L4XB fc557e57ff fix(hooks): also read a group's writes joined in the order the shell receives them ...

The commands in a group write one stream into the pipe, so a bypass split across them, as in { printf 'git pu'; printf 'sh --no-verify'; } | sh, was read as two harmless fragments. groupSources() now adds the outputs joined in order next to the separate ones. The group handling moves out of pipelineSources() to keep it under the complexity limit.

2026-10-23 07:33:24 +02:00

..

lib

fix(hooks): block a bypass that a brace group or subshell pipes into a shell

2026-10-23 07:19:32 +02:00

auto-tmux-dev.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.js

fix(hooks): also read a group's writes joined in the order the shell receives them

2026-10-23 07:33:24 +02:00

check-console-log.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

check-hook-enabled.js

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00

config-protection.js

Merge reviewed Biome-filename correction from PR2835

2026-09-28 07:07:45 -04:00

context-prompt-suggestions.js

feat(context): integrate generation-bound advisory suggestions (#3453)

2026-10-10 17:44:29 -04:00

context-routing-index.js

feat(context): suggest skills at prompt time from a generation-bound index

2026-10-07 17:19:46 +00:00

cost-tracker.js

fix(cost-tracker): retain model across duplicate usage blocks

2026-10-11 06:24:18 +08:00

cursor-session-env.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

design-quality-check.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

desktop-notify.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

doc-file-warning.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

ecc-context-monitor.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

ecc-statusline.js

fix: recover failed ledger batches and preserve project state

2026-10-11 09:42:05 -04:00

evaluate-session.js

Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

2026-02-18 07:40:12 +00:00

gateguard-fact-force.js

refactor(hooks): split gateguard gate and classifiers into smaller units

2026-10-19 22:03:57 -04:00

gateguard-heredoc.js

fix(gateguard): ignore heredoc prose for tee and path-qualified sinks (#2886)

2026-09-17 17:29:26 +00:00

governance-capture.js

fix: address PowerShell review bypasses

2026-09-05 16:12:58 -04:00

hook-input-limits.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hook-input.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-frontmatter.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-runtime.js

fix: preserve Hookify Windows missing-device identity

2026-10-09 19:10:06 -04:00

insaits-security-monitor.py

test: cover hook bootstrap and InsAIts monitor

2026-04-29 17:45:22 -04:00

insaits-security-wrapper.js

fix: fail open on insaits monitor errors

2026-04-29 18:03:33 -04:00

lifecycle-hook-bootstrap.js

fix: keep session summaries within the lifecycle deadline

2026-10-11 00:15:12 +08:00

mcp-health-check.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

observe-runner.js

fix(hooks): never run .sh hooks through the WSL bash launcher on Windows

2026-10-09 15:56:14 -04:00

plan-canvas-pending.js

fix(plan-canvas): reconcile profile resolver and retain invalid feedback queues

2026-10-10 19:19:30 -04:00

plan-canvas-sessions.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

plugin-hook-bootstrap.js

feat: integrate reviewed adapters, conversion and GateGuard improvements

2026-10-10 17:53:23 -04:00

post-bash-build-complete.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-command-log.js

fix(plan-canvas): route session state through CLAUDE_CONFIG_DIR

2026-10-03 20:20:40 +05:30

post-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-pr-created.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-edit-accumulator.js

fix(hooks): resolve session IDs from hook payloads

2026-10-08 23:46:56 +02:00

post-edit-console-warn.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-format.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-typecheck.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

posttooluse-dispatcher.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

pre-bash-commit-quality.js

fix(hooks): enforce literal formatter invocation at spawn boundaries

2026-10-10 19:13:24 -04:00

pre-bash-dev-server-block.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-dispatcher.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

pre-bash-git-push-reminder.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

pre-write-doc-warn.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

pretooluse-visible-output.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

quality-gate.js

fix(hooks): enforce literal formatter invocation at spawn boundaries

2026-10-10 19:13:24 -04:00

run-with-flags-shell.sh

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

run-with-flags.js

fix: keep session summaries within the lifecycle deadline

2026-10-11 00:15:12 +08:00

session-activity-tracker.js

fix: also fix hook_event_name env-var bug found by pre-merge review; sanitize session_id

2026-09-05 17:08:47 -07:00

session-end-marker.js

fix(hooks): resolve session IDs from hook payloads

2026-10-08 23:46:56 +02:00

session-end.js

refactor(hooks): break up session-end summary and main flow

2026-10-19 22:03:57 -04:00

session-start-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

session-start.js

fix(session): preserve optional startup context and independent history reads

2026-10-10 20:14:22 -04:00

skill-run-tracker.js

fix: record skill runs under OpenCode and report unmeasured skills honestly

2026-10-07 19:45:21 -05:00

stop-format-typecheck.js

Merge PR #3464: identify hooks by their input sessions

2026-10-10 17:38:00 -04:00

suggest-compact.js

test: cover inferred-window hook output

2026-08-29 14:55:13 -04:00