588e194d59
Removes 9×20 LOC duplication of KEI_DISABLED_HOOKS gate logic from each hook into hooks/_lib/gate.sh. Next CVE in gate path fixes in ONE file, not 9. hooks/_lib/gate.sh (new, 57 LOC) — POSIX sh library, single kei_hook_gate() function. Exact-token tokenize on comma OR space (RED-1 fix preserved). Minimal-profile whitelist baked in: no-hand-edit-agents, assemble-validate, agent-fork-logger, session-end-dump. Idempotent re-source guard. hooks/_lib/test-gate.sh (new, 47 LOC) — 11 test cases covering empty/comma/space/whitespace/substring-NOT-match/literal 'all'/ minimal-profile included+excluded/minimal+disabled combo. Per-hook shim (exactly 2 LOC, same in all 9): _KEI_LIB="$(dirname "$0")/_lib/gate.sh" if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "<name>" || exit 0; fi Net LOC delta: −171 (hooks) +104 (lib new) +15 (installer) = −52. Gate semantics bit-identical to v0.15.1 hotfix on the 6 enumerated behaviors; off/advisory-off profile values dropped per spec (only 'minimal' recognized, any other = full). Fail-open on missing lib — if _lib/gate.sh absent (old install pre-v0.17), hook falls through to normal operation. install.sh — +15 LOC copies hooks/_lib/*.sh to $HOOKS_DIR/_lib/, preserving relative path the shim expects. Note: v0.16 split this file; A1 worktree was based on pre-split main — merge into current main required resolving conflict so _lib-copy logic moved to install/lib-hooks.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
54 lines
1.9 KiB
Bash
Executable file
54 lines
1.9 KiB
Bash
Executable file
#!/bin/sh
|
|
# agent-fork-logger.sh — PreToolUse:Agent advisory hook (RULE 0.12).
|
|
#
|
|
# Reads the Agent tool invocation JSON from stdin and, if kei-ledger is on
|
|
# PATH, logs a fork row so the orchestrator can later validate the bundle.
|
|
# NEVER blocks: every exit path is `exit 0`. Hard-dependency absent (no jq,
|
|
# no kei-ledger, no git) → silent no-op.
|
|
|
|
command -v jq >/dev/null 2>&1 || exit 0
|
|
|
|
_KEI_LIB="$(dirname "$0")/_lib/gate.sh"
|
|
if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "agent-fork-logger" || exit 0; fi
|
|
|
|
set -eu
|
|
|
|
input="$(cat)"
|
|
|
|
# Extract subagent_type / prompt / isolation from the Agent tool_input.
|
|
subagent=$(printf '%s' "$input" | jq -r '.tool_input.subagent_type // empty' 2>/dev/null || true)
|
|
prompt=$(printf '%s' "$input" | jq -r '.tool_input.prompt // empty' 2>/dev/null || true)
|
|
isolation=$(printf '%s' "$input" | jq -r '.tool_input.isolation // empty' 2>/dev/null || true)
|
|
|
|
# No subagent name → not an agent call we know how to track.
|
|
if [ -z "$subagent" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Spec fingerprint = first 16 hex chars of SHA-256(prompt).
|
|
spec_sha=$(printf '%s' "$prompt" | shasum -a 256 2>/dev/null | cut -c1-16)
|
|
spec_sha=${spec_sha:-unknown}
|
|
|
|
ts=$(date +%s)
|
|
agent_id="${subagent}-${ts}"
|
|
|
|
if [ "$isolation" = "worktree" ]; then
|
|
branch="agent/${subagent}-${ts}"
|
|
else
|
|
branch="inline-${subagent}-${ts}"
|
|
fi
|
|
|
|
# Current git branch (if we're inside a repo). Non-fatal if git absent.
|
|
current_branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo none)
|
|
|
|
# If kei-ledger is unavailable, bail silently — the hook is advisory only.
|
|
command -v kei-ledger >/dev/null 2>&1 || exit 0
|
|
|
|
# Emit the fork row. Always exit 0 even if kei-ledger returns non-zero:
|
|
# the hook must never block an Agent invocation on ledger trouble.
|
|
kei-ledger fork "$agent_id" "$branch" \
|
|
--parent "$current_branch" \
|
|
--spec-sha "$spec_sha" \
|
|
>/dev/null 2>&1 || true
|
|
|
|
exit 0
|