switchroom 0.5.0

package/telegram-plugin/hooks/hooks.json

@@ -0,0 +1,58 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-guard-pretool.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "^(Agent|Task)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-pretool.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "^(Agent|Task)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-posttool.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-scrub-stop.mjs\"",
+            "timeout": 15,
+            "async": true
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/silent-end-interrupt-stop.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}

package/telegram-plugin/hooks/secret-guard-pretool.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook — blocks any tool call whose input contains a currently-
+ * active vault value verbatim. Second-line defense: if a secret slips past
+ * the Telegram-plugin detector (e.g. Claude synthesized it, or it came from
+ * another channel), this catches it before the tool fires.
+ *
+ * Claude Code PreToolUse protocol (v1):
+ *   Input:  JSON on stdin — { session_id, tool_name, tool_input, ... }
+ *   Output: exit 0 + empty stdout → allow.
+ *           exit 0 + JSON on stdout with `decision: "block"` + `reason` → block.
+ *
+ * Performance note (closes #472 finding #7):
+ *   Earlier versions forked `switchroom vault list` + `switchroom vault get`
+ *   per key — each fork paid ~785ms of CLI cold-start cost. With N vault
+ *   keys × every tool call, that compounded to seconds of overhead per turn.
+ *
+ *   This version connects directly to the running vault-broker daemon via
+ *   its NDJSON unix socket protocol (see src/vault/broker/protocol.ts) and
+ *   issues sequential list+get requests over a single connection. Sub-10ms
+ *   total even with several keys, vs 800ms × (1 + N) before.
+ *
+ *   When the broker is unreachable (not running, socket missing, denied)
+ *   the hook fails open — same behavior as before. Vault security is owned
+ *   by the broker; we are an opportunistic second-line checker.
+ */
+
+import { readFileSync, statSync } from 'node:fs'
+import { connect } from 'node:net'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+// ─── Tunables ─────────────────────────────────────────────────────────────
+
+const BROKER_SOCKET =
+  process.env.SWITCHROOM_VAULT_BROKER_SOCK
+  ?? join(homedir(), '.switchroom', 'vault-broker.sock')
+const BROKER_TIMEOUT_MS = 1500
+const MIN_VALUE_LENGTH_TO_GUARD = 8
+
+// ─── Stdin ────────────────────────────────────────────────────────────────
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+// ─── Token-file discovery (mirrors src/vault/broker/client.ts) ────────────
+
+function readVaultToken() {
+  const slug = process.env.SWITCHROOM_AGENT_NAME
+  if (!slug) return null
+  const path = join(homedir(), '.switchroom', 'agents', slug, '.vault-token')
+  try {
+    // 0o600 enforcement matches the TS client. The broker treats the token
+    // as full auth (peercred ACL is bypassed), so a widened mode is a
+    // real privilege-escalation surface — same UID processes could
+    // exfiltrate the bearer.
+    const st = statSync(path)
+    if ((st.mode & 0o077) !== 0) return null
+    const raw = readFileSync(path, 'utf8')
+    const tok = raw.split('\n')[0].trim()
+    return tok.length > 0 ? tok : null
+  } catch {
+    return null
+  }
+}
+
+// ─── Inline NDJSON broker client ──────────────────────────────────────────
+
+/**
+ * Open a connection, run sequential request/response pairs, close.
+ * Fails open (returns []) on any error — connection refused, timeout,
+ * malformed response, broker locked, etc.
+ */
+function loadVaultValuesViaBroker() {
+  return new Promise((resolve) => {
+    const token = readVaultToken()
+    const sock = connect(BROKER_SOCKET)
+    let buf = ''
+    let done = false
+    let pending = null   // { resolve(line) }
+    const finish = (result) => {
+      if (done) return
+      done = true
+      try { sock.destroy() } catch { /* best-effort */ }
+      resolve(result)
+    }
+
+    const timer = setTimeout(() => finish([]), BROKER_TIMEOUT_MS)
+
+    sock.on('error', () => finish([]))
+    sock.on('close', () => {
+      clearTimeout(timer)
+      if (!done) finish([])
+    })
+
+    sock.on('data', (chunk) => {
+      buf += chunk.toString('utf8')
+      // Split on newlines; emit complete lines through the pending request.
+      let idx
+      while ((idx = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, idx)
+        buf = buf.slice(idx + 1)
+        if (pending) {
+          const p = pending
+          pending = null
+          p.resolve(line)
+        }
+      }
+    })
+
+    function send(req) {
+      return new Promise((respond) => {
+        pending = { resolve: respond }
+        sock.write(JSON.stringify(req) + '\n')
+      })
+    }
+
+    sock.on('connect', async () => {
+      try {
+        // 1. list keys
+        const listReq = token ? { v: 1, op: 'list', token } : { v: 1, op: 'list' }
+        const listLine = await send(listReq)
+        let listRsp
+        try { listRsp = JSON.parse(listLine) } catch { return finish([]) }
+        if (!listRsp || listRsp.ok !== true || !Array.isArray(listRsp.keys)) {
+          // LOCKED / DENIED / etc. — fall through, no values.
+          return finish([])
+        }
+        // 2. fetch each value
+        const values = []
+        for (const k of listRsp.keys) {
+          const getReq = token
+            ? { v: 1, op: 'get', key: k, token }
+            : { v: 1, op: 'get', key: k }
+          const getLine = await send(getReq)
+          let getRsp
+          try { getRsp = JSON.parse(getLine) } catch { continue }
+          if (!getRsp || getRsp.ok !== true || !getRsp.entry) continue
+          // Only string-kind entries are scannable haystack candidates;
+          // binary/files entries can't be substring-matched against a
+          // tool-input string in any meaningful way.
+          if (getRsp.entry.kind === 'string'
+              && typeof getRsp.entry.value === 'string'
+              && getRsp.entry.value.length >= MIN_VALUE_LENGTH_TO_GUARD) {
+            values.push({ key: k, value: getRsp.entry.value })
+          }
+        }
+        finish(values)
+      } catch {
+        finish([])
+      }
+    })
+  })
+}
+
+// ─── Scan ─────────────────────────────────────────────────────────────────
+
+function scanToolInput(toolInput, vaultValues) {
+  const haystack = typeof toolInput === 'string' ? toolInput : JSON.stringify(toolInput ?? '')
+  for (const v of vaultValues) {
+    if (haystack.includes(v.value)) return v
+  }
+  return null
+}
+
+// ─── Main ─────────────────────────────────────────────────────────────────
+
+async function main() {
+  const raw = readStdin().trim()
+  if (!raw) {
+    process.exit(0)
+  }
+  let event
+  try {
+    event = JSON.parse(raw)
+  } catch {
+    process.exit(0)
+  }
+  const toolInput = event.tool_input
+  if (toolInput == null) {
+    process.exit(0)
+  }
+  const vaultValues = await loadVaultValuesViaBroker()
+  if (vaultValues.length === 0) {
+    // Fail-open when the broker is unreachable or locked. Vault security
+    // is owned by the broker; we are an opportunistic checker. Blocking
+    // every tool call when the broker hiccups would break the session.
+    process.exit(0)
+  }
+  const hit = scanToolInput(toolInput, vaultValues)
+  if (hit) {
+    process.stdout.write(
+      JSON.stringify({
+        decision: 'block',
+        reason: `tool_input contains a vaulted secret — reference it as vault:${hit.key} instead`,
+      }),
+    )
+    process.exit(0)
+  }
+  process.exit(0)
+}
+
+main().catch(() => process.exit(0))

package/telegram-plugin/hooks/secret-scrub-stop.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+/**
+ * Stop hook — scans the session transcript file at shutdown and rewrites
+ * any occurrences of a vault value to `vault:${slug}`. Backs up the original
+ * `.jsonl` to `.bak` before rewriting.
+ *
+ * Protocol:
+ *   Input: JSON on stdin — { session_id, transcript_path, ... }
+ *   Output: ignored; hook just runs and exits.
+ *
+ * Fail-open on any error. This is a best-effort cleanup, not a correctness
+ * boundary — the real defense is the Telegram plugin detector preventing
+ * secrets from reaching the transcript in the first place.
+ */
+
+import { readFileSync, writeFileSync, copyFileSync, existsSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+function loadVaultValues() {
+  const pp = process.env.SWITCHROOM_VAULT_PASSPHRASE
+  if (!pp) return []
+  try {
+    const cli = process.env.SWITCHROOM_CLI_PATH ?? 'switchroom'
+    const keysOut = execFileSync(cli, ['vault', 'list'], { encoding: 'utf8', timeout: 5000 })
+    const keys = keysOut.split('\n').map((k) => k.trim()).filter(Boolean)
+    const values = []
+    for (const k of keys) {
+      try {
+        const v = execFileSync(cli, ['vault', 'get', k], { encoding: 'utf8', timeout: 5000 }).trim()
+        if (v.length >= 8) values.push({ key: k, value: v })
+      } catch {
+        /* skip */
+      }
+    }
+    return values
+  } catch {
+    return []
+  }
+}
+
+function scrubContent(content, vaultValues) {
+  let modified = false
+  let out = content
+  for (const { key, value } of vaultValues) {
+    if (out.includes(value)) {
+      // Replace with vault:slug — plain string replace, no regex (no regex
+      // escaping needed, and stops weird tokens from turning into meta chars).
+      const marker = `vault:${key}`
+      let prev
+      do {
+        prev = out
+        out = out.split(value).join(marker)
+      } while (prev !== out && out.includes(value))
+      modified = true
+    }
+  }
+  return { out, modified }
+}
+
+function main() {
+  const raw = readStdin().trim()
+  if (!raw) process.exit(0)
+  let event
+  try {
+    event = JSON.parse(raw)
+  } catch {
+    process.exit(0)
+  }
+  const transcriptPath = event.transcript_path
+  if (!transcriptPath || !existsSync(transcriptPath)) process.exit(0)
+  const vaultValues = loadVaultValues()
+  if (vaultValues.length === 0) process.exit(0)
+  let content
+  try {
+    content = readFileSync(transcriptPath, 'utf8')
+  } catch {
+    process.exit(0)
+  }
+  const { out, modified } = scrubContent(content, vaultValues)
+  if (!modified) process.exit(0)
+  try {
+    copyFileSync(transcriptPath, `${transcriptPath}.bak`)
+    writeFileSync(transcriptPath, out, 'utf8')
+  } catch (err) {
+    process.stderr.write(`[secret-scrub-stop] rewrite failed: ${err.message}\n`)
+  }
+  process.exit(0)
+}
+
+main()

package/telegram-plugin/hooks/silent-end-interrupt-stop.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+/**
+ * Stop hook — auto-interrupt for silent-end turns.
+ *
+ * When a Claude Code session ends without the agent having called reply or
+ * stream_reply (a "silent-end"), the Telegram gateway writes a state file at
+ * $TELEGRAM_STATE_DIR/silent-end-pending.json. This hook reads that file and,
+ * if a first-time silent-end is detected (retryCount === 0), returns a
+ * decision:block to re-prompt the agent instead of letting the session close.
+ *
+ * On the second silent-end (retryCount >= MAX_RETRIES), the hook allows the
+ * stop so the gateway can render the "🙊 Ended without reply" warning card.
+ *
+ * Carve-outs preserved:
+ *   - wasAutonomous=true turns: the gateway never writes a state file for
+ *     these (no reply expected on autonomous wakeup turns).
+ *   - Turns with running sub-agents: the gateway only fires onSilentEnd after
+ *     all sub-agents have finished (same gate as completeTurnFully).
+ *
+ * Protocol:
+ *   Input:  JSON on stdin — { session_id, transcript_path, ... }
+ *   Output: exit 0 + empty stdout → allow stop.
+ *           exit 0 + JSON stdout { decision: "block", reason: "..." } → re-prompt.
+ *
+ * Fail-open on any error — if we can't read/write the state file, allow stop
+ * rather than blocking every session close.
+ */
+
+import { readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+
+const MAX_RETRIES = 1
+
+function readStdin() {
+  try {
+    return readFileSync(0, 'utf8')
+  } catch {
+    return ''
+  }
+}
+
+function getStateDir() {
+  return process.env.TELEGRAM_STATE_DIR ?? join(homedir(), '.claude', 'channels', 'telegram')
+}
+
+function main() {
+  const raw = readStdin().trim()
+  if (!raw) process.exit(0)
+
+  // Parse the Stop hook input (fail-open)
+  let _event
+  try {
+    _event = JSON.parse(raw)
+  } catch {
+    process.exit(0)
+  }
+
+  const stateDir = getStateDir()
+  const statePath = join(stateDir, 'silent-end-pending.json')
+
+  if (!existsSync(statePath)) {
+    // No silent-end pending — normal completion, allow stop.
+    process.exit(0)
+  }
+
+  let state
+  try {
+    state = JSON.parse(readFileSync(statePath, 'utf8'))
+  } catch {
+    // Corrupt state file — fail-open, allow stop.
+    process.exit(0)
+  }
+
+  const retryCount = typeof state.retryCount === 'number' ? state.retryCount : 0
+
+  if (retryCount >= MAX_RETRIES) {
+    // Retry exhausted — let the session end so the gateway can render the
+    // warning card.
+    process.stderr.write(
+      `[silent-end-interrupt] retry exhausted (retryCount=${retryCount} >= MAX_RETRIES=${MAX_RETRIES}) — allowing stop\n`,
+    )
+    process.exit(0)
+  }
+
+  // First silent-end: increment retryCount and block to re-prompt the agent.
+  try {
+    writeFileSync(statePath, JSON.stringify({ ...state, retryCount: retryCount + 1 }), 'utf8')
+  } catch (err) {
+    process.stderr.write(`[silent-end-interrupt] failed to update state file: ${err.message}\n`)
+    // Fail-open: allow stop rather than blocking forever.
+    process.exit(0)
+  }
+
+  process.stderr.write(
+    `[silent-end-interrupt] blocking stop to re-prompt agent (chatId=${state.chatId ?? '?'} retryCount was ${retryCount})\n`,
+  )
+
+  process.stdout.write(
+    JSON.stringify({
+      decision: 'block',
+      reason:
+        'You ran tools but never sent a reply to the user. ' +
+        'Call mcp__switchroom-telegram__reply or mcp__switchroom-telegram__stream_reply (with done=true) ' +
+        'to send your final answer now.',
+    }),
+  )
+  process.exit(0)
+}
+
+main()