declare const SERVICE_READ = "service_read";
|
|
30
|
+
export declare const SERVICE_WRITE = "service_write";
|
|
31
|
+
export declare const SERVICE_DESTRUCTIVE = "service_destructive";
|
|
32
|
+
export declare const AGENT_EXEC_BYPASS = "agent_exec_bypass";
|
|
33
|
+
export declare const OBFUSCATED = "obfuscated";
|
|
34
|
+
export declare const UNKNOWN = "unknown";
|
|
35
|
+
export type ActionType = string;
|
|
36
|
+
//# sourceMappingURL=constants.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/lib/classify/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,eAAO,MAAM,OAAO,YAAY,CAAC;AACjC,eAAO,MAAM,QAAQ,aAAa,CAAC;AAEnC,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,UAAU,eAAe,CAAC;AAEvC,eAAO,MAAM,OAAO,YAAY,CAAC;AAEjC,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC"}
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Action type constants (from nah's taxonomy).
|
|
3
|
+
* Reference: https://github.com/manuelschipper/nah/blob/main/src/nah/taxonomy.py
|
|
4
|
+
*/
|
|
5
|
+
export const FILESYSTEM_READ = "filesystem_read";
|
|
6
|
+
export const FILESYSTEM_WRITE = "filesystem_write";
|
|
7
|
+
export const FILESYSTEM_DELETE = "filesystem_delete";
|
|
8
|
+
export const GIT_SAFE = "git_safe";
|
|
9
|
+
export const GIT_WRITE = "git_write";
|
|
10
|
+
export const GIT_REMOTE_WRITE = "git_remote_write";
|
|
11
|
+
export const GIT_DISCARD = "git_discard";
|
|
12
|
+
export const GIT_HISTORY_REWRITE = "git_history_rewrite";
|
|
13
|
+
export const NETWORK_OUTBOUND = "network_outbound";
|
|
14
|
+
export const NETWORK_WRITE = "network_write";
|
|
15
|
+
export const NETWORK_DIAGNOSTIC = "network_diagnostic";
|
|
16
|
+
export const WEBFETCH = "webfetch";
|
|
17
|
+
export const WEBSEARCH = "websearch";
|
|
18
|
+
export const PACKAGE_INSTALL = "package_install";
|
|
19
|
+
export const PACKAGE_RUN = "package_run";
|
|
20
|
+
export const PACKAGE_UNINSTALL = "package_uninstall";
|
|
21
|
+
export const LANG_EXEC = "lang_exec";
|
|
22
|
+
export const PROCESS_SIGNAL = "process_signal";
|
|
23
|
+
export const DB_READ = "db_read";
|
|
24
|
+
export const DB_WRITE = "db_write";
|
|
25
|
+
export const CONTAINER_READ = "container_read";
|
|
26
|
+
export const CONTAINER_WRITE = "container_write";
|
|
27
|
+
export const CONTAINER_EXEC = "container_exec";
|
|
28
|
+
export const CONTAINER_DESTRUCTIVE = "container_destructive";
|
|
29
|
+
export const SERVICE_READ = "service_read";
|
|
30
|
+
export const SERVICE_WRITE = "service_write";
|
|
31
|
+
export const SERVICE_DESTRUCTIVE = "service_destructive";
|
|
32
|
+
export const AGENT_EXEC_BYPASS = "agent_exec_bypass";
|
|
33
|
+
export const OBFUSCATED = "obfuscated";
|
|
34
|
+
export const UNKNOWN = "unknown";
|
|
35
|
+
//# sourceMappingURL=constants.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/lib/classify/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC;AACnC,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC;AACjC,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAEnC,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AAEvC,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
import { type ActionType } from "./constants.js";
|
|
2
|
+
/**
|
|
3
|
+
* Classify command components and return action type.
|
|
4
|
+
* @param components List of command parts, e.g., ["rm", "-rf", "/tmp/build"]
|
|
5
|
+
* @returns Action type string, e.g., "filesystem_delete"
|
|
6
|
+
*/
|
|
7
|
+
export declare function classifyCommandComponents(components: string[]): ActionType;
|
|
8
|
+
//# sourceMappingURL=dispatch.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/lib/classify/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA8CvE;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,UAAU,CAwD1E"}
|