@groeponline/pi-wishcraft 0.23.2 → 0.23.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [0.23.4] - 2026-08-20
+
+### Fixed
+- Command hooks, session context inject, and `/repairs` run: `setupHooks` is registered on activation.
+- Hook runner ignores EPIPE when a command exits before reading stdin.
+
+## [0.23.3] - 2026-08-20
+
+### Fixed
+- Nested settings writes reject `__proto__` / `constructor` / `prototype` keys in the assignment loop.
+- Test workflow pins `GITHUB_TOKEN` to `contents: read`.
+
 ## [0.23.2] - 2026-08-20
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "0.23.2",
+  "version": "0.23.4",
   "description": "Wishcraft cockpit for the pi coding agent — powerline status, vibes, idea inbox, bash mode, and full customization.",
   "type": "module",
   "files": [

package/src/extension/hooks/hooks-runner.ts

@@ -110,12 +110,20 @@ export function runHookCommand(
       finish(null);
     });
     child.on("close", (code) => finish(code));
+    // Hooks that exit before reading stdin (typical `exit 2` deny scripts)
+    // close the pipe; ignore EPIPE so the harness still records the exit code.
+    child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
+      if (error.code === "EPIPE") return;
+      stderr += String(error);
+    });
 
     try {
       child.stdin?.write(JSON.stringify(payload));
       child.stdin?.end();
-    } catch {
-      // stdin weg → hook zonder input; laat 'm zelf falen
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EPIPE") {
+        stderr += String(error);
+      }
     }
   });
 }

package/src/extension/hooks/index.ts

@@ -74,11 +74,15 @@ function basePayload(
 }
 
 /** Registreer de hooks + repairs op de pi extension API. */
-export function setupHooks(pi: ExtensionAPI, rt: RuntimeState, cwd: string): void {
-  refreshSettings(cwd);
+export function setupHooks(
+  pi: ExtensionAPI,
+  rt: RuntimeState,
+  cwd: string = process.cwd(),
+): void {
+  refreshSettings(rt.currentCtx?.cwd ?? cwd);
 
   pi.on("session_start", async () => {
-    refreshSettings(cwd);
+    refreshSettings(rt.currentCtx?.cwd ?? process.cwd());
     if (!hooksEnabled) return;
     const cmds = commandsFor(hooksSettings, "sessionStart");
     if (cmds.length === 0) return;

package/src/extension/session/activate.ts

@@ -6,6 +6,7 @@ import { registerCustomSegments } from "../../segments/index.ts";
 import { readSettings } from "../settings/settings-io.ts";
 import { registerSessionLifecycle } from "./session-lifecycle.ts";
 import { registerCommands } from "../commands/commands.ts";
+import { setupHooks } from "../hooks/index.ts";
 import { setupInlineInvocation } from "../skills/inline-invocation.ts";
 import {
   config,
@@ -26,4 +27,5 @@ export default function powerlineFooter(pi: ExtensionAPI) {
   registerSessionLifecycle(pi, rt);
   registerCommands(pi, rt);
   setupInlineInvocation(pi, rt);
+  setupHooks(pi, rt, process.cwd());
 }

package/src/extension/settings/wishcraft-config.ts

@@ -55,7 +55,44 @@ export function readConfigPath(settings: Record<string, unknown>, path: string):
   return null;
 }
 
-/** Genest schrijven (immutabel op elk niveau) + persist naar settings.json. */
+/** True for path segments that would mutate Object.prototype. */
+export function isUnsafeConfigKey(key: string): boolean {
+  return key === "__proto__" || key === "constructor" || key === "prototype";
+}
+
+/**
+ * Set `parts` (after the root key) on `root`. Returns false and leaves
+ * `root` unchanged when a segment is `__proto__`, `constructor`, or `prototype`.
+ */
+export function assignNestedConfigValue(
+  root: Record<string, unknown>,
+  parts: string[],
+  value: ConfigValue,
+): boolean {
+  for (const part of parts) {
+    if (part === "__proto__" || part === "constructor" || part === "prototype") {
+      return false;
+    }
+  }
+  let node = root;
+  for (let i = 0; i < parts.length; i++) {
+    const key = parts[i]!;
+    // Guard in this loop so CodeQL sees the key check next to the assignment.
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return false;
+    }
+    if (i === parts.length - 1) {
+      if (value === null) delete node[key];
+      else node[key] = value;
+    } else {
+      if (!isRecord(node[key])) node[key] = {};
+      node = node[key] as Record<string, unknown>;
+    }
+  }
+  return true;
+}
+
+/** Nested write (new object per level) + persist to settings.json. */
 export function writeConfigPath(
   cwd: string,
   path: string,
@@ -63,29 +100,20 @@ export function writeConfigPath(
 ): boolean {
   const parts = path.split(".");
   const rootKey = parts[0]!;
-  // Weiger prototype-pollution keys (CodeQL).
-  if (parts.some((p) => p === "__proto__" || p === "constructor" || p === "prototype")) {
+  if (!rootKey || parts.some(isUnsafeConfigKey)) {
     return false;
   }
   return writeSettingKey(cwd, rootKey, (existing) => {
-    // Shorthand string onder powerline (bv. "chef") is een preset-naam: bewaar 'm.
-    let node: Record<string, unknown> = isRecord(existing)
+    // Shorthand string under powerline (e.g. "chef") is a preset name: keep it.
+    const node: Record<string, unknown> = isRecord(existing)
       ? existing
       : rootKey === "powerline" && typeof existing === "string"
         ? { preset: existing }
         : {};
-    const root = node;
-    for (let i = 1; i < parts.length; i++) {
-      const key = parts[i]!;
-      if (i === parts.length - 1) {
-        if (value === null) delete node[key];
-        else node[key] = value;
-      } else {
-        if (!isRecord(node[key])) node[key] = {};
-        node = node[key] as Record<string, unknown>;
-      }
+    if (!assignNestedConfigValue(node, parts.slice(1), value)) {
+      return existing;
     }
-    return root;
+    return node;
   });
 }