oh-my-customcodex 0.3.4 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli/index.js
CHANGED
package/dist/index.js
CHANGED
package/package.json
CHANGED
|
@@ -82,6 +82,16 @@
|
|
|
82
82
|
],
|
|
83
83
|
"description": "Schema-based tool input validation — Phase 1 advisory only"
|
|
84
84
|
},
|
|
85
|
+
{
|
|
86
|
+
"matcher": "tool == \"Bash\" && tool_input.command matches \"\\\\.claude/\"",
|
|
87
|
+
"hooks": [
|
|
88
|
+
{
|
|
89
|
+
"type": "command",
|
|
90
|
+
"command": "bash .codex/hooks/scripts/claude-sensitive-path-guard.sh"
|
|
91
|
+
}
|
|
92
|
+
],
|
|
93
|
+
"description": "Block Bash writes into .claude/ sensitive paths before Claude Code permission prompts fire"
|
|
94
|
+
},
|
|
85
95
|
{
|
|
86
96
|
"matcher": "tool == \"Bash\"",
|
|
87
97
|
"hooks": [
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
#!/bin/bash
|
|
2
|
+
# Block Bash write operations targeting .claude/ sensitive paths.
|
|
3
|
+
# Claude Code can surface a sensitive-file permission prompt before allow rules
|
|
4
|
+
# or bypassPermissions are evaluated, so fail fast before the command runs.
|
|
5
|
+
|
|
6
|
+
set -euo pipefail
|
|
7
|
+
|
|
8
|
+
command -v jq >/dev/null 2>&1 || exit 0
|
|
9
|
+
|
|
10
|
+
input=$(cat)
|
|
11
|
+
cmd=$(echo "$input" | jq -r '.tool_input.command // ""')
|
|
12
|
+
|
|
13
|
+
if [ -z "$cmd" ]; then
|
|
14
|
+
echo "$input"
|
|
15
|
+
exit 0
|
|
16
|
+
fi
|
|
17
|
+
|
|
18
|
+
targets_claude=0
|
|
19
|
+
if [[ "$cmd" =~ \.claude/ ]]; then
|
|
20
|
+
targets_claude=1
|
|
21
|
+
fi
|
|
22
|
+
|
|
23
|
+
writes_claude=0
|
|
24
|
+
if [[ "$cmd" =~ (^|[[:space:]])(cp|mv|install|rsync|tee|touch|mkdir|ln)[[:space:]] ]]; then
|
|
25
|
+
writes_claude=1
|
|
26
|
+
elif [[ "$cmd" =~ sed[[:space:]]+-i ]] || [[ "$cmd" =~ perl[[:space:]]+-pi ]]; then
|
|
27
|
+
writes_claude=1
|
|
28
|
+
elif [[ "$cmd" =~ [\>]{1,2}[[:space:]]*[^[:space:]]*\.claude/ ]]; then
|
|
29
|
+
writes_claude=1
|
|
30
|
+
fi
|
|
31
|
+
|
|
32
|
+
if [ "$targets_claude" -eq 1 ] && [ "$writes_claude" -eq 1 ]; then
|
|
33
|
+
echo "[Hook] BLOCKED: Bash write targeting .claude/ sensitive path" >&2
|
|
34
|
+
echo "[Hook] Command: $cmd" >&2
|
|
35
|
+
echo "[Hook] Use Write/Edit or the repo's managed sync/update path instead of Bash for .claude/ changes." >&2
|
|
36
|
+
exit 2
|
|
37
|
+
fi
|
|
38
|
+
|
|
39
|
+
echo "$input"
|
package/templates/manifest.json
CHANGED