feat(hooks): 3 self-audit triggers — stop/milestone/error-spike
This commit is contained in:
Parfii-bot
parent
040e189b80
commit
994c310fc4
3 changed files with 189 additions and 0 deletions
86
hooks/error-spike-detector.sh
Executable file
86
hooks/error-spike-detector.sh
Executable file
|
|
@ -0,0 +1,86 @@
|
|||
#!/bin/sh
|
||||
# error-spike-detector.sh — PostToolUse:* hook (RULE 0.14).
|
||||
#
|
||||
# Maintains a rolling 20-tool-call window of (timestamp, error_flag) pairs.
|
||||
# When ≥3 errors land in the window, append to audit-backlog.md. NEVER
|
||||
# blocks: every exit path is `exit 0`. Silent-first: stderr advisory only
|
||||
# fires after 10 sessions are in the memory store.
|
||||
|
||||
command -v jq >/dev/null 2>&1 || exit 0
|
||||
|
||||
set -eu
|
||||
|
||||
input="$(cat)"
|
||||
|
||||
is_err=$(printf '%s' "$input" | jq -r '.tool_response.is_error // empty' 2>/dev/null || true)
|
||||
msg=$(printf '%s' "$input" | jq -r '.tool_response.content // .tool_response // empty' 2>/dev/null || true)
|
||||
|
||||
# Classify current call as errored if explicit is_error=true OR message
|
||||
# matches a common failure signature. Empty tool_response → treat as OK.
|
||||
flag=0
|
||||
case "$is_err" in
|
||||
true|True|TRUE|1) flag=1 ;;
|
||||
esac
|
||||
if [ "$flag" -eq 0 ] && [ -n "$msg" ]; then
|
||||
case "$(printf '%s' "$msg" | tr 'A-Z' 'a-z')" in
|
||||
*error:*|*failed*|*panic*|*denied*) flag=1 ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
window="${HOME}/.claude/memory/error-window.txt"
|
||||
backlog="${HOME}/.claude/memory/audit-backlog.md"
|
||||
mkdir -p "$(dirname "$window")" 2>/dev/null || exit 0
|
||||
|
||||
# Append this tool call to the rolling window.
|
||||
ts=$(date +%s)
|
||||
printf '%s %s\n' "$ts" "$flag" >> "$window"
|
||||
|
||||
# Trim to last 20 lines.
|
||||
tmp="${window}.tmp.$$"
|
||||
tail -n 20 "$window" > "$tmp" 2>/dev/null || true
|
||||
mv -f "$tmp" "$window" 2>/dev/null || true
|
||||
|
||||
# Count errors in the window.
|
||||
err_ct=$(awk '$2==1' "$window" 2>/dev/null | wc -l | tr -d ' ')
|
||||
err_ct=${err_ct:-0}
|
||||
|
||||
if [ "$err_ct" -lt 3 ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Classify the spike by greping the recent error messages. Best-effort.
|
||||
pattern="unclassified"
|
||||
if [ -n "$msg" ]; then
|
||||
case "$(printf '%s' "$msg" | tr 'A-Z' 'a-z')" in
|
||||
*permission*denied*) pattern="permission_denied" ;;
|
||||
*worktree*) pattern="worktree_error" ;;
|
||||
*cargo*workspace*) pattern="cargo_workspace" ;;
|
||||
*panic*) pattern="panic" ;;
|
||||
*timeout*) pattern="timeout" ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Ensure the backlog file exists.
|
||||
if [ ! -f "$backlog" ]; then
|
||||
{
|
||||
printf '# Audit Backlog\n\n'
|
||||
printf '<!-- session_count: 0 -->\n\n'
|
||||
} > "$backlog"
|
||||
fi
|
||||
|
||||
iso=$(date -u +%Y-%m-%dT%H:%M)
|
||||
printf -- '- [ERROR-SPIKE %s] %s errors in last 20 tool calls. Pattern: %s\n' \
|
||||
"$iso" "$err_ct" "$pattern" >> "$backlog"
|
||||
|
||||
# Reset window so we do not re-fire on every subsequent call.
|
||||
: > "$window"
|
||||
|
||||
# Silent-first: advisory stderr only after 10 sessions.
|
||||
session_count=$(grep -Eo 'session_count: [0-9]+' "$backlog" 2>/dev/null | head -1 | awk '{print $2}')
|
||||
session_count=${session_count:-0}
|
||||
if [ "$session_count" -ge 10 ]; then
|
||||
printf 'kei-memory: error spike detected (%s in 20) — see %s\n' \
|
||||
"$err_ct" "$backlog" >&2
|
||||
fi
|
||||
|
||||
exit 0
|
||||
59
hooks/milestone-commit-hook.sh
Executable file
59
hooks/milestone-commit-hook.sh
Executable file
|
|
@ -0,0 +1,59 @@
|
|||
#!/bin/sh
|
||||
# milestone-commit-hook.sh — PostToolUse:Bash hook (RULE 0.14).
|
||||
#
|
||||
# On `git commit -m "feat..."` / `refactor:` / `git merge`: call
|
||||
# `kei-memory analyze --last 1 --summary` and append to audit-backlog.md.
|
||||
# NEVER blocks: every exit path is `exit 0`. Silent-first: prompts only
|
||||
# activate after 10 sessions are in the memory store.
|
||||
|
||||
command -v jq >/dev/null 2>&1 || exit 0
|
||||
|
||||
set -eu
|
||||
|
||||
input="$(cat)"
|
||||
|
||||
cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
|
||||
[ -z "$cmd" ] && exit 0
|
||||
|
||||
# Detect milestone commits — feat: / refactor: / merge commits. Case-sensitive
|
||||
# on the conventional-commit prefix so we don't false-fire on "feature-" docs.
|
||||
case "$cmd" in
|
||||
*"git commit"*"-m"*"\"feat"[:\ ]*|\
|
||||
*"git commit"*"-m"*"\"refactor"[:\ ]*|\
|
||||
*"git merge"*)
|
||||
;;
|
||||
*)
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
backlog="${HOME}/.claude/memory/audit-backlog.md"
|
||||
mkdir -p "$(dirname "$backlog")" 2>/dev/null || exit 0
|
||||
|
||||
# Ensure the header + session_count counter exist.
|
||||
if [ ! -f "$backlog" ]; then
|
||||
{
|
||||
printf '# Audit Backlog\n\n'
|
||||
printf '<!-- session_count: 0 -->\n\n'
|
||||
} > "$backlog"
|
||||
fi
|
||||
|
||||
# Read current session_count (silent-first threshold).
|
||||
session_count=$(grep -Eo 'session_count: [0-9]+' "$backlog" 2>/dev/null | head -1 | awk '{print $2}')
|
||||
session_count=${session_count:-0}
|
||||
|
||||
# Append the summary line if kei-memory is present.
|
||||
ts=$(date -u +%Y-%m-%dT%H:%M)
|
||||
if command -v kei-memory >/dev/null 2>&1; then
|
||||
summary=$(kei-memory analyze --last 1 --summary 2>/dev/null || true)
|
||||
if [ -n "$summary" ]; then
|
||||
printf -- '- [MILESTONE %s] %s' "$ts" "$summary" >> "$backlog"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Advisory stderr reminder only after silent-first threshold.
|
||||
if [ "$session_count" -ge 10 ]; then
|
||||
printf 'kei-memory: audit backlog has unreviewed items (%s)\n' "$backlog" >&2
|
||||
fi
|
||||
|
||||
exit 0
|
||||
44
hooks/session-end-dump.sh
Executable file
44
hooks/session-end-dump.sh
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
#!/bin/sh
|
||||
# session-end-dump.sh — Stop event hook (RULE 0.14).
|
||||
#
|
||||
# On session end: save the transcript JSONL to ~/.claude/memory/traces/
|
||||
# and call `kei-memory ingest` if the primitive is installed. NEVER blocks:
|
||||
# every exit path is `exit 0`. No jq → silent no-op. No kei-memory → still
|
||||
# saves the raw trace so later installs can back-fill.
|
||||
|
||||
command -v jq >/dev/null 2>&1 || exit 0
|
||||
|
||||
set -eu
|
||||
|
||||
input="$(cat)"
|
||||
|
||||
session_id=$(printf '%s' "$input" | jq -r '.session_id // empty' 2>/dev/null || true)
|
||||
transcript=$(printf '%s' "$input" | jq -r '.transcript_path // .transcript // empty' 2>/dev/null || true)
|
||||
|
||||
# Nothing to dump without an id — silent no-op.
|
||||
if [ -z "$session_id" ]; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Destination dir for trace archives (created lazily).
|
||||
traces_dir="${HOME}/.claude/memory/traces"
|
||||
mkdir -p "$traces_dir" 2>/dev/null || exit 0
|
||||
|
||||
dest="${traces_dir}/${session_id}.jsonl"
|
||||
|
||||
# If Claude Code provides a transcript path, copy the JSONL to our store.
|
||||
# If transcript is missing, leave dest un-created — analyzer falls back to
|
||||
# no-op for that session and logs a zero-event row on next ingest.
|
||||
if [ -n "$transcript" ] && [ -f "$transcript" ]; then
|
||||
cp -f "$transcript" "$dest" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Best-effort ingest — advisory only; never blocks the session from ending.
|
||||
if command -v kei-memory >/dev/null 2>&1 && [ -f "$dest" ]; then
|
||||
kei-memory ingest \
|
||||
--session-id "$session_id" \
|
||||
--transcript "$dest" \
|
||||
>/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
exit 0
|
||||
Loading…
Reference in a new issue