Repository navigation
Conversation
WHY: - The session-start sync reported this repo's hooks out of date with agents-master: 18 hook files changed upstream and 6 were missing - Shared command parsing (lib/git-command.cjs) now covers wrappers, subshells and git -C targets, which the guards rely on EXPECTED: - .claude/hooks matches agents-master c80f825, including the new opt-in check-agent-routing.js (left unregistered, as upstream does) and its tests - hooks.config.json project overrides are unchanged - Project-tailored skills/agents (release-readiness, qa-reviewer, content-integrity-auditor, failure-mode-analyzer) keep their HelloEmily.dev text instead of the generic template - node --test *.test.js *.test.cjs lib/*.test.cjs: 569 pass, 0 fail
There was a problem hiding this comment.
🟡 Changes recommended
Multiple critical guard flaws still allow valid push/delete commands to bypass protection, including failed-directory handling, SSH remote parsing, quoted shell syntax, and spaced xargs paths.
5 open issues
What changed in this PR
This pull request synchronizes .claude/hooks/ with agents-master c80f825, expanding shared command parsing and updating Git-related guards, configuration, documentation, and test coverage.
Changes:
- Enhanced command parsing for wrappers, quoting, refspecs, chained pushes, redirections, and repository paths.
- Updated merge, branch-delete, push-audit, CI-status, environment, script-existence, search, and commit-message guard behavior.
- Added lifecycle and regression tests plus the opt-in agent-routing reminder hook.
| File | Description |
|---|---|
| .claude/hooks/README.md | Documents the updated parser behavior, guard defaults, limitations, optional routing hook, and test commands. |
| .claude/hooks/lib/git-command.test.cjs | Updates shared parser tests for directory tracking and multiple push segments. |
| .claude/hooks/lib/git-command.cjs | Adds shell parsing, wrapper handling, quote removal, refspec extraction, redirection filtering, directory tracking, and multi-push support. |
| .claude/hooks/lib/git-command-wrappers.test.cjs | Adds regression coverage for eval, xargs, quoting, nested wrappers, and command-path variations. |
| .claude/hooks/hook-config-integration.test.cjs | Verifies the default commit-guard configuration. |
| .claude/hooks/config.json | Enables blocking commit-message enforcement by default and updates exit-code documentation. |
| .claude/hooks/check-search-command.test.js | Adds lifecycle coverage for quoted and Windows-style search executable paths. |
| .claude/hooks/check-search-command.js | Improves detection of watched search commands with quoted or path-qualified executables. |
| .claude/hooks/check-script-exists.test.js | Tests project-directory resolution and blocking behavior from an external working directory. |
| .claude/hooks/check-script-exists.mjs | Resolves configured package paths from the project directory and uses the blocking exit code. |
| .claude/hooks/check-merge-guard.test.js | Adds coverage for protected refspecs, checkout tracking, tags, redirections, and multiple repositories. |
| .claude/hooks/check-merge-guard.js | Uses shared push parsing and per-repository checkout state to identify protected-branch operations. |
| .claude/hooks/check-merge-guard.hook.test.js | Tests runtime blocking for wrapped merge and push commands. |
| .claude/hooks/check-git-push-audit.test.js | Adds coverage for chained pushes, delete-only operations, matching refspecs, and unknown repositories. |
| .claude/hooks/check-git-push-audit.js | Audits pushes across multiple repositories while excluding delete-only operations. |
| .claude/hooks/check-env-guard.test.js | Adds lifecycle coverage for case-insensitive environment-file matching and allowed filenames. |
| .claude/hooks/check-env-guard.js | Makes environment-file matching case-insensitive. |
| .claude/hooks/check-commit-message.test.js | Updates the documented test invocation. |
| .claude/hooks/check-ci-status-after-push.test.js | Adds lifecycle coverage for chained pushes and deletion handling. |
| .claude/hooks/check-ci-status-after-push.js | Verifies CI status independently for each detected push. |
| .claude/hooks/check-branch-delete-guard.test.js | Adds coverage for remote forms, refspecs, wrappers, paths, and multi-repository deletions. |
| .claude/hooks/check-branch-delete-guard.js | Parses deletion refspecs through shared helpers and evaluates targets per repository. |
| .claude/hooks/check-agent-routing.test.js | Tests matching and unmatched prompt-routing behavior. |
| .claude/hooks/check-agent-routing.js | Adds an opt-in prompt-routing reminder hook. |
Review effort: Lite
Comment on lines
+123
to
+124
| for (const { normalized: segment, cwd } of commandSegments(fullCmd)) { | ||
| const dir = cwd !== null && fs.existsSync(cwd) ? cwd : null; |
| if (nonFlags.length >= 2 && PROTECTED_BRANCHES.includes(branch)) { | ||
| return { src: branch, dest: branch }; | ||
| const { remote, refspecs } = pushArgs(segment); | ||
| const candidates = remote && remote.includes(':') ? [remote, ...refspecs] : refspecs; |
Comment on lines
+175
to
178
| function effectiveBranch(i, dir) { | ||
| const target = checkedOutTo(i, dir); | ||
| if (target) return target; | ||
| if (!branchByDir.has(dir)) branchByDir.set(dir, getCurrentBranch(dir)); |
| // line continuation is removed. `$(...)` and backtick substitutions are | ||
| // copied through unchanged, to be parsed later. Null if a quote is | ||
| // unterminated. | ||
| function unquotedWords(str) { |
| // from GNU/BSD) takes the rest of the token, or the next token if none | ||
| // remains; i/e/l take only an attached rest. Only the common options are | ||
| // handled. | ||
| const XARGS_COMMAND = /^(?:\S*[\\/])?xargs(?:\.exe)?(?=\s|$)\s*/; |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings
.claude/hooks/up to date with agents-masterc80f825, which the session-start sync reported as out of date.Changed: 18 hook files, including the shared command parser
lib/git-command.cjs(wrappers, subshells,git -Ctargets) used by the merge, branch-delete, push-audit and CI-status guards.Added:
check-agent-routing.jsand its tests (opt-in, left unregistered as upstream does), plus new tests for the env guard, merge guard lifecycle, script-exists guard and git-command wrappers.Left as is:
hooks.config.jsonproject overridesrelease-readiness.md,qa-reviewer.md,content-integrity-auditor.md,failure-mode-analyzer.md: these are tailored to HelloEmily.dev, and upstream differs only by generic template textintegration-architect.md,performance-sanity-checker.md: differ only in line endingsTesting:
node --test *.test.js *.test.cjs lib/*.test.cjsin.claude/hooks: 569 pass, 0 fail. No site files change.