claude-dev-env 7.0.0 → 7.2.0

package/hooks/blocking/fable_spawn_gate.py

@@ -1,187 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse gate: deny a fable-tier subagent spawn that carries no marker.
-
-One exact token in the spawn prompt authorizes a spawn at the fable tier::
-
-    model: fable,           no FABLE-SPAWN-AUTHORIZED   flag: deny
-    model: claude-fable-5,  no FABLE-SPAWN-AUTHORIZED   flag: deny
-    model: fable,           FABLE-SPAWN-AUTHORIZED      ok:   allow
-    model: claude-sonnet-4, prompt either way           ok:   allow
-    no model field,         prompt either way           ok:   allow
-
-The gate reads an ``Agent`` or ``Task`` call and finds the tier in the model
-field whether that field carries the bare alias or a full model id, in any
-letter case. Its deny reason points at the advisor-protocol document rather
-than quoting the token, so a denial pasted into a retry authorizes nothing.
-A deny also sets ``additionalContext`` so the spawner sees the recovery path
-(re-spawn at opus / an opus-equivalent tier, or authorize a fable bind).
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-from typing import Mapping, TextIO
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.fable_spawn_gate_constants import (  # noqa: E402
-    ALL_SPAWN_TOOL_NAMES,
-    CALLING_HOOK_NAME,
-    DENY_ADDITIONAL_CONTEXT,
-    DENY_PREVIEW_TEMPLATE,
-    DENY_REASON,
-    FABLE_MODEL_ALIAS,
-    FABLE_SPAWN_AUTHORIZATION_MARKER,
-    HOOK_EVENT_NAME,
-    MAXIMUM_PREVIEW_MODEL_LENGTH,
-    MODEL_FIELD_NAME,
-    MODEL_SEGMENT_SPLIT_PATTERN,
-    PROMPT_FIELD_NAME,
-    TOOL_INPUT_FIELD_NAME,
-    TOOL_NAME_FIELD_NAME,
-)
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
-    read_hook_input_dictionary_from_stdin,
-)
-
-
-def _model_names_the_fable_tier(model_identifier: str) -> bool:
-    """Report whether a model string names the fable tier.
-
-    The field carries either the bare alias or a full model id, so the
-    lowercased string is cut on its delimiters and the tier is looked for as
-    a whole segment::
-
-        fable            -> ['fable']                 flag: fable tier
-        claude-fable-5   -> ['claude', 'fable', '5']  flag: fable tier
-        claude-sonnet-4  -> ['claude', 'sonnet', '4'] ok:   another tier
-        affable          -> ['affable']               ok:   another tier
-
-    Args:
-        model_identifier: The spawn's ``model`` string.
-
-    Returns:
-        True when a model segment reads ``fable`` in any letter case; False
-        for another tier.
-    """
-    all_segments = MODEL_SEGMENT_SPLIT_PATTERN.split(model_identifier.strip().lower())
-    return FABLE_MODEL_ALIAS in all_segments
-
-
-def _prompt_carries_authorization_marker(all_tool_input: Mapping[str, object]) -> bool:
-    """Report whether the spawn prompt holds the exact authorization token.
-
-    Args:
-        all_tool_input: The spawn's ``tool_input`` mapping.
-
-    Returns:
-        True when the prompt is a string holding the marker token; False for
-        an unmarked prompt and for an absent or non-string field.
-    """
-    spawn_prompt = all_tool_input.get(PROMPT_FIELD_NAME)
-    if not isinstance(spawn_prompt, str):
-        return False
-    return FABLE_SPAWN_AUTHORIZATION_MARKER in spawn_prompt
-
-
-def _denied_spawn_model(all_payload_by_field: Mapping[str, object]) -> str | None:
-    """Return the model string of an unauthorized fable spawn, or None.
-
-    The model string travels back as the decision, so the deny path holds a
-    proven fable string and never re-derives one.
-
-    Args:
-        all_payload_by_field: The parsed PreToolUse payload, keyed by
-            top-level field name.
-
-    Returns:
-        The ``model`` string for a spawn tool call at the fable tier whose
-        prompt lacks the authorization marker; None for every allowed call.
-    """
-    if all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "") not in ALL_SPAWN_TOOL_NAMES:
-        return None
-    tool_input = all_payload_by_field.get(TOOL_INPUT_FIELD_NAME, {})
-    if not isinstance(tool_input, dict):
-        return None
-    model_identifier = tool_input.get(MODEL_FIELD_NAME)
-    if not isinstance(model_identifier, str):
-        return None
-    if not _model_names_the_fable_tier(model_identifier):
-        return None
-    if _prompt_carries_authorization_marker(tool_input):
-        return None
-    return model_identifier
-
-
-def _build_denial_preview(model_identifier: str) -> str:
-    """Build the bounded preview the hook-blocks log records for a denial.
-
-    The preview names the model field that tripped the gate, so its length
-    holds steady whatever the spawn prompt carries::
-
-        fable           -> model=fable marker_present=False
-        claude-fable-5  -> model=claude-fable-5 marker_present=False
-
-    Args:
-        model_identifier: The fable model string the denial was decided on.
-
-    Returns:
-        One preview line naming the model text and the marker state.
-    """
-    return DENY_PREVIEW_TEMPLATE.format(
-        model_text=model_identifier[:MAXIMUM_PREVIEW_MODEL_LENGTH]
-    )
-
-
-def _emit_denial(
-    decision_stream: TextIO,
-    all_payload_by_field: Mapping[str, object],
-    model_identifier: str,
-) -> None:
-    """Log the denied spawn and write the PreToolUse deny payload.
-
-    Args:
-        decision_stream: Writable text stream — production code passes
-            ``sys.stdout``; tests pass a ``StringIO`` to capture the JSON.
-        all_payload_by_field: The parsed PreToolUse payload, whose tool name
-            names the denied spawn in the hook-blocks log.
-        model_identifier: The fable model string the denial was decided on.
-    """
-    denial = {
-        "hookSpecificOutput": {
-            "hookEventName": HOOK_EVENT_NAME,
-            "permissionDecision": "deny",
-            "permissionDecisionReason": DENY_REASON,
-            "additionalContext": DENY_ADDITIONAL_CONTEXT,
-        }
-    }
-    log_hook_block(
-        calling_hook_name=CALLING_HOOK_NAME,
-        hook_event=HOOK_EVENT_NAME,
-        block_reason=DENY_REASON,
-        tool_name=str(all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "")),
-        offending_input_preview=_build_denial_preview(model_identifier),
-    )
-    decision_stream.write(json.dumps(denial) + "\n")
-    decision_stream.flush()
-
-
-def main() -> None:
-    """Read the PreToolUse payload and deny an unmarked fable spawn."""
-    hook_payload = read_hook_input_dictionary_from_stdin()
-    if hook_payload is None:
-        sys.exit(0)
-    denied_model = _denied_spawn_model(hook_payload)
-    if denied_model is None:
-        sys.exit(0)
-    _emit_denial(sys.stdout, hook_payload, denied_model)
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/luna_fast_mode_gate.py

@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse gate: deny Luna spawns that use an unsupported service tier."""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-from typing import Mapping, TextIO
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.luna_fast_mode_gate_constants import (  # noqa: E402
-    ALL_SPAWN_TOOL_NAMES,
-    CALLING_HOOK_NAME,
-    CODEX_AGENT_TOOL_NAME,
-    DENY_ADDITIONAL_CONTEXT,
-    DENY_PREVIEW_TEMPLATE,
-    DENY_REASON,
-    FAST_SERVICE_TIER,
-    HOOK_EVENT_NAME,
-    LUNA_MODEL_ALIAS,
-    MAXIMUM_PREVIEW_FIELD_LENGTH,
-    MODEL_FIELD_NAME,
-    MODEL_SEGMENT_SPLIT_PATTERN,
-    PRIORITY_SERVICE_TIER,
-    SERVICE_TIER_FIELD_NAME,
-    TOOL_INPUT_FIELD_NAME,
-    TOOL_NAME_FIELD_NAME,
-)
-from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
-    read_hook_input_dictionary_from_stdin,
-)
-
-
-def _model_names_the_luna_tier(model_identifier: str) -> bool:
-    """Report whether a model string names the Luna tier.
-
-    Args:
-        model_identifier: The spawn's ``model`` string.
-
-    Returns:
-        True when a model segment reads ``luna`` in any letter case; False
-        for another tier.
-    """
-    all_segments = MODEL_SEGMENT_SPLIT_PATTERN.split(model_identifier.strip().lower())
-    return LUNA_MODEL_ALIAS in all_segments
-
-
-def _is_service_tier_allowed(tool_name: object, service_tier: object) -> bool:
-    if service_tier == FAST_SERVICE_TIER:
-        return True
-    return (
-        tool_name == CODEX_AGENT_TOOL_NAME
-        and service_tier == PRIORITY_SERVICE_TIER
-    )
-
-
-def _denied_spawn_details(
-    all_payload_by_field: Mapping[str, object],
-) -> tuple[str, object] | None:
-    """Return model and service tier for a Luna spawn that must be denied.
-
-    Args:
-        all_payload_by_field: The parsed PreToolUse payload.
-
-    Returns:
-        The model and service tier for an invalid Luna spawn; None otherwise.
-    """
-    tool_name = all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "")
-    if tool_name not in ALL_SPAWN_TOOL_NAMES:
-        return None
-    tool_input = all_payload_by_field.get(TOOL_INPUT_FIELD_NAME, {})
-    if not isinstance(tool_input, dict):
-        return None
-    model_identifier = tool_input.get(MODEL_FIELD_NAME)
-    if not isinstance(model_identifier, str):
-        return None
-    if not _model_names_the_luna_tier(model_identifier):
-        return None
-    service_tier = tool_input.get(SERVICE_TIER_FIELD_NAME)
-    if _is_service_tier_allowed(tool_name, service_tier):
-        return None
-    return model_identifier, service_tier
-
-
-def _build_denial_preview(model_identifier: str, service_tier: object) -> str:
-    """Build a bounded preview for the block log without recording the prompt.
-
-    Args:
-        model_identifier: The Luna model string.
-        service_tier: The supplied service tier value.
-
-    Returns:
-        A bounded preview naming only the model and service tier fields.
-    """
-    model_text = model_identifier[:MAXIMUM_PREVIEW_FIELD_LENGTH]
-    service_tier_text = str(service_tier)[:MAXIMUM_PREVIEW_FIELD_LENGTH]
-    return DENY_PREVIEW_TEMPLATE.format(
-        model_text=model_text,
-        service_tier_text=service_tier_text,
-    )
-
-
-def _emit_denial(
-    decision_stream: TextIO,
-    all_payload_by_field: Mapping[str, object],
-    model_identifier: str,
-    service_tier: object,
-) -> None:
-    """Log the denied spawn and write the PreToolUse deny payload.
-
-    Args:
-        decision_stream: Writable stream for the JSON decision.
-        all_payload_by_field: The parsed PreToolUse payload.
-        model_identifier: The denied Luna model string.
-        service_tier: The invalid service tier value.
-    """
-    denial = {
-        "hookSpecificOutput": {
-            "hookEventName": HOOK_EVENT_NAME,
-            "permissionDecision": "deny",
-            "permissionDecisionReason": DENY_REASON,
-            "additionalContext": DENY_ADDITIONAL_CONTEXT,
-        }
-    }
-    log_hook_block(
-        calling_hook_name=CALLING_HOOK_NAME,
-        hook_event=HOOK_EVENT_NAME,
-        block_reason=DENY_REASON,
-        tool_name=str(all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "")),
-        offending_input_preview=_build_denial_preview(model_identifier, service_tier),
-    )
-    decision_stream.write(json.dumps(denial) + "\n")
-    decision_stream.flush()
-
-
-def main() -> None:
-    """Read the PreToolUse payload and deny an invalid Luna spawn."""
-    hook_payload = read_hook_input_dictionary_from_stdin()
-    if hook_payload is None:
-        sys.exit(0)
-    denied_details = _denied_spawn_details(hook_payload)
-    if denied_details is None:
-        sys.exit(0)
-    denied_model, denied_service_tier = denied_details
-    _emit_denial(
-        sys.stdout,
-        hook_payload,
-        denied_model,
-        denied_service_tier,
-    )
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/nas_ssh_binary_enforcer.py

@@ -1,163 +0,0 @@
-#!/usr/bin/env python3
-"""PreToolUse hook: force the Windows OpenSSH binary for NAS ssh/scp/sftp commands.
-
-Root cause: Git Bash's MSYS ssh reads ``~/.ssh/id_ed25519`` as world-readable
-through its ACL mapping, rejects the key as "bad permissions", offers no key, and
-falls back to an interactive password prompt that hangs unattended agent sessions.
-The Windows OpenSSH binary under ``System32/OpenSSH`` authenticates the same key
-without prompting.
-
-Detection strategy: this hook fires only on the Bash tool. The command is
-shlex-tokenized (quotes removed), glued shell control operators are exploded off
-the tokens, and the tokens are split into simple-command segments on ``&&`` /
-``||`` / ``;`` / ``|&`` / ``|`` / ``&``. For each segment the effective leading program is
-found by skipping ``VAR=value`` assignments and launcher wrappers (``timeout``,
-``nohup``, ``nice``, ``stdbuf``, ``setsid``, ``env``) with their flags and duration
-arguments. A segment is evaluated only when its leading program's basename is
-``ssh``/``scp``/``sftp`` (with or without a ``.exe`` suffix) AND a token in that same
-segment holds the NAS host (resolved from the ``CLAUDE_NAS_*`` environment variables or ``~/.claude/local-identity.json``) as a connection host — bare,
-``user@host``, or a ``host:path`` target. The address inside a remote-command
-argument or a remote path component on another host does not count.
-
-An evaluated segment is DENIED with the binary-swap message when its leading program
-is a bare ssh-family word rather than a path ending in ``OpenSSH/ssh.exe`` (or
-``scp.exe`` / ``sftp.exe``). An evaluated segment whose leading program is that full
-OpenSSH path is DENIED with the batch-mode message when no token in the segment
-carries ``BatchMode=yes``, so an authentication regression fails loudly rather than
-prompting. Everything else is allowed: ssh to any other host, the full OpenSSH path
-with ``BatchMode=yes``, non-Bash tools, a command that only mentions the address
-without an ssh-family leading program, and a command shlex cannot tokenize.
-"""
-
-import json
-import re
-import shlex
-import sys
-from pathlib import Path
-
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.local_identity import (  # noqa: E402
-    bare_ssh_binary_deny_message,
-    missing_batch_mode_deny_message,
-    nas_host,
-)
-from hooks_constants.nas_ssh_binary_enforcer_constants import (  # noqa: E402
-    ALL_OPENSSH_BINARY_PATH_SUFFIXES,
-    ALL_SSH_FAMILY_COMMAND_BASENAMES,
-    BASH_TOOL_NAME,
-    BATCH_MODE_PATTERN,
-)
-from hooks_constants.shell_command_segments import (  # noqa: E402
-    effective_leading_program,
-    split_into_segments,
-    token_basename,
-)
-
-
-def _is_openssh_binary_path(token: str) -> bool:
-    normalized_token = token.replace("\\", "/").lower()
-    return any(
-        normalized_token.endswith(each_suffix)
-        for each_suffix in ALL_OPENSSH_BINARY_PATH_SUFFIXES
-    )
-
-
-def _nas_host_token_pattern() -> re.Pattern[str]:
-    return re.compile(rf"(?:^|@){re.escape(nas_host())}(?::|$)")
-
-
-def _segment_references_nas(
-    all_segment_tokens: list[str], nas_host_pattern: re.Pattern[str]
-) -> bool:
-    return any(nas_host_pattern.search(each_token) for each_token in all_segment_tokens)
-
-
-def _segment_carries_batch_mode(all_segment_tokens: list[str]) -> bool:
-    return any(BATCH_MODE_PATTERN.search(each_token) for each_token in all_segment_tokens)
-
-
-def _find_nas_ssh_violation(command: str) -> str | None:
-    """Return the deny message for a NAS ssh-family command, or None to allow.
-
-    ::
-
-        ssh -p 22 operator@nas.example.local "ls"          flag: bare-binary message
-        "…/OpenSSH/ssh.exe" -p 22 operator@nas…    flag: missing-batch-mode message
-        "…/OpenSSH/ssh.exe" -o BatchMode=yes …NAS   ok:   None
-        ssh operator@example.com "ls"                     ok:   None
-
-    Tokenizes the command, splits it into simple-command segments, and evaluates
-    each segment whose leading program is an ssh-family word AND whose tokens carry
-    the NAS address. A bare ssh-family leader returns the binary-swap message; the
-    full OpenSSH path leader without a ``BatchMode=yes`` token returns the batch-mode
-    message. Returns None when shlex cannot tokenize the command.
-
-    Args:
-        command: The raw Bash command string from the tool input.
-
-    Returns:
-        The deny message string when a segment violates the NAS ssh policy, else None.
-    """
-    try:
-        all_command_tokens = shlex.split(command)
-    except ValueError:
-        return None
-    nas_host_pattern = _nas_host_token_pattern()
-    for each_segment in split_into_segments(all_command_tokens):
-        leading_program = effective_leading_program(each_segment)
-        if leading_program is None:
-            continue
-        if token_basename(leading_program) not in ALL_SSH_FAMILY_COMMAND_BASENAMES:
-            continue
-        if not _segment_references_nas(each_segment, nas_host_pattern):
-            continue
-        if not _is_openssh_binary_path(leading_program):
-            return bare_ssh_binary_deny_message()
-        if not _segment_carries_batch_mode(each_segment):
-            return missing_batch_mode_deny_message()
-    return None
-
-
-def main() -> None:
-    try:
-        hook_input = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
-
-    tool_name = hook_input.get("tool_name", "")
-    if tool_name != BASH_TOOL_NAME:
-        sys.exit(0)
-
-    command = hook_input.get("tool_input", {}).get("command", "")
-    if not command:
-        sys.exit(0)
-
-    deny_reason = _find_nas_ssh_violation(command)
-    if deny_reason is None:
-        sys.exit(0)
-
-    deny_payload = {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": deny_reason,
-        }
-    }
-    log_hook_block(
-        calling_hook_name="nas_ssh_binary_enforcer.py",
-        hook_event="PreToolUse",
-        block_reason=deny_reason,
-        tool_name=tool_name,
-        offending_input_preview=command,
-    )
-    print(json.dumps(deny_payload))
-    sys.stdout.flush()
-    sys.exit(0)
-
-
-if __name__ == "__main__":
-    main()