fix: make Cursor hooks fail closed

elydora/plugins/hook_template.py

@@ -1,14 +1,14 @@
-"""Generates self-contained Python hook scripts for AI agent integrations.
-
-The generated script contains all crypto and networking inline so it has zero
-import dependencies beyond the Python stdlib + cryptography (already an
-Elydora SDK dependency).
-"""
+"""Generate self-contained audit hook scripts."""
 
 from __future__ import annotations
 
 import sys
 
+from .guard_template import generate_guard_script
+from .runtime_reader_template import PROTECTED_RUNTIME_READER
+
+__all__ = ["generate_guard_script", "generate_hook_script"]
+
 
 def generate_hook_script(
     *,
@@ -17,76 +17,63 @@ def generate_hook_script(
     kid: str,
     base_url: str,
     success_output: str = "",
+    fail_closed: bool = False,
+    native_payload: bool = False,
+    agent_name: str = "",
 ) -> str:
-    """Return a complete, self-contained Python hook script as a string.
-
-    The script:
-      1. Reads JSON from stdin (tool-use event)
-      2. Constructs an Elydora Operation Record (EOR)
-      3. Signs it with Ed25519
-      4. POSTs it fire-and-forget to the Elydora API
-      5. Always exits 0 (never blocks the host agent)
-
-    Chain state is persisted in ~/.elydora/{agent_id}/chain-state.json.
-    """
-    shebang = sys.executable
-    return f'''#!{shebang}
-"""Elydora audit hook — auto-generated, do not edit."""
+    """Return a self-contained signed audit hook."""
+    return f'''#!{sys.executable}
+"""Elydora audit hook. Generated by elydora-sdk."""
 
 import base64
 import hashlib
 import json
 import math
 import os
+import re
 import stat
 import struct
 import sys
 import time
+import urllib.error
+import urllib.parse
+import urllib.request
 
-# ---------------------------------------------------------------------------
-# Configuration (baked at install time)
-# ---------------------------------------------------------------------------
 ORG_ID = {org_id!r}
 AGENT_ID = {agent_id!r}
+AGENT_NAME = {agent_name!r}
 KID = {kid!r}
 BASE_URL = {base_url!r}
 SUCCESS_OUTPUT = {success_output!r}
-
+FAIL_CLOSED = {fail_closed!r}
+NATIVE_PAYLOAD = {native_payload!r}
 ELYDORA_DIR = os.path.join(os.path.expanduser("~"), ".elydora")
+CONFIG_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "config.json")
 PRIVATE_KEY_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "private.key")
 CHAIN_STATE_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "chain-state.json")
 ERROR_LOG_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "error.log")
 ZERO_CHAIN_HASH = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-MAX_PRIVATE_KEY_BYTES = 64 * 1024
 
-# ---------------------------------------------------------------------------
-# Base64url helpers
-# ---------------------------------------------------------------------------
+{PROTECTED_RUNTIME_READER}
 
-def base64url_encode(data: bytes) -> str:
+
+def base64url_encode(data):
     return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
 
-def base64url_decode(s: str) -> bytes:
-    s = s.replace("-", "+").replace("_", "/")
-    padding = 4 - len(s) % 4
-    if padding != 4:
-        s += "=" * padding
-    return base64.b64decode(s)
 
-# ---------------------------------------------------------------------------
-# SHA-256
-# ---------------------------------------------------------------------------
+def base64url_decode(value):
+    encoded = value.replace("-", "+").replace("_", "/")
+    encoded += "=" * ((4 - len(encoded) % 4) % 4)
+    return base64.b64decode(encoded, validate=True)
+
 
 def sha256_base64url(data):
     if isinstance(data, str):
         data = data.encode("utf-8")
     return base64url_encode(hashlib.sha256(data).digest())
 
-# ---------------------------------------------------------------------------
-# JCS canonicalization (RFC 8785)
-# ---------------------------------------------------------------------------
 
-def _jcs_number(value):
+def jcs_number(value):
     if isinstance(value, bool):
         return "true" if value else "false"
     if isinstance(value, int):
@@ -97,362 +84,278 @@ def _jcs_number(value):
         return "0"
     return json.dumps(value)
 
+
 def jcs_canonicalize(value):
     if value is None:
         return "null"
     if isinstance(value, bool):
         return "true" if value else "false"
     if isinstance(value, (int, float)):
-        return _jcs_number(value)
+        return jcs_number(value)
     if isinstance(value, str):
         return json.dumps(value, ensure_ascii=False)
     if isinstance(value, list):
-        return "[" + ",".join(jcs_canonicalize(v) for v in value) + "]"
+        return "[" + ",".join(jcs_canonicalize(item) for item in value) + "]"
     if isinstance(value, dict):
-        keys = sorted(value.keys())
-        pairs = []
-        for k in keys:
-            pairs.append(json.dumps(k, ensure_ascii=False) + ":" + jcs_canonicalize(value[k]))
+        pairs = [
+            json.dumps(key, ensure_ascii=False) + ":" + jcs_canonicalize(value[key])
+            for key in sorted(value)
+        ]
         return "{{" + ",".join(pairs) + "}}"
     return json.dumps(value)
 
-# ---------------------------------------------------------------------------
-# Hash helpers
-# ---------------------------------------------------------------------------
 
 def compute_payload_hash(payload):
     return sha256_base64url(jcs_canonicalize(payload))
 
-def compute_chain_hash(prev_chain_hash, payload_hash, operation_id, issued_at):
-    input_str = f"{{prev_chain_hash}}|{{payload_hash}}|{{operation_id}}|{{issued_at}}"
-    return sha256_base64url(input_str)
 
-# ---------------------------------------------------------------------------
-# Ed25519 signing (uses cryptography library)
-# ---------------------------------------------------------------------------
+def compute_chain_hash(previous, payload_hash, operation_id, issued_at):
+    value = f"{{previous}}|{{payload_hash}}|{{operation_id}}|{{issued_at}}"
+    return sha256_base64url(value)
 
-def sign_ed25519(private_key_b64url, data):
-    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-    seed = base64url_decode(private_key_b64url)
-    key = Ed25519PrivateKey.from_private_bytes(seed)
-    return base64url_encode(key.sign(data))
 
 def read_private_key():
-    before = os.lstat(PRIVATE_KEY_PATH)
-    if not stat.S_ISREG(before.st_mode):
-        raise ValueError("Private key path is not a regular file: " + PRIVATE_KEY_PATH)
-    if before.st_size > MAX_PRIVATE_KEY_BYTES:
-        raise ValueError("Private key file exceeds the size limit: " + PRIVATE_KEY_PATH)
-    if os.name != "nt" and before.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
-        raise PermissionError("Private key file permissions are too broad: " + PRIVATE_KEY_PATH)
+    encoded = read_protected_file(PRIVATE_KEY_PATH, "Private key").decode("utf-8")
+    if not encoded or "\\r" in encoded or "\\n" in encoded or "\\0" in encoded:
+        raise ValueError("Private key file must contain exactly one line")
+    seed = base64url_decode(encoded)
+    if len(seed) != 32 or base64url_encode(seed) != encoded:
+        raise ValueError("Private key must be a canonical 32-byte base64url value")
+    return seed
 
-    flags = os.O_RDONLY
-    flags |= getattr(os, "O_BINARY", 0)
-    flags |= getattr(os, "O_CLOEXEC", 0)
-    flags |= getattr(os, "O_NOFOLLOW", 0)
-    descriptor = os.open(PRIVATE_KEY_PATH, flags)
+
+def sign_ed25519(seed, data):
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+    return base64url_encode(Ed25519PrivateKey.from_private_bytes(seed).sign(data))
+
+
+def generate_uuidv7():
+    timestamp = struct.pack(">Q", int(time.time() * 1000))[2:]
+    random_a = (struct.unpack(">H", os.urandom(2))[0] & 0x0FFF) | 0x7000
+    random_b = bytearray(os.urandom(8))
+    random_b[0] = (random_b[0] & 0x3F) | 0x80
+    value = (timestamp + struct.pack(">H", random_a) + bytes(random_b)).hex()
+    return f"{{value[0:8]}}-{{value[8:12]}}-{{value[12:16]}}-{{value[16:20]}}-{{value[20:32]}}"
+
+
+def log_error(error):
+    descriptor = -1
     try:
-        file = os.fdopen(descriptor, "rb")
-        descriptor = -1
-        with file:
-            after = os.fstat(file.fileno())
-            if not stat.S_ISREG(after.st_mode):
-                raise ValueError("Private key path is not a regular file: " + PRIVATE_KEY_PATH)
-            if after.st_size > MAX_PRIVATE_KEY_BYTES:
-                raise ValueError("Private key file exceeds the size limit: " + PRIVATE_KEY_PATH)
-            if os.name != "nt" and after.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
-                raise PermissionError("Private key file permissions are too broad: " + PRIVATE_KEY_PATH)
-            if (before.st_dev, before.st_ino) != (after.st_dev, after.st_ino):
-                raise OSError("Private key file changed while opening: " + PRIVATE_KEY_PATH)
-            encoded = file.read(MAX_PRIVATE_KEY_BYTES + 1)
+        message = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+        message += " [elydora-hook] " + repr(error) + "\\n"
+        flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
+        flags |= getattr(os, "O_BINARY", 0) | getattr(os, "O_CLOEXEC", 0)
+        flags |= getattr(os, "O_NOFOLLOW", 0)
+        descriptor = os.open(ERROR_LOG_PATH, flags, 0o600)
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode):
+            raise ValueError("Error log path is not a physical file: " + ERROR_LOG_PATH)
+        with os.fdopen(descriptor, "a", encoding="utf-8") as file:
+            descriptor = -1
+            file.write(message)
+        if os.name != "nt":
+            os.chmod(ERROR_LOG_PATH, 0o600)
+    except Exception as log_failure:
+        sys.stderr.write("[Elydora audit] Failed to write error log: " + str(log_failure) + "\\n")
     finally:
         if descriptor >= 0:
             os.close(descriptor)
 
-    if len(encoded) > MAX_PRIVATE_KEY_BYTES:
-        raise ValueError("Private key file exceeds the size limit: " + PRIVATE_KEY_PATH)
-    value = encoded.decode("utf-8")
-    if not value or "\\r" in value or "\\n" in value or "\\0" in value:
-        raise ValueError("Private key file must contain exactly one line")
-    return value
-
-# ---------------------------------------------------------------------------
-# UUIDv7
-# ---------------------------------------------------------------------------
-
-def generate_uuidv7():
-    timestamp_ms = int(time.time() * 1000)
-    ts_bytes = struct.pack(">Q", timestamp_ms)[2:]
-    rand_a = struct.unpack(">H", os.urandom(2))[0]
-    rand_a = (rand_a & 0x0FFF) | 0x7000
-    rand_b = bytearray(os.urandom(8))
-    rand_b[0] = (rand_b[0] & 0x3F) | 0x80
-    uuid_bytes = ts_bytes + struct.pack(">H", rand_a) + bytes(rand_b)
-    h = uuid_bytes.hex()
-    return f"{{h[0:8]}}-{{h[8:12]}}-{{h[12:16]}}-{{h[16:20]}}-{{h[20:32]}}"
-
-def generate_nonce():
-    return base64url_encode(os.urandom(16))
-
-# ---------------------------------------------------------------------------
-# Chain state persistence
-# ---------------------------------------------------------------------------
 
 def read_chain_state():
     try:
-        with open(CHAIN_STATE_PATH, "r") as f:
-            state = json.load(f)
-            return state.get("prev_chain_hash", ZERO_CHAIN_HASH) or ZERO_CHAIN_HASH
-    except (FileNotFoundError, json.JSONDecodeError):
+        raw = read_protected_file(
+            CHAIN_STATE_PATH,
+            "Chain state",
+            MAX_PROTECTED_CONFIG_BYTES,
+            require_private_permissions=False,
+        ).decode("utf-8")
+    except FileNotFoundError:
         return ZERO_CHAIN_HASH
+    except Exception as error:
+        if FAIL_CLOSED:
+            raise RuntimeError("Failed to read chain state: " + str(error)) from error
+        log_error(error)
+        return ZERO_CHAIN_HASH
+    try:
+        state = json.loads(raw)
+    except (json.JSONDecodeError, ValueError) as error:
+        if FAIL_CLOSED:
+            raise RuntimeError("Chain state is invalid JSON: " + str(error)) from error
+        log_error(error)
+        return ZERO_CHAIN_HASH
+    previous = state.get("prev_chain_hash") if isinstance(state, dict) else None
+    if not isinstance(previous, str) or re.fullmatch(r"[A-Za-z0-9_-]{{43}}", previous) is None:
+        error = ValueError("Chain state contains an invalid prev_chain_hash")
+        if FAIL_CLOSED:
+            raise error
+        log_error(error)
+        return ZERO_CHAIN_HASH
+    return previous
+
 
 def write_chain_state(chain_hash):
-    os.makedirs(os.path.dirname(CHAIN_STATE_PATH), exist_ok=True)
-    tmp_path = CHAIN_STATE_PATH + ".tmp"
-    with open(tmp_path, "w") as f:
-        json.dump({{"prev_chain_hash": chain_hash}}, f)
+    token = os.urandom(8).hex()
+    temporary_path = CHAIN_STATE_PATH + "." + str(os.getpid()) + "." + token + ".tmp"
+    descriptor = -1
     try:
-        os.replace(tmp_path, CHAIN_STATE_PATH)
-    except OSError:
-        import shutil
-        shutil.move(tmp_path, CHAIN_STATE_PATH)
-
-def log_error(err):
-    try:
-        ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-        msg = f"{{ts}} [elydora-hook] {{err}}\\n"
-        os.makedirs(os.path.dirname(ERROR_LOG_PATH), exist_ok=True)
-        with open(ERROR_LOG_PATH, "a") as f:
-            f.write(msg)
-    except Exception:
-        pass
-
-# ---------------------------------------------------------------------------
-# Main hook logic
-# ---------------------------------------------------------------------------
-
-def main():
-    try:
-        raw = sys.stdin.read()
-        if not raw.strip():
-            return
-
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0)
+        descriptor = os.open(temporary_path, flags, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as file:
+            descriptor = -1
+            json.dump({{"prev_chain_hash": chain_hash}}, file)
+            file.flush()
+            os.fsync(file.fileno())
+        os.replace(temporary_path, CHAIN_STATE_PATH)
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
         try:
-            event = json.loads(raw)
-        except (json.JSONDecodeError, ValueError):
-            return
+            os.remove(temporary_path)
+        except FileNotFoundError:
+            pass
 
-        # Extract tool event data
-        tool_name = "unknown"
-        tool_input = {{}}
-        session_id = "unknown"
 
-        if isinstance(event, dict):
-            cline_event = event.get("tool_result")
-            if not isinstance(cline_event, dict):
-                cline_event = event.get("tool_call")
-            if not isinstance(cline_event, dict):
-                cline_event = {{}}
-            tool_name = event.get(
-                "tool_name",
-                event.get("toolName", event.get("name", cline_event.get("name", "unknown"))),
-            )
-            tool_input = event.get(
-                "tool_input",
-                event.get("toolInput", event.get("input", cline_event.get("input", {{}}))),
-            )
-            session_id = event.get(
-                "session_id",
-                event.get("sessionId", event.get("session", event.get("taskId", "unknown"))),
-            )
-
-        # Read chain state
-        prev_chain_hash = read_chain_state()
-
-        # Build the EOR
-        operation_id = generate_uuidv7()
-        issued_at = int(time.time() * 1000)
-        nonce = generate_nonce()
-
-        payload = {{
-            "tool_name": tool_name,
-            "tool_input": tool_input,
-            "session_id": session_id,
-        }}
-
-        payload_hash = compute_payload_hash(payload)
-        chain_hash = compute_chain_hash(prev_chain_hash, payload_hash, operation_id, issued_at)
-
-        eor_without_sig = {{
-            "op_version": "1.0",
-            "operation_id": operation_id,
+def read_runtime_config():
+    if not FAIL_CLOSED:
+        return {{
             "org_id": ORG_ID,
             "agent_id": AGENT_ID,
-            "issued_at": issued_at,
-            "ttl_ms": 30000,
-            "nonce": nonce,
-            "operation_type": "ai.tool_use",
-            "subject": {{"session_id": session_id}},
-            "action": {{"tool": tool_name}},
-            "payload": payload,
-            "payload_hash": payload_hash,
-            "prev_chain_hash": prev_chain_hash,
-            "agent_pubkey_kid": KID,
+            "agent_name": AGENT_NAME,
+            "kid": KID,
+            "base_url": BASE_URL,
+            "token": "",
         }}
+    try:
+        raw = read_protected_file(
+            CONFIG_PATH,
+            "Agent config",
+            MAX_PROTECTED_CONFIG_BYTES,
+        ).decode("utf-8")
+        config = json.loads(raw)
+    except Exception as error:
+        raise RuntimeError("Failed to read agent config: " + str(error)) from error
+    if not isinstance(config, dict):
+        raise ValueError("Agent config must contain a JSON object")
+    if config.get("agent_id") != AGENT_ID or config.get("agent_name") != AGENT_NAME:
+        raise ValueError("Agent config identity does not match the generated audit hook")
+    for field in ("org_id", "agent_id", "kid"):
+        if not isinstance(config.get(field), str) or not config[field]:
+            raise ValueError("Agent config is missing " + field)
+    base_url = config.get("base_url", "https://api.elydora.com")
+    if not isinstance(base_url, str):
+        raise ValueError("Agent config base_url must be a string")
+    if urllib.parse.urlsplit(base_url).scheme not in ("http", "https"):
+        raise ValueError("Agent config base_url must use HTTP or HTTPS")
+    if not isinstance(config.get("token", ""), str):
+        raise ValueError("Agent config token must be a string")
+    return config
 
-        canonical = jcs_canonicalize(eor_without_sig)
-        signature = sign_ed25519(read_private_key(), canonical.encode("utf-8"))
 
-        eor = dict(eor_without_sig)
-        eor["chain_hash"] = chain_hash
-        eor["signature"] = signature
+def read_event():
+    raw = sys.stdin.read()
+    if not raw.strip():
+        raise ValueError("Hook input is empty")
+    try:
+        event = json.loads(raw)
+    except (json.JSONDecodeError, ValueError) as error:
+        raise ValueError("Hook input is invalid JSON: " + str(error)) from error
+    if not isinstance(event, dict):
+        raise ValueError("Hook input must contain a JSON object")
+    return event
 
-        # POST to /v1/operations (5s timeout)
-        # Only update local chain state on success to prevent desync
-        try:
-            import urllib.request
-            import urllib.error
-            url = BASE_URL.rstrip("/") + "/v1/operations"
-            body = json.dumps(eor).encode("utf-8")
-            headers = {{"Content-Type": "application/json", "Accept": "application/json"}}
-            req = urllib.request.Request(url, data=body, headers=headers, method="POST")
-            resp = urllib.request.urlopen(req, timeout=5)
-            # Server accepted (2xx) — safe to advance local chain state
+
+def submit_operation(event, runtime):
+    nested = event.get("tool_result")
+    if not isinstance(nested, dict):
+        nested = event.get("tool_call")
+    if not isinstance(nested, dict):
+        nested = {{}}
+    tool_name = event.get("tool_name", event.get("toolName", event.get("name", nested.get("name", "unknown"))))
+    tool_input = event.get("tool_input", event.get("toolInput", event.get("input", nested.get("input", {{}}))))
+    session_id = event.get(
+        "conversation_id",
+        event.get("session_id", event.get("sessionId", event.get("session", event.get("taskId", "unknown")))),
+    )
+    previous = read_chain_state()
+    operation_id = generate_uuidv7()
+    issued_at = int(time.time() * 1000)
+    payload = event if NATIVE_PAYLOAD else {{
+        "tool_name": tool_name,
+        "tool_input": tool_input,
+        "session_id": session_id,
+    }}
+    payload_hash = compute_payload_hash(payload)
+    chain_hash = compute_chain_hash(previous, payload_hash, operation_id, issued_at)
+    unsigned = {{
+        "op_version": "1.0",
+        "operation_id": operation_id,
+        "org_id": runtime["org_id"],
+        "agent_id": runtime["agent_id"],
+        "issued_at": issued_at,
+        "ttl_ms": 30000,
+        "nonce": base64url_encode(os.urandom(16)),
+        "operation_type": "ai.tool_use",
+        "subject": {{"session_id": session_id}},
+        "action": {{"tool": tool_name}},
+        "payload": payload,
+        "payload_hash": payload_hash,
+        "prev_chain_hash": previous,
+        "agent_pubkey_kid": runtime["kid"],
+    }}
+    signature = sign_ed25519(
+        read_private_key(),
+        jcs_canonicalize(unsigned).encode("utf-8"),
+    )
+    operation = dict(unsigned)
+    operation.update({{"chain_hash": chain_hash, "signature": signature}})
+    url = runtime.get("base_url", "https://api.elydora.com").rstrip("/") + "/v1/operations"
+    headers = {{"Content-Type": "application/json", "Accept": "application/json"}}
+    if runtime.get("token"):
+        headers["Authorization"] = "Bearer " + runtime["token"]
+    request = urllib.request.Request(
+        url,
+        data=json.dumps(operation).encode("utf-8"),
+        headers=headers,
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=5):
             write_chain_state(chain_hash)
-        except urllib.error.HTTPError as http_err:
-            if http_err.code == 400:
-                # Possible chain hash mismatch — try to resync from server response
-                try:
-                    import re
-                    err_body = json.loads(http_err.read().decode("utf-8"))
-                    if isinstance(err_body, dict) and isinstance(err_body.get("error"), dict):
-                        if err_body["error"].get("code") == "PREV_HASH_MISMATCH":
-                            match = re.search(r'Expected prev_chain_hash "([^"]+)"', err_body["error"].get("message", ""))
-                            if match:
-                                write_chain_state(match.group(1))
-                                log_error("Chain hash resynced to server: " + match.group(1))
-                except Exception:
-                    pass  # ignore parse errors
-            else:
-                log_error("API returned HTTP " + str(http_err.code))
-        except Exception:
-            pass  # Network error — don't advance chain state, will retry with same prev_chain_hash
-
-    except Exception as e:
-        log_error(e)
-
-if __name__ == "__main__":
-    main()
-    if SUCCESS_OUTPUT:
-        sys.stdout.write(SUCCESS_OUTPUT)
-'''
-
-
-def generate_guard_script(
-    agent_name: str,
-    agent_id: str,
-    success_output: str = "",
-) -> str:
-    """Return a self-contained Python guard script for PreToolUse freeze enforcement.
-
-    The script:
-      1. Reads agent config from ~/.elydora/{agent_id}/config.json
-      2. Checks cached status from ~/.elydora/{agent_id}/status-cache.json (60s TTL)
-      3. If cache is stale, fetches agent status from GET {base_url}/v1/agents/{agent_id}
-      4. If status is "frozen", writes error to stderr and exits with blocking code 2
-      5. Fail-open: if API unreachable or config missing, exits 0 (allow)
-      6. Uses only stdlib — no external deps
-    """
-    shebang = sys.executable
-    return f'''#!{shebang}
-"""Elydora agent guard (PreToolUse) for: {agent_name}
-Generated by elydora-sdk — DO NOT EDIT."""
-
-import json
-import os
-import sys
-import time
-
-AGENT_NAME = {agent_name!r}
-AGENT_ID = {agent_id!r}
-SUCCESS_OUTPUT = {success_output!r}
-ELYDORA_DIR = os.path.join(os.path.expanduser("~"), ".elydora")
-CONFIG_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "config.json")
-STATUS_CACHE_PATH = os.path.join(ELYDORA_DIR, AGENT_ID, "status-cache.json")
-CACHE_TTL_S = 60  # 60 seconds
-
-# Consume stdin so the parent process doesn't block on a full pipe
-try:
-    sys.stdin.read()
-except Exception:
-    pass
+    except urllib.error.HTTPError as error:
+        body = error.read().decode("utf-8")
+        if error.code == 400 and body:
+            try:
+                failure = json.loads(body)
+            except (json.JSONDecodeError, ValueError) as parse_error:
+                raise RuntimeError("Audit API returned invalid error JSON: " + str(parse_error)) from parse_error
+            details = failure.get("error", {{}}) if isinstance(failure, dict) else {{}}
+            if details.get("code") == "PREV_HASH_MISMATCH":
+                match = re.search(
+                    r'Expected prev_chain_hash "([A-Za-z0-9_-]{{43}})"',
+                    str(details.get("message", "")),
+                )
+                if match:
+                    write_chain_state(match.group(1))
+                    log_error("Chain hash resynced to server: " + match.group(1))
+        raise RuntimeError("Audit API returned HTTP " + str(error.code)) from error
 
 
 def main():
-    # Read agent config
     try:
-        with open(CONFIG_PATH, "r") as f:
-            config = json.load(f)
-    except Exception:
-        return  # Can't read config — fail-open (allow)
-
-    # Check cached status
-    try:
-        with open(STATUS_CACHE_PATH, "r") as f:
-            cache = json.load(f)
-        age = time.time() - cache.get("cached_at", 0)
-        if age < CACHE_TTL_S:
-            if cache.get("status") == "frozen":
-                sys.stderr.write(
-                    'Agent "' + AGENT_NAME + '" is frozen by Elydora. Tool execution blocked.\\n'
-                )
-                sys.exit(2)
-            return  # Cache is fresh — use cached result
-    except Exception:
-        pass  # No cache or invalid — need to check API
-
-    # Fetch agent status from API
-    base_url = config.get("base_url", "https://api.elydora.com").rstrip("/")
-    agent_id = config.get("agent_id", "")
-
-    try:
-        import urllib.request
-        import urllib.error
-
-        url = base_url + "/v1/agents/" + urllib.request.quote(agent_id, safe="")
-        req = urllib.request.Request(url, method="GET")
-        req.add_header("Accept", "application/json")
-        token = config.get("token", "")
-        if token:
-            req.add_header("Authorization", "Bearer " + token)
-
-        resp = urllib.request.urlopen(req, timeout=3)
-        data = json.loads(resp.read().decode("utf-8"))
-        agent_status = "active"
-        if isinstance(data, dict) and isinstance(data.get("agent"), dict):
-            agent_status = data["agent"].get("status", "active")
-
-        # Update cache
-        try:
-            os.makedirs(os.path.dirname(STATUS_CACHE_PATH), exist_ok=True)
-            with open(STATUS_CACHE_PATH, "w") as f:
-                json.dump({{"status": agent_status, "cached_at": time.time()}}, f)
-        except Exception:
-            pass  # Ignore cache write failures
-
-        if agent_status == "frozen":
-            sys.stderr.write(
-                'Agent "' + AGENT_NAME + '" is frozen by Elydora. Tool execution blocked.\\n'
-            )
-            sys.exit(2)
-    except SystemExit:
-        raise  # Re-raise sys.exit
-    except Exception:
-        pass  # API unreachable — fail-open (allow)
+        submit_operation(read_event(), read_runtime_config())
+    except Exception as error:
+        log_error(error)
+        if FAIL_CLOSED:
+            raise
 
 
 if __name__ == "__main__":
-    main()
+    try:
+        main()
+    except Exception as error:
+        sys.stderr.write("[Elydora audit] " + repr(error) + "\\n")
+        raise SystemExit(1)
     if SUCCESS_OUTPUT:
         sys.stdout.write(SUCCESS_OUTPUT)
 '''