Repository navigation
feat(hooks): close hook coverage gaps and add scan switches - #36
Merged
Merged
Conversation
…P posts A new code scope reads whole code files, string literals included, so hidden-characters catches a zero-width space in a string. check-bash reads git commit, tag, merge, and notes messages from -F and --trailer, with git -C in front, and gh release notes, gh pr review bodies, and body files. check-edit reads files that cat or tee writes from a heredoc, and NotebookEdit cells. The new check-mcp hook reads the body or message an MCP tool posts. PowerShell commands go through check-bash.
Each surface past Write and Edit now has a switch under `scan` (codeFiles, notebooks, heredocWrites, shellWrites, mcp, plans, tasks, questions), all on by default, with matching BEC_FEATURE ids and console toggles. New checks: - check-shell-writes (PostToolUse on Bash and PowerShell) scans the lines a command added to files in a git work tree and reports each finding once. - check-tool-text replaces check-mcp. It reads MCP posts, MCP file writes and their commit messages, the ExitPlanMode plan, TaskCreate and TaskUpdate text, and AskUserQuestion questions. - check-bash reads gh api request fields, gh titles and merge subjects, and jj and hg messages. - Codex runs check-tool-text on MCP tools. check-edit and check-bash claim the call's tool_use_id when two of their if rules can match one command, so an overlapping second run exits without output.
yannelli
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the scan gaps from the hook coverage review and adds a switch for each new surface.
New surfaces
codescope: whole code files and unknown extensions, string literals included.hidden-charactersuses it.cat/teeheredoc writes and NotebookEdit cells.sed -i,echo >, scripts). Each finding is reported once, next to the command output.git commit|tag|merge|noteswith-F,--trailer, andgit -C.jjandhgmessages.gh pr review|mergeandgh release.gh apifields (body,message,description,title,@file,--input)..claude/, whichstyleIgnoreGlobsskip), TaskCreate/TaskUpdate text, and AskUserQuestion questions. Codex runs it on MCP tools too.Switches
scan.codeFiles,notebooks,heredocWrites,shellWrites,mcp,plans,tasks,questions: alltrueby default. Each is also aBEC_FEATURE_*id and a toggle on the console's Scanned text panel.Other changes
tool_use_idwhen two of theirifrules can match one command. This keeps an overlapping second run from breaking the confirm flow.Not covered
MessageDisplayis display-only.Checks
node scripts/check.mjsnode --test test/*.test.mjs: 199 passed.render-patterns --checkandvalidate-packs: both pass.