agent-relay-runner 0.123.1 → 0.123.2

package/hooks/rg-r-guard/hooks.json

@@ -0,0 +1,18 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${HOOK_DIR}/rg-r-guard.cjs\"",
+            "timeout": 5,
+            "statusMessage": "Checking ripgrep replace guard",
+            "suppressOutput": true
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/rg-r-guard/rg-r-guard.cjs

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+"use strict";
+
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+});
+process.stdin.on("end", () => {
+  let payload;
+  try {
+    payload = JSON.parse(input || "{}");
+  } catch {
+    return;
+  }
+
+  const toolName = String(payload.tool_name || payload.toolName || "").toLowerCase();
+  const command = String(payload.tool_input?.command || payload.toolInput?.command || "");
+  if (toolName !== "bash" || !command || !containsRipgrepReplaceFootgun(command)) return;
+
+  const reason = "Blocked: `rg -r` is ripgrep replace, not recursive search. Use `rg PATTERN PATH` for search, or `rg --replace REPLACEMENT PATTERN` only when replacement output is intentional.";
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  }));
+  process.stdout.write("\n");
+});
+
+function containsRipgrepReplaceFootgun(command) {
+  for (const segment of splitShellSegments(command)) {
+    const words = shellWords(segment);
+    for (let i = 0; i < words.length; i += 1) {
+      const word = basename(words[i] || "");
+      if (word !== "rg" && word !== "ripgrep") continue;
+      if (ripgrepArgsUseReplace(words.slice(i + 1))) return true;
+    }
+  }
+  return false;
+}
+
+function ripgrepArgsUseReplace(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i] || "";
+    if (arg === "--") return false;
+    if (arg === "--replace" || arg.startsWith("--replace=")) return true;
+    if (arg === "-r") return true;
+    if (/^-([A-Za-z]*r[A-Za-z]*|[A-Za-z]*r=.+)$/.test(arg)) return true;
+  }
+  return false;
+}
+
+function splitShellSegments(text) {
+  const segments = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      current += ch;
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      current += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === "'" || ch === "\"") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    // Command-substitution + grouping boundaries (`$(rg -r …)`, backtick `` `rg -r …` ``,
+    // subshells) split into their own segments so the inner command is scanned on its own
+    // (basename of `$(rg` ≠ rg otherwise) and its args never bleed into the outer command's
+    // scan. Only fires OUTSIDE quotes — a single/double-quoted literal is left intact, matching
+    // the tokenizer's existing quote handling. Known gap: substitution inside double quotes
+    // ("$(rg -r x)") is still treated as an opaque quoted word.
+    if (ch === "(" || ch === ")" || ch === "`") {
+      if (current.trim()) segments.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current);
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current);
+  return segments;
+}
+
+function shellWords(text) {
+  const words = [];
+  let current = "";
+  let quote = "";
+  let escaped = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) quote = "";
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === "\"") {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+function basename(value) {
+  return value.split("/").pop() || value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.123.1",
+  "version": "0.123.2",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -10,7 +10,9 @@
   "files": [
     "src/**/*.ts",
     "plugins/**",
-    "!src/**/*.test.ts"
+    "hooks/**",
+    "!src/**/*.test.ts",
+    "!hooks/**/*.test.ts"
   ],
   "license": "AGPL-3.0-or-later",
   "author": "Edin Mujkanovic <edin@exelerus.com>",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.123.1",
+  "version": "0.123.2",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }