588e194d59
Removes 9×20 LOC duplication of KEI_DISABLED_HOOKS gate logic from each hook into hooks/_lib/gate.sh. Next CVE in gate path fixes in ONE file, not 9. hooks/_lib/gate.sh (new, 57 LOC) — POSIX sh library, single kei_hook_gate() function. Exact-token tokenize on comma OR space (RED-1 fix preserved). Minimal-profile whitelist baked in: no-hand-edit-agents, assemble-validate, agent-fork-logger, session-end-dump. Idempotent re-source guard. hooks/_lib/test-gate.sh (new, 47 LOC) — 11 test cases covering empty/comma/space/whitespace/substring-NOT-match/literal 'all'/ minimal-profile included+excluded/minimal+disabled combo. Per-hook shim (exactly 2 LOC, same in all 9): _KEI_LIB="$(dirname "$0")/_lib/gate.sh" if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "<name>" || exit 0; fi Net LOC delta: −171 (hooks) +104 (lib new) +15 (installer) = −52. Gate semantics bit-identical to v0.15.1 hotfix on the 6 enumerated behaviors; off/advisory-off profile values dropped per spec (only 'minimal' recognized, any other = full). Fail-open on missing lib — if _lib/gate.sh absent (old install pre-v0.17), hook falls through to normal operation. install.sh — +15 LOC copies hooks/_lib/*.sh to $HOOKS_DIR/_lib/, preserving relative path the shim expects. Note: v0.16 split this file; A1 worktree was based on pre-split main — merge into current main required resolving conflict so _lib-copy logic moved to install/lib-hooks.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
55 lines
1.9 KiB
Bash
Executable file
55 lines
1.9 KiB
Bash
Executable file
#!/bin/sh
|
|
# session-end-dump.sh — Stop event hook (RULE 0.14).
|
|
#
|
|
# On session end: save the transcript JSONL to ~/.claude/memory/traces/
|
|
# and call `kei-memory ingest` if the primitive is installed. NEVER blocks:
|
|
# every exit path is `exit 0`. No jq → silent no-op. No kei-memory → still
|
|
# saves the raw trace so later installs can back-fill.
|
|
|
|
command -v jq >/dev/null 2>&1 || exit 0
|
|
|
|
_KEI_LIB="$(dirname "$0")/_lib/gate.sh"
|
|
if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "session-end-dump" || exit 0; fi
|
|
|
|
set -eu
|
|
|
|
input="$(cat)"
|
|
|
|
session_id=$(printf '%s' "$input" | jq -r '.session_id // empty' 2>/dev/null || true)
|
|
transcript=$(printf '%s' "$input" | jq -r '.transcript_path // .transcript // empty' 2>/dev/null || true)
|
|
|
|
# Nothing to dump without an id — silent no-op.
|
|
if [ -z "$session_id" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Destination dir for trace archives (created lazily).
|
|
traces_dir="${HOME}/.claude/memory/traces"
|
|
mkdir -p "$traces_dir" 2>/dev/null || exit 0
|
|
|
|
dest="${traces_dir}/${session_id}.jsonl"
|
|
|
|
# If Claude Code provides a transcript path, copy the JSONL to our store.
|
|
# If transcript is missing, leave dest un-created — analyzer falls back to
|
|
# no-op for that session and logs a zero-event row on next ingest.
|
|
if [ -n "$transcript" ] && [ -f "$transcript" ]; then
|
|
cp -f "$transcript" "$dest" 2>/dev/null || true
|
|
fi
|
|
|
|
# Best-effort ingest — advisory only; never blocks the session from ending.
|
|
if command -v kei-memory >/dev/null 2>&1 && [ -f "$dest" ]; then
|
|
kei-memory ingest \
|
|
--session-id "$session_id" \
|
|
--transcript "$dest" \
|
|
>/dev/null 2>&1 || true
|
|
fi
|
|
|
|
# v0.11 sleep-sync (RULE 0.15) — push traces to the user's memory-repo so a
|
|
# cloud agent can consolidate them overnight. Silent no-op when the primitive
|
|
# is absent or the user hasn't opted in via /sleep-setup.
|
|
sleep_sync="${HOME}/.claude/agents/_primitives/kei-sleep-sync.sh"
|
|
if [ -x "$sleep_sync" ]; then
|
|
"$sleep_sync" >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
exit 0
|