timothyandClaude Opus 4.8
98e4767322
Build ErsatzTV Image / Docs update reminder (push) Has been skipped
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (push) Successful in 4m9s
Build ErsatzTV Image / Build & test (.NET) (push) Successful in 5m22s
Build ErsatzTV Image / Build & push image (amd64) (push) Has been cancelled
Wave 1 rigor-enforcement hooks (methodology review, #303), fail-open + pipe-tested: - pretooluse-bash-guard.sh — deny golden-baseline regen env var in command position (H1) - pretooluse-nav-guard.sh — deny browser-tab nav to /iptv,.m3u8,/artwork (H2) - pretooluse-agent-ram.sh — RAM-gate Agent/Task spawn, deny <10%% / ask <20%% (H8) - .claude/settings.json wires the three PreToolUse matchers Also: docs/decisions.md gains a 44-entry Index/TOC (additive); .gitignore ignores stray root *.png + .playwright-mcp/ (E2E scratch). Wave 2/3 + follow-ups tracked in #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
1.0 KiB
Bash
Executable File
16 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# PreToolUse / Bash — deny commands that violate a HARD RULE.
|
|
# Fail-open: any parse trouble → allow (exit 0 with no output).
|
|
set -euo pipefail
|
|
input=$(cat)
|
|
cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
|
|
|
|
# Match an actual env ASSIGNMENT in COMMAND POSITION — line start or right after a shell
|
|
# separator (; && || | ( ), optionally `export`. This deliberately does NOT match the name
|
|
# when it sits inside a quoted string (echo, git commit -m, jq test payloads), where the
|
|
# preceding char is a quote/word, not a separator — so mentions of the rule never false-trip.
|
|
if printf '%s' "$cmd" | grep -qE '(^|[;&|(]|&&|\|\|)[[:space:]]*(export[[:space:]]+)?ETV_UPDATE_GOLDENS='; then
|
|
jq -n '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:"Blocked: ETV_UPDATE_GOLDENS regenerates golden-test baselines — HARD RULE (docs/handoffs lore); never set it in a session. Update a golden deliberately and reviewed, not via a guarded run."}}'
|
|
fi
|
|
exit 0
|