prae-cli 0.9.2 → 0.10.0

package/lib/hook-Gll2spTP.js

@@ -0,0 +1,695 @@
+import { i as relativeTo, n as PATH_ARGS, o as segments, t as evaluate } from "./evaluate-DhoGQw0Z.js";
+import "./frameworks-BgZHGKiH.js";
+import { t as parsePack } from "./pack-h5n43S0F.js";
+import { n as Ledger } from "./src-Cy-Acrgj.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-BuaOiL2v.js";
+import { lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { capabilityForTool } from "capmark";
+
+//#region ../dsh/src/facts.ts
+function resolveArgs(args, resolvePath, cwd) {
+	if (resolvePath === void 0 && cwd === void 0) return args;
+	const out = { ...args };
+	for (const key of PATH_ARGS) {
+		const value = out[key];
+		if (typeof value !== "string") continue;
+		let path = value;
+		if (resolvePath !== void 0) try {
+			path = resolvePath(path);
+		} catch {}
+		out[key] = cwd === void 0 ? path : relativeTo(path, cwd);
+	}
+	return out;
+}
+/**
+* Claude Code names its built-in tools in PascalCase (`Read`, `Bash`, …),
+* which capmark's catalogue does not list. Each takes the capability of its
+* lowercase counterpart; without this a Claude Code call carries no
+* capability, and the rules scoped by one (paths, egress, the shell) never
+* see it. An MCP tool, `mcp__<server>__<tool>`, takes its tool's.
+*/
+const CLAUDE_CODE = {
+	Read: "read",
+	Write: "write",
+	Edit: "edit",
+	MultiEdit: "edit",
+	NotebookEdit: "edit",
+	Bash: "bash",
+	PowerShell: "bash",
+	Grep: "grep",
+	Glob: "glob",
+	LS: "glob",
+	WebFetch: "web_fetch",
+	WebSearch: "web_search"
+};
+/**
+* MCP tools whose names capmark's catalogue does not list, from the
+* reference servers an agent most often mounts (modelcontextprotocol
+* `filesystem` and `fetch`) and `prae mcp`'s own. Applied only after an
+* `mcp__<server>__` prefix: without it, a Claude Code session reading
+* `.env` through `mcp__filesystem__read_file` carries no capability, and
+* no `fs:read` rule sees it.
+*/
+const MCP_TOOLS = {
+	read_file: "read",
+	read_text_file: "read",
+	read_media_file: "read",
+	list_directory: "glob",
+	list_dir: "glob",
+	directory_tree: "glob",
+	search_files: "glob",
+	get_file_info: "glob",
+	write_file: "write",
+	edit_file: "edit",
+	create_directory: "write",
+	fetch: "web_fetch"
+};
+function capabilityOf(tool) {
+	const direct = capabilityForTool(tool)?.id;
+	if (direct !== void 0) return direct;
+	const alias = CLAUDE_CODE[tool];
+	if (alias !== void 0) return capabilityForTool(alias)?.id;
+	const mcp = tool.startsWith("mcp__") ? tool.lastIndexOf("__") : -1;
+	if (mcp <= 5) return void 0;
+	const name = tool.slice(mcp + 2);
+	return capabilityOf(MCP_TOOLS[name] ?? name);
+}
+function factsFor(exec, options = {}) {
+	const args = exec.arguments ?? {};
+	const capability = capabilityOf(exec.name);
+	const plugin = options.owners?.get(exec.name);
+	const id = exec.agent?.id;
+	const agent = typeof id === "string" ? id : void 0;
+	return {
+		tool: exec.name,
+		...capability === void 0 ? {} : { capability },
+		...plugin === void 0 ? {} : { plugin },
+		...agent === void 0 ? {} : { agent },
+		args: resolveArgs(args, options.resolvePath, options.cwd),
+		...options.counts === void 0 ? {} : { counts: options.counts }
+	};
+}
+
+//#endregion
+//#region ../dsh/src/judge.ts
+/**
+* Judge one call against a pack, without a harness anywhere near it.
+*
+* Exported separately from {@link apply} so the whole decision path is
+* testable without booting a profile, and so a host with its own event plumbing
+* can reuse it.
+*/
+function judge(pack, exec, options = {}) {
+	const started = process.hrtime.bigint();
+	const bare = factsFor(exec, {
+		...options.owners === void 0 ? {} : { owners: options.owners },
+		...options.counts === void 0 ? {} : { counts: options.counts },
+		...options.cwd === void 0 ? {} : { cwd: options.cwd }
+	});
+	const inspect = options.inspect;
+	const cwd = options.cwd;
+	const findings = options.findings ?? (inspect === void 0 ? void 0 : inspectTarget(bare.args, (path) => inspect(cwd === void 0 ? path : resolve(cwd, path))));
+	const facts = findings !== void 0 && findings.length > 0 ? {
+		...bare,
+		secrets: findings
+	} : bare;
+	const result = facts.capability !== void 0 && options.withheld?.has(facts.capability) ? {
+		kind: "deny",
+		rule: "baseline",
+		reason: `\`${facts.capability}\` is not permitted by pack ${pack.pack} ${pack.version}`,
+		trace: [{
+			rule: "baseline",
+			effect: "deny",
+			because: `\`${facts.capability}\` is outside the operator baseline`
+		}],
+		evaluated: pack.rules.length
+	} : evaluate(pack, facts);
+	const micros = Number((process.hrtime.bigint() - started) / 1000n);
+	const at = options.at ?? (/* @__PURE__ */ new Date()).toISOString();
+	let decision;
+	let verdict;
+	switch (result.kind) {
+		case "allow":
+			decision = { kind: "allow" };
+			verdict = "allow";
+			break;
+		case "deny":
+			decision = {
+				kind: "deny",
+				reason: (pack.rules.find((rule) => rule.id === result.rule)?.when.secrets !== void 0 && facts.secrets !== void 0 ? JSON.stringify({
+					decision: "deny",
+					reason: "secret_detected",
+					...subjectOf(facts.args) === void 0 ? {} : { resource: subjectOf(facts.args) },
+					secret_types: [...new Set(facts.secrets.map((f) => f.type))],
+					policy: result.rule,
+					...options.phase === "output" ? {
+						phase: "output",
+						executed: true
+					} : {},
+					retry: false,
+					message: result.reason ?? "refused by policy"
+				}) : void 0) ?? result.reason ?? "refused by policy"
+			};
+			verdict = "deny";
+			break;
+		case "ask":
+			decision = {
+				kind: "ask",
+				reason: result.reason ?? "held for a human"
+			};
+			verdict = "ask";
+			break;
+		case "correct": {
+			const changed = Object.entries(result.args ?? {}).filter(([key, value]) => facts.args[key] !== value).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join(", ");
+			decision = {
+				kind: "deny",
+				reason: `${result.reason ?? "corrected by policy"}. Retry with ${changed}.`
+			};
+			verdict = "correct";
+			break;
+		}
+	}
+	const corrected = result.kind === "correct" ? Object.fromEntries(Object.entries(result.args ?? {}).filter(([key, value]) => facts.args[key] !== value).map(([key, value]) => [key, {
+		from: facts.args[key],
+		to: value
+	}])) : void 0;
+	const record = {
+		at,
+		...options.session === void 0 ? {} : { session: options.session },
+		...facts.agent === void 0 ? {} : { agent: facts.agent },
+		tool: facts.tool,
+		...subjectOf(facts.args) === void 0 ? {} : { subject: subjectOf(facts.args) },
+		...facts.capability === void 0 ? {} : { capability: facts.capability },
+		...facts.plugin === void 0 ? {} : { plugin: facts.plugin },
+		verdict,
+		...result.rule === void 0 ? {} : { rule: result.rule },
+		...result.reason === void 0 ? {} : { reason: result.reason },
+		trace: result.trace,
+		pack: {
+			name: pack.pack,
+			version: pack.version
+		},
+		...corrected === void 0 ? {} : { corrected },
+		micros,
+		...exec.callId === void 0 ? {} : { correlation: exec.callId },
+		...options.phase === void 0 ? {} : { phase: options.phase },
+		...fingerprintOf(facts.args) === void 0 ? {} : { command: fingerprintOf(facts.args) },
+		...findings !== void 0 && findings.length > 0 ? { secrets: findings.map(({ rule, type, line, confidence }) => ({
+			rule,
+			type,
+			line,
+			confidence
+		})) } : {}
+	};
+	return {
+		decision,
+		record
+	};
+}
+/**
+* Argument names worth inspecting: the ones that name a local file a read
+* tool is about to return. `url` is deliberately absent — fetching a URL to
+* scan it would make the gate the exfiltration channel.
+*/
+const INSPECT_ARGS = [
+	"path",
+	"file_path",
+	"filePath",
+	"file",
+	"target",
+	"source"
+];
+function inspectTarget(args, inspect) {
+	for (const key of INSPECT_ARGS) {
+		const value = args[key];
+		if (typeof value === "string" && value !== "") return inspect(value);
+	}
+}
+/**
+* The host-side inspector: reads the file the agent asked for, within limits,
+* and reduces it to findings. Built once per mount, and only when the pack
+* actually has a `secrets` rule — a pack that never asks about content should
+* not pay a file read per call, or grow one silently.
+*
+* A file it cannot read, or one over {@link MAX_SCAN_BYTES}, yields no
+* findings rather than an error: the read itself will fail or succeed on its
+* own terms, and a pack that wants oversized files stopped can say so with a
+* plain path rule.
+*/
+function inspectorFor(pack) {
+	if (!pack.rules.some((rule) => rule.when.secrets !== void 0)) return;
+	return (path) => {
+		try {
+			const stat = statSync(path);
+			if (!stat.isFile() || stat.size > MAX_SCAN_BYTES) return void 0;
+			return scan(readFileSync(path, "utf8"));
+		} catch {
+			return;
+		}
+	};
+}
+/**
+* The one argument worth keeping in a durable record: what the call was aimed at.
+*
+* Only these keys, and only strings. Recording the whole argument object would
+* put file contents and command bodies into an append-only log — this plugin
+* exists partly to refuse reads of `.env`, and a ledger that copies every
+* argument would become the leak it was installed to prevent. Long values are
+* truncated because a record row is meant to be quotable, not to hold a
+* payload.
+*/
+function subjectOf(args) {
+	for (const key of [
+		"path",
+		"file_path",
+		"filePath",
+		"target",
+		"url"
+	]) {
+		const value = args[key];
+		if (typeof value === "string" && value !== "") return value.length > 200 ? `${value.slice(0, 197)}...` : value;
+	}
+}
+/**
+* A shell line, reduced to what a record may hold: the program word and a
+* hash. The design partner's first bypass test showed `subject: null` on
+* every shell row, which is correct — a command line can carry a secret and
+* the ledger must never quote one — and also useless to an auditor. This is
+* the part that can be shown.
+*/
+function fingerprintOf(args) {
+	const raw = args.command ?? args.cmd ?? args.script;
+	if (typeof raw !== "string" || raw.trim() === "") return void 0;
+	return {
+		program: segments(raw)[0]?.name ?? "?",
+		hash: createHash("sha256").update(raw).digest("hex").slice(0, 16)
+	};
+}
+
+//#endregion
+//#region ../dsh/src/symlink.ts
+/**
+* Symbolic links (PRA-144; review §6.3, gap 3). A path rule judges the path
+* as written; a link inside an allowed directory can point anywhere. The
+* gate therefore also judges where the path really leads, and the stricter
+* of the two verdicts stands.
+*/
+/**
+* Where `path` really leads: through every link on the way, including a
+* dangling one (a write through it would create its target) and a file
+* that does not exist yet (its directory is resolved). `undefined` when the
+* chain does not end.
+*/
+function realLocation(path, depth = 0) {
+	if (depth > 40) return void 0;
+	try {
+		return realpathSync(path);
+	} catch {}
+	try {
+		if (lstatSync(path).isSymbolicLink()) return realLocation(resolve(dirname(path), readlinkSync(path)), depth + 1);
+	} catch {}
+	const parent = dirname(path);
+	if (parent === path) return path;
+	const real = realLocation(parent, depth + 1);
+	return real === void 0 ? void 0 : join(real, basename(path));
+}
+/**
+* The call's path arguments as they really resolve, when any of them goes
+* through a link: inside the working directory as `./…`, outside it as an
+* absolute path. `undefined` when no path argument changes.
+*/
+function throughLinks(args, cwd) {
+	const realCwd = realLocation(cwd) ?? cwd;
+	let changed;
+	const out = { ...args };
+	for (const key of PATH_ARGS) {
+		const value = args[key];
+		if (typeof value !== "string" || value === "") continue;
+		const written = resolve(cwd, value);
+		const real = realLocation(written);
+		if (real === void 0) continue;
+		const lexical = relative(cwd, written);
+		const actual = relative(realCwd, real);
+		if (lexical === actual) continue;
+		const shown = actual === "" ? "." : actual.startsWith("..") || isAbsolute(actual) ? real : `./${actual}`;
+		out[key] = shown;
+		changed ??= {
+			from: value,
+			to: shown
+		};
+	}
+	return changed === void 0 ? void 0 : {
+		args: out,
+		...changed
+	};
+}
+
+//#endregion
+//#region src/claude-code/hook.ts
+/**
+* A Claude Code tool call as the arguments the kernel's rules read.
+*
+* Every field is kept, so `arg` rules see what the tool sees; where Claude
+* Code spells a target differently from the kernel's conventional names
+* (`PATH_ARGS`, `url`, `command`) an alias is added beside it:
+*
+* - `NotebookEdit.notebook_path` → `file_path`.
+* - `Glob` / `Grep` search `path`, which defaults to the session's working
+*   directory: a search with no path still has a place it reads, and a scope
+*   rule must see it. An absolute or `..` Glob pattern with no path reads
+*   from the pattern's fixed prefix.
+*/
+function argsOf(tool, input, cwd) {
+	const args = { ...input };
+	if (tool === "NotebookEdit" && typeof input.notebook_path === "string") args.file_path ??= input.notebook_path;
+	if ((tool === "Glob" || tool === "Grep") && typeof input.path !== "string") {
+		const pattern = typeof input.pattern === "string" ? input.pattern : "";
+		const fixed = pattern.split("/").findIndex((part) => /[*?[{]/.test(part));
+		const prefix = (fixed === -1 ? pattern : pattern.split("/").slice(0, fixed).join("/")) || "/";
+		args.path = tool === "Glob" && (isAbsolute(pattern) || pattern.startsWith("..")) ? resolve(cwd, prefix) : cwd;
+	}
+	return args;
+}
+/** A path and its real location, both spelled for absolute and `./` rules. */
+function spellings(paths, cwd) {
+	const out = /* @__PURE__ */ new Set();
+	for (const p of paths) {
+		const abs = resolve(p);
+		let real = abs;
+		try {
+			real = realpathSync(abs);
+		} catch {}
+		for (const one of [abs, real]) {
+			out.add(one);
+			for (const base of [cwd, realOr(cwd)]) {
+				const rel = relativeTo(one, base);
+				if (rel !== one) out.add(rel);
+			}
+		}
+	}
+	return [...out];
+}
+function realOr(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* PRAE's own files are not the agent's to change: the pack that judges it,
+* the ledger that records it, the settings entry that runs this hook, and
+* the private key that signs the rows (not even to read). Evaluated by the
+* kernel like any pack rule, ahead of the operator's own.
+*/
+function selfRules(options, cwd) {
+	return [{
+		id: "PRAE-SELF",
+		title: "PRAE’s own files are protected",
+		when: {
+			capability: "fs:write",
+			path: { inside: spellings([
+				options.pack,
+				options.ledger,
+				`${options.ledger}.lock`,
+				...options.settings === void 0 ? [] : [options.settings],
+				...options.key === void 0 ? [] : [options.key]
+			], cwd) }
+		},
+		effect: {
+			kind: "deny",
+			because: "PRAE’s own pack, ledger, key and hook settings are not the agent’s to change"
+		}
+	}, ...options.key === void 0 ? [] : [{
+		id: "PRAE-SELF-KEY",
+		title: "The ledger signing key is not readable by the agent",
+		when: {
+			capability: "fs:read",
+			path: { inside: spellings([options.key], cwd) }
+		},
+		effect: {
+			kind: "deny",
+			because: "the key that signs the ledger is not the agent’s to read"
+		}
+	}]];
+}
+/**
+* A shell line naming the pack, the hook settings or the key. Best effort,
+* and said so: a shell can spell a path in ways no string test sees
+* (variables, globs, `cd` first). It catches the plain attempt, not a
+* determined one. The ledger is left out on purpose: reading it (`prae
+* report`) is legitimate, and an edit to it breaks its chain and signatures.
+*/
+function mentionsSelf(command, options, cwd) {
+	return spellings([
+		options.pack,
+		...options.settings === void 0 ? [] : [options.settings],
+		...options.key === void 0 ? [] : [options.key]
+	], cwd).map((s) => s.startsWith("./") ? s.slice(2) : s).find((s) => s !== "" && s !== "." && command.includes(s));
+}
+const rank = (v) => v === "deny" ? 3 : v === "ask" ? 2 : 1;
+function override(j, rule, reason) {
+	return {
+		decision: {
+			kind: "deny",
+			reason
+		},
+		record: {
+			...j.record,
+			verdict: "deny",
+			rule,
+			reason,
+			trace: [...j.record.trace, {
+				rule,
+				effect: "deny",
+				because: reason
+			}]
+		}
+	};
+}
+/** Attempts this session, by capability, from the ledger: only when a rule counts. */
+function countsFrom(ledger, session, capability) {
+	if (capability === void 0) return {};
+	const seen = ledger.read().filter((e) => e.session === session && e.capability === capability && e.phase === void 0).length;
+	return { [capability]: seen + 1 };
+}
+function loadPack(path) {
+	let bytes;
+	try {
+		bytes = readFileSync(path);
+	} catch (e) {
+		throw new Error(`cannot read the pack ${path}: ${e.message}`);
+	}
+	const read = parsePack(bytes.toString("utf8"));
+	if (!read.ok) throw new Error(`the pack ${path} did not parse: ${read.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")}`);
+	return {
+		pack: read.pack,
+		sha256: createHash("sha256").update(bytes).digest("hex")
+	};
+}
+function appendWithin(ledger, record, waitMs) {
+	const deadline = Date.now() + waitMs;
+	const nap = new Int32Array(new SharedArrayBuffer(4));
+	for (;;) {
+		const entry = ledger.tryAppend(record);
+		if (entry !== void 0) return entry;
+		if (Date.now() > deadline) throw new Error(`the ledger ${ledger.path} stayed locked for ${waitMs} ms; nothing was sealed`);
+		Atomics.wait(nap, 0, 0, 2);
+	}
+}
+function openLedger(options) {
+	const signWith = options.key === void 0 ? void 0 : readFileSync(options.key, "utf8");
+	return Ledger.open(options.ledger, signWith === void 0 ? {} : { signWith });
+}
+/** Judge one payload, seal it, and say what the hook prints and exits with. */
+function decide(payload, options) {
+	const wait = options.lockWaitMs ?? 3e3;
+	let ledger;
+	try {
+		if (options.pack === "" || options.ledger === "") throw new Error("hook claude-code needs --pack <file> and --ledger <file>");
+		if (payload.hook_event_name !== "PreToolUse") throw new Error(`expected a PreToolUse payload, got ${JSON.stringify(payload.hook_event_name)}`);
+		const tool = payload.tool_name;
+		if (typeof tool !== "string" || tool === "") throw new Error("the payload names no tool_name");
+		const cwd = typeof payload.cwd === "string" && isAbsolute(payload.cwd) ? payload.cwd : process.cwd();
+		const input = payload.tool_input !== null && typeof payload.tool_input === "object" ? payload.tool_input : {};
+		const loaded = loadPack(options.pack);
+		const pack = {
+			...loaded.pack,
+			rules: [...selfRules(options, cwd), ...loaded.pack.rules]
+		};
+		ledger = openLedger(options);
+		const exec = {
+			name: tool,
+			arguments: argsOf(tool, input, cwd),
+			...payload.tool_use_id === void 0 ? {} : { callId: payload.tool_use_id },
+			...payload.agent_type === void 0 ? {} : { agent: { id: payload.agent_type } }
+		};
+		const inspect = inspectorFor(pack);
+		const counts = pack.rules.some((r) => r.when.count !== void 0) ? countsFrom(ledger, payload.session_id, capabilityOf(tool)) : void 0;
+		const judging = {
+			...payload.session_id === void 0 ? {} : { session: payload.session_id },
+			...inspect === void 0 ? {} : { inspect },
+			...counts === void 0 ? {} : { counts },
+			cwd
+		};
+		const written = judge(pack, exec, judging);
+		const linked = throughLinks(exec.arguments ?? {}, cwd);
+		let judged = written;
+		if (linked !== void 0) {
+			const real = judge(pack, {
+				...exec,
+				arguments: linked.args
+			}, judging);
+			if (rank(real.record.verdict) > rank(written.record.verdict)) {
+				const why = `\`${linked.from}\` resolves through a symbolic link to \`${linked.to}\`: ${real.record.reason ?? ""}`;
+				judged = {
+					decision: real.decision.kind === "deny" ? {
+						kind: "deny",
+						reason: why
+					} : real.decision,
+					record: {
+						...real.record,
+						...written.record.subject === void 0 ? {} : { subject: written.record.subject },
+						reason: why,
+						trace: [...real.record.trace, {
+							rule: "PRAE-SYMLINK",
+							effect: real.record.verdict,
+							because: `judged at the link's target, ${linked.to}`
+						}]
+					}
+				};
+			}
+		}
+		if (pack.expires_at !== void 0 && Date.now() > Date.parse(pack.expires_at)) judged = override(judged, "PRAE-EXPIRED", `the policy ${pack.pack} ${pack.version} expired at ${pack.expires_at}; every call is refused until a current policy is in force (fail closed)`);
+		const command = exec.arguments?.command;
+		const named = typeof command === "string" && judged.record.verdict !== "deny" ? mentionsSelf(command, options, cwd) : void 0;
+		if (named !== void 0) judged = override(judged, "PRAE-SELF", `the command names \`${named}\`; PRAE’s own pack, ledger, key and hook settings are not the agent’s to change`);
+		const record = {
+			...judged.record,
+			pack: {
+				...judged.record.pack,
+				sha256: loaded.sha256
+			},
+			...options.mode === "shadow" ? { shadow: true } : {}
+		};
+		const entry = appendWithin(ledger, record, wait);
+		if (options.mode === "shadow" || judged.decision.kind === "allow") return {
+			stdout: "",
+			stderr: "",
+			exitCode: 0,
+			entry
+		};
+		return {
+			stdout: JSON.stringify({ hookSpecificOutput: {
+				hookEventName: "PreToolUse",
+				permissionDecision: judged.decision.kind,
+				permissionDecisionReason: `PRAE ${record.rule ?? ""}: ${judged.decision.reason} (ledger row ${entry.seq})`
+			} }),
+			stderr: "",
+			exitCode: 0,
+			entry
+		};
+	} catch (error) {
+		return failed(payload, options, ledger, error, wait);
+	}
+}
+/** The gate could not judge: enforce refuses, shadow proceeds; both say so. */
+function failed(payload, options, opened, error, wait) {
+	const message = error instanceof Error ? error.message : String(error);
+	const enforce = options.mode === "enforce";
+	const reason = enforce ? `PRAE gate error, call refused (fail closed): ${message}` : `PRAE gate error, call proceeded unjudged (shadow mode): ${message}`;
+	let entry;
+	try {
+		entry = appendWithin(opened ?? openLedger(options), {
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			...payload.session_id === void 0 ? {} : { session: payload.session_id },
+			tool: typeof payload.tool_name === "string" ? payload.tool_name : "prae:hook",
+			verdict: "deny",
+			rule: "PRAE-ERROR",
+			reason,
+			trace: [{
+				rule: "PRAE-ERROR",
+				effect: "deny",
+				because: message
+			}],
+			pack: {
+				name: "(unavailable)",
+				version: "-"
+			},
+			...payload.tool_use_id === void 0 ? {} : { correlation: payload.tool_use_id },
+			...enforce ? {} : { shadow: true }
+		}, Math.min(wait, 1e3));
+	} catch {}
+	const sealed = entry === void 0 ? " (not sealed: the ledger is unavailable)" : "";
+	if (!enforce) return {
+		stdout: JSON.stringify({ systemMessage: `${reason}${sealed}` }),
+		stderr: `${reason}${sealed}\n`,
+		exitCode: 0,
+		...entry === void 0 ? {} : { entry }
+	};
+	return {
+		stdout: JSON.stringify({ hookSpecificOutput: {
+			hookEventName: "PreToolUse",
+			permissionDecision: "deny",
+			permissionDecisionReason: `${reason}${sealed}`
+		} }),
+		stderr: `${reason}${sealed}\n`,
+		exitCode: 2,
+		...entry === void 0 ? {} : { entry }
+	};
+}
+function flag(argv, name) {
+	const at = argv.indexOf(`--${name}`);
+	return at === -1 ? void 0 : argv[at + 1];
+}
+/** Parse `prae hook claude-code …` flags. A missing one is a gate error in {@link decide}. */
+function hookOptions(argv) {
+	const key = flag(argv, "key");
+	const settings = flag(argv, "settings");
+	return {
+		mode: argv.includes("--enforce") ? "enforce" : "shadow",
+		pack: flag(argv, "pack") ?? "",
+		ledger: flag(argv, "ledger") ?? "",
+		...key === void 0 ? {} : { key },
+		...settings === void 0 ? {} : { settings }
+	};
+}
+/** Read stdin to its end, or give up at the deadline. */
+function readStdin(ms) {
+	return new Promise((done, fail) => {
+		const chunks = [];
+		const timer = setTimeout(() => {
+			process.stdin.pause();
+			fail(/* @__PURE__ */ new Error(`no complete payload on stdin within ${ms} ms`));
+		}, ms);
+		process.stdin.on("data", (c) => chunks.push(c));
+		process.stdin.on("end", () => {
+			clearTimeout(timer);
+			done(Buffer.concat(chunks).toString("utf8"));
+		});
+		process.stdin.on("error", (e) => {
+			clearTimeout(timer);
+			fail(e);
+		});
+	});
+}
+/** The process entry: `prae hook claude-code [--enforce|--shadow] --pack … --ledger …`. */
+async function runHook(argv) {
+	const options = hookOptions(argv);
+	let result;
+	let payload = {};
+	try {
+		payload = JSON.parse(await readStdin(5e3));
+		result = decide(payload, options);
+	} catch (error) {
+		result = failed(payload, options, void 0, error, 1e3);
+	}
+	if (result.stdout !== "") process.stdout.write(`${result.stdout}\n`);
+	if (result.stderr !== "") process.stderr.write(result.stderr);
+	process.exitCode = result.exitCode;
+}
+
+//#endregion
+export { argsOf, decide, hookOptions, runHook };

package/lib/index.js

@@ -1,6 +1,8 @@
-import "./evaluate-BqLxhYiP.js";
-import "./views-D4UEfbzt.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-B_B6-bUZ.js";
-import "./src-LA7NdLKb.js";
+import "./evaluate-DhoGQw0Z.js";
+import "./frameworks-BgZHGKiH.js";
+import "./pack-h5n43S0F.js";
+import "./src-Cy-Acrgj.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-DPldZ2ND.js";
+import "./views-CUcixte0.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };