replicas-engine 0.1.702 → 0.1.704

package/dist/src/post-tool-pr-hook.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import {
+  notifyPostToolUse
+} from "./chunk-GDCMH7YA.js";
+import {
+  isRecord
+} from "./chunk-2RB7SIP3.js";
+import "./chunk-WUJ4IALO.js";
+
+// src/post-tool-pr-hook.ts
+async function main() {
+  let stdin = "";
+  for await (const chunk of process.stdin) stdin += chunk;
+  try {
+    const input = JSON.parse(stdin);
+    const record = isRecord(input) ? input : {};
+    const toolName = [record.tool_name, record.tool, record.name].find((value) => typeof value === "string") ?? "";
+    const toolInput = record.tool_input ?? record.arguments ?? record.args ?? ("command" in record ? { command: record.command } : record);
+    await notifyPostToolUse(toolName, toolInput);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+  }
+  process.stdout.write("{}\n");
+}
+main();

package/package.json

@@ -1,18 +1,21 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.702",
+  "version": "0.1.704",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",
   "bin": {
     "replicas-engine": "./dist/src/index.js",
     "replicas-headless-agent": "./dist/src/headless-agent.js",
+    "replicas-command-protection-hook": "./dist/src/command-protection-hook.js",
+    "replicas-post-tool-pr-hook": "./dist/src/post-tool-pr-hook.js",
     "replicas-engine-watchdog": "./scripts/engine-watchdog.sh"
   },
   "files": [
     "dist",
     "workspace-sdk",
     "scripts/opencode",
+    "scripts/opencode-command-protection-plugin.ts",
     "scripts/deepseek",
     "scripts/engine-watchdog.sh",
     "scripts/lockmem.c"

package/scripts/deepseek/replicas.cordis.patch.yml

@@ -16,3 +16,7 @@
         contextWindow: 262144
       - id: moonshotai/kimi-k2.6
         contextWindow: 262144
+
+- insert:
+    - id: replicas-command-protection
+      name: __REPLICAS_DSH_COMMAND_PROTECTION_PLUGIN__

package/scripts/opencode-command-protection-plugin.ts

@@ -0,0 +1,88 @@
+import { spawn } from 'node:child_process';
+
+interface PolicyResult {
+  allowed: boolean;
+  reason?: string;
+}
+
+interface ToolExecuteBeforeInput {
+  tool: string;
+  callID: string;
+}
+
+interface ToolExecuteBeforeOutput {
+  args: unknown;
+}
+
+const toolInputs = new Map<string, unknown>();
+
+function evaluate(tool: string, args: unknown, callId: string, cwd: string): Promise<PolicyResult> {
+  return new Promise((resolve) => {
+    let settled = false;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    const finish = (result: PolicyResult) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      resolve(result);
+    };
+    const hookPath = process.env.REPLICAS_COMMAND_PROTECTION_HOOK_PATH;
+    const runtimePath = process.env.REPLICAS_COMMAND_PROTECTION_RUNTIME_PATH;
+    if (!hookPath || !runtimePath) {
+      finish({ allowed: false, reason: 'Replicas command protection runtime is missing.' });
+      return;
+    }
+    const hookArgs = hookPath.endsWith('.ts') && !runtimePath.endsWith('/bun')
+      ? ['--import', 'tsx', hookPath, 'opencode']
+      : [hookPath, 'opencode'];
+    const child = spawn(runtimePath, hookArgs, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    timeout = setTimeout(() => {
+      child.kill('SIGTERM');
+      finish({ allowed: false, reason: 'Command protection failed closed: hook timed out' });
+    }, 30_000);
+    child.stdout.on('data', (chunk: Buffer) => { stdout = (stdout + chunk).slice(-16_384); });
+    child.stderr.on('data', (chunk: Buffer) => { stderr = (stderr + chunk).slice(-16_384); });
+    child.on('error', (error) => finish({ allowed: false, reason: `Command protection failed closed: ${error.message}` }));
+    child.on('exit', (code) => {
+      if (code !== 0) {
+        finish({ allowed: false, reason: `Command protection failed closed: ${stderr || `hook exited with code ${code}`}` });
+        return;
+      }
+      try {
+        const result: unknown = JSON.parse(stdout);
+        finish(result && typeof result === 'object' && 'allowed' in result && typeof result.allowed === 'boolean'
+          ? { allowed: result.allowed, ...('reason' in result && typeof result.reason === 'string' ? { reason: result.reason } : {}) }
+          : { allowed: false, reason: 'Command protection failed closed: invalid hook response' });
+      } catch {
+        finish({ allowed: false, reason: 'Command protection failed closed: invalid hook response' });
+      }
+    });
+    child.stdin.end(JSON.stringify({ name: tool, arguments: args, call_id: callId, cwd }));
+  });
+}
+
+export const ReplicasCommandProtection = async ({ directory }: { directory: string }) => ({
+  'tool.execute.before': async (input: ToolExecuteBeforeInput, output: ToolExecuteBeforeOutput) => {
+    const result = await evaluate(input.tool, output.args, input.callID, directory);
+    if (!result.allowed) throw new Error(result.reason ?? 'Blocked by Replicas command protection.');
+    toolInputs.set(input.callID, output.args);
+  },
+  'tool.execute.after': async (input: ToolExecuteBeforeInput) => {
+    const args = toolInputs.get(input.callID);
+    toolInputs.delete(input.callID);
+    const hookPath = process.env.REPLICAS_POST_TOOL_PR_HOOK_PATH;
+    const runtimePath = process.env.REPLICAS_COMMAND_PROTECTION_RUNTIME_PATH;
+    if (!hookPath || !runtimePath) return;
+    const hookArgs = hookPath.endsWith('.ts') && !runtimePath.endsWith('/bun')
+      ? ['--import', 'tsx', hookPath]
+      : [hookPath];
+    await new Promise<void>((resolve) => {
+      const child = spawn(runtimePath, hookArgs, { cwd: directory, stdio: ['pipe', 'ignore', 'ignore'] });
+      child.on('error', () => resolve());
+      child.on('exit', () => resolve());
+      child.stdin.end(JSON.stringify({ tool: input.tool, args }));
+    });
+  },
+});