Geronimo 27667bc746 fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks ...

- orchestrate-codex-worker: drop yolo, default never approval, worktree containment
- run-with-flags-shell: add path traversal containment mirroring JS guard
- mcp-health-check: gate workspace probe, denylist dangerous env, shell-free reconnect with opt-in
- install.sh/ps1: add --ignore-scripts to block postinstall RCE
- git hooks: refuse global hooksPath clobber, remove file disable bypass, gate pre-push repo script execution
- claw.js: remove Windows shell:true, validate model token
- tests: opt into new secure defaults, quote-aware reconnect parsing

2026-09-14 13:24:58 +05:30

..

auto-tmux-dev.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.js

fix(hooks): block-no-verify handles stuck optional values and long-option prefixes (#3073)

2026-09-12 03:07:29 +01:00

check-console-log.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

check-hook-enabled.js

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00

config-protection.js

fix(config-protection): match protected filenames case-insensitively (#2543)

2026-07-22 12:17:04 -04:00

cost-tracker.js

docs(costs): cite the pricing contract

2026-08-28 16:38:56 -04:00

cursor-session-env.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

design-quality-check.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

desktop-notify.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

doc-file-warning.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

ecc-context-monitor.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-statusline.js

chore: update statusline ANSI color palette

2026-05-15 23:18:01 -04:00

evaluate-session.js

Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

2026-02-18 07:40:12 +00:00

gateguard-fact-force.js

Merge reviewed PowerShell enforcement fixes for 2.2.1

2026-09-07 16:38:41 -04:00

gateguard-heredoc.js

fix(gateguard): match heredoc tab-strip order

2026-08-29 14:55:14 -04:00

governance-capture.js

fix: address PowerShell review bypasses

2026-09-05 16:12:58 -04:00

insaits-security-monitor.py

test: cover hook bootstrap and InsAIts monitor

2026-04-29 17:45:22 -04:00

insaits-security-wrapper.js

fix: fail open on insaits monitor errors

2026-04-29 18:03:33 -04:00

mcp-health-check.js

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

observe-runner.js

fix(hooks): require successful shell probe in observe runner (#2403)

2026-07-13 21:31:12 -04:00

plan-canvas-pending.js

fix(plan-canvas): deliver browser chat to the agent every time (#2739)

2026-08-09 18:15:25 -04:00

plan-canvas-sessions.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

plugin-hook-bootstrap.js

fix(hooks): classify platform-dependent raw prefixes

2026-08-28 22:35:23 -04:00

post-bash-build-complete.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-command-log.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-pr-created.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-edit-accumulator.js

perf(hooks): batch format+typecheck at Stop instead of per Edit (#746)

2026-03-31 14:12:12 -07:00

post-edit-console-warn.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-format.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-typecheck.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

posttooluse-dispatcher.js

fix: close PowerShell destructive command gate bypass

2026-09-04 15:02:57 -04:00

pre-bash-commit-quality.js

fix(hooks): support Windows linter paths and ESLint 9 (#3076)

2026-09-12 01:46:38 +01:00

pre-bash-dev-server-block.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

pre-bash-git-push-reminder.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

pre-write-doc-warn.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

pretooluse-visible-output.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

quality-gate.js

refactor: deduplicate config lists and unify resolveFormatterBin branches

2026-03-11 10:45:28 +09:00

run-with-flags-shell.sh

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

run-with-flags.js

fix(plan-canvas): deliver browser chat to the agent every time (#2739)

2026-08-09 18:15:25 -04:00

session-activity-tracker.js

Merge pull request #1384 from KeWang0622/fix/lint-md028-eqeqeq

2026-04-12 23:03:19 -07:00

session-end-marker.js

fix: clean up observer sessions on lifecycle end

2026-04-02 18:02:29 -07:00

session-end.js

Merge remote-tracking branch 'origin/main' into maint/pr-2866-current

2026-08-28 18:29:35 -04:00

session-start-bootstrap.js

refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410)

2026-07-03 20:01:17 -07:00

session-start.js

feat(session-start): rank injected instincts by project/stack relevance (#2466)

2026-08-10 21:46:24 -04:00

skill-run-tracker.js

fix(skill-evolution): wire Skill PostToolUse tracker so skill-health shows real runs (#2490)

2026-08-12 18:12:49 -04:00

stop-format-typecheck.js

fix(hooks): never format installed plugin and marketplace clones (#2667)

2026-08-04 17:14:37 -04:00

suggest-compact.js

test: cover inferred-window hook output

2026-08-29 14:55:13 -04:00