prae-cli 0.9.2 → 0.10.1

package/lib/init-BPlBJvA-.js

@@ -0,0 +1,272 @@
+import { t as parsePack } from "./src-CZYvvEn5.js";
+import { d as generateKeypair, u as fingerprint } from "./src-CuiWC80o.js";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+//#region src/claude-code/init.ts
+/** What marks a hook command as PRAE's own: how `--remove` finds it. */
+const MARKER = " hook claude-code ";
+/** Seconds Claude Code waits for the hook before it gives up on it. */
+const HOOK_TIMEOUT = 10;
+const isPrae = (h) => typeof h.command === "string" && `${h.command} `.includes(MARKER);
+/**
+* The node the hook runs with, by a path that survives a Node upgrade: the
+* first `node` on PATH that is this very binary (`/opt/homebrew/bin/node`
+* rather than its versioned Cellar target). A hook whose executable has
+* gone cannot start, and Claude Code lets the call through when a hook
+* cannot start.
+*/
+function stableNode(execPath, path = "") {
+	let real = execPath;
+	try {
+		real = realpathSync(execPath);
+	} catch {}
+	for (const dir of path.split(delimiter)) {
+		if (dir === "") continue;
+		try {
+			if (realpathSync(join(dir, "node")) === real) return join(dir, "node");
+		} catch {}
+	}
+	return execPath;
+}
+/** POSIX single-quoting: the command runs through a shell. */
+const quote = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+/** `obj` with `key` replaced in place (or appended), or removed when `value` is undefined. */
+function put(obj, key, value) {
+	const out = {};
+	for (const [k, v] of Object.entries(obj)) if (k !== key) out[k] = v;
+	else if (value !== void 0) out[k] = value;
+	if (value !== void 0 && !(key in obj)) out[key] = value;
+	return out;
+}
+/** Settings without PRAE's handler; containers it emptied are dropped. */
+function withoutPrae(settings) {
+	const hooks = settings.hooks;
+	const groups = hooks?.PreToolUse;
+	if (hooks === void 0 || !Array.isArray(groups)) return settings;
+	const kept = groups.map((g) => Array.isArray(g.hooks) && g.hooks.some(isPrae) ? {
+		...g,
+		hooks: g.hooks.filter((h) => !isPrae(h))
+	} : g).filter((g) => !Array.isArray(g.hooks) || g.hooks.length > 0);
+	if (kept.length === groups.length && kept.every((g, i) => g === groups[i])) return settings;
+	const next = put(hooks, "PreToolUse", kept.length === 0 ? void 0 : kept);
+	return put(settings, "hooks", Object.keys(next).length === 0 ? void 0 : next);
+}
+/**
+* Settings with PRAE's handler as the one PRAE entry, replacing any old one.
+*
+* Enforce adds `onFailure: "block"`: from Claude Code 2.1.295 a hook that
+* cannot start or times out then blocks the call instead of letting it
+* through. Earlier versions ignore the field (2.1.233 checked: the hook
+* still runs, and a hook that cannot start still lets the call through).
+*/
+function withPrae(settings, command, enforce = false) {
+	const base = withoutPrae(settings);
+	const hooks = base.hooks ?? {};
+	const groups = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+	const entry = {
+		matcher: "*",
+		hooks: [{
+			type: "command",
+			command,
+			timeout: HOOK_TIMEOUT,
+			...enforce ? { onFailure: "block" } : {}
+		}]
+	};
+	return put(base, "hooks", put(hooks, "PreToolUse", [...groups, entry]));
+}
+/** A line diff (LCS), `+`/`-` on changed lines, two lines of context. */
+function lineDiff(before, after) {
+	const a = before.split("\n");
+	const b = after.split("\n");
+	const w = b.length + 1;
+	const lcs = new Uint32Array((a.length + 1) * w);
+	for (let i$1 = a.length - 1; i$1 >= 0; i$1 -= 1) for (let j$1 = b.length - 1; j$1 >= 0; j$1 -= 1) lcs[i$1 * w + j$1] = a[i$1] === b[j$1] ? (lcs[(i$1 + 1) * w + j$1 + 1] ?? 0) + 1 : Math.max(lcs[(i$1 + 1) * w + j$1] ?? 0, lcs[i$1 * w + j$1 + 1] ?? 0);
+	const ops = [];
+	let i = 0;
+	let j = 0;
+	while (i < a.length || j < b.length) if (i < a.length && j < b.length && a[i] === b[j]) {
+		ops.push(`  ${a[i]}`);
+		i += 1;
+		j += 1;
+	} else if (j < b.length && (i === a.length || (lcs[i * w + j + 1] ?? 0) >= (lcs[(i + 1) * w + j] ?? 0))) {
+		ops.push(`+ ${b[j]}`);
+		j += 1;
+	} else {
+		ops.push(`- ${a[i]}`);
+		i += 1;
+	}
+	const changed = (k) => ops.slice(Math.max(0, k - 2), k + 3).some((op) => !op.startsWith(" "));
+	const out = [];
+	for (const [k, op] of ops.entries()) if (changed(k)) out.push(op);
+	else if (out.at(-1) !== "  …") out.push("  …");
+	return out.join("\n");
+}
+function flag(argv, name) {
+	const at = argv.indexOf(`--${name}`);
+	if (at === -1) return void 0;
+	const value = argv[at + 1];
+	if (value === void 0 || value.startsWith("--")) throw new Error(`--${name} needs a value`);
+	return value;
+}
+/** The settings file to edit: always named, never guessed. */
+function settingsTarget(argv, cwd) {
+	const explicit = flag(argv, "settings");
+	const scope = flag(argv, "scope");
+	if (explicit !== void 0 && scope !== void 0) throw new Error("give --settings <path> or --scope, not both");
+	if (explicit !== void 0) return resolve(cwd, explicit);
+	if (scope === "user") return join(homedir(), ".claude", "settings.json");
+	if (scope === "project") return join(cwd, ".claude", "settings.json");
+	throw new Error("init claude-code needs a target: --settings <path>, --scope user (~/.claude/settings.json) or --scope project (./.claude/settings.json)");
+}
+function readSettings(path) {
+	if (!existsSync(path)) return {
+		text: "",
+		json: {},
+		indent: "  "
+	};
+	const text = readFileSync(path, "utf8");
+	let json;
+	try {
+		json = text.trim() === "" ? {} : JSON.parse(text);
+	} catch (e) {
+		throw new Error(`${path} is not JSON (${e.message}); not touching it`);
+	}
+	if (json === null || typeof json !== "object" || Array.isArray(json)) throw new Error(`${path} is not a JSON object; not touching it`);
+	const indent = text.match(/^[ \t]+(?=")/m)?.[0] ?? "  ";
+	return {
+		text,
+		json,
+		indent
+	};
+}
+/** Work out the change; touches nothing. */
+function planInit(argv, context) {
+	const settings = settingsTarget(argv, context.cwd);
+	const read = readSettings(settings);
+	const render = (json) => Object.keys(json).length === 0 && read.text === "" ? "" : `${JSON.stringify(json, null, read.indent)}\n`;
+	if (argv.includes("--remove")) {
+		const next = withoutPrae(read.json);
+		return {
+			settings,
+			before: read.text,
+			after: next === read.json ? read.text : render(next)
+		};
+	}
+	if (argv.includes("--shadow") && argv.includes("--enforce")) throw new Error("--shadow or --enforce, not both");
+	const dir = resolve(context.cwd, flag(argv, "dir") ?? join(homedir(), ".prae", "claude-code"));
+	const given = flag(argv, "pack");
+	let pack;
+	let copyPack;
+	if (given !== void 0) {
+		pack = resolve(context.cwd, given);
+		let text;
+		try {
+			text = readFileSync(pack, "utf8");
+		} catch {
+			throw new Error(`cannot read ${pack}`);
+		}
+		const parsed = parsePack(text);
+		if (!parsed.ok) throw new Error(`${pack} is not a valid pack: ${parsed.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")}`);
+	} else {
+		if (context.baseline === void 0) throw new Error("no --pack given and no bundled baseline found");
+		pack = join(dir, "prae-baseline.prae.json");
+		copyPack = context.baseline;
+	}
+	const ledger = resolve(context.cwd, flag(argv, "ledger") ?? join(dir, "ledger.jsonl"));
+	const key = join(dir, "prae-signing.pem");
+	const mode = argv.includes("--enforce") ? "--enforce" : "--shadow";
+	const command = [
+		quote(context.node),
+		quote(context.bin),
+		"hook",
+		"claude-code",
+		mode,
+		"--pack",
+		quote(pack),
+		"--ledger",
+		quote(ledger),
+		"--key",
+		quote(key),
+		"--settings",
+		quote(settings)
+	].join(" ");
+	return {
+		settings,
+		before: read.text,
+		after: render(withPrae(read.json, command, mode === "--enforce")),
+		command,
+		dir,
+		pack,
+		ledger,
+		key,
+		...copyPack === void 0 ? {} : { copyPack }
+	};
+}
+/** Write what the plan says: the state directory, key and pack, then settings. */
+function applyInit(plan) {
+	let print;
+	if (plan.dir !== void 0 && plan.key !== void 0) {
+		mkdirSync(plan.dir, {
+			recursive: true,
+			mode: 448
+		});
+		const pub = plan.key.replace(/\.pem$/, ".pub.pem");
+		if (!existsSync(plan.key)) {
+			const keys = generateKeypair();
+			writeFileSync(plan.key, keys.privateKey, { mode: 384 });
+			writeFileSync(pub, keys.publicKey);
+		}
+		if (existsSync(pub)) print = fingerprint(readFileSync(pub, "utf8"));
+		if (plan.copyPack !== void 0 && plan.pack !== void 0 && !existsSync(plan.pack)) copyFileSync(plan.copyPack, plan.pack);
+	}
+	if (plan.after !== plan.before) {
+		mkdirSync(dirname(plan.settings), { recursive: true });
+		writeFileSync(plan.settings, plan.after);
+	}
+	return print === void 0 ? {} : { fingerprint: print };
+}
+/** Whether a script path is inside npm's temporary npx cache (`…/_npx/<hash>/…`). */
+function fromNpxCache(bin) {
+	return /[\\/]_npx[\\/]/.test(bin);
+}
+/** `prae init claude-code …`: print the diff; with --apply, write it. */
+function initClaudeCode(argv, context) {
+	const plan = planInit(argv, context);
+	const removing = argv.includes("--remove");
+	if (!removing && fromNpxCache(context.bin)) console.error(`prae: warning: this prae runs from npm's temporary npx cache (${context.bin}).\n  The hook entry would point there, and npm may clear that cache: the hook would
+  stop running, and Claude Code lets a call through when its hook cannot start.
+  Install it to stay: npm install -g prae-cli, then run prae init claude-code again.`);
+	console.log(`settings    ${plan.settings}`);
+	if (!removing) {
+		console.log(`mode        ${argv.includes("--enforce") ? "enforce · deny and ask are returned to Claude Code; a gate error refuses the call" : "shadow · every verdict sealed, every call proceeds"}`);
+		console.log(`pack        ${plan.pack}${plan.copyPack === void 0 ? "" : " (the built-in baseline, copied here)"}`);
+		console.log(`ledger      ${plan.ledger}`);
+		console.log(`signing key ${plan.key} (generated if absent; 0600)`);
+	}
+	if (plan.after === plan.before) {
+		console.log(removing ? "\nNo PRAE hook entry in this file; nothing to remove." : "\nThe settings already hold exactly this entry.");
+		if (!removing && argv.includes("--apply")) applyInit(plan);
+		return;
+	}
+	console.log(`\n--- ${plan.settings}\n+++ ${plan.settings} (after)`);
+	console.log(lineDiff(plan.before, plan.after));
+	if (!argv.includes("--apply")) {
+		console.log("\nNothing was written. Re-run with --apply to write it.");
+		return;
+	}
+	const { fingerprint: print } = applyInit(plan);
+	console.log("\nwritten.");
+	if (removing) {
+		console.log("Only PRAE’s hook entry was removed. The ledger and key stay where they");
+		console.log("are: they are the evidence of what ran.");
+		return;
+	}
+	if (print !== void 0) console.log(`ledger key fingerprint ${print}`);
+	console.log("New Claude Code sessions run every tool call through PRAE.");
+	console.log(`Read the record: prae report ${quote(plan.ledger ?? "")} --out report.html`);
+}
+
+//#endregion
+export { HOOK_TIMEOUT, MARKER, applyInit, fromNpxCache, initClaudeCode, lineDiff, planInit, quote, settingsTarget, stableNode, withPrae, withoutPrae };

package/lib/{instructions-ya0LVnZy.js → instructions-fCJ4j7ce.js}

@@ -1,4 +1,5 @@
-import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-D4UEfbzt.js";
+import "./src-CZYvvEn5.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-C7DD-Oif.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-BCXbpqu4.js → mcp-DdEDvTvR.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-BqLxhYiP.js";
+import { i as evaluate } from "./src-CZYvvEn5.js";
 import { a as scan, n as MAX_SCAN_BYTES } from "./src-B25SHWcz.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";