sinapse-ai 7.7.2 → 7.7.3

package/.claude/hooks/enforce-git-push-authority.sh

@@ -4,6 +4,7 @@
 # Only meant to run when agent is NOT @devops
 # Uses node (not jq) for JSON parsing — works on Windows/Git Bash
 # FAIL-CLOSED: if parsing fails, blocks the command (exit 2)
+# Hardened v2: also detects indirect execution via script files and pipes
 
 INPUT=$(cat)
 
@@ -23,10 +24,41 @@ if [ $? -ne 0 ]; then
   exit 0
 fi
 
-# Block git push in all forms (push, push --force, push origin, etc.)
-if echo "$COMMAND" | grep -qiE '\bgit\s+push\b'; then
+# Helper: deny with message
+deny() {
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Git push is EXCLUSIVE to @devops agent. Activate @devops for push operations."}}'
   exit 0
+}
+
+# 1. Direct git push (existing check)
+if echo "$COMMAND" | grep -qiE '\bgit\s+push\b'; then
+  deny
+fi
+
+# 2. Indirect: bash/sh/source executing a script file that contains git push
+SCRIPT_FILE=$(echo "$COMMAND" | grep -oP '(?:bash|sh|source|\.)\s+\K[^\s;|&]+' 2>/dev/null | head -1)
+if [ -n "$SCRIPT_FILE" ] && [ -f "$SCRIPT_FILE" ]; then
+  if grep -qiE '\bgit\s+push\b' "$SCRIPT_FILE" 2>/dev/null; then
+    deny
+  fi
+fi
+
+# 3. Pipe-to-shell patterns (cat file | bash, echo cmd | sh)
+if echo "$COMMAND" | grep -qiE '\|\s*(ba)?sh\b'; then
+  # Only block if push-related content is likely
+  if echo "$COMMAND" | grep -qiE 'push'; then
+    deny
+  fi
+fi
+
+# 4. eval/exec patterns with push
+if echo "$COMMAND" | grep -qiE '\b(eval|exec)\b.*push'; then
+  deny
+fi
+
+# 5. node -e / python -c executing push
+if echo "$COMMAND" | grep -qiE '(node\s+-e|python[3]?\s+-c).*push'; then
+  deny
 fi
 
 # Allow all other commands

package/.claude/rules/safe-collaboration.md

@@ -44,7 +44,18 @@ The agent creates the branch. The user never needs to name it.
 
 Types: `feat`, `fix`, `refactor`, `docs`, `chore`, `test`
 
-**Detection:** Check `git config user.name` or `$USERNAME` or `$USER` to determine who is working.
+**User Detection (priority order):**
+1. `git config user.name` -> lookup in mapping table (case-insensitive)
+2. `$USERNAME` (Windows) or `$USER` (Unix) -> lookup in mapping table
+3. Fallback: `dev/`
+
+**Mapping Table:**
+
+| git config / env var contains | Branch prefix |
+|-------------------------------|---------------|
+| caio (case-insensitive)       | `caio/`       |
+| matheus OR soier              | `soier/`      |
+| (anything else)               | `dev/`        |
 
 ### 3. Before Every Commit — Safety Checks (MANDATORY)