@lousy-agents/agent-shell 5.8.5 → 5.8.7

package/README.md

@@ -170,7 +170,7 @@ Patterns support `*` wildcards for prefix, suffix, and infix matching (e.g., `np
 
 ### Copilot Hook Configuration
 
-Add the following to `.github/copilot/hooks.json` to use policy-check as a pre-tool-use hook:
+Add the following to `.github/hooks/agent-shell/hooks.json` to use policy-check as a pre-tool-use hook:
 
 ```json
 {
@@ -228,7 +228,7 @@ agent-shell policy --init
 | File | Description |
 | ------ | ------------- |
 | `.github/hooks/agent-shell/policy.json` | Allow/deny policy derived from discovered commands |
-| `.github/copilot/hooks.json` | Copilot `preToolUse` hook entry wiring `agent-shell policy-check` |
+| `.github/hooks/agent-shell/hooks.json` | Copilot `preToolUse` hook entry wiring `agent-shell policy-check` |
 
 If either file already exists, the command skips writing it and notifies you. Both files are safe to commit for team-wide enforcement.
 
@@ -307,7 +307,7 @@ Once authenticated, `policy --init` will automatically detect the SDK and run AI
 Scanning project...
 Discovered: 8 npm script(s), 12 workflow command(s), 3 mise task(s), 1 language(s)
 Created .github/hooks/agent-shell/policy.json
-Created .github/copilot/hooks.json
+Created .github/hooks/agent-shell/hooks.json
 
 --- Proposed Policy ---
 {

package/dist/index.js

@@ -567,6 +567,13 @@ function isWithinProjectRoot(resolvedPath, projectRoot) {
     // Outside the root if: empty, exact "..", starts with "../" (or "..\"), or is absolute (different drive on Windows)
     return rel !== "" && rel !== ".." && !rel.startsWith(`..${external_node_path_namespaceObject.sep}`) && !(0,external_node_path_namespaceObject.isAbsolute)(rel);
 }
+function isPathNotFoundError(err) {
+    if (typeof err === "object" && err !== null && "code" in err) {
+        const { code } = err;
+        return code === "ENOENT" || code === "ENOTDIR";
+    }
+    return false;
+}
 
 ;// CONCATENATED MODULE: ../../node_modules/zod/v4/core/core.js
 /** A special constant with type `never` */
@@ -14408,8 +14415,27 @@ async function resolveReadEventsDir(env, deps) {
     const defaultDir = (0,external_node_path_namespaceObject.join)(projectRoot, ".agent-shell", "events");
     const logDir = env.AGENTSHELL_LOG_DIR;
     if (logDir !== undefined && logDir !== "") {
-        const resolved = await deps.realpath(logDir);
-        if (!isWithinProjectRoot(resolved, projectRoot)) {
+        const projectRootReal = await deps.realpath(projectRoot);
+        const candidate = (0,external_node_path_namespaceObject.resolve)(projectRoot, logDir);
+        if (!isWithinProjectRoot(candidate, projectRoot) && !isWithinProjectRoot(candidate, projectRootReal)) {
+            return {
+                dir: "",
+                error: "AGENTSHELL_LOG_DIR resolves outside project root"
+            };
+        }
+        let resolved;
+        try {
+            resolved = await deps.realpath(candidate);
+        } catch (err) {
+            if (isPathNotFoundError(err)) {
+                return {
+                    dir: "",
+                    error: "AGENTSHELL_LOG_DIR does not exist or is not a directory"
+                };
+            }
+            throw err;
+        }
+        if (!isWithinProjectRoot(resolved, projectRootReal)) {
             return {
                 dir: "",
                 error: "AGENTSHELL_LOG_DIR resolves outside project root"
@@ -14874,13 +14900,6 @@ function evaluatePolicy(policy, command) {
         return `\\x${ch.charCodeAt(0).toString(16).padStart(2, "0")}`;
     });
 }
-function isPolicyFileNotFound(error) {
-    if (typeof error === "object" && error !== null && "code" in error) {
-        const { code } = error;
-        return code === "ENOENT" || code === "ENOTDIR";
-    }
-    return false;
-}
 function resolvePolicyPath(env, repoRoot) {
     const override = env.AGENTSHELL_POLICY_PATH;
     if (override !== undefined && override !== "") {
@@ -14910,7 +14929,7 @@ async function loadPolicy(env, deps) {
     try {
         resolvedPath = await deps.realpath(candidatePath);
     } catch (error) {
-        if (isPolicyFileNotFound(error)) {
+        if (isPathNotFoundError(error)) {
             if (isOverride) {
                 throw new Error(`Policy override path does not exist: ${sanitizePath(candidatePath)}`);
             }
@@ -14925,7 +14944,7 @@ async function loadPolicy(env, deps) {
     try {
         content = await deps.readFile(resolvedPath, "utf-8");
     } catch (error) {
-        if (isPolicyFileNotFound(error)) {
+        if (isPathNotFoundError(error)) {
             if (isOverride) {
                 throw new Error(`Policy override path does not exist: ${sanitizePath(resolvedPath)}`);
             }
@@ -15091,13 +15110,6 @@ function captureTags(env) {
 
 const SESSION_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
 const DEFAULT_EVENTS_SUBDIR = ".agent-shell/events";
-function isPathNotFoundError(err) {
-    if (typeof err === "object" && err !== null && "code" in err) {
-        const code = err.code;
-        return code === "ENOENT" || code === "ENOTDIR";
-    }
-    return false;
-}
 async function realpathExistingAncestor(targetPath, deps) {
     let current = targetPath;
     while(true){
@@ -16141,7 +16153,7 @@ const DEFAULT_DENY_RULES = [
     "sudo *"
 ];
 const POLICY_SUBPATH = ".github/hooks/agent-shell/policy.json";
-const HOOKS_SUBPATH = ".github/copilot/hooks.json";
+const HOOKS_SUBPATH = ".github/hooks/agent-shell/hooks.json";
 /**
  * Extracts the script or task name from a command string, skipping any
  * flags (tokens starting with `-`) that appear between the prefix and
@@ -16318,7 +16330,7 @@ const HOOKS_SUBPATH = ".github/copilot/hooks.json";
     const policyContent = `${JSON.stringify(policy, null, 2)}\n`;
     const hooksContent = `${JSON.stringify(hooksConfig, null, 2)}\n`;
     await writeFileIfNotExists(policyPath, (0,external_node_path_namespaceObject.join)(repoRoot, ".github", "hooks", "agent-shell"), policyContent, POLICY_SUBPATH, deps.writeStdout);
-    await writeFileIfNotExists(hooksPath, (0,external_node_path_namespaceObject.join)(repoRoot, ".github", "copilot"), hooksContent, HOOKS_SUBPATH, deps.writeStdout);
+    await writeFileIfNotExists(hooksPath, (0,external_node_path_namespaceObject.join)(repoRoot, ".github", "hooks", "agent-shell"), hooksContent, HOOKS_SUBPATH, deps.writeStdout);
     deps.writeStdout("\n--- Proposed Policy ---\n");
     deps.writeStdout(`${sanitizeOutput(JSON.stringify(policy, null, 2))}\n`);
     deps.writeStdout("\n--- Hook Configuration ---\n");