mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 18:05:31 +02:00
Garry TanandClaude Fable 5.1
55322de58a
set -e plus a failing pipeline (a tool on PATH exiting non-zero, a deleted cwd) ended the deny-tier hook with no JSON, which Claude Code treats as non-blocking: the edit outside the boundary proceeded. The EXIT trap now prints a deny for any non-zero exit that happens before a decision was written; every deliberate output sets _FREEZE_DECIDED first so a late failure never prints a second object. Tests also pin careful's state-root precedence (GSTACK_HOME over CLAUDE_PLUGIN_DATA, plugin data when CLAUDE_PLUGIN_ROOT names gstack) and the specific "out of date" deny for a helper without gstack_hook_state_root. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
170 lines
7.1 KiB
Bash
Executable File
170 lines
7.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# check-freeze.sh — PreToolUse hook for /freeze skill
|
|
# Reads JSON from stdin, checks if file_path is within the freeze boundary.
|
|
# Returns a PreToolUse hookSpecificOutput with permissionDecision "deny" to block,
|
|
# or {} to allow. The decision MUST be nested under hookSpecificOutput — Claude
|
|
# Code ignores a top-level permissionDecision, which silently no-ops the block.
|
|
#
|
|
# Polarity: freeze is a DENY-tier hook, so an unreadable payload DENIES
|
|
# (fail closed). A payload that parses but has no file_path is a non-file
|
|
# tool — allow. This is the opposite edge-handling from careful's ask-tier
|
|
# and intentionally so: /guard runs both, and a boundary that fails open is
|
|
# not a boundary.
|
|
set -euo pipefail
|
|
|
|
# Deny-tier backstop: any unexpected non-zero death (a failing pipeline under
|
|
# set -e, a deleted cwd, EACCES) would otherwise exit with no decision JSON,
|
|
# which Claude Code treats as non-blocking — the edit proceeds. Every
|
|
# deliberate output below sets _FREEZE_DECIDED first so a late failure after
|
|
# a decision never prints a second JSON object.
|
|
_FREEZE_DECIDED=""
|
|
_freeze_backstop() {
|
|
local rc=$?
|
|
if [ "$rc" -ne 0 ] && [ -z "$_FREEZE_DECIDED" ]; then
|
|
_FREEZE_DECIDED=1
|
|
printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook failed unexpectedly (exit %s) - blocked, fail closed. Re-run ./setup or /unfreeze."}}\n' "$rc"
|
|
exit 0
|
|
fi
|
|
}
|
|
trap _freeze_backstop EXIT
|
|
|
|
# Read stdin
|
|
INPUT=$(cat)
|
|
|
|
# Shared JSON helpers (extractor + encoder) — one copy for careful AND freeze.
|
|
# freeze previously carried its own grep-first extractor which truncated at
|
|
# escaped quotes and failed OPEN; the shared file kills that drift class.
|
|
_HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=careful/bin/hook-extract.sh
|
|
# Freeze is deny-tier: if its own helpers are missing/broken (partial install,
|
|
# mid-upgrade state), the boundary must fail CLOSED — inline JSON, since the
|
|
# encoder we would normally use lives in the file that just failed to load.
|
|
# NOTE: bash treats `.` on a MISSING file as fatal in non-interactive shells
|
|
# (an if-guard cannot catch it) — the existence check must come first.
|
|
_HOOK_HELPER="$_HOOK_DIR/../../careful/bin/hook-extract.sh"
|
|
if [ ! -f "$_HOOK_HELPER" ] || ! . "$_HOOK_HELPER" 2>/dev/null; then
|
|
_FREEZE_DECIDED=1
|
|
printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook helpers unavailable (broken install?) - blocked, fail closed. Reinstall gstack or run /unfreeze."}}\n'
|
|
exit 0
|
|
fi
|
|
|
|
# Locate the freeze directory state file. The writer (/freeze via
|
|
# gstack-paths) and this reader MUST resolve the same root or the boundary
|
|
# fails open: with GSTACK_HOME set, /freeze wrote freeze-dir.txt under
|
|
# GSTACK_HOME while this hook read $HOME/.gstack, found nothing, and allowed
|
|
# everything (#1459, #1509). gstack_hook_state_root mirrors gstack-paths.
|
|
# A helper from an older install that lacks the function must fail CLOSED
|
|
# (the existence check above only proves the file sourced), never exit 127
|
|
# with no JSON — Claude Code treats that as non-blocking.
|
|
if ! command -v gstack_hook_state_root >/dev/null 2>&1; then
|
|
_FREEZE_DECIDED=1
|
|
printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook helpers out of date (partial upgrade?) - blocked, fail closed. Re-run ./setup or /unfreeze."}}\n'
|
|
exit 0
|
|
fi
|
|
STATE_DIR="$(gstack_hook_state_root; printf x)"; STATE_DIR="${STATE_DIR%x}"
|
|
FREEZE_FILE="$STATE_DIR/freeze-dir.txt"
|
|
|
|
# If no freeze file exists, allow everything (not yet configured)
|
|
if [ ! -f "$FREEZE_FILE" ]; then
|
|
_FREEZE_DECIDED=1
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
# First line, trimmed of LEADING/TRAILING whitespace only. The previous
|
|
# `tr -d '[:space:]'` deleted INTERNAL spaces too, so a boundary like
|
|
# "~/My Project/src" could never match anything — every edit denied (or the
|
|
# mangled path accidentally allowed the wrong tree).
|
|
FREEZE_DIR=$(head -n 1 "$FREEZE_FILE" 2>/dev/null | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
|
|
# A literal leading ~ in the state file never matches absolute tool paths
|
|
# (tilde is not expanded from variables) — expand it here.
|
|
case "$FREEZE_DIR" in
|
|
"~/"*) FREEZE_DIR="$HOME/${FREEZE_DIR#\~/}" ;;
|
|
"~") FREEZE_DIR="$HOME" ;;
|
|
esac
|
|
|
|
# If freeze dir is empty, allow
|
|
if [ -z "$FREEZE_DIR" ]; then
|
|
_FREEZE_DECIDED=1
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
# Extract file_path from tool_input with the shared real-JSON parser.
|
|
set +e
|
|
FILE_PATH=$(gstack_hook_extract_field "$INPUT" file_path)
|
|
EXTRACT_RC=$?
|
|
set -e
|
|
|
|
# Unparseable payload (or no parser available): DENY. A boundary hook that
|
|
# allows what it cannot read is not a boundary.
|
|
if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then
|
|
_FREEZE_DECIDED=1
|
|
gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR"
|
|
exit 0
|
|
fi
|
|
|
|
# Parsed fine but no file_path field: a non-file tool payload — allow.
|
|
if [ -z "$FILE_PATH" ]; then
|
|
_FREEZE_DECIDED=1
|
|
echo '{}'
|
|
exit 0
|
|
fi
|
|
|
|
# Resolve file_path to absolute if it isn't already
|
|
case "$FILE_PATH" in
|
|
/*) ;; # already absolute
|
|
*)
|
|
FILE_PATH="$(pwd)/$FILE_PATH"
|
|
;;
|
|
esac
|
|
|
|
# Normalize: remove double slashes and trailing slash
|
|
FILE_PATH=$(printf '%s' "$FILE_PATH" | sed 's|/\+|/|g;s|/$||')
|
|
|
|
# Resolve symlinks and .. sequences (POSIX-portable, works on macOS).
|
|
# The FULL path is resolved, including the FINAL component: the previous
|
|
# version resolved only the parent directory, so an in-boundary symlink
|
|
# pointing at an out-of-boundary target sailed through the check while the
|
|
# actual write landed outside the boundary. A final component that is a
|
|
# symlink is followed (bounded, cycle-safe) so the TARGET gets checked; a
|
|
# final component that does not exist yet (new file) has nothing to follow
|
|
# and parent resolution is the correct behavior.
|
|
_resolve_path() {
|
|
local _p="$1" _dir _base _tgt _i=0
|
|
while [ -L "$_p" ] && [ "$_i" -lt 40 ]; do
|
|
_tgt=$(readlink "$_p" 2>/dev/null) || break
|
|
case "$_tgt" in
|
|
/*) _p="$_tgt" ;;
|
|
*) _p="$(dirname "$_p")/$_tgt" ;;
|
|
esac
|
|
_i=$((_i + 1))
|
|
done
|
|
_dir="$(dirname "$_p")"
|
|
_base="$(basename "$_p")"
|
|
_dir="$(cd "$_dir" 2>/dev/null && pwd -P || printf '%s' "$_dir")"
|
|
printf '%s/%s' "$_dir" "$_base"
|
|
}
|
|
FILE_PATH=$(_resolve_path "$FILE_PATH")
|
|
FREEZE_DIR=$(_resolve_path "$FREEZE_DIR")
|
|
|
|
# Check: does the file path start with the freeze directory?
|
|
case "$FILE_PATH" in
|
|
"${FREEZE_DIR}/"*|"${FREEZE_DIR}")
|
|
# Inside freeze boundary — allow
|
|
_FREEZE_DECIDED=1
|
|
echo '{}'
|
|
;;
|
|
*)
|
|
# Outside freeze boundary — deny
|
|
# Log hook fire event (shared helper respects GSTACK_HOME)
|
|
gstack_hook_log_fire freeze boundary_deny
|
|
|
|
# The reason is JSON-encoded by the shared helper. Never interpolate paths
|
|
# into hand-built JSON: a path containing a quote or newline produced
|
|
# malformed JSON here, and the deny silently no-oped.
|
|
_FREEZE_DECIDED=1
|
|
gstack_hook_decision deny "[freeze] Blocked: $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed."
|
|
;;
|
|
esac
|