588e194d59
Removes 9×20 LOC duplication of KEI_DISABLED_HOOKS gate logic from each hook into hooks/_lib/gate.sh. Next CVE in gate path fixes in ONE file, not 9. hooks/_lib/gate.sh (new, 57 LOC) — POSIX sh library, single kei_hook_gate() function. Exact-token tokenize on comma OR space (RED-1 fix preserved). Minimal-profile whitelist baked in: no-hand-edit-agents, assemble-validate, agent-fork-logger, session-end-dump. Idempotent re-source guard. hooks/_lib/test-gate.sh (new, 47 LOC) — 11 test cases covering empty/comma/space/whitespace/substring-NOT-match/literal 'all'/ minimal-profile included+excluded/minimal+disabled combo. Per-hook shim (exactly 2 LOC, same in all 9): _KEI_LIB="$(dirname "$0")/_lib/gate.sh" if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "<name>" || exit 0; fi Net LOC delta: −171 (hooks) +104 (lib new) +15 (installer) = −52. Gate semantics bit-identical to v0.15.1 hotfix on the 6 enumerated behaviors; off/advisory-off profile values dropped per spec (only 'minimal' recognized, any other = full). Fail-open on missing lib — if _lib/gate.sh absent (old install pre-v0.17), hook falls through to normal operation. install.sh — +15 LOC copies hooks/_lib/*.sh to $HOOKS_DIR/_lib/, preserving relative path the shim expects. Note: v0.16 split this file; A1 worktree was based on pre-split main — merge into current main required resolving conflict so _lib-copy logic moved to install/lib-hooks.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
1.9 KiB
Bash
Executable file
62 lines
1.9 KiB
Bash
Executable file
#!/bin/sh
|
|
# milestone-commit-hook.sh — PostToolUse:Bash hook (RULE 0.14).
|
|
#
|
|
# On `git commit -m "feat..."` / `refactor:` / `git merge`: call
|
|
# `kei-memory analyze --last 1 --summary` and append to audit-backlog.md.
|
|
# NEVER blocks: every exit path is `exit 0`. Silent-first: prompts only
|
|
# activate after 10 sessions are in the memory store.
|
|
|
|
command -v jq >/dev/null 2>&1 || exit 0
|
|
|
|
_KEI_LIB="$(dirname "$0")/_lib/gate.sh"
|
|
if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "milestone-commit-hook" || exit 0; fi
|
|
|
|
set -eu
|
|
|
|
input="$(cat)"
|
|
|
|
cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
|
|
[ -z "$cmd" ] && exit 0
|
|
|
|
# Detect milestone commits — feat: / refactor: / merge commits. Case-sensitive
|
|
# on the conventional-commit prefix so we don't false-fire on "feature-" docs.
|
|
case "$cmd" in
|
|
*"git commit"*"-m"*"\"feat"[:\ ]*|\
|
|
*"git commit"*"-m"*"\"refactor"[:\ ]*|\
|
|
*"git merge"*)
|
|
;;
|
|
*)
|
|
exit 0
|
|
;;
|
|
esac
|
|
|
|
backlog="${HOME}/.claude/memory/audit-backlog.md"
|
|
mkdir -p "$(dirname "$backlog")" 2>/dev/null || exit 0
|
|
|
|
# Ensure the header + session_count counter exist.
|
|
if [ ! -f "$backlog" ]; then
|
|
{
|
|
printf '# Audit Backlog\n\n'
|
|
printf '<!-- session_count: 0 -->\n\n'
|
|
} > "$backlog"
|
|
fi
|
|
|
|
# Read current session_count (silent-first threshold).
|
|
session_count=$(grep -Eo 'session_count: [0-9]+' "$backlog" 2>/dev/null | head -1 | awk '{print $2}')
|
|
session_count=${session_count:-0}
|
|
|
|
# Append the summary line if kei-memory is present.
|
|
ts=$(date -u +%Y-%m-%dT%H:%M)
|
|
if command -v kei-memory >/dev/null 2>&1; then
|
|
summary=$(kei-memory analyze --last 1 --summary 2>/dev/null || true)
|
|
if [ -n "$summary" ]; then
|
|
printf -- '- [MILESTONE %s] %s' "$ts" "$summary" >> "$backlog"
|
|
fi
|
|
fi
|
|
|
|
# Advisory stderr reminder only after silent-first threshold.
|
|
if [ "$session_count" -ge 10 ]; then
|
|
printf 'kei-memory: audit backlog has unreviewed items (%s)\n' "$backlog" >&2
|
|
fi
|
|
|
|
exit 0
|