code-puppy-core-plugins 0.0.16__tar.gz → 0.0.18__tar.gz

{code_puppy_core_plugins-0.0.16 → code_puppy_core_plugins-0.0.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-puppy-core-plugins
-Version: 0.0.16
+Version: 0.0.18
 Summary: Official plugin bundle for Code Puppy
 Project-URL: Repository, https://github.com/mpfaffenberger/code_puppy_core_plugins
 Project-URL: Homepage, https://github.com/mpfaffenberger/code_puppy_core_plugins

{code_puppy_core_plugins-0.0.16 → code_puppy_core_plugins-0.0.18}/code_puppy_core_plugins/claude_code_hooks/config.py

@@ -15,6 +15,8 @@ import os
 from pathlib import Path
 from typing import Any, Dict, Optional
 
+from . import trust as _trust
+
 logger = logging.getLogger(__name__)
 
 PROJECT_HOOKS_FILE = ".claude/settings.json"
@@ -94,23 +96,24 @@ def load_hooks_config() -> Optional[Dict[str, Any]]:
         except Exception as e:
             logger.error(f"Failed to load {GLOBAL_HOOKS_FILE}: {e}", exc_info=True)
 
-    # Load and merge project-level hooks
-    project_config_path = Path(os.getcwd()) / PROJECT_HOOKS_FILE
-
-    if project_config_path.exists():
-        try:
-            with open(project_config_path, "r", encoding="utf-8") as f:
-                config = json.load(f)
-            hooks_config = config.get("hooks")
-            if hooks_config:
-                logger.info(f"Merging hooks configuration from {project_config_path}")
-                merged_config = _deep_merge_hooks(merged_config, hooks_config)
-            else:
-                logger.debug(f"No 'hooks' section found in {project_config_path}")
-        except json.JSONDecodeError as e:
-            logger.error(f"Invalid JSON in {project_config_path}: {e}")
-        except Exception as e:
-            logger.error(f"Failed to load {project_config_path}: {e}", exc_info=True)
+    # Hash the already-parsed subtree rather than re-reading the file — a
+    # second read is a TOCTOU foothold where an attacker could swap benign
+    # bytes for malicious ones between check and merge.
+    project_root = Path(os.getcwd())
+    project_settings_path = _trust.get_project_hooks_settings_file(project_root)
+
+    if project_settings_path is not None:
+        project_subtree = _trust._extract_hooks_subtree(project_settings_path)
+        if project_subtree is not None and _trust._has_effective_hooks(project_subtree):
+            current_hash = _trust.hash_subtree(project_subtree)
+            status = _trust.get_trust_status_for_hash(project_root, current_hash)
+            if status == _trust.TRUSTED:
+                logger.info(
+                    f"Merging trusted hooks configuration from {project_settings_path}"
+                )
+                merged_config = _deep_merge_hooks(merged_config, project_subtree)
+            # The untrusted warning fires from the `startup` callback so it
+            # renders after boot rather than scrolling past above the banner.
 
     if not merged_config:
         logger.debug("No hooks configuration found")

{code_puppy_core_plugins-0.0.16 → code_puppy_core_plugins-0.0.18}/code_puppy_core_plugins/claude_code_hooks/register_callbacks.py

@@ -27,6 +27,7 @@ from typing import Any, Dict, List, Optional
 from code_puppy.callbacks import register_callback
 from code_puppy.hook_engine import EventData, HookEngine
 
+from . import trust as _trust
 from .config import load_hooks_config
 
 _SUBAGENT_NAMES = frozenset(
@@ -76,6 +77,28 @@ def _initialize_engine() -> Optional[HookEngine]:
 _hook_engine = _initialize_engine()
 
 
+def reload_hook_engine() -> None:
+    """Rebuild ``_hook_engine`` from the current on-disk hooks config.
+
+    Called by the ``/hooks trust`` ceremony after accept/revoke so future
+    lifecycle events reflect the fresh trust state without a process
+    restart.
+
+    Intentionally does NOT re-fire ``SessionStart`` — that event's
+    semantics are "agent boot", and auto-firing mid-session would be a
+    surprise side-effect.
+
+    Also intentionally does NOT clear ``_pending_session_context`` on
+    revoke. The buffer only holds stdout produced by hooks that were
+    trusted at the moment they fired; honoring that stdout on the next
+    user prompt reflects the state that existed when the side-effect
+    already happened. The buffer is one-shot per session by design and
+    will drain on the next ``UserPromptSubmit`` regardless.
+    """
+    global _hook_engine
+    _hook_engine = _initialize_engine()
+
+
 def _collect_context_stdout(result: Any) -> List[str]:
     """Pull stdout from non-blocking, exit-0 hook results.
 
@@ -223,6 +246,17 @@ register_callback("startup", on_startup_hook)
 register_callback("session_end", on_session_end_hook)
 
 
+async def on_startup_emit_untrusted_warning() -> None:
+    """Startup callback: emit the untrusted-hooks warning after boot."""
+    try:
+        _trust.emit_untrusted_project_hooks_warning_if_any()
+    except Exception as e:  # pragma: no cover - defensive
+        logger.debug("emit_untrusted_project_hooks_warning_if_any failed: %s", e)
+
+
+register_callback("startup", on_startup_emit_untrusted_warning)
+
+
 # ---------------------------------------------------------------------------
 # UserPromptSubmit
 # ---------------------------------------------------------------------------

code_puppy_core_plugins-0.0.18/code_puppy_core_plugins/claude_code_hooks/trust.py

@@ -0,0 +1,339 @@
+"""Content-hash trust store for project-level Claude Code hook configs.
+
+Project ``.claude/settings.json`` files can declare hooks that run arbitrary
+shell commands at lifecycle events. ``SessionStart`` fires during boot, so a
+hostile repo is a workstation-compromise vector the moment the user runs
+``cd <repo> && code-puppy``. The project ``hooks`` subtree is therefore
+disabled until explicitly accepted via ``/hooks trust``.
+
+The store lives user-side so a repo can never self-trust. Array order
+survives canonicalization because hook execution order is semantic.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+logger = logging.getLogger(__name__)
+
+TRUST_STORE_FILE = Path.home() / ".code_puppy" / "trusted_hooks.json"
+PROJECT_SETTINGS_RELPATH = Path(".claude") / "settings.json"
+
+_STORE_VERSION = 1
+
+TRUSTED = "trusted"
+CHANGED = "changed"
+UNTRUSTED = "untrusted"
+
+REVOKED = "revoked"
+NOT_TRUSTED = "not_trusted"
+REVOKE_FAILED = "revoke_failed"
+
+_WARNED: set[tuple[str, str]] = set()
+
+
+# ---------- discovery --------------------------------------------------------
+
+
+def get_project_hooks_settings_file(
+    project_root: Optional[Path] = None,
+) -> Optional[Path]:
+    """Return ``<root>/.claude/settings.json`` if it exists, else ``None``.
+
+    Discovery is CWD-only — no ancestor walk — so the ceremony can't be
+    silently widened by a settings file in some parent directory.
+    """
+    root = _resolved_root(project_root)
+    candidate = root / PROJECT_SETTINGS_RELPATH
+    try:
+        if not candidate.is_file():
+            return None
+        if candidate.is_symlink():
+            logger.warning(
+                "Refusing symlinked project hooks file %s — replace with a "
+                "real file to enable the trust ceremony.",
+                candidate,
+            )
+            return None
+        resolved = candidate.resolve()
+        if not _is_within(resolved, root):
+            logger.warning(
+                "Refusing project hooks file %s: resolves to %s, which is "
+                "outside the project root. A parent directory (typically "
+                "'.claude/') is likely a symlink. Replace with a real "
+                "in-project directory to enable the trust ceremony.",
+                candidate,
+                resolved,
+            )
+            return None
+        return candidate
+    except OSError:  # pragma: no cover - exotic filesystem errors
+        return None
+
+
+def _is_within(path: Path, root: Path) -> bool:
+    """True if *path* is *root* or lives beneath it. Both must be resolved."""
+    try:
+        return path.is_relative_to(root)
+    except AttributeError:  # pragma: no cover - Python < 3.9
+        try:
+            path.relative_to(root)
+            return True
+        except ValueError:
+            return False
+
+
+def _resolved_root(project_root: Optional[Path]) -> Path:
+    """Canonicalize the project root so a symlinked CWD and its real path
+    produce the same trust key."""
+    root = Path(project_root) if project_root is not None else Path.cwd()
+    try:
+        return root.resolve()
+    except OSError:  # pragma: no cover - defensive
+        return root
+
+
+# ---------- content hashing --------------------------------------------------
+
+
+def _extract_hooks_subtree(settings_file: Path) -> Optional[Dict[str, Any]]:
+    """Return the ``hooks`` subtree of *settings_file*, or ``None``. Never raises."""
+    try:
+        raw_bytes = Path(settings_file).read_bytes()
+    except OSError as exc:
+        logger.warning("Could not read project hooks file %s: %s", settings_file, exc)
+        return None
+    try:
+        raw = raw_bytes.decode("utf-8")
+    except UnicodeDecodeError as exc:
+        logger.warning("Non-UTF-8 project hooks file %s: %s", settings_file, exc)
+        return None
+    try:
+        data = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        logger.warning("Invalid JSON in project hooks file %s: %s", settings_file, exc)
+        return None
+    if not isinstance(data, dict):
+        return None
+    subtree = data.get("hooks")
+    if not isinstance(subtree, dict):
+        return None
+    return subtree
+
+
+def _has_effective_hooks(subtree: Dict[str, Any]) -> bool:
+    """True iff *subtree* has a non-comment event entry.
+
+    ``_``-prefixed keys are comments, matching the loader convention in
+    :mod:`.config`.
+    """
+    return any(not key.startswith("_") for key in subtree)
+
+
+def hash_subtree(subtree: Optional[Dict[str, Any]]) -> Optional[str]:
+    """SHA-256 of the canonicalized subtree, or ``None`` if not effective.
+
+    Takes a pre-parsed subtree so the loader can hash the exact bytes it is
+    about to merge — re-reading the file would open a TOCTOU gap.
+    """
+    if subtree is None or not _has_effective_hooks(subtree):
+        return None
+    canonical = json.dumps(subtree, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def compute_hooks_config_hash(settings_file: Path) -> Optional[str]:
+    """Hash the hooks subtree as it exists on disk right now.
+
+    Ceremony paths only. The loader must call :func:`hash_subtree` on an
+    already-parsed subtree to stay TOCTOU-safe.
+    """
+    return hash_subtree(_extract_hooks_subtree(settings_file))
+
+
+# ---------- trust store I/O --------------------------------------------------
+
+
+def _project_key(project_root: Path) -> str:
+    return str(_resolved_root(project_root))
+
+
+def _load_store() -> dict:
+    """Read the trust store, returning an empty store on any problem."""
+    try:
+        if TRUST_STORE_FILE.is_file():
+            data = json.loads(TRUST_STORE_FILE.read_text(encoding="utf-8"))
+            if isinstance(data, dict) and isinstance(data.get("projects"), dict):
+                return data
+            logger.warning(
+                "Malformed hooks trust store at %s — treating as empty",
+                TRUST_STORE_FILE,
+            )
+    except (OSError, json.JSONDecodeError, UnicodeDecodeError) as exc:
+        logger.warning("Could not read hooks trust store %s: %s", TRUST_STORE_FILE, exc)
+    return {"version": _STORE_VERSION, "projects": {}}
+
+
+def _save_store(store: dict) -> bool:
+    """Persist the trust store atomically. Returns ``False`` on failure.
+
+    Written via tempfile + ``os.replace`` so a crash mid-write can't wipe
+    every project's trust.
+    """
+    payload = json.dumps(store, indent=2, sort_keys=True)
+    tmp_path: Optional[str] = None
+    try:
+        TRUST_STORE_FILE.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=str(TRUST_STORE_FILE.parent),
+            prefix=TRUST_STORE_FILE.name + ".",
+            suffix=".tmp",
+            delete=False,
+        ) as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+            tmp_path = handle.name
+        # This file decides whether shell commands run at boot, so keep it
+        # owner-only rather than whatever the umask allows.
+        os.chmod(tmp_path, 0o600)
+        os.replace(tmp_path, TRUST_STORE_FILE)
+        return True
+    except OSError as exc:
+        logger.error("Could not write hooks trust store %s: %s", TRUST_STORE_FILE, exc)
+        if tmp_path is not None:
+            try:
+                Path(tmp_path).unlink(missing_ok=True)
+            except OSError:  # pragma: no cover - defensive
+                pass
+        return False
+
+
+# ---------- trust queries / mutations ----------------------------------------
+
+
+def get_trust_status_for_hash(project_root: Path, current_hash: Optional[str]) -> str:
+    """Compare a caller-provided hash to the store. TOCTOU-safe."""
+    store = _load_store()
+    entry = store["projects"].get(_project_key(project_root))
+    if not isinstance(entry, dict) or not entry.get("hash"):
+        return UNTRUSTED
+    if current_hash is not None and current_hash == entry["hash"]:
+        return TRUSTED
+    return CHANGED
+
+
+def get_trust_status(project_root: Path, settings_file: Path) -> str:
+    """Trust status of *settings_file*, read from disk.
+
+    Ceremony paths only — the loader uses :func:`get_trust_status_for_hash`.
+    """
+    return get_trust_status_for_hash(
+        project_root, compute_hooks_config_hash(settings_file)
+    )
+
+
+def trust_project_hooks(project_root: Optional[Path] = None) -> bool:
+    """Record acceptance of the current project's ``hooks`` subtree."""
+    root = _resolved_root(project_root)
+    settings_file = get_project_hooks_settings_file(root)
+    if settings_file is None:
+        return False
+    hooks_hash = compute_hooks_config_hash(settings_file)
+    if hooks_hash is None:
+        return False
+    store = _load_store()
+    store["projects"][_project_key(root)] = {
+        "hash": hooks_hash,
+        "accepted_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+    }
+    return _save_store(store)
+
+
+def revoke_project_hooks(project_root: Optional[Path] = None) -> str:
+    """Remove trust for the current project.
+
+    Returns :data:`REVOKED`, :data:`NOT_TRUSTED` (no entry to remove), or
+    :data:`REVOKE_FAILED` (entry exists but the store could not be written,
+    so the project is still trusted).
+    """
+    root = _resolved_root(project_root)
+    store = _load_store()
+    key = _project_key(root)
+    if key not in store["projects"]:
+        return NOT_TRUSTED
+    del store["projects"][key]
+    return REVOKED if _save_store(store) else REVOKE_FAILED
+
+
+# ---------- boot / loader warning surface ------------------------------------
+
+
+def warn_untrusted_project_hooks(
+    project_root: Path, settings_file: Path, status: str
+) -> None:
+    """Emit a one-time warning about an unloaded project hooks file."""
+    key = (_project_key(project_root), status)
+    if key in _WARNED:
+        return
+    _WARNED.add(key)
+
+    # The legacy message_queue's startup buffer is never drained, so
+    # pre-renderer warnings emitted through it vanish silently.
+    try:
+        from code_puppy.messaging.bus import emit_warning
+    except Exception:  # pragma: no cover - defensive during early boot
+        return
+
+    if status == CHANGED:
+        emit_warning(
+            f"Project hooks in '{settings_file}' have CHANGED since you "
+            "trusted them — they will NOT run. Review the changes and run "
+            "'/hooks trust accept' to re-enable."
+        )
+    else:
+        emit_warning(
+            f"Project hooks in '{settings_file}' are NOT trusted — they will "
+            "NOT run. Review them and run '/hooks trust accept' to enable "
+            "(project hooks can run arbitrary shell commands)."
+        )
+
+
+def _reset_warning_cache() -> None:
+    """Test hook."""
+    _WARNED.clear()
+
+
+def emit_untrusted_project_hooks_warning_if_any(
+    project_root: Optional[Path] = None,
+) -> None:
+    """Emit the untrusted-hooks warning, if any, for ``project_root``.
+
+    Called from the ``startup`` plugin callback rather than from
+    ``load_hooks_config`` so the warning renders after boot output instead
+    of scrolling past above the banner.
+    """
+    root = _resolved_root(project_root)
+    settings_file = get_project_hooks_settings_file(root)
+    if settings_file is None:
+        return
+
+    subtree = _extract_hooks_subtree(settings_file)
+    if subtree is None or not _has_effective_hooks(subtree):
+        return
+
+    current_hash = hash_subtree(subtree)
+    status = get_trust_status_for_hash(root, current_hash)
+    if status == TRUSTED:
+        return
+
+    warn_untrusted_project_hooks(root, settings_file, status)

{code_puppy_core_plugins-0.0.16 → code_puppy_core_plugins-0.0.18}/code_puppy_core_plugins/hook_manager/config.py

@@ -24,13 +24,13 @@ HookSource = Literal["project", "global"]
 
 
 def _find_settings_path() -> Path:
-    """Return the path to .claude/settings.json, searching from cwd upward."""
-    cwd = Path.cwd()
-    for parent in [cwd, *cwd.parents]:
-        candidate = parent / _SETTINGS_FILENAME
-        if candidate.exists():
-            return candidate
-    return cwd / _SETTINGS_FILENAME
+    """Return the CWD's ``.claude/settings.json`` path.
+
+    Deliberately does not search ancestors. The executor only ever loads and
+    trust-gates the CWD's file, so returning a parent's settings here would
+    let the menu display and toggle hooks that can never actually run.
+    """
+    return Path.cwd() / _SETTINGS_FILENAME
 
 
 def _load_global_hooks_config() -> Dict[str, Any]:
@@ -123,9 +123,33 @@ def save_hooks_config(hooks: Dict[str, Any]) -> Path:
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps(existing, indent=2) + "\n", encoding="utf-8")
     logger.debug("Saved hooks config to %s", path)
+    _reaccept_trust_after_user_write(path)
     return path
 
 
+def _reaccept_trust_after_user_write(path: Path) -> None:
+    """Re-record trust after a user-initiated write to the project hooks file.
+
+    Menu actions like ``/hooks enable`` rewrite the hashed subtree (adding
+    ``enabled`` keys), which would otherwise flip TRUSTED to CHANGED and
+    silently stop the very hooks the user just toggled. Only re-accepts a
+    project that was already trusted — an untrusted project stays untrusted,
+    so this can never grant trust the user did not give.
+    """
+    from code_puppy_core_plugins.claude_code_hooks import trust as _trust
+
+    try:
+        project_root = Path(os.getcwd()).resolve()
+        if path.resolve() != (project_root / _trust.PROJECT_SETTINGS_RELPATH):
+            return
+        store = _trust._load_store()
+        if _trust._project_key(project_root) not in store["projects"]:
+            return
+        _trust.trust_project_hooks(project_root)
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.warning("Could not refresh hooks trust after save: %s", exc)
+
+
 def save_global_hooks_config(hooks: Dict[str, Any]) -> Path:
     """Persist hooks config to ~/.code_puppy/hooks.json.
 

{code_puppy_core_plugins-0.0.16 → code_puppy_core_plugins-0.0.18}/code_puppy_core_plugins/hook_manager/register_callbacks.py

@@ -7,6 +7,7 @@ Provides:
   /hooks enable    – Enable all hooks (both global and project)
   /hooks disable   – Disable all hooks (both global and project)
   /hooks status    – Show summary counts per event type
+  /hooks trust     – Preview / accept / revoke trust for project hooks
 """
 
 import logging
@@ -32,6 +33,10 @@ def _hooks_command_help() -> List[Tuple[str, str]]:
             "hooks",
             "Manage Claude Code hooks (global + project) – browse, enable/disable, inspect",
         ),
+        (
+            "hooks trust",
+            "Preview / accept / revoke trust for project hooks from .claude/settings.json",
+        ),
         ("hook", "Alias for /hooks"),
     ]
 
@@ -51,6 +56,7 @@ def _handle_hooks_command(command: str, name: str) -> Optional[Any]:
     /hooks enable    Enable every hook (both global and project)
     /hooks disable   Disable every hook (both global and project)
     /hooks status    Show counts per event type
+    /hooks trust     Preview / accept / revoke trust for project hooks
     """
     if name not in (_COMMAND_NAME, *_ALIASES):
         return None  # Not our command – pass through
@@ -69,6 +75,16 @@ def _handle_hooks_command(command: str, name: str) -> Optional[Any]:
     tokens = command.split()
     subcommand = tokens[1].lower() if len(tokens) > 1 else ""
 
+    # ----------------------------------------------------------------- trust
+    #
+    # Handled before the load/save-based branches below because the trust
+    # ceremony must work even when the project hooks file is currently
+    # untrusted (that is, in fact, its whole purpose).
+    if subcommand == "trust":
+        from .trust_handler import handle_trust_subcommand
+
+        return handle_trust_subcommand(tokens[2:])
+
     # ------------------------------------------------------------------ list
     if subcommand == "list":
         entries = flatten_all_hooks()
@@ -208,7 +224,7 @@ def _handle_hooks_command(command: str, name: str) -> Optional[Any]:
     # ----------------------------------------------- unknown sub-command
     if subcommand and subcommand not in ("", "tui"):
         emit_error(f"Unknown sub-command: {subcommand}")
-        emit_info("Usage: /hooks [list|enable|disable|status]")
+        emit_info("Usage: /hooks [list|enable|disable|status|trust]")
         return True
     # --------------------------------------------------- default: TUI menu
     from .hooks_menu import show_hooks_menu