agentic-loop 1.0.0

package/ralph/hooks/warn-empty-catch.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# warn-empty-catch.sh - Warn about empty catch blocks that silently swallow errors
+# Hook: PostToolUse matcher: "Edit|Write"
+
+set -euo pipefail
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // ""')
+
+# Only check code files
+case "$FILE_PATH" in
+  *.ts|*.tsx|*.js|*.jsx|*.py)
+    ;;
+  *)
+    echo '{"continue": true}'
+    exit 0
+    ;;
+esac
+
+# Get the content that was written
+NEW_CONTENT=""
+if [[ "$TOOL_NAME" == "Write" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // ""')
+elif [[ "$TOOL_NAME" == "Edit" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // ""')
+fi
+
+WARNINGS=""
+
+# JavaScript/TypeScript: catch (e) { } or catch { }
+if echo "$NEW_CONTENT" | grep -qE 'catch\s*\([^)]*\)\s*\{\s*\}'; then
+  WARNINGS="⚠️  Empty catch block detected. Handle the error or add a comment explaining why it's ignored."
+fi
+
+# Also check for catch with only a comment (no actual handling)
+if echo "$NEW_CONTENT" | grep -qE 'catch\s*\([^)]*\)\s*\{\s*(//[^\n]*)?\s*\}'; then
+  if [[ -z "$WARNINGS" ]]; then
+    WARNINGS="⚠️  Catch block with no error handling. Consider logging or rethrowing the error."
+  fi
+fi
+
+# Python: except: pass or except Exception: pass
+if echo "$NEW_CONTENT" | grep -qE 'except.*:\s*pass\s*$'; then
+  WARNINGS="⚠️  Empty except block (pass). Handle the exception or add logging."
+fi
+
+# Python: bare except with just pass on next line
+if echo "$NEW_CONTENT" | grep -qE 'except.*:\s*$' && echo "$NEW_CONTENT" | grep -qE '^\s*pass\s*$'; then
+  if [[ -z "$WARNINGS" ]]; then
+    WARNINGS="⚠️  Except block with only 'pass'. Consider logging or reraising the exception."
+  fi
+fi
+
+# Block if empty catch detected
+if [[ -n "$WARNINGS" ]]; then
+  jq -n --arg warn "$WARNINGS" '{
+    "continue": false,
+    "message": $warn
+  }'
+else
+  echo '{"continue": true}'
+fi

package/ralph/hooks/warn-secrets.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# warn-secrets.sh - Warn about potential secrets in written code
+# Hook: PostToolUse matcher: "Edit|Write"
+#
+# Mirrors the pre-commit check-secrets patterns for consistency
+
+set -euo pipefail
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // ""')
+
+# Only check code files
+case "$FILE_PATH" in
+  *.ts|*.tsx|*.js|*.jsx|*.py|*.json|*.yaml|*.yml|*.env*)
+    ;;
+  *)
+    echo '{"continue": true}'
+    exit 0
+    ;;
+esac
+
+# Get the content that was written
+NEW_CONTENT=""
+if [[ "$TOOL_NAME" == "Write" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // ""')
+elif [[ "$TOOL_NAME" == "Edit" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // ""')
+fi
+
+WARNINGS=""
+
+# AWS Access Key (AKIA followed by 16 alphanumeric chars)
+if echo "$NEW_CONTENT" | grep -qE 'AKIA[0-9A-Z]{16}'; then
+  WARNINGS="🚨 SECURITY: Possible AWS Access Key detected! Use environment variables."
+fi
+
+# Stripe keys (sk_live_* or sk_test_*)
+if echo "$NEW_CONTENT" | grep -qE 'sk_(live|test)_[0-9a-zA-Z]{24,}'; then
+  WARNINGS="${WARNINGS}\n🚨 SECURITY: Stripe API key detected! Use environment variables."
+fi
+
+# GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
+if echo "$NEW_CONTENT" | grep -qE 'gh[pousr]_[A-Za-z0-9_]{36,}'; then
+  WARNINGS="${WARNINGS}\n🚨 SECURITY: GitHub token detected! Use environment variables."
+fi
+
+# Slack tokens (xoxb-, xoxp-, xoxa-, xoxr-, xoxs-)
+if echo "$NEW_CONTENT" | grep -qE 'xox[baprs]-[0-9]{10,}-[0-9a-zA-Z]{24,}'; then
+  WARNINGS="${WARNINGS}\n🚨 SECURITY: Slack token detected! Use environment variables."
+fi
+
+# SendGrid keys (SG.*)
+if echo "$NEW_CONTENT" | grep -qE 'SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}'; then
+  WARNINGS="${WARNINGS}\n🚨 SECURITY: SendGrid API key detected! Use environment variables."
+fi
+
+# Private keys
+if echo "$NEW_CONTENT" | grep -qE '-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'; then
+  WARNINGS="${WARNINGS}\n🚨 SECURITY: Private key detected! Never commit private keys."
+fi
+
+# Generic API key patterns (api_key = "...", apikey: "...", etc.)
+if echo "$NEW_CONTENT" | grep -qiE '(api[_-]?key|api[_-]?secret)\s*[:=]\s*['"'"'"][a-zA-Z0-9_\-]{20,}['"'"'"]'; then
+  # Check it's not a placeholder
+  if ! echo "$NEW_CONTENT" | grep -qiE '(example|placeholder|your[_-]?key|xxx|test|dummy|fake|sample|demo)'; then
+    WARNINGS="${WARNINGS}\n⚠️  Possible hardcoded API key - use environment variables."
+  fi
+fi
+
+# Generic secrets (password = "...", token = "...", etc.)
+if echo "$NEW_CONTENT" | grep -qiE '(password|passwd|pwd|secret|token)\s*[:=]\s*['"'"'"][^'"'"'"]{8,}['"'"'"]'; then
+  # Check it's not a placeholder or type annotation
+  if ! echo "$NEW_CONTENT" | grep -qiE '(example|placeholder|xxx|test|dummy|type|interface|password:)'; then
+    WARNINGS="${WARNINGS}\n⚠️  Possible hardcoded secret - use environment variables."
+  fi
+fi
+
+# Output warning as additional context (non-blocking)
+if [[ -n "$WARNINGS" ]]; then
+  jq -n --arg warn "$WARNINGS" '{
+    "continue": true,
+    "hookSpecificOutput": {
+      "additionalContext": $warn
+    }
+  }'
+else
+  echo '{"continue": true}'
+fi

package/ralph/hooks/warn-urls.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# warn-urls.sh - Warn about hardcoded URLs in written code
+# Hook: PostToolUse matcher: "Edit|Write"
+#
+# Mirrors the pre-commit check-hardcoded-urls patterns for consistency
+
+set -euo pipefail
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // ""')
+
+# Only check code files (skip test files)
+case "$FILE_PATH" in
+  *.test.*|*.spec.*|*/__tests__/*|*/test/*|*/fixtures/*)
+    echo '{"continue": true}'
+    exit 0
+    ;;
+  *.ts|*.tsx|*.js|*.jsx|*.py)
+    ;;
+  *)
+    echo '{"continue": true}'
+    exit 0
+    ;;
+esac
+
+# Get the content that was written
+NEW_CONTENT=""
+if [[ "$TOOL_NAME" == "Write" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // ""')
+elif [[ "$TOOL_NAME" == "Edit" ]]; then
+  NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // ""')
+fi
+
+WARNINGS=""
+
+# Check for localhost URLs
+if echo "$NEW_CONTENT" | grep -qE 'https?://localhost(:[0-9]+)?'; then
+  # Skip if it's in a fallback pattern (|| or ?? or default)
+  if ! echo "$NEW_CONTENT" | grep -qE '(\|\||\?\?|default|fallback).*localhost'; then
+    WARNINGS="⚠️  Hardcoded localhost URL detected - use environment variable (e.g., process.env.API_URL)"
+  fi
+fi
+
+# Check for 127.0.0.1 URLs
+if echo "$NEW_CONTENT" | grep -qE 'https?://127\.0\.0\.1(:[0-9]+)?'; then
+  if ! echo "$NEW_CONTENT" | grep -qE '(\|\||\?\?|default|fallback).*127\.0\.0\.1'; then
+    WARNINGS="${WARNINGS}\n⚠️  Hardcoded 127.0.0.1 URL detected - use environment variable"
+  fi
+fi
+
+# Check for hardcoded production-looking URLs (skip CDNs and common safe domains)
+SAFE_DOMAINS="cdn.jsdelivr.net|cdnjs.cloudflare.com|unpkg.com|fonts.googleapis.com|fonts.gstatic.com|api.github.com|raw.githubusercontent.com|registry.npmjs.org|schema.org|www.w3.org|example.com|example.org"
+
+# Look for https:// URLs that aren't safe domains
+PROD_URLS=$(echo "$NEW_CONTENT" | grep -oE 'https://[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | grep -vE "$SAFE_DOMAINS" || true)
+
+if [[ -n "$PROD_URLS" ]]; then
+  # Skip if they look like example/placeholder URLs
+  PROD_URLS=$(echo "$PROD_URLS" | grep -v -E '(example|placeholder|test|mock)' || true)
+  if [[ -n "$PROD_URLS" ]]; then
+    FIRST_URL=$(echo "$PROD_URLS" | head -1)
+    WARNINGS="${WARNINGS}\n⚠️  Hardcoded URL ($FIRST_URL) - consider using environment variable"
+  fi
+fi
+
+# Output warning as additional context (non-blocking)
+if [[ -n "$WARNINGS" ]]; then
+  jq -n --arg warn "$WARNINGS" '{
+    "continue": true,
+    "hookSpecificOutput": {
+      "additionalContext": $warn
+    }
+  }'
+else
+  echo '{"continue": true}'
+fi