da0f2cb42b
10 hooks get 21-line guard block: env-var short-circuit, 4 profiles (full/advisory-off/minimal/off), per-hook disable. Safety-critical preserved in 'minimal': no-hand-edit-agents, assemble-validate, git-pre-commit-genesis. Advisory off list: recurrence-suggest, citation-verify, error-spike-detector, milestone-commit-hook. skills/hooks-control/SKILL.md — click-only toggle emitting shell export commands. README +27 LOC 'Runtime hook controls' section with examples.
75 lines
2.5 KiB
Bash
Executable file
75 lines
2.5 KiB
Bash
Executable file
#!/bin/sh
|
|
# PreToolUse(Edit|Write) — block hand-editing generated agent .md files.
|
|
#
|
|
# Generated files start with: <!-- GENERATED by _assembler ...
|
|
# Edit the manifest at _manifests/<name>.toml instead.
|
|
#
|
|
# Override: set AGENT_MIGRATION=1 in env to allow hand edits (migration / emergency).
|
|
#
|
|
# Stdin: JSON with tool_input.file_path
|
|
|
|
# Silent fall-through if jq is absent; otherwise `set -eu` would abort and
|
|
# Claude Code would refuse Edit/Write system-wide.
|
|
command -v jq >/dev/null 2>&1 || exit 0
|
|
|
|
# --- RUNTIME CONTROLS (v0.14.2) ---
|
|
_hook_name="$(basename "$0" .sh)"
|
|
case "${KEI_DISABLED_HOOKS:-}" in
|
|
*"$_hook_name"*|*all*) exit 0 ;;
|
|
esac
|
|
case "${KEI_HOOK_PROFILE:-full}" in
|
|
off) exit 0 ;;
|
|
minimal)
|
|
case "$_hook_name" in
|
|
no-github-push|genesis-leak-guard|no-hand-edit-agents|secrets-guard|assemble-validate|git-pre-commit-genesis) ;;
|
|
*) exit 0 ;;
|
|
esac
|
|
;;
|
|
advisory-off)
|
|
case "$_hook_name" in
|
|
recurrence-suggest|citation-verify|error-spike-detector|milestone-commit-hook) exit 0 ;;
|
|
esac
|
|
;;
|
|
full|*) ;;
|
|
esac
|
|
# --- end runtime controls ---
|
|
|
|
set -eu
|
|
|
|
[ "${AGENT_MIGRATION:-0}" = "1" ] && exit 0
|
|
|
|
FILE=$(jq -r '.tool_input.file_path // empty')
|
|
[ -n "$FILE" ] || exit 0
|
|
|
|
# Only care about files directly under ~/.claude/agents/*.md
|
|
# (not blocks/, manifests/, assembler/, template, generated preview)
|
|
#
|
|
# NOTE on staleness: we use the `<!-- GENERATED by _assembler -->` marker
|
|
# on line 1 as the SOLE SOURCE OF TRUTH for "is this file generated?".
|
|
# Legacy agent .md files that were produced before the assembler existed
|
|
# (and therefore lack the marker) will pass this hook silently. That is
|
|
# intentional — the marker is how the assembler self-declares ownership,
|
|
# and any file without it is assumed hand-authored. Re-run the assembler
|
|
# to adopt an older file into the managed set.
|
|
case "$FILE" in
|
|
"$HOME/.claude/agents/_"*) exit 0 ;;
|
|
"$HOME/.claude/agents/"*.md) ;;
|
|
*) exit 0 ;;
|
|
esac
|
|
|
|
# Detect generated marker in the first 10 lines (sole truth — see NOTE above)
|
|
if [ -f "$FILE" ] && head -10 "$FILE" | grep -q 'GENERATED by _assembler'; then
|
|
NAME=$(basename "$FILE" .md)
|
|
echo "[no-hand-edit-agents] BLOCKED: $FILE is generated." >&2
|
|
echo "" >&2
|
|
echo "Edit the manifest instead:" >&2
|
|
echo " ~/.claude/agents/_manifests/$NAME.toml" >&2
|
|
echo "" >&2
|
|
echo "Or edit a shared block:" >&2
|
|
echo " ~/.claude/agents/_blocks/<block>.md" >&2
|
|
echo "" >&2
|
|
echo "Override (emergency only): export AGENT_MIGRATION=1" >&2
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|