KeiSei84
2ffb3a8b1e
Some checks are pending
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / preflight (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / vps-smoke (push) Waiting to run
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:frustration-matrix,kei-frustration-loop,kei-skill-importer,kei-projects-index,kei-projects-watcher,kei-gdrive-import,kei-leak-matrix,kei-skills,kei-gateway,kei-cron-scheduler,kei-export-trajectories,kei-backend-daytona,kei-d… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-compute-baremetal,kei-compute-vultr,kei-compute-linode,kei-compute-digitalocean,kei-svc-systemd,kei-llm-bridge-mlx name:hosted-sleep-compute]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-diff,kei-scheduler,kei-watch,kei-prune,kei-discover,kei-brain-view,kei-hibernate,kei-ledger-sign,kei-fork name:wave13-15]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-git-gitea,kei-git-forgejo,kei-git-gitlab,kei-git-bitbucket,kei-memory-sled,kei-memory-redis,kei-memory-postgres,kei-memory-sqlite,kei-auth-google,kei-auth-apple,kei-auth-magiclink,kei-auth-webauthn,kei-notify-slack,kei-n… (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-ledger,kei-migrate,kei-changelog,kei-memory,kei-store,kei-conflict-scan,kei-refactor-engine,kei-graph-check,kei-shared,kei-dna-index,kei-pet name:core]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-machine-probe,kei-llm-ollama,kei-llm-llamacpp,kei-llm-mlx,kei-llm-router,kei-model name:llm-stack]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:kei-router,kei-sage,kei-task,kei-chat-store,kei-crossdomain,kei-search-core,kei-content-store,kei-social-store,kei-curator,kei-auth,kei-artifact name:mcp-lbm]) (push) Blocked by required conditions
CI (Forgejo Actions — self-hosted runner on Mac, host mode) / rust-primitives (map[crates:keisei,kei-forge,kei-runtime,kei-runtime-core,kei-atom-discovery,kei-agent-runtime,kei-capability,kei-provision,kei-entity-store,kei-pipe,kei-cache,kei-spawn,kei-replay name:atom-substrate]) (push) Blocked by required conditions
Pre-public Phase 1. Remove personal/IP traces that should not ship in a general-purpose kit; keep only intended author attribution. - no-github-push.sh + hooks-and-blocks.md + ci-scaffold: drop "KeiTech unfiled patent IP / trade secrets / priority date" wording; reword as a generic opt-in guard for keeping code on a private remote. - check-error-patterns.sh: remove author-local absolute path from the tombstone comment. - graph-export-watcher.sh: default viz dir to ~/.local/share/kei/graph-viz (was a personal project path). - agent manifests (cost-guardian, modal-runner, infra/ml/code-implementer) + ci.yml: strip private memory references and dated personal incidents; keep the generic cost/ops lessons. Snapshots regenerated; golden 3/3. Kept intentionally: author attribution (NOTICE / README / Cargo / plugin). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
85 lines
2.7 KiB
Bash
Executable file
85 lines
2.7 KiB
Bash
Executable file
#!/bin/sh
|
|
# no-github-push.sh — PreToolUse:Bash hard deny.
|
|
#
|
|
# Blocks any Bash command that would push code or create a repo on github.com.
|
|
# Opt-in guard for teams that keep proprietary code on a private remote
|
|
# (Forgejo / Gitea / self-hosted) and want a hard stop against an accidental
|
|
# public push. Off by default in the public kit — enable it in onboarding.
|
|
#
|
|
# Exit codes:
|
|
# 0 = pass (command is safe)
|
|
# 2 = block (Claude Code aborts the tool call)
|
|
#
|
|
# Bypass: set KEI_NO_GITHUB_PUSH_BYPASS=1 in the calling environment.
|
|
# Even with bypass, the rule is logged to stderr.
|
|
|
|
set -u
|
|
|
|
# Bypass check (must be explicit env, not embedded in command string)
|
|
if [ "${KEI_NO_GITHUB_PUSH_BYPASS:-0}" = "1" ]; then
|
|
printf '[no-github-push] BYPASS active (KEI_NO_GITHUB_PUSH_BYPASS=1). Proceeding.\n' >&2
|
|
exit 0
|
|
fi
|
|
|
|
# jq is required to parse the Claude Code hook input
|
|
if ! command -v jq > /dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
|
|
INPUT=$(cat)
|
|
COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
|
|
|
|
[ -z "$COMMAND" ] && exit 0
|
|
|
|
# --- Pattern matching -------------------------------------------------------
|
|
# Match any of the forbidden surfaces (case-sensitive; github URLs are
|
|
# always lowercase in practice, but we anchor on the protocol/domain).
|
|
|
|
BLOCKED=0
|
|
|
|
# git push to github.com (HTTPS or SSH)
|
|
if printf '%s' "$COMMAND" | grep -qE 'git[[:space:]]+push[^|&;]*github\.com'; then
|
|
BLOCKED=1
|
|
fi
|
|
|
|
# git push to SSH shorthand git@github.com
|
|
if [ "$BLOCKED" -eq 0 ] && \
|
|
printf '%s' "$COMMAND" | grep -qE 'git[[:space:]]+push[^|&;]*git@github\.com'; then
|
|
BLOCKED=1
|
|
fi
|
|
|
|
# gh repo create (any visibility — creating a public repo leaks IP by default)
|
|
if [ "$BLOCKED" -eq 0 ] && \
|
|
printf '%s' "$COMMAND" | grep -qE 'gh[[:space:]]+repo[[:space:]]+create'; then
|
|
BLOCKED=1
|
|
fi
|
|
|
|
# gh repo sync (pushes local state to remote)
|
|
if [ "$BLOCKED" -eq 0 ] && \
|
|
printf '%s' "$COMMAND" | grep -qE 'gh[[:space:]]+repo[[:space:]]+sync'; then
|
|
BLOCKED=1
|
|
fi
|
|
|
|
# git remote add/set-url pointing at github.com
|
|
if [ "$BLOCKED" -eq 0 ] && \
|
|
printf '%s' "$COMMAND" | grep -qE 'git[[:space:]]+remote[[:space:]]+(add|set-url)[^|&;]*github\.com'; then
|
|
BLOCKED=1
|
|
fi
|
|
|
|
[ "$BLOCKED" -eq 0 ] && exit 0
|
|
|
|
# --- Block ------------------------------------------------------------------
|
|
cat >&2 <<'EOF'
|
|
[no-github-push] BLOCK — push to github.com is disabled by this guard.
|
|
This checkout is configured to stay on a private remote; a public push
|
|
could expose code you intend to keep private.
|
|
|
|
Use your private remote instead (Forgejo, Gitea, self-hosted):
|
|
git remote set-url origin ssh://git@<private-host>/<user>/<repo>.git
|
|
git push origin <branch>
|
|
|
|
Bypass (visible, per-call):
|
|
Set env KEI_NO_GITHUB_PUSH_BYPASS=1 before the command.
|
|
EOF
|
|
|
|
exit 2
|