L4XB b8ce049abb fix(hooks): block a bypass that a brace group or subshell pipes into a shell ...

pipelineSources() read the literal output of the commands that feed a shell, but a brace group or subshell producer has no words of its own, so nothing it printed reached the check. { echo 'git commit --no-verify -m x'; } | sh and (echo 'git push --no-verify'; printf x) | bash passed the guard, while echo 'git commit --no-verify -m x' | sh is blocked. shell-scan now keeps the source text of a closed scope, and pipelineSources() reads the commands in it that write to the group's output, as it already does for a plain producer.

2026-10-23 07:19:32 +02:00

..

lib

fix(hooks): block a bypass that a brace group or subshell pipes into a shell

2026-10-23 07:19:32 +02:00

auto-tmux-dev.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.js

fix(hooks): block a bypass that a brace group or subshell pipes into a shell

2026-10-23 07:19:32 +02:00

check-console-log.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

check-hook-enabled.js

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00

config-protection.js

Merge reviewed Biome-filename correction from PR2835

2026-09-28 07:07:45 -04:00

context-prompt-suggestions.js

feat(context): integrate generation-bound advisory suggestions (#3453)

2026-10-10 17:44:29 -04:00

context-routing-index.js

feat(context): suggest skills at prompt time from a generation-bound index

2026-10-07 17:19:46 +00:00

cost-tracker.js

fix(cost-tracker): retain model across duplicate usage blocks

2026-10-11 06:24:18 +08:00

cursor-session-env.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

design-quality-check.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

desktop-notify.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

doc-file-warning.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

ecc-context-monitor.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

ecc-statusline.js

fix: recover failed ledger batches and preserve project state

2026-10-11 09:42:05 -04:00

evaluate-session.js

Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

2026-02-18 07:40:12 +00:00

gateguard-fact-force.js

refactor(hooks): split gateguard gate and classifiers into smaller units

2026-10-19 22:03:57 -04:00

gateguard-heredoc.js

fix(gateguard): ignore heredoc prose for tee and path-qualified sinks (#2886)

2026-09-17 17:29:26 +00:00

governance-capture.js

fix: address PowerShell review bypasses

2026-09-05 16:12:58 -04:00

hook-input-limits.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hook-input.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-frontmatter.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-runtime.js

fix: preserve Hookify Windows missing-device identity

2026-10-09 19:10:06 -04:00

insaits-security-monitor.py

test: cover hook bootstrap and InsAIts monitor

2026-04-29 17:45:22 -04:00

insaits-security-wrapper.js

fix: fail open on insaits monitor errors

2026-04-29 18:03:33 -04:00

lifecycle-hook-bootstrap.js

fix: keep session summaries within the lifecycle deadline

2026-10-11 00:15:12 +08:00

mcp-health-check.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

observe-runner.js

fix(hooks): never run .sh hooks through the WSL bash launcher on Windows

2026-10-09 15:56:14 -04:00

plan-canvas-pending.js

fix(plan-canvas): reconcile profile resolver and retain invalid feedback queues

2026-10-10 19:19:30 -04:00

plan-canvas-sessions.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

plugin-hook-bootstrap.js

feat: integrate reviewed adapters, conversion and GateGuard improvements

2026-10-10 17:53:23 -04:00

post-bash-build-complete.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-command-log.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

post-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-pr-created.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-edit-accumulator.js

fix(hooks): resolve session IDs from hook payloads

2026-10-08 23:46:56 +02:00

post-edit-console-warn.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-format.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-typecheck.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

posttooluse-dispatcher.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

pre-bash-commit-quality.js

fix(hooks): enforce literal formatter invocation at spawn boundaries

2026-10-10 19:13:24 -04:00

pre-bash-dev-server-block.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-dispatcher.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

pre-bash-git-push-reminder.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

pre-write-doc-warn.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

pretooluse-visible-output.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

quality-gate.js

fix(hooks): enforce literal formatter invocation at spawn boundaries

2026-10-10 19:13:24 -04:00

run-with-flags-shell.sh

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

run-with-flags.js

fix: keep session summaries within the lifecycle deadline

2026-10-11 00:15:12 +08:00

session-activity-tracker.js

fix: also fix hook_event_name env-var bug found by pre-merge review; sanitize session_id

2026-09-05 17:08:47 -07:00

session-end-marker.js

fix(hooks): resolve session IDs from hook payloads

2026-10-08 23:46:56 +02:00

session-end.js

refactor(hooks): break up session-end summary and main flow

2026-10-19 22:03:57 -04:00

session-start-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

session-start.js

fix(session): preserve optional startup context and independent history reads

2026-10-10 20:14:22 -04:00

skill-run-tracker.js

fix: record skill runs under OpenCode and report unmeasured skills honestly

2026-10-07 19:45:21 -05:00

stop-format-typecheck.js

Merge PR #3464: identify hooks by their input sessions

2026-10-10 17:38:00 -04:00

suggest-compact.js

test: cover inferred-window hook output

2026-08-29 14:55:13 -04:00