@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-careful/bin/check-careful.sh

@@ -1,407 +0,0 @@
-#!/usr/bin/env bash
-# check-careful.sh — PreToolUse hook for /careful skill
-# Reads JSON from stdin, checks a Bash or PowerShell command for destructive
-# patterns (best-effort string matching, not a security boundary).
-# Two tiers:
-#   HIGH   — a tiny set of catastrophic SIMPLE commands returns "deny"
-#            (best-effort advisory hard-stop, not a policy boundary).
-#   MEDIUM — the destructive families below return "ask" (always overridable).
-# The decision MUST be nested under hookSpecificOutput — Claude Code ignores a
-# top-level permissionDecision, which silently no-ops the warning.
-set -euo pipefail
-
-# Read stdin (JSON with tool_input)
-INPUT=$(cat)
-
-# Shared JSON helpers (extractor + encoder) — one copy for careful AND freeze.
-# See hook-extract.sh for the drift history that motivated the shared file.
-_HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=careful/bin/hook-extract.sh
-# bash treats `.` on a MISSING file as fatal non-interactively; a partial
-# install must degrade to an ASK (this is the ask-tier hook), never silence.
-_HOOK_HELPER="$_HOOK_DIR/hook-extract.sh"
-if [ ! -f "$_HOOK_HELPER" ] || ! . "$_HOOK_HELPER" 2>/dev/null; then
-  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"[careful] Hook helpers unavailable (broken install?) - cannot safety-check this command. Approve only if you know what it does."}}\n'
-  exit 0
-fi
-
-# Extract the "command" field value from tool_input with a real JSON parser.
-#
-# The previous extractor was
-#   grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"'
-# whose [^"]* stops at the first escaped quote in the JSON string value. Any
-# destructive command preceded by a quoted argument was therefore truncated
-# away before the pattern checks ever ran:
-#
-#   git commit -m "wip" && rm -rf /   ->  CMD='git commit -m \'   -> allowed
-#   bash -c "rm -rf /"                ->  CMD='bash -c \'         -> allowed
-#   echo "x"; rm -rf ~                ->  CMD='echo \'            -> allowed
-#
-# Parse the payload properly instead, and fail CLOSED when it cannot be parsed
-# at all — a hook that gates destructive commands must not allow-by-default on
-# unreadable input.
-#
-# The same parser call reads tool_name: the PowerShell tool (Claude Code's
-# primary shell on Windows, and the only one without Git Bash) carries its
-# command in the same tool_input.command field as Bash (hooks reference,
-# "PreToolUse > PowerShell"). An older hook-extract.sh without the combined
-# reader (partial upgrade) still checks the command, as Bash.
-TOOL_NAME=""
-set +e
-if command -v gstack_hook_extract_tool >/dev/null 2>&1; then
-  gstack_hook_extract_tool "$INPUT" command
-  EXTRACT_RC=$?
-  TOOL_NAME="$GSTACK_HOOK_TOOL"
-  CMD="$GSTACK_HOOK_VALUE"
-else
-  CMD=$(gstack_hook_extract_field "$INPUT" command)
-  EXTRACT_RC=$?
-fi
-set -e
-
-# No parser available, or the payload is not parseable JSON. Fail closed.
-if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then
-  gstack_hook_decision ask "[careful] Could not parse the tool payload to safety-check this command. Approve only if you know what it does."
-  exit 0
-fi
-
-# Parsed fine, but there is genuinely no command field (non-shell payload) — allow.
-if [ -z "$CMD" ]; then
-  echo '{}'
-  exit 0
-fi
-
-# Log a hook fire event (pattern name only, never command content).
-# Shared helper respects GSTACK_HOME, so tests never write real analytics.
-_careful_log_fire() { gstack_hook_log_fire careful "$1"; }
-
-# Normalize: lowercase for case-insensitive SQL matching
-CMD_LOWER=$(printf '%s' "$CMD" | tr '[:upper:]' '[:lower:]')
-
-# --- Shell-obfuscation tripwire ---
-# Every check below inspects the command as a STRING, but bash executes what the
-# string MEANS after expansion. ${IFS} holds the default field separator and
-# contains no literal whitespace, so
-#
-#   rm${IFS}-rf${IFS}/
-#
-# matches none of the `rm\s+` patterns while executing as a full recursive
-# delete. The same holds for a command assembled by a base64 decode piped to a
-# shell. Rather than try to out-parse bash, treat these splitting/decoding
-# primitives as a reason to ask: they are vanishingly rare in commands a human
-# actually means to run unattended.
-if grep -qE '\$\{IFS\}|\$IFS|\$\(echo[^)]*base64[^)]*\)|base64[[:space:]]+(-d|--decode)[^|]*\|[[:space:]]*(sh|bash)' <<< "$CMD" 2>/dev/null; then
-  gstack_hook_decision ask "[careful] Shell obfuscation detected (IFS word-splitting or base64-to-shell). Read the command carefully before approving."
-  exit 0
-fi
-
-# --- HIGH tier: hard deny (best-effort advisory hard-stop, NOT a policy boundary) ---
-# Only SIMPLE commands are eligible: string matching cannot resolve what a
-# compound command does (`cd X && git push --force` — whose cwd? which repo?),
-# so anything containing ; && || | or a newline falls through to the MEDIUM ask
-# families below — conservative failure = ask, never guess.
-# --force-with-lease is deliberately NOT matched here (it is the safe variant).
-# curl|sh stays MEDIUM/allow territory: hard-denying it would block legitimate
-# installer flows, including gstack's own setup pattern.
-_IS_SIMPLE=1
-case "$CMD" in
-  *';'*|*'&&'*|*'||'*|*'|'*|*$'\n'*) _IS_SIMPLE=0 ;;
-esac
-if [ "$_IS_SIMPLE" -eq 1 ]; then
-  # Recursive delete aimed at the filesystem root or the whole home directory.
-  # Tokenized: options (long or short, any position — --no-preserve-root may
-  # trail the target) are skipped; EVERY non-option token must be a root-class
-  # target (/, ~, $HOME, /*), and a recursive flag must be present. noglob is
-  # forced around word-splitting so a literal /* token never expands.
-  if grep -qE '^[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]' <<< "$CMD" 2>/dev/null \
-    && grep -qE '(^|[[:space:]])(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]|$)' <<< "$CMD" 2>/dev/null; then
-    _ROOT_TARGETS=0
-    _SAFE_TARGETS=0
-    set -f
-    for _TOK in $CMD; do
-      # Strip one layer of surrounding quotes: rm -rf "/" is still rm -rf /.
-      _TOK="${_TOK#\"}"; _TOK="${_TOK%\"}"; _TOK="${_TOK#\'}"; _TOK="${_TOK%\'}"
-      case "$_TOK" in
-        # Skip non-target decoration: options, `--`, redirections (2>/dev/null
-        # is the most common suffix on agent-generated commands), backgrounding.
-        sudo|rm|-*|--|[0-9]'>'*|'>'*|'<'*|'&') continue ;;
-        '/'|'~'|'~/'|'$HOME'|'$HOME/'|'${HOME}'|'${HOME}/'|'/*'|'//') _ROOT_TARGETS=1 ;;
-        *) _SAFE_TARGETS=1 ;;
-      esac
-    done
-    set +f
-    if [ "$_ROOT_TARGETS" -eq 1 ] && [ "$_SAFE_TARGETS" -eq 0 ]; then
-      _careful_log_fire "high_rm_root"
-      gstack_hook_decision deny "[careful][HIGH] Recursive delete of / or the home directory is blocked while /careful is active. If you truly mean it, end the /careful session first."
-      exit 0
-    fi
-  fi
-  # Force-push to the repo's default branch (the shared history everyone pulls).
-  # Force is carried by -f/--force OR by git's plus-refspec syntax (+main,
-  # +HEAD:main) which needs no flag at all. --force-with-lease never matches.
-  if grep -qE '^[[:space:]]*git[[:space:]]+push([[:space:]]|$)' <<< "$CMD" 2>/dev/null; then
-    _HAS_FORCE=0
-    if grep -qE '(^|[[:space:]])(-f|--force)($|[[:space:]])' <<< "$CMD" 2>/dev/null; then
-      _HAS_FORCE=1
-    elif grep -qE '(^|[[:space:]])\+[^[:space:]]' <<< "$CMD" 2>/dev/null; then
-      _HAS_FORCE=1
-    fi
-    if [ "$_HAS_FORCE" -eq 1 ]; then
-      # Full branch path (slashed defaults like release/2.0 stay intact) and
-      # FIXED-STRING token comparison — never interpolate a branch name into
-      # an ERE (metacharacters would over/under-match).
-      _DEFAULT_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|^refs/remotes/origin/||' || true)
-      # Conductor worktrees often lack the origin/HEAD symbolic ref — without a
-      # fallback the HIGH tier would be silently inert in the primary deploy
-      # environment. Probe the two conventional defaults.
-      if [ -z "$_DEFAULT_BRANCH" ]; then
-        if git show-ref --verify -q refs/remotes/origin/main 2>/dev/null; then
-          _DEFAULT_BRANCH="main"
-        elif git show-ref --verify -q refs/remotes/origin/master 2>/dev/null; then
-          _DEFAULT_BRANCH="master"
-        fi
-      fi
-      if [ -n "$_DEFAULT_BRANCH" ]; then
-        _TARGETS_DEFAULT=0
-        set -f
-        for _TOK in $CMD; do
-          # Strip one layer of surrounding quotes: `git push -f origin "main"`
-          # must not dodge the deny just because the ref is quoted.
-          _TOK="${_TOK#\"}"; _TOK="${_TOK%\"}"; _TOK="${_TOK#\'}"; _TOK="${_TOK%\'}"
-          case "$_TOK" in git|push|sudo|-*) continue ;; esac
-          _REF="${_TOK#+}"          # +main -> main
-          _REF="${_REF##*:}"        # HEAD:main / src:main -> main
-          if [ "$_REF" = "$_DEFAULT_BRANCH" ]; then
-            _TARGETS_DEFAULT=1
-            break
-          fi
-        done
-        set +f
-        if [ "$_TARGETS_DEFAULT" -eq 0 ] && grep -qE '^[[:space:]]*git[[:space:]]+push([[:space:]]+(-f|--force))*[[:space:]]*$' <<< "$CMD" 2>/dev/null; then
-          # Bare `git push --force` (force flags only, no remote/ref): targets
-          # the current branch's upstream — the default branch only when ON it.
-          _CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || true)
-          [ -n "$_CURRENT_BRANCH" ] && [ "$_CURRENT_BRANCH" = "$_DEFAULT_BRANCH" ] && _TARGETS_DEFAULT=1
-        fi
-        if [ "$_TARGETS_DEFAULT" -eq 1 ]; then
-          _careful_log_fire "high_force_push_default"
-          gstack_hook_decision deny "[careful][HIGH] Force-push to the default branch ($_DEFAULT_BRANCH) is blocked while /careful is active. Use --force-with-lease on a feature branch, or end the /careful session if you truly mean it."
-          exit 0
-        fi
-      fi
-    fi
-  fi
-fi
-
-# --- Check for safe exceptions (one standalone rm of build artifacts) ---
-# Match the complete command. Parsing only the last rm is unsafe because shell
-# syntax or comments can hide an earlier destructive command, for example:
-#   rm -rf / # rm -rf node_modules
-# Unknown syntax fails closed and falls through to the destructive checks.
-# Two hardenings on top of the anchored shape (#2039 wave):
-#   - flag cluster accepts capital -R (BSD/macOS recursive), so a single
-#     `rm -Rf node_modules` stays allowed instead of prompting;
-#   - target tokens exclude `(` and backtick, so command substitution that
-#     ENDS in a whitelisted suffix (`rm -rf $(./wipe-all)/node_modules`)
-#     cannot ride the whitelist. Plain $VAR expansion (no parenthesis) is
-#     still allowed.
-#   - multi-line commands never ride the whitelist: grep matches the anchored
-#     shape against EACH line, so `rm -rf /\nrm -rf node_modules` would be
-#     allowed by its second line. With the JSON-parser extraction the \n in
-#     the payload is a real newline (the old grep extractor kept it as two
-#     literal characters, which broke the anchored match by accident).
-case "$CMD" in
-  *$'\n'*) : ;; # multi-line: fall through to the destructive checks
-  *)
-    if grep -qE '^[[:space:]]*rm[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*[[:space:]]+|--recursive[[:space:]]+)(([^[:space:];&|#(`]*/)?(node_modules|\.next|dist|__pycache__|\.cache|build|\.turbo|coverage)[[:space:]]*)+$' <<< "$CMD" 2>/dev/null; then
-      echo '{}'
-      exit 0
-    fi
-    ;;
-esac
-
-# --- Destructive pattern checks (MEDIUM tier — always overridable) ---
-WARN=""
-PATTERN=""
-
-# --- PowerShell and cmd table (#3067) ---
-# Runs on the PowerShell tool's command, and on the part of any command from a
-# nested `powershell`/`pwsh`/`cmd` launcher onward (`pwsh -c "..."`,
-# `cmd /c rd /s /q x`, Git Bash's `cmd //c`). Plain Bash commands never reach
-# it, so Bash keeps exactly its old behavior. Best-effort: PowerShell can
-# build commands at runtime, so encoded and dynamic forms ask instead of being
-# parsed, and Claude Code permission deny rules stay the stronger layer.
-# Matching is bash [[ =~ ]] on the already-lowercased command (POSIX ERE,
-# bash 3.2 compatible): no added subprocess on the per-command path.
-_WIN_SCAN=""
-[ "$TOOL_NAME" = "PowerShell" ] && _WIN_SCAN="$CMD_LOWER"
-_WIN_LAUNCH_RE='(^|[^a-z0-9_.$-])((powershell|pwsh|cmd)(\.exe)?([[:space:]].*)?)$'
-if [ -z "$_WIN_SCAN" ] && [[ $CMD_LOWER =~ $_WIN_LAUNCH_RE ]]; then
-  _WIN_SCAN="${BASH_REMATCH[2]}"
-fi
-if [ -n "$_WIN_SCAN" ]; then
-  # cmd escapes with ^ (r^d is rd) and PowerShell with a backtick
-  # (Re`move-Item is Remove-Item); dropping both only joins characters.
-  _WIN_SCAN="${_WIN_SCAN//^/}"
-  _WIN_SCAN="${_WIN_SCAN//\`/}"
-  _NL=$'\n'
-  # Command position: start of text, a statement/pipeline separator, an
-  # opening bracket or quote, or right after a shell launcher and its
-  # switches. Names elsewhere (ord, --del, /rd/, git branch -d) never match.
-  _CP="(^|[;&|({}\"'${_NL}]|(powershell|pwsh|cmd)(\.exe)?([[:space:]]+(-|/+)[a-z]+([[:space:]:=]+[a-z0-9_.-]+)?)*)[[:space:]]*"
-  _STMT="[^;|${_NL}]*"
-  _CMD_STMT="[^;|&${_NL}]*"
-  _WHY_DYNAMIC="Encoded or dynamic PowerShell can't be inspected, so /careful cannot tell what it will run. Read it before approving; Claude Code permission deny rules (for example \"PowerShell(Remove-Item *)\") are the stronger layer."
-  # One table: pattern name, ERE, warning. Parameters match any unique
-  # prefix PowerShell accepts (-r/-rec/-recurse, -fo/-forc/-force; -f alone
-  # is ambiguous with -Filter), with or without a :$true value.
-  _WIN_RULES=(
-    ps_remove_item
-    "${_CP}(remove-item|rm|ri|del|erase|rd|rmdir)[[:space:]](${_STMT}[[:space:]])?-(r|re|rec|recu|recur|recurs|recurse|fo|for|forc|force)([[:space:]:]|$)"
-    "Destructive: PowerShell Remove-Item (or rm/ri/del/erase/rd/rmdir) with -Recurse or -Force. This permanently removes files."
-    cmd_rd_s
-    "${_CP}(rd|rmdir)[[:space:]]${_CMD_STMT}/s([[:space:]/]|$)"
-    "Destructive: cmd rd/rmdir /s deletes a whole directory tree."
-    cmd_del_s
-    "${_CP}(del|erase)[[:space:]]${_CMD_STMT}/s([[:space:]/]|$)"
-    "Destructive: cmd del/erase /s deletes matching files in every subdirectory."
-    ps_format_volume
-    "${_CP}format-volume([[:space:]]|$)"
-    "Destructive: Format-Volume erases a whole volume."
-    ps_clear_disk
-    "${_CP}clear-disk([[:space:]]|$)"
-    "Destructive: Clear-Disk wipes every partition on a disk."
-    ps_clear_content
-    "${_CP}(clear-content|clc)([[:space:]]|$)"
-    "Destructive: Clear-Content empties files (like truncate)."
-    ps_dotnet_delete
-    '\[(system\.)?io\.(directory|file)\]::delete'
-    "Destructive: .NET [IO.Directory]::Delete / [IO.File]::Delete removes files without Remove-Item."
-    ps_encoded_command
-    "(^|[^a-z0-9_.$-])(powershell|pwsh)(\.exe)?[[:space:]](${_STMT}[[:space:]])?-(e|ec|en|enc[a-z]*)([[:space:]:]|$)"
-    "PowerShell -EncodedCommand. ${_WHY_DYNAMIC}"
-    ps_invoke_expression
-    "${_CP}(invoke-expression|iex)([[:space:](]|$)"
-    "PowerShell Invoke-Expression (iex). ${_WHY_DYNAMIC}"
-    ps_start_process_shell
-    "${_CP}(start-process|saps|start)[[:space:]](${_STMT}[[:space:]\"',])?(powershell|pwsh|cmd|bash|wsl|sh)(\.exe)?([[:space:]\"',]|$)"
-    "Start-Process launching another shell. ${_WHY_DYNAMIC}"
-    ps_call_operator
-    "(^|[^&])&[[:space:]]*[\$(]"
-    "PowerShell call operator on a variable or expression (& \$cmd). ${_WHY_DYNAMIC}"
-  )
-  _WI=0
-  while [ "$_WI" -lt "${#_WIN_RULES[@]}" ]; do
-    _WRE="${_WIN_RULES[$((_WI + 1))]}"
-    if [[ $_WIN_SCAN =~ $_WRE ]]; then
-      PATTERN="${_WIN_RULES[$_WI]}"
-      WARN="${_WIN_RULES[$((_WI + 2))]} (pattern: $PATTERN)"
-      break
-    fi
-    _WI=$((_WI + 3))
-  done
-fi
-
-# rm -rf / rm -r / rm -R / rm --recursive (capital -R is BSD/macOS recursive)
-if [ -z "$WARN" ] && grep -qE 'rm\s+(-[a-zA-Z]*[rR]|--recursive)' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: recursive delete (rm -r). This permanently removes files."
-  PATTERN="rm_recursive"
-fi
-
-# DROP TABLE / DROP DATABASE
-if [ -z "$WARN" ] && grep -qE 'drop\s+(table|database)' <<< "$CMD_LOWER" 2>/dev/null; then
-  WARN="Destructive: SQL DROP detected. This permanently deletes database objects."
-  PATTERN="drop_table"
-fi
-
-# TRUNCATE
-if [ -z "$WARN" ] && grep -qE '\btruncate\b' <<< "$CMD_LOWER" 2>/dev/null; then
-  WARN="Destructive: SQL TRUNCATE detected. This deletes all rows from a table."
-  PATTERN="truncate"
-fi
-
-# git push --force / git push -f / plus-refspec force (git push origin +ref)
-if [ -z "$WARN" ] && grep -qE 'git\s+push\s' <<< "$CMD" 2>/dev/null \
-  && grep -qE '(-f\b|--force|(^|[[:space:]])\+[^[:space:]])' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: git force-push rewrites remote history. Other contributors may lose work."
-  PATTERN="git_force_push"
-fi
-
-# git reset --hard
-if [ -z "$WARN" ] && grep -qE 'git\s+reset\s+--hard' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: git reset --hard discards all uncommitted changes."
-  PATTERN="git_reset_hard"
-fi
-
-# git checkout . / git restore .
-if [ -z "$WARN" ] && grep -qE 'git\s+(checkout|restore)\s+\.' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: discards all uncommitted changes in the working tree."
-  PATTERN="git_discard"
-fi
-
-# kubectl delete
-if [ -z "$WARN" ] && grep -qE 'kubectl\s+delete' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: kubectl delete removes Kubernetes resources. May impact production."
-  PATTERN="kubectl_delete"
-fi
-
-# docker rm -f / docker system prune
-if [ -z "$WARN" ] && grep -qE 'docker\s+(rm\s+-f|system\s+prune)' <<< "$CMD" 2>/dev/null; then
-  WARN="Destructive: Docker force-remove or prune. May delete running containers or cached images."
-  PATTERN="docker_destructive"
-fi
-
-# --- Additive project patterns ---
-# Config can only ADD warn rules, never remove or weaken a baseline family:
-# these files are consulted AFTER the hardcoded checks and only when none of
-# them matched, so no file content can suppress a baseline warning. One POSIX
-# ERE per line; blank lines and #-comments skipped; an invalid regex is
-# skipped (never fatal — the hook must not break on a typo in config).
-if [ -z "$WARN" ]; then
-  # Same state root the writer (/careful via gstack-paths) uses — see
-  # gstack_hook_state_root in hook-extract.sh (#1459 class).
-  if command -v gstack_hook_state_root >/dev/null 2>&1; then
-    _GSTACK_HOME_DIR="$(gstack_hook_state_root; printf x)"; _GSTACK_HOME_DIR="${_GSTACK_HOME_DIR%x}"
-  else
-    # Older hook-extract.sh (partial upgrade): the plain chain beats dying
-    # under set -e with no decision JSON — rules under $HOME/.gstack still load.
-    _GSTACK_HOME_DIR="${GSTACK_HOME:-$HOME/.gstack}"
-  fi
-  _PATTERN_FILES="$_GSTACK_HOME_DIR/careful-patterns.txt"
-  # Short-circuit: resolving the project slug costs a subprocess + git call on
-  # EVERY Bash command while /careful is active — only pay it when some
-  # per-project pattern file actually exists anywhere.
-  _ANY_PROJ_PAT=$(find "$_GSTACK_HOME_DIR/projects" -maxdepth 2 -name careful-patterns.txt -print -quit 2>/dev/null || true)
-  if [ -n "$_ANY_PROJ_PAT" ]; then
-    eval "$("$_HOOK_DIR/../../bin/gstack-slug" 2>/dev/null)" 2>/dev/null || true
-    if [ -n "${SLUG:-}" ]; then
-      _PATTERN_FILES="$_PATTERN_FILES
-$_GSTACK_HOME_DIR/projects/$SLUG/careful-patterns.txt"
-    fi
-  fi
-  while IFS= read -r _PF; do
-    [ -f "$_PF" ] || continue
-    while IFS= read -r _PAT || [ -n "$_PAT" ]; do
-      case "$_PAT" in ''|'#'*) continue ;; esac
-      _PAT_RC=0
-      printf '' | grep -qE -- "$_PAT" 2>/dev/null || _PAT_RC=$?
-      [ "$_PAT_RC" -eq 2 ] && continue # invalid ERE — skip the line
-      if grep -qE -- "$_PAT" <<< "$CMD" 2>/dev/null; then
-        WARN="Project rule matched: $_PAT"
-        PATTERN="project_rule"
-        break
-      fi
-    done < "$_PF"
-    [ -n "$WARN" ] && break
-  done <<EOF_PATTERN_FILES
-$_PATTERN_FILES
-EOF_PATTERN_FILES
-fi
-
-# --- Output ---
-if [ -n "$WARN" ]; then
-  _careful_log_fire "$PATTERN"
-  gstack_hook_decision ask "[careful] $WARN"
-else
-  echo '{}'
-fi

package/.agent/skills/gstack-careful/bin/hook-extract.sh

@@ -1,198 +0,0 @@
-#!/usr/bin/env bash
-# hook-extract.sh — SHARED JSON and path helpers for gstack PreToolUse hooks.
-# Sourced (never executed) by careful/bin/check-careful.sh and
-# freeze/bin/check-freeze.sh via a path relative to each hook script.
-#
-# ONE copy on purpose. These two hooks previously carried separate extractor
-# copies; the escaped-quote truncation bug got fixed in careful's copy while
-# freeze silently kept the broken one. Any future parsing fix lands here and
-# reaches both hooks by construction.
-
-# gstack_hook_extract_field PAYLOAD FIELD
-#   Prints tool_input.FIELD when PAYLOAD is valid JSON and the field is a
-#   string ("" when absent or non-string). Returns 1 when no parser is
-#   available or the payload is not parseable JSON — the CALLER decides the
-#   polarity for that case (careful asks, freeze denies).
-#
-#   python3 is tried first because it ships with macOS and most Linux distros
-#   and is reliably on PATH in a hook environment; node is the fallback.
-gstack_hook_extract_field() {
-  _ghef_payload="$1"
-  _ghef_field="$2"
-  if command -v python3 >/dev/null 2>&1; then
-    printf '%s' "$_ghef_payload" | python3 -c 'import sys,json
-field = sys.argv[1]
-d = json.loads(sys.stdin.read())
-c = d.get("tool_input", {}).get(field, "")
-sys.stdout.write(c if isinstance(c, str) else "")' "$_ghef_field" 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$_ghef_payload" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);const c=(j&&j.tool_input&&j.tool_input[process.argv[1]])||"";process.stdout.write(typeof c==="string"?c:"")}catch(e){process.exit(3)}})' "$_ghef_field" 2>/dev/null && return 0
-  fi
-  return 1
-}
-
-# gstack_hook_extract_tool PAYLOAD FIELD [FIELD...]
-#   One parser call that reads the top-level tool_name together with the first
-#   non-empty string among tool_input.FIELD..., so tool dispatch costs no
-#   extra fork on the per-command hot path. Sets three globals (stdout stays
-#   the hook's decision channel):
-#     GSTACK_HOOK_TOOL   tool_name ("" when absent or non-string)
-#     GSTACK_HOOK_FIELD  the FIELD that supplied the value ("" when none did)
-#     GSTACK_HOOK_VALUE  that field's string value, trailing newlines dropped
-#                        (the same shape $(gstack_hook_extract_field ...) gave)
-#   Returns 1 when no parser is available or the payload is not parseable
-#   JSON; the caller decides the polarity, exactly as for the field extractor.
-#   Python reads and writes bytes: Windows text-mode stdout turns every "\n"
-#   into "\r\n", which left tool_name as "PowerShell\r" and never matched.
-#   Payload shapes (Claude Code hooks reference, PreToolUse input): Bash and
-#   PowerShell carry tool_input.command; Edit and Write carry file_path;
-#   NotebookEdit carries notebook_path.
-GSTACK_HOOK_TOOL=""
-GSTACK_HOOK_FIELD=""
-GSTACK_HOOK_VALUE=""
-gstack_hook_extract_tool() {
-  _ghet_payload="$1"
-  shift
-  _ghet_out=""
-  _ghet_ok=1
-  if command -v python3 >/dev/null 2>&1; then
-    _ghet_out=$(printf '%s' "$_ghet_payload" | python3 -c 'import sys,json
-d = json.loads(sys.stdin.buffer.read())
-t = d.get("tool_name", "") if isinstance(d, dict) else ""
-i = d.get("tool_input", {}) if isinstance(d, dict) else {}
-i = i if isinstance(i, dict) else {}
-f = v = ""
-for k in sys.argv[1:]:
-    c = i.get(k, "")
-    if isinstance(c, str) and c:
-        f, v = k, c
-        break
-sys.stdout.buffer.write(((t if isinstance(t, str) else "").replace("\n", " ") + "\n" + f + "\n" + v.rstrip("\n") + ".").encode("utf-8", "surrogatepass"))' "$@" 2>/dev/null) && _ghet_ok=0
-  fi
-  if [ "$_ghet_ok" -ne 0 ] && command -v node >/dev/null 2>&1; then
-    _ghet_out=$(printf '%s' "$_ghet_payload" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{let j;try{j=JSON.parse(s)}catch(e){process.exit(3)}const o=j&&typeof j==="object"?j:{};const t=typeof o.tool_name==="string"?o.tool_name:"";const i=o.tool_input&&typeof o.tool_input==="object"?o.tool_input:{};let f="",v="";for(const k of process.argv.slice(1)){const c=i[k];if(typeof c==="string"&&c){f=k;v=c;break}}process.stdout.write(t.replace(/\n/g," ")+"\n"+f+"\n"+v.replace(/\n+$/,"")+".")})' "$@" 2>/dev/null) && _ghet_ok=0
-  fi
-  [ "$_ghet_ok" -eq 0 ] || return 1
-  _ghet_out="${_ghet_out%.}"
-  GSTACK_HOOK_TOOL="${_ghet_out%%$'\n'*}"
-  _ghet_out="${_ghet_out#*$'\n'}"
-  GSTACK_HOOK_FIELD="${_ghet_out%%$'\n'*}"
-  GSTACK_HOOK_VALUE="${_ghet_out#*$'\n'}"
-  return 0
-}
-
-# Windows bash (Git Bash / MSYS / Cygwin), read from bash's own OSTYPE so the
-# check never costs a fork: careful sources this file on every Bash call.
-case "${OSTYPE:-}" in
-  msys*|cygwin*|win32*) GSTACK_HOOK_IS_WINDOWS=1 ;;
-  *) GSTACK_HOOK_IS_WINDOWS=0 ;;
-esac
-_GSTACK_HOOK_AZ_UPPER=ABCDEFGHIJKLMNOPQRSTUVWXYZ
-_GSTACK_HOOK_AZ_LOWER=abcdefghijklmnopqrstuvwxyz
-GSTACK_HOOK_PATH=""
-
-# gstack_hook_normalize_path PATH
-#   The one path canonicalization for freeze's boundary AND the tool's
-#   file_path (#2876). Leaves the result in GSTACK_HOOK_PATH (stdout is the
-#   hook's decision channel, and $(...) would cost a fork):
-#     C:\dev\x  c:/dev/x  -> /c/dev/x      (separators, drive-letter case)
-#     \\srv\share\x       -> //srv/share/x (UNC: the leading // is kept)
-#     /cygdrive/c/x       -> /c/x          (Windows bash only)
-#   Drive-letter and UNC shapes are recognised lexically on every platform.
-#   A path without those shapes is rewritten only on Windows bash: on POSIX
-#   '\' is a legal filename character, and rewriting it would let a name like
-#   'a\..\..\etc\x' change which directory the check sees. Remaining case
-#   differences on Windows are handled by comparing under nocasematch.
-#   Builtins only, bash 3.2 compatible.
-gstack_hook_normalize_path() {
-  GSTACK_HOOK_PATH="$1"
-  case "$GSTACK_HOOK_PATH" in
-    [A-Za-z]:[\\/]*|[A-Za-z]:|\\\\[!\\]*) ;;
-    *) [ "$GSTACK_HOOK_IS_WINDOWS" = 1 ] || return 0 ;;
-  esac
-  GSTACK_HOOK_PATH="${GSTACK_HOOK_PATH//\\//}"
-  case "$GSTACK_HOOK_PATH" in
-    [A-Za-z]:/*|[A-Za-z]:)
-      _ghnp_d="${GSTACK_HOOK_PATH%%:*}"
-      _ghnp_pre="${_GSTACK_HOOK_AZ_UPPER%%"$_ghnp_d"*}"
-      [ "$_ghnp_pre" = "$_GSTACK_HOOK_AZ_UPPER" ] || _ghnp_d="${_GSTACK_HOOK_AZ_LOWER:${#_ghnp_pre}:1}"
-      GSTACK_HOOK_PATH="/$_ghnp_d${GSTACK_HOOK_PATH#?:}"
-      ;;
-    /cygdrive/[A-Za-z]/*|/cygdrive/[A-Za-z]) GSTACK_HOOK_PATH="${GSTACK_HOOK_PATH#/cygdrive}" ;;
-  esac
-  return 0
-}
-
-# gstack_hook_json_string TEXT
-#   Prints TEXT as a JSON string literal (surrounding quotes included),
-#   encoding quotes, backslashes, control characters and newlines. Never build
-#   hook JSON with printf/sed interpolation: a path containing a quote or a
-#   newline produces malformed JSON, and Claude Code silently ignores the
-#   whole decision — a deny that no-ops exactly when it matters.
-gstack_hook_json_string() {
-  _ghjs_text="$1"
-  if command -v python3 >/dev/null 2>&1; then
-    printf '%s' "$_ghjs_text" | python3 -c 'import sys,json; sys.stdout.write(json.dumps(sys.stdin.read()))' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$_ghjs_text" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.stringify(s)))' 2>/dev/null && return 0
-  fi
-  # Last-resort fallback (no parser on PATH): strip to a safe charset so the
-  # envelope stays valid JSON even if the message loses characters.
-  printf '"%s"' "$(printf '%s' "$_ghjs_text" | tr -cd 'a-zA-Z0-9 ._/:@=+-' )"
-}
-
-# gstack_hook_decision DECISION REASON
-#   Emits the full PreToolUse hookSpecificOutput envelope with REASON safely
-#   JSON-encoded. DECISION is "ask" or "deny". The decision MUST be nested
-#   under hookSpecificOutput — Claude Code ignores a top-level
-#   permissionDecision, which silently no-ops the block.
-gstack_hook_decision() {
-  _ghd_decision="$1"
-  _ghd_reason="$2"
-  _ghd_encoded=$(gstack_hook_json_string "$_ghd_reason")
-  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"%s","permissionDecisionReason":%s}}\n' "$_ghd_decision" "$_ghd_encoded"
-}
-
-# gstack_hook_state_root
-#   Print the gstack state root: a thin wrapper over gstack_state_root from
-#   bin/gstack-state-root.sh, the one bash implementation of the chain
-#   bin/gstack-paths uses (docs/state-root.md). Hooks run on every Edit/Bash
-#   call, so the twin is pure bash — never spawn gstack-paths from a hook. The
-#   writers (/freeze, /guard, /unfreeze, /investigate) resolve through
-#   gstack-paths; a reader that used a different chain failed OPEN whenever
-#   GSTACK_HOME was set (#1459). test/hook-scripts.test.ts pins parity.
-#   Printed WITHOUT a trailing newline: callers capture with a sentinel
-#   (`r="$(gstack_hook_state_root; printf x)"; r="${r%x}"`) so a root that
-#   itself ends in a newline round-trips exactly as gstack-paths' %q does.
-#   When the twin is missing (partial upgrade) the wrapper is removed, so
-#   callers take their own fallback: careful asks, freeze fails closed.
-gstack_hook_state_root() {
-  gstack_state_root
-}
-_ghsr_twin="${BASH_SOURCE[0]%[/\\]*}/../../bin/gstack-state-root.sh"
-if ! { [ -f "$_ghsr_twin" ] && . "$_ghsr_twin" 2>/dev/null; } || ! command -v gstack_state_root >/dev/null 2>&1; then
-  unset -f gstack_hook_state_root
-fi
-
-# gstack_hook_log_fire SKILL PATTERN
-#   Append a hook_fire analytics record (pattern name only, never command
-#   content) under the resolved state root, the same root every other
-#   analytics writer and reader (gstack-skill-start, gstack-retro-metrics,
-#   gstack-analytics) uses, so the usage log stays one file and tests never
-#   pollute the operator's real analytics file. Best-effort: failures (or a
-#   missing twin) never affect the hook decision.
-gstack_hook_log_fire() {
-  command -v gstack_state_root >/dev/null 2>&1 || return 0
-  _ghlf_dir="$(gstack_state_root; printf x)"; _ghlf_dir="${_ghlf_dir%x}/analytics"
-  mkdir -p "$_ghlf_dir" 2>/dev/null || true
-  # Fields are JSON-encoded (a repo basename can carry quotes/backslashes) —
-  # same rule this file states for decisions: never raw-interpolate into JSON.
-  _ghlf_repo=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")
-  printf '{"event":"hook_fire","skill":%s,"pattern":%s,"ts":"%s","repo":%s}\n' \
-    "$(gstack_hook_json_string "$1")" \
-    "$(gstack_hook_json_string "$2")" \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-    "$(gstack_hook_json_string "$_ghlf_repo")" >> "$_ghlf_dir/skill-usage.jsonl" 2>/dev/null || true
-}