0be354a920
Single-commit clean baseline after security scrub of niche-tells, project codenames, internal jargon, and contributor-email leaks. Contents: - 100 Rust crates (_primitives/_rust/) - 37 agent manifests (_manifests/) + generated specs (_generated/) - 67 user-invocable skills (skills/) - 33 hooks (hooks/) - Composition blocks (_blocks/) - Documentation (docs/, README.md) - TS adapter packages (_ts_packages/) - Assembler (_assembler/) - Roles (_roles/) - Templates (_templates/) - Forgejo CI (.forgejo/) Author: Denis Parfionovich <info@greendragon.info> License: see LICENSE.
28 lines
759 B
Bash
Executable file
28 lines
759 B
Bash
Executable file
#!/bin/bash
|
|
# Block dangerous commands that could cause irreversible damage
|
|
|
|
INPUT=$(cat)
|
|
COMMAND=$(echo "$INPUT" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null)
|
|
|
|
# Block patterns
|
|
if echo "$COMMAND" | grep -qE 'rm\s+-rf\s+(/|~|\$HOME|/Users)'; then
|
|
echo "BLOCKED: rm -rf on home/root directory" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if echo "$COMMAND" | grep -qE 'dd\s+if=.*of=/dev/'; then
|
|
echo "BLOCKED: dd write to device" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if echo "$COMMAND" | grep -qE 'mkfs|format\s+'; then
|
|
echo "BLOCKED: filesystem format command" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if echo "$COMMAND" | grep -qE 'git\s+push\s+.*--force\s+.*main|git\s+push\s+-f\s+.*main'; then
|
|
echo "BLOCKED: force push to main" >&2
|
|
exit 2
|
|
fi
|
|
|
|
exit 0
|