openlatch-client 0.0.1

The open-source security layer for AI agents — client forwarder
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
/// JSONC string surgery for `settings.json`.
///
/// Uses `jsonc_parser`'s CST API to locate insertion points in the raw string,
/// insert or replace entries by their `_openlatch` marker, and produce a
/// modified string that preserves all comments, whitespace, and trailing commas
/// in untouched regions.
///
/// # Design (D-12)
///
/// We operate at the string/CST level, NOT via full deserialisation + re-serialisation.
/// This guarantees that every byte outside our target arrays is preserved verbatim.
use std::path::Path;

use crate::error::OlError;

// Re-export hook error codes used in tests.
pub use crate::error::{ERR_HOOK_AGENT_NOT_FOUND, ERR_HOOK_MALFORMED_JSONC, ERR_HOOK_WRITE_FAILED};

/// Read the JSONC settings file, or create it with `{}` if it does not exist.
///
/// Returns the raw JSONC string ready for surgery.
///
/// # Errors
///
/// - `OL-1401` if the file cannot be read or created.
pub fn read_or_create_settings(path: &Path) -> Result<String, OlError> {
    if path.exists() {
        std::fs::read_to_string(path).map_err(|e| {
            OlError::new(
                ERR_HOOK_WRITE_FAILED,
                format!("Cannot read settings.json: {e}"),
            )
            .with_suggestion("Check file permissions.")
            .with_docs("https://docs.openlatch.ai/errors/OL-1401")
        })
    } else {
        // Create parent directories if needed.
        if let Some(parent) = path.parent() {
            std::fs::create_dir_all(parent).map_err(|e| {
                OlError::new(
                    ERR_HOOK_WRITE_FAILED,
                    format!("Cannot create settings directory: {e}"),
                )
                .with_suggestion("Check file permissions.")
                .with_docs("https://docs.openlatch.ai/errors/OL-1401")
            })?;
        }
        std::fs::write(path, "{}").map_err(|e| {
            OlError::new(
                ERR_HOOK_WRITE_FAILED,
                format!("Cannot create settings.json: {e}"),
            )
            .with_suggestion("Check file permissions.")
            .with_docs("https://docs.openlatch.ai/errors/OL-1401")
        })?;
        Ok("{}".to_string())
    }
}

/// Convert a `serde_json::Value` into the CST's `CstInputValue` type.
///
/// This enables us to insert arbitrary JSON values into the CST while preserving
/// surrounding JSONC structure (comments, trailing commas, whitespace).
fn serde_to_cst_input(v: serde_json::Value) -> jsonc_parser::cst::CstInputValue {
    use jsonc_parser::cst::CstInputValue;
    match v {
        serde_json::Value::Null => CstInputValue::Null,
        serde_json::Value::Bool(b) => CstInputValue::Bool(b),
        serde_json::Value::Number(n) => CstInputValue::Number(n.to_string()),
        serde_json::Value::String(s) => CstInputValue::String(s),
        serde_json::Value::Array(arr) => {
            CstInputValue::Array(arr.into_iter().map(serde_to_cst_input).collect())
        }
        serde_json::Value::Object(map) => {
            let props: Vec<(String, CstInputValue)> = map
                .into_iter()
                .map(|(k, v)| (k, serde_to_cst_input(v)))
                .collect();
            CstInputValue::Object(props)
        }
    }
}

/// Insert or replace hook entries in the raw JSONC string.
///
/// For each `(event_type, entry_value)` pair:
/// - If the `hooks[event_type]` array exists and already contains an entry with
///   `_openlatch: true`, that entry is **replaced** (idempotent re-install).
/// - Otherwise, the new entry is **appended** to the array (creating the array
///   and/or `hooks` object if they do not yet exist).
///
/// The returned string preserves all comments, whitespace, and trailing commas
/// in regions not modified by this function.
///
/// # Errors
///
/// - `OL-1402` if the JSONC cannot be parsed.
pub fn insert_hook_entries(
    raw_jsonc: &str,
    entries: &[(String, serde_json::Value)],
) -> Result<(String, Vec<super::HookAction>), OlError> {
    use jsonc_parser::cst::{CstContainerNode, CstNode, CstRootNode};
    use jsonc_parser::ParseOptions;

    // Parse the JSONC to a CST.
    let root = CstRootNode::parse(raw_jsonc, &ParseOptions::default()).map_err(|e| {
        OlError::new(
            ERR_HOOK_MALFORMED_JSONC,
            format!("Cannot parse settings.json as JSONC: {e}"),
        )
        .with_suggestion("Fix the JSON syntax in your settings.json file.")
        .with_docs("https://docs.openlatch.ai/errors/OL-1402")
    })?;

    // Get (or create) the root object.
    let root_obj = root.object_value_or_set();

    // Ensure "hooks" key exists as an object.
    let hooks_obj = root_obj.object_value_or_set("hooks");

    let mut actions = Vec::new();

    for (event_type, entry_value) in entries {
        // Ensure the event-type array exists.
        let arr = hooks_obj.array_value_or_set(event_type);

        // Convert the new entry to a CstInputValue (object form).
        let cst_value = serde_to_cst_input(entry_value.clone());

        // Search for an existing OpenLatch-owned element.
        let existing_index = find_openlatch_element_index(&arr);

        if let Some(idx) = existing_index {
            // Replace the existing element.  The CST array's elements() are CstNode;
            // Container nodes have replace_with(), leaf nodes have replace_with() too.
            let elements = arr.elements();
            let old_el = &elements[idx];
            match old_el {
                CstNode::Container(c) => {
                    // object or array — replace using container's replace_with
                    match c {
                        CstContainerNode::Object(obj) => {
                            obj.clone().replace_with(cst_value);
                        }
                        CstContainerNode::Array(a) => {
                            a.clone().replace_with(cst_value);
                        }
                        _ => {
                            // Unexpected container type — fall back to remove + insert
                            old_el.clone().remove();
                            arr.insert(idx, cst_value);
                        }
                    }
                }
                CstNode::Leaf(_) => {
                    // scalar value — remove and re-insert
                    old_el.clone().remove();
                    arr.insert(idx, cst_value);
                }
            }
            actions.push(super::HookAction::Replaced);
        } else {
            // Append a new element.
            arr.append(cst_value);
            actions.push(super::HookAction::Added);
        }
    }

    Ok((root.to_string(), actions))
}

/// Remove all hook entries owned by OpenLatch (`_openlatch: true`) from the JSONC.
///
/// Entries belonging to other tools are left untouched.
///
/// # Errors
///
/// - `OL-1402` if the JSONC cannot be parsed.
pub fn remove_owned_entries(raw_jsonc: &str) -> Result<String, OlError> {
    use jsonc_parser::cst::{CstContainerNode, CstNode, CstRootNode};
    use jsonc_parser::ParseOptions;

    let root = CstRootNode::parse(raw_jsonc, &ParseOptions::default()).map_err(|e| {
        OlError::new(
            ERR_HOOK_MALFORMED_JSONC,
            format!("Cannot parse settings.json as JSONC: {e}"),
        )
        .with_suggestion("Fix the JSON syntax in your settings.json file.")
        .with_docs("https://docs.openlatch.ai/errors/OL-1402")
    })?;

    // Walk the object tree; if there's no hooks key we're done.
    let root_obj = match root.object_value() {
        Some(obj) => obj,
        None => return Ok(root.to_string()),
    };

    let hooks_prop = match root_obj.get("hooks") {
        Some(p) => p,
        None => return Ok(root.to_string()),
    };

    let hooks_obj = match hooks_prop.value() {
        Some(CstNode::Container(CstContainerNode::Object(obj))) => obj,
        _ => return Ok(root.to_string()),
    };

    for event_prop in hooks_obj.properties() {
        let arr = match event_prop.value() {
            Some(CstNode::Container(CstContainerNode::Array(a))) => a,
            _ => continue,
        };

        // Collect elements to remove (snapshot before mutating).
        let to_remove: Vec<CstNode> = arr
            .elements()
            .into_iter()
            .filter(is_openlatch_node)
            .collect();

        // Remove each owned entry. The CST handles re-indexing internally.
        for el in to_remove {
            el.remove();
        }
    }

    Ok(root.to_string())
}

/// Set an environment variable in the `"env"` object of the JSONC settings.
///
/// Creates the `"env"` key if it does not exist. Overwrites the value if the key
/// already exists. Preserves all other keys and JSONC structure.
///
/// # Errors
///
/// - `OL-1402` if the JSONC cannot be parsed.
pub fn set_env_var(raw_jsonc: &str, key: &str, value: &str) -> Result<String, OlError> {
    use jsonc_parser::cst::CstRootNode;
    use jsonc_parser::ParseOptions;

    let root = CstRootNode::parse(raw_jsonc, &ParseOptions::default()).map_err(|e| {
        OlError::new(
            ERR_HOOK_MALFORMED_JSONC,
            format!("Cannot parse settings.json as JSONC: {e}"),
        )
        .with_suggestion("Fix the JSON syntax in your settings.json file.")
        .with_docs("https://docs.openlatch.ai/errors/OL-1402")
    })?;

    let root_obj = root.object_value_or_set();
    let env_obj = root_obj.object_value_or_set("env");
    let string_value = jsonc_parser::cst::CstInputValue::String(value.to_string());
    if let Some(prop) = env_obj.get(key) {
        prop.set_value(string_value);
    } else {
        env_obj.append(key, string_value);
    }

    Ok(root.to_string())
}

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

/// Find the index of the first array element that carries `"_openlatch": true`.
fn find_openlatch_element_index(arr: &jsonc_parser::cst::CstArray) -> Option<usize> {
    arr.elements().iter().position(is_openlatch_node)
}

/// Return `true` if the CST node is a JSON object with `"_openlatch": true`.
fn is_openlatch_node(el: &jsonc_parser::cst::CstNode) -> bool {
    // Use serde_json feature to convert the CST node to a value, then check.
    match el.to_serde_value() {
        Some(serde_json::Value::Object(map)) => map
            .get("_openlatch")
            .and_then(|v| v.as_bool())
            .unwrap_or(false),
        _ => false,
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::json;

    // -------------------------------------------------------------------------
    // read_or_create_settings tests
    // -------------------------------------------------------------------------

    #[test]
    fn test_read_or_create_creates_missing_file() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("settings.json");

        // File does not exist yet.
        assert!(!path.exists());

        let content = read_or_create_settings(&path).unwrap();
        assert_eq!(content, "{}");
        assert!(path.exists());
    }

    #[test]
    fn test_read_or_create_reads_existing_file() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("settings.json");
        std::fs::write(&path, r#"{ "key": "value" }"#).unwrap();

        let content = read_or_create_settings(&path).unwrap();
        assert_eq!(content, r#"{ "key": "value" }"#);
    }

    // -------------------------------------------------------------------------
    // insert_hook_entries tests
    // -------------------------------------------------------------------------

    fn make_entries() -> Vec<(String, serde_json::Value)> {
        vec![
            (
                "PreToolUse".to_string(),
                json!({ "_openlatch": true, "matcher": "", "hooks": [] }),
            ),
            (
                "UserPromptSubmit".to_string(),
                json!({ "_openlatch": true, "hooks": [] }),
            ),
            (
                "Stop".to_string(),
                json!({ "_openlatch": true, "hooks": [] }),
            ),
        ]
    }

    #[test]
    fn test_insert_into_empty_settings_creates_hooks_object() {
        let raw = "{}";
        let entries = make_entries();

        let (result, actions) = insert_hook_entries(raw, &entries).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&result).unwrap();

        assert!(parsed["hooks"]["PreToolUse"].is_array());
        assert!(parsed["hooks"]["UserPromptSubmit"].is_array());
        assert!(parsed["hooks"]["Stop"].is_array());

        assert_eq!(parsed["hooks"]["PreToolUse"][0]["_openlatch"], true);
        assert_eq!(actions.len(), 3);
        assert!(actions
            .iter()
            .all(|a| *a == super::super::HookAction::Added));
    }

    #[test]
    fn test_insert_preserves_existing_non_openlatch_hooks() {
        let raw = r#"{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "echo hi" }] }
    ]
  }
}"#;
        let entries = vec![(
            "PreToolUse".to_string(),
            json!({ "_openlatch": true, "matcher": "", "hooks": [] }),
        )];

        let (result, _) = insert_hook_entries(raw, &entries).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&result).unwrap();

        let arr = parsed["hooks"]["PreToolUse"].as_array().unwrap();
        // Both the original entry and the OpenLatch entry should be present.
        assert_eq!(arr.len(), 2, "Expected 2 entries, got {}", arr.len());
        // Original entry still present.
        assert_eq!(arr[0]["hooks"][0]["command"], "echo hi");
        // OpenLatch entry appended.
        assert_eq!(arr[1]["_openlatch"], true);
    }

    #[test]
    fn test_insert_is_idempotent_replaces_existing_openlatch_entry() {
        let raw = r#"{
  "hooks": {
    "PreToolUse": [
      { "_openlatch": true, "matcher": "", "hooks": [{"type": "http", "url": "http://localhost:7443/hooks/pre-tool-use"}] }
    ]
  }
}"#;
        let new_entry = json!({
            "_openlatch": true,
            "matcher": "",
            "hooks": [{ "type": "http", "url": "http://localhost:9000/hooks/pre-tool-use" }]
        });
        let entries = vec![("PreToolUse".to_string(), new_entry)];

        let (result, actions) = insert_hook_entries(raw, &entries).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&result).unwrap();

        let arr = parsed["hooks"]["PreToolUse"].as_array().unwrap();
        // Must still be exactly one entry.
        assert_eq!(
            arr.len(),
            1,
            "Idempotent install should not duplicate entries"
        );
        // The URL should be updated.
        let url = arr[0]["hooks"][0]["url"].as_str().unwrap();
        assert!(url.contains("9000"), "Expected updated URL, got: {url}");
        assert_eq!(actions[0], super::super::HookAction::Replaced);
    }

    #[test]
    fn test_insert_preserves_jsonc_comments() {
        // Comments in untouched regions (other arrays, other keys) should survive.
        let raw_with_comment = r#"{
  "hooks": {
    "Stop": [
      // existing user hook
      { "type": "command", "command": "echo stop" }
    ]
  }
}"#;
        let entries = vec![(
            "PreToolUse".to_string(),
            json!({ "_openlatch": true, "matcher": "", "hooks": [] }),
        )];

        let (result, _) = insert_hook_entries(raw_with_comment, &entries).unwrap();
        // The comment in the Stop array should survive (untouched region).
        assert!(
            result.contains("// existing user hook"),
            "Comment was removed: {result}"
        );

        // Verify the new entry was added by re-parsing via the JSONC parser
        // (not serde_json which rejects JSONC comments).
        use jsonc_parser::cst::CstRootNode;
        use jsonc_parser::ParseOptions;
        let verify_root = CstRootNode::parse(&result, &ParseOptions::default())
            .expect("result must be valid JSONC");
        let root_obj = verify_root.object_value().expect("root must be object");
        let hooks_obj = root_obj
            .object_value("hooks")
            .expect("hooks key must exist");
        let pre_arr = hooks_obj
            .array_value("PreToolUse")
            .expect("PreToolUse must be array");
        // The first element should carry _openlatch:true
        let first_el = pre_arr
            .elements()
            .into_iter()
            .next()
            .expect("must have element");
        let first_val = first_el.to_serde_value().expect("must be a value");
        assert_eq!(first_val["_openlatch"], json!(true));
    }

    #[test]
    fn test_malformed_jsonc_returns_ol_1402() {
        let raw = "{ this is not json }";
        let entries = make_entries();

        let err = insert_hook_entries(raw, &entries).unwrap_err();
        assert_eq!(err.code, ERR_HOOK_MALFORMED_JSONC);
    }

    // -------------------------------------------------------------------------
    // remove_owned_entries tests
    // -------------------------------------------------------------------------

    #[test]
    fn test_remove_owned_entries_removes_openlatch_entries() {
        let raw = r#"{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "echo hi" }] },
      { "_openlatch": true, "matcher": "", "hooks": [] }
    ]
  }
}"#;
        let result = remove_owned_entries(raw).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&result).unwrap();

        let arr = parsed["hooks"]["PreToolUse"].as_array().unwrap();
        // Only the non-OpenLatch entry should remain.
        assert_eq!(
            arr.len(),
            1,
            "Expected 1 entry after removal, got {}",
            arr.len()
        );
        assert!(arr[0].get("_openlatch").is_none());
    }

    #[test]
    fn test_remove_owned_entries_no_hooks_key_is_noop() {
        let raw = r#"{"key": "value"}"#;
        let result = remove_owned_entries(raw).unwrap();
        let parsed: serde_json::Value = serde_json::from_str(&result).unwrap();
        assert_eq!(parsed["key"], "value");
        assert!(parsed.get("hooks").is_none());
    }
}