pre-ship-security-red-team-mod

1// Generated by skill-to-mod from the skill "pre-ship-security-red-team". It is plain code: edit it freely.
2//
3// Hooks: gate: holds a ship command until the required skills have run since the last edit; prime: adds one line of context when a prompt matches; /pre-ship-security-red-team-mod: shows state, snoozes with off
4//
5// A reminder, not a security boundary: it reads text and fails open. The skill
6// itself, bundled in skills/pre-ship-security-red-team/, still does the real work.
7
8const NAME = "pre-ship-security-red-team-mod"
9const SKILL = "pre-ship-security-red-team"
10const DEFAULT_MODE = "ask"
11const DEFAULT_REQUIRED = "pre-ship-security-red-team"
12
13// State is per session. Module variables start over when the mod reloads.
14let snoozed = false
15
16// What counts as shipping: a command line that puts work in front of others or into production.
17const SHIP = [
18  new RegExp("(?:^|[\\s;&|(])wrangler\\s+deploy(?![\\w-])"),
19  new RegExp("(?:^|[\\s;&|(])wrangler\\s+pages\\s+deploy(?![\\w-])"),
20  new RegExp("\\bvercel\\b[^;&|]*--prod\\b"),
21  new RegExp("\\bnetlify\\s+deploy\\b[^;&|]*--prod\\b"),
22  new RegExp("(?:^|[\\s;&|(])firebase\\s+deploy(?![\\w-])"),
23  new RegExp("(?:^|[\\s;&|(])fly\\s+deploy(?![\\w-])"),
24  new RegExp("(?:^|[\\s;&|(])railway\\s+up(?![\\w-])"),
25  new RegExp("(?:^|[\\s;&|(])gh\\s+pr\\s+merge(?![\\w-])"),
26]
27const MAX_HOLDS = 2
28
29// What has happened since the last edit.
30const done = new Set()
31let acknowledged = false
32let holds = 0
33
34function isShip(command) {
35  return SHIP.some((re) => re.test(command))
36}
37
38function listRequired(options) {
39  const raw = typeof options.required === 'string' ? options.required : DEFAULT_REQUIRED
40  return raw.split(',').map((s) => s.trim()).filter((s) => s !== '')
41}
42
43// A skill reaches skill.prompt as `name`, or `plugin:name` for a plugin's skill.
44function sameSkill(seen, wanted) {
45  return seen === wanted || seen.endsWith(':' + wanted)
46}
47
48// Prompts that say the moment has come.
49const PRIME = [
50  new RegExp("(?<![\\w-])red\\s+team(?![\\w-])", "i"),
51  new RegExp("(?<![\\w-])play\\s+the\\s+bad\\s+guy(?![\\w-])", "i"),
52  new RegExp("(?<![\\w-])safe\\s+to\\s+launch(?![\\w-])", "i"),
53]
54
55export function register(on, options) {
56  const mode = typeof options.mode === 'string' ? options.mode : DEFAULT_MODE
57  const required = listRequired(options)
58
59  function outstanding() {
60    return required.filter((name) => !done.has(name))
61  }
62
63  on('session.start', async ($, e, next) => {
64    await $.command.register({
65      name: "pre-ship-security-red-team-mod",
66      description: 'Show pre-ship-security-red-team-mod state, or snooze it with "off" and resume it with "on"',
67      argumentHint: '[off|on]',
68      immediate: true,
69    })
70    return next(e)
71  })
72
73  on('skill.prompt', async ($, e, next) => {
74    for (const name of required) {
75      if (sameSkill(e.skill, name)) {
76        done.add(name)
77        holds = 0
78      }
79    }
80    $.ui.status(outstanding().length === 0 ? undefined : NAME + ': ' + outstanding().join(', ') + ' still to run')
81    return next(e)
82  })
83
84  on('tool.call', { tool: ['Edit', 'Write', 'MultiEdit', 'NotebookEdit'] }, async ($, e, next) => {
85    const ran = await next(e)
86    const changed = ran.deny === undefined && ran.isError !== true
87    if (changed && (done.size > 0 || acknowledged)) {
88      done.clear()
89      acknowledged = false
90      holds = 0
91      $.ui.status(NAME + ': checks are stale after edits (' + required.join(', ') + ')')
92    }
93    return ran
94  }).catch(($, e, next) => next(e)) // fail open: a reminder must never block an edit
95
96  on('tool.call', { tool: 'Bash' }, async ($, e, next) => {
97    const command = String(e.command ?? '')
98    if (mode === 'off' || snoozed || required.length === 0 || !isShip(command)) {
99      return next(e)
100    }
101    const missing = outstanding()
102    if (missing.length === 0 || acknowledged) {
103      return next(e)
104    }
105    // Never trap the session: after a couple of holds, let the command through.
106    if (holds >= MAX_HOLDS) {
107      $.ui.toast(NAME + ': let it through after ' + MAX_HOLDS + ' holds')
108      return next(e)
109    }
110    const instruction =
111      NAME + ' held this command: ' + missing.join(', ') + ' has not run since the last edit. ' +
112      'Run ' + (missing.length === 1 ? 'that skill' : 'those skills') + ' on the current changes, fix what it finds, then retry. ' +
113      'If a skill is not available, tell the user instead of retrying.'
114
115    if (mode === 'nudge') {
116      const ran = await next(e)
117      if (ran.deny !== undefined) {
118        return ran
119      }
120      return { ...ran, context: [...(ran.context ?? []), NAME + ': that ran before ' + missing.join(', ') + ' had run since the last edit. Run ' + (missing.length === 1 ? 'it' : 'them') + ' now.'] }
121    }
122
123    if (mode === 'ask') {
124      // A question nobody answers counts as "run the checks first".
125      let answer = 'Run checks first'
126      try {
127        answer = await $.ui.ask(
128          missing.join(', ') + ' has not run since the last edit. Run this anyway? ' + command.slice(0, 120),
129          ['Run checks first', 'Ship anyway'],
130        )
131      } catch {
132        // dismissed, or nobody is there to ask
133      }
134      if (answer === 'Ship anyway') {
135        acknowledged = true
136        return next(e)
137      }
138    }
139
140    holds += 1
141    return { deny: instruction }
142  }).catch(($, e, next) => next(e)) // fail open: if the guard breaks, the command runs as it would without it
143
144  on('prompt.submit', async ($, e, next) => {
145    if (mode === 'off' || snoozed || required.length === 0 || outstanding().length === 0 || !PRIME.some((re) => re.test(e.text))) {
146      return next(e)
147    }
148    const line = NAME + ': before shipping, run ' + outstanding().join(', ') + ' on the current changes.'
149    return next({ ...e, context: [...(e.context ?? []), line] })
150  }).catch(($, e, next) => next(e)) // fail open
151
152  on('command.run', { command: "pre-ship-security-red-team-mod" }, async ($, e) => {
153    const arg = String(e.args ?? '').trim()
154    if (arg === 'off') {
155      snoozed = true
156      $.ui.status(undefined)
157      return { text: NAME + ': snoozed. Run /' + "pre-ship-security-red-team-mod" + ' on to resume.' }
158    }
159    if (arg === 'on') {
160      snoozed = false
161      return { text: NAME + ': back on.' }
162    }
163    const left = outstanding()
164    return {
165      text:
166        NAME + ' (' + mode + (snoozed ? ', snoozed' : '') + '): ' +
167        (required.length - left.length) + ' of ' + required.length + ' checks run since the last edit' +
168        (left.length > 0 ? ', still to run: ' + left.join(', ') : '') +
169        (acknowledged ? '. Shipping was acknowledged.' : '.'),
170    }
171  })
172}
173