Greptile + CodeRabbit review of #3019:
- config-protection: compare basenames case-insensitively (macOS/Windows
resolve ESLINT.CONFIG.JS to the protected eslint.config.js) and use lstat
so a dangling symlink to a protected name still blocks (os.path.exists
follows the link and returns False).
- Both hooks: fail-open stays, silence goes — every swallowed path now
writes a one-line stderr diagnostic.
- config-protection: sys.stdout.write instead of print() per repo Python
style; block decisions carry a trailing newline.
- New tests/hermes-hooks.test.js: 13 cases through the real scripts via
spawnSync — block (all names, case variants, dangling symlink, edits[],
per-tool), allow (normal source, new config, non-edit tools), fail-open
with diagnostics (malformed payload, missing path, unreadable file).
- docs: absolute-path copy-paste block via $HOME (CodeRabbit: /Users/YOU
placeholders were unverifiable), self-contained block-case proof that
creates its target, pointer to the committed suite.
ravitejarenangi
b30a8c782a