588e194d59
Removes 9×20 LOC duplication of KEI_DISABLED_HOOKS gate logic from each hook into hooks/_lib/gate.sh. Next CVE in gate path fixes in ONE file, not 9. hooks/_lib/gate.sh (new, 57 LOC) — POSIX sh library, single kei_hook_gate() function. Exact-token tokenize on comma OR space (RED-1 fix preserved). Minimal-profile whitelist baked in: no-hand-edit-agents, assemble-validate, agent-fork-logger, session-end-dump. Idempotent re-source guard. hooks/_lib/test-gate.sh (new, 47 LOC) — 11 test cases covering empty/comma/space/whitespace/substring-NOT-match/literal 'all'/ minimal-profile included+excluded/minimal+disabled combo. Per-hook shim (exactly 2 LOC, same in all 9): _KEI_LIB="$(dirname "$0")/_lib/gate.sh" if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "<name>" || exit 0; fi Net LOC delta: −171 (hooks) +104 (lib new) +15 (installer) = −52. Gate semantics bit-identical to v0.15.1 hotfix on the 6 enumerated behaviors; off/advisory-off profile values dropped per spec (only 'minimal' recognized, any other = full). Fail-open on missing lib — if _lib/gate.sh absent (old install pre-v0.17), hook falls through to normal operation. install.sh — +15 LOC copies hooks/_lib/*.sh to $HOOKS_DIR/_lib/, preserving relative path the shim expects. Note: v0.16 split this file; A1 worktree was based on pre-split main — merge into current main required resolving conflict so _lib-copy logic moved to install/lib-hooks.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
57 lines
2.2 KiB
Bash
57 lines
2.2 KiB
Bash
#!/bin/sh
|
|
# hooks/_lib/gate.sh — shared runtime-gate library for KeiSeiKit hooks.
|
|
#
|
|
# SOURCED (not executed). Each hook dot-sources this file and then calls
|
|
# `kei_hook_gate <hook-name-without-.sh>`. Return value:
|
|
# 0 → hook continues executing
|
|
# 1 → hook MUST `exit 0` (disabled or filtered out by profile)
|
|
#
|
|
# Semantics (bit-identical to the v0.15.1 RED-1 hotfix):
|
|
# KEI_DISABLED_HOOKS="" → everything runs
|
|
# KEI_DISABLED_HOOKS="hook-a,hook-b" → a and b skipped
|
|
# KEI_DISABLED_HOOKS="hook-a hook-b" → a and b skipped (space-sep OK)
|
|
# KEI_DISABLED_HOOKS="all" → ALL hooks skipped (literal token)
|
|
# KEI_DISABLED_HOOKS="foo-all-bar" → NOTHING skipped (exact-token only)
|
|
# KEI_HOOK_PROFILE=minimal → only whitelist hooks run
|
|
# KEI_HOOK_PROFILE=minimal + disabled-whitelist → that hook ALSO skipped (disabled wins)
|
|
#
|
|
# POSIX sh only (macOS bash 3.2 compatible). No arrays, no `[[`.
|
|
|
|
# Idempotent re-source guard.
|
|
if [ "${_KEI_HOOK_GATE_LOADED:-0}" = "1" ]; then
|
|
return 0 2>/dev/null || true
|
|
fi
|
|
_KEI_HOOK_GATE_LOADED=1
|
|
|
|
# Minimal-profile whitelist as space-separated tokens (iterated, not pattern-matched).
|
|
_KEI_HOOK_MINIMAL_WHITELIST='no-hand-edit-agents assemble-validate agent-fork-logger session-end-dump'
|
|
|
|
kei_hook_gate() {
|
|
_khg_name="$1"
|
|
[ -n "$_khg_name" ] || return 0
|
|
|
|
# Normalize KEI_DISABLED_HOOKS: commas → spaces. Iterate with exact-token match;
|
|
# substring bypass (`foo-all-bar` vs literal `all`) is impossible by construction.
|
|
_khg_disabled="${KEI_DISABLED_HOOKS:-}"
|
|
if [ -n "$_khg_disabled" ]; then
|
|
_khg_disabled=$(printf '%s' "$_khg_disabled" | tr ',' ' ')
|
|
for _khg_tok in $_khg_disabled; do
|
|
if [ "$_khg_tok" = "$_khg_name" ] || [ "$_khg_tok" = "all" ]; then
|
|
return 1
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Profile filter. `minimal` keeps only whitelist; any other value (empty,
|
|
# `full`, unknown) runs every hook.
|
|
if [ "${KEI_HOOK_PROFILE:-}" = "minimal" ]; then
|
|
for _khg_tok in $_KEI_HOOK_MINIMAL_WHITELIST; do
|
|
if [ "$_khg_tok" = "$_khg_name" ]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
}
|