vibe-coding-master 0.8.12 → 0.9.0

package/scripts/harness-tools/vcm-subagent-guard

@@ -1,66 +1,70 @@
-#!/usr/bin/env python3
-"""Restrict VCM role sessions to their assigned worker subagents."""
-
-import json
-import os
-import sys
-
-
-ALLOWED_SUBAGENTS = {
-    "architect": frozenset({
-        "vcm-architect-evidence-worker",
-        "vcm-architect-scaffold-worker",
-        "vcm-architect-validation-worker",
-    }),
-    "coder": frozenset({"vcm-coder-worker"}),
+#!/usr/bin/env node
+"use strict";
+// Restrict VCM role sessions to their assigned worker subagents.
+
+const fs = require("node:fs");
+
+const ALLOWED_SUBAGENTS = {
+  architect: [
+    "vcm-architect-evidence-worker",
+    "vcm-architect-scaffold-worker",
+    "vcm-architect-validation-worker"
+  ],
+  coder: ["vcm-coder-worker"]
+};
+
+function deny(reason) {
+  process.stdout.write(`${JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason
+    }
+  })}\n`);
 }
 
+function main() {
+  const role = (process.env.VCM_ROLE || "").trim();
+  if (!role) {
+    return;
+  }
+
+  let payload;
+  try {
+    payload = JSON.parse(fs.readFileSync(0, "utf8"));
+  } catch {
+    deny("VCM could not validate this subagent request because its hook payload is invalid.");
+    return;
+  }
+
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    deny("VCM could not validate this subagent request because its hook payload is invalid.");
+    return;
+  }
+
+  if (payload.tool_name !== "Agent") {
+    return;
+  }
+
+  if (payload.agent_id) {
+    deny("VCM worker subagents may not invoke nested subagents.");
+    return;
+  }
+
+  const toolInput = payload.tool_input;
+  const subagentType = toolInput && typeof toolInput === "object" ? toolInput.subagent_type : undefined;
+  const allowed = ALLOWED_SUBAGENTS[role];
+
+  if (!allowed) {
+    deny(`VCM role \`${role}\` may not invoke subagents.`);
+    return;
+  }
+
+  if (!allowed.includes(subagentType)) {
+    const requested = typeof subagentType === "string" && subagentType ? subagentType : "<missing>";
+    const allowedNames = [...allowed].sort().map((name) => `\`${name}\``).join(", ");
+    deny(`VCM role \`${role}\` may invoke only ${allowedNames}, not \`${requested}\`.`);
+  }
+}
 
-def deny(reason: str) -> None:
-    print(json.dumps({
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": reason,
-        }
-    }))
-
-
-def main() -> None:
-    role = os.environ.get("VCM_ROLE", "").strip()
-    if not role:
-        return
-
-    try:
-        payload = json.load(sys.stdin)
-    except (json.JSONDecodeError, OSError):
-        deny("VCM could not validate this subagent request because its hook payload is invalid.")
-        return
-
-    if not isinstance(payload, dict):
-        deny("VCM could not validate this subagent request because its hook payload is invalid.")
-        return
-
-    if payload.get("tool_name") != "Agent":
-        return
-
-    if payload.get("agent_id"):
-        deny("VCM worker subagents may not invoke nested subagents.")
-        return
-
-    tool_input = payload.get("tool_input")
-    subagent_type = tool_input.get("subagent_type") if isinstance(tool_input, dict) else None
-    allowed = ALLOWED_SUBAGENTS.get(role)
-
-    if allowed is None:
-        deny(f"VCM role `{role}` may not invoke subagents.")
-        return
-
-    if subagent_type not in allowed:
-        requested = subagent_type if isinstance(subagent_type, str) and subagent_type else "<missing>"
-        allowed_names = ", ".join(f"`{name}`" for name in sorted(allowed))
-        deny(f"VCM role `{role}` may invoke only {allowed_names}, not `{requested}`.")
-
-
-if __name__ == "__main__":
-    main()
+main();