pino-guard

1import type { Register } from 'claude-code';
2
3import { addedText, addsUnguardedTransport, hasDevGuard } from './rules';
4
5const SOURCE = /\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$/;
6
7export const register: Register = on => {
8  on('tool.call', { tool: /^(Edit|Write|MultiEdit)$/ }, async ($, e, next) => {
9    const input = e as { file_path?: unknown; content?: unknown; new_string?: unknown; edits?: unknown };
10    const path = String(input.file_path ?? '');
11    if (!SOURCE.test(path) || !addsUnguardedTransport(addedText(input))) {
12      return next(e);
13    }
14    // An Edit lands inside existing code: a guard already in the file counts. A Write replaces the file, so only its own text does.
15    if (e.tool !== 'Write') {
16      const current = await $.fs.read(path).catch(() => '');
17      if (hasDevGuard(current)) return next(e);
18    }
19    return {
20      deny: `${$.plugin.name}: this adds a pino transport to ${path}. Under \`bun build\` its worker thread cannot load inlined modules and every log stream, stdout included, dies with no error. Use \`pino.multistream()\` with direct streams (for example @logtail/node) in production. A transport is fine only on the unbundled development path, behind \`isDevelopment()\`.`,
21    };
22  }).catch(($, e, next) => next(e));
23};
24

1// What a pino transport looks like in source, and what counts as keeping it to development.
2
3// pino.transport({...}) or a transport option with a worker target: pino({ transport: { target: ... } }).
4const TRANSPORT = /pino\s*\.\s*transport\s*\(|transport\s*:\s*\{[^}]*\btargets?\s*:/s;
5
6// The guard the rule allows: a transport only on the unbundled development path.
7const DEV_GUARD = /isDevelopment\s*\(|NODE_ENV\s*[!=]==?\s*['"](development|production)['"]|import\.meta\.env\.DEV|Bun\.env\.NODE_ENV/;
8
9/** The text an edit puts into a file. */
10export function addedText(input: { content?: unknown; new_string?: unknown; edits?: unknown }): string {
11  if (typeof input.content === 'string') return input.content;
12  if (typeof input.new_string === 'string') return input.new_string;
13  if (Array.isArray(input.edits)) {
14    return input.edits
15      .map(edit =>
16        edit !== null && typeof edit === 'object' && typeof (edit as { new_string?: unknown }).new_string === 'string'
17          ? (edit as { new_string: string }).new_string
18          : '',
19      )
20      .join('\n');
21  }
22  return '';
23}
24
25/** True when the added text brings in a pino transport with no development-only guard beside it. */
26export const addsUnguardedTransport = (text: string): boolean => TRANSPORT.test(text) && !DEV_GUARD.test(text);
27
28/** True when a file already keeps something behind a development check. */
29export const hasDevGuard = (text: string): boolean => DEV_GUARD.test(text);
30