3 people 34a97fa898 fix: reject unsupported env split-string escapes ...

Validate env -S and --split-string escape syntax before shell scanning or
opaque fallback. Preserve literal single-quoted data and charge each
validation character against the shared input-proportional work budget.

Verified 787 focused cases and 290 real Git/config, harmless native env
and registered-routing controls. Keeps the prior paid-copy protection.

Co-authored-by: Nguyen Thanh Dat <ntdat812.dev@gmail.com>
Co-authored-by: Davemaina1 <dmain7015@gmail.com>

2026-10-09 21:04:20 -04:00

..

lib

fix(hooks): preserve Git configuration across shell command scopes

2026-09-28 05:38:05 -04:00

auto-tmux-dev.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.js

fix: reject unsupported env split-string escapes

2026-10-09 21:04:20 -04:00

check-console-log.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

check-hook-enabled.js

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00

config-protection.js

Merge reviewed Biome-filename correction from PR2835

2026-09-28 07:07:45 -04:00

cost-tracker.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

cursor-session-env.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

design-quality-check.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

desktop-notify.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

doc-file-warning.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

ecc-context-monitor.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

ecc-statusline.js

chore: update statusline ANSI color palette

2026-05-15 23:18:01 -04:00

evaluate-session.js

Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

2026-02-18 07:40:12 +00:00

gateguard-fact-force.js

merge: preserve tested SQL wrapper guard source 3050

2026-10-09 16:16:43 -04:00

gateguard-heredoc.js

fix(gateguard): ignore heredoc prose for tee and path-qualified sinks (#2886)

2026-09-17 17:29:26 +00:00

governance-capture.js

fix: address PowerShell review bypasses

2026-09-05 16:12:58 -04:00

hook-input-limits.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hook-input.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-frontmatter.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

hookify-runtime.js

fix: preserve Hookify Windows missing-device identity

2026-10-09 19:10:06 -04:00

insaits-security-monitor.py

test: cover hook bootstrap and InsAIts monitor

2026-04-29 17:45:22 -04:00

insaits-security-wrapper.js

fix: fail open on insaits monitor errors

2026-04-29 18:03:33 -04:00

lifecycle-hook-bootstrap.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

mcp-health-check.js

fix(security): stderr skip, independent audit, home MCP trust, dry-run conflict check

2026-09-15 00:29:23 +05:30

observe-runner.js

fix(hooks): require successful shell probe in observe runner (#2403)

2026-07-13 21:31:12 -04:00

plan-canvas-pending.js

fix(plan-canvas): deliver browser chat to the agent every time (#2739)

2026-08-09 18:15:25 -04:00

plan-canvas-sessions.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

plugin-hook-bootstrap.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

post-bash-build-complete.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-command-log.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-pr-created.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-edit-accumulator.js

perf(hooks): batch format+typecheck at Stop instead of per Edit (#746)

2026-03-31 14:12:12 -07:00

post-edit-console-warn.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-format.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-typecheck.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

posttooluse-dispatcher.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

pre-bash-commit-quality.js

fix(hooks): support python style comments in pre-commit quality checks (#3194)

2026-09-21 14:33:19 -04:00

pre-bash-dev-server-block.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-dispatcher.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

pre-bash-git-push-reminder.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

pre-write-doc-warn.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

pretooluse-visible-output.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

quality-gate.js

refactor: deduplicate config lists and unify resolveFormatterBin branches

2026-03-11 10:45:28 +09:00

run-with-flags-shell.sh

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

run-with-flags.js

feat: execute bounded local Hookify rules in lifecycle hooks

2026-10-09 15:59:20 -04:00

session-activity-tracker.js

fix: also fix hook_event_name env-var bug found by pre-merge review; sanitize session_id

2026-09-05 17:08:47 -07:00

session-end-marker.js

fix: clean up observer sessions on lifecycle end

2026-04-02 18:02:29 -07:00

session-end.js

fix(session-start): scope summary lookup to repository identity (#3160) (#3168)

2026-09-19 02:08:50 -04:00

session-start-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

session-start.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

skill-run-tracker.js

fix(skill-evolution): wire Skill PostToolUse tracker so skill-health shows real runs (#2490)

2026-08-12 18:12:49 -04:00

stop-format-typecheck.js

merge: preserve tested commit-review source 2974

2026-10-09 16:10:04 -04:00

suggest-compact.js

test: cover inferred-window hook output

2026-08-29 14:55:13 -04:00