mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-14 17:05:28 +02:00
Garry TanandClaude Fable 5
455c805125
Freeze boundary hook had four verified bugs: the grep-first JSON extractor truncated at escaped quotes and failed OPEN on unparseable payloads; the deny JSON was printf-interpolated so a quote- or newline-bearing path silently no-oped the block; the freeze path read stripped INTERNAL spaces (a boundary like ~/My Project could never match); and the path resolver skipped the final component, letting an in-boundary symlink write through to an out-of-boundary target. Fixes, structurally: one shared sourced helper (careful/bin/hook-extract.sh) now owns JSON extraction and JSON-encoded decision envelopes for BOTH hooks -- the two-copy drift is how freeze kept a broken extractor after careful's was fixed. Freeze is now deny-tier fail-closed (unparseable payload denies, parsed-but-no-file_path still allows), trims only leading/trailing whitespace, and resolves symlinks through the final path component. Careful gains a HIGH tier (hard deny, simple commands only): recursive delete of /, ~, or $HOME, and force-push to the repo's default branch. Compound commands always fall through to the MEDIUM ask; --force-with-lease is never HIGH. Documented as a best-effort advisory hard-stop, not a policy boundary. Plus additive-only project patterns (~/.gstack/careful-patterns.txt + per-project file): config can only ADD warn rules, never suppress a baseline family. test/hook-scripts.test.ts: 89 tests incl. malformed-payload deny, parseable deny JSON for hostile paths, space-bearing boundaries, symlink escape, HIGH tier splits, additive invariant, invalid-regex resilience. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
97 lines
3.6 KiB
Cheetah
97 lines
3.6 KiB
Cheetah
---
|
|
name: freeze
|
|
version: 0.1.0
|
|
description: |
|
|
Restrict file edits to a specific directory for the session. Blocks Edit and
|
|
Write outside the allowed path. Use when debugging to prevent accidentally
|
|
"fixing" unrelated code, or when you want to scope changes to one module.
|
|
Use when asked to "freeze", "restrict edits", "only edit this folder",
|
|
or "lock down edits". (gstack)
|
|
triggers:
|
|
- freeze edits to directory
|
|
- lock editing scope
|
|
- restrict file changes
|
|
allowed-tools:
|
|
- Bash
|
|
- Read
|
|
- AskUserQuestion
|
|
hooks:
|
|
PreToolUse:
|
|
- matcher: "Edit"
|
|
hooks:
|
|
- type: command
|
|
command: "bash $HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh"
|
|
statusMessage: "Checking freeze boundary..."
|
|
- matcher: "Write"
|
|
hooks:
|
|
- type: command
|
|
command: "bash $HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh"
|
|
statusMessage: "Checking freeze boundary..."
|
|
sensitive: true
|
|
---
|
|
|
|
# /freeze — Restrict Edits to a Directory
|
|
|
|
Lock file edits to a specific directory. Any Edit or Write operation targeting
|
|
a file outside the allowed path will be **blocked** (not just warned).
|
|
|
|
```bash
|
|
mkdir -p ~/.gstack/analytics
|
|
echo '{"skill":"freeze","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true
|
|
```
|
|
|
|
## Setup
|
|
|
|
Ask the user which directory to restrict edits to. Use AskUserQuestion:
|
|
|
|
- Question: "Which directory should I restrict edits to? Files outside this path will be blocked from editing."
|
|
- Text input (not multiple choice) — the user types a path.
|
|
|
|
Once the user provides a directory path:
|
|
|
|
1. Resolve it to an absolute path:
|
|
```bash
|
|
FREEZE_DIR=$(cd "<user-provided-path>" 2>/dev/null && pwd)
|
|
echo "$FREEZE_DIR"
|
|
```
|
|
|
|
2. Ensure trailing slash and save to the freeze state file:
|
|
```bash
|
|
FREEZE_DIR="${FREEZE_DIR%/}/"
|
|
eval "$(~/.claude/skills/gstack/bin/gstack-paths)"
|
|
STATE_DIR="$GSTACK_STATE_ROOT"
|
|
mkdir -p "$STATE_DIR"
|
|
echo "$FREEZE_DIR" > "$STATE_DIR/freeze-dir.txt"
|
|
echo "Freeze boundary set: $FREEZE_DIR"
|
|
```
|
|
|
|
Tell the user: "Edits are now restricted to `<path>/`. Any Edit or Write
|
|
outside this directory will be blocked. To change the boundary, run `/freeze`
|
|
again. To remove it, run `/unfreeze` or end the session."
|
|
|
|
## How it works
|
|
|
|
The hook reads `file_path` from the Edit/Write tool input JSON (shared
|
|
real-JSON extractor with /careful — one copy, sourced by both hooks), then
|
|
checks whether the path starts with the freeze directory. If not, it returns a
|
|
`hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
|
|
operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
|
|
`permissionDecision`).
|
|
|
|
Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
|
|
allowed — a boundary that fails open is not a boundary. A payload that parses
|
|
but has no `file_path` (a non-file tool) is allowed. Symlinks are resolved
|
|
through their FINAL component, so an in-boundary symlink pointing outside the
|
|
boundary is checked against its target.
|
|
|
|
The freeze boundary persists for the session via the state file. The hook
|
|
script reads it on every Edit/Write invocation. Boundaries containing spaces
|
|
are supported.
|
|
|
|
## Notes
|
|
|
|
- The trailing `/` on the freeze directory prevents `/src` from matching `/src-old`
|
|
- Freeze applies to Edit and Write tools only — Read, Bash, Glob, Grep are unaffected
|
|
- This prevents accidental edits, not a security boundary — Bash commands like `sed` can still modify files outside the boundary
|
|
- To deactivate, run `/unfreeze` or end the conversation
|