10 Commits

• Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

  Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>

  copilot-swe-agent[bot] · 2026-02-18 07:40:12 +00:00
  1eca3c9130
• fix: add cwd to prettier hook, consistent process.exit(0), and stdout pass-through

  - post-edit-format.js: add cwd based on file directory so npx resolves
    correct local prettier binary
  - post-edit-typecheck.js, post-edit-format.js: replace console.log(data)
    with process.stdout.write(data) to avoid trailing newline corruption
  - Add process.exit(0) to 4 hooks for consistent termination
    (check-console-log, post-edit-console-warn, post-edit-format,
    post-edit-typecheck)
  - run-all.js: switch from execSync to spawnSync so stderr is visible
    on the success path (hook warnings were silently discarded)
  - Add 21 tests: cwd verification, process.exit(0) checks, exact
    stdout pass-through, extension edge cases, exclusion pattern
    matching, threshold boundary values (630 → 651)

  Affaan Mustafa · 2026-02-13 03:20:41 -08:00
  992688a674
• fix: eliminate command injection in hooks, fix pass-through newline corruption, add 8 tests

  Replace shell: true with npx.cmd on Windows in post-edit-format.js and
  post-edit-typecheck.js to prevent command injection via crafted file paths.
  Replace console.log(data) with process.stdout.write(data) in
  check-console-log.js to avoid appending extra newlines to pass-through data.

  Affaan Mustafa · 2026-02-13 02:22:55 -08:00
  d9331cb17f
• fix: 3 bugs fixed, stdin encoding hardened, 37 CI validator tests added

  Bug fixes:
  - utils.js: glob-to-regex conversion now escapes all regex special chars
    (+, ^, $, |, (), {}, [], \) before converting * and ? wildcards
  - validate-hooks.js: escape sequence processing order corrected —
    \\\\ now processed before \\n and \\t to prevent double-processing
  - 6 hooks: added process.stdin.setEncoding('utf8') to prevent
    multi-byte UTF-8 character corruption at chunk boundaries
    (check-console-log, post-edit-format, post-edit-typecheck,
    post-edit-console-warn, session-end, evaluate-session)
  
  New tests (37):
  - CI validator test suite (tests/ci/validators.test.js):
    - validate-agents: 9 tests (real project, frontmatter parsing,
      BOM/CRLF, colons in values, missing fields, non-md skip)
    - validate-hooks: 13 tests (real project, invalid JSON, invalid
      event types, missing fields, async/timeout validation, inline JS
      syntax, array commands, legacy format)
    - validate-skills: 6 tests (real project, missing SKILL.md, empty
      files, non-directory entries)
    - validate-commands: 5 tests (real project, empty files, non-md skip)
    - validate-rules: 4 tests (real project, empty files)
  
  Total test count: 228 (up from 191)

  Affaan Mustafa · 2026-02-12 16:08:49 -08:00
  492c99ac24
• fix: use readFile utility in hooks and add pattern type safety

  - Replace raw fs.readFileSync with readFile() from utils in
    check-console-log.js and post-edit-console-warn.js to eliminate
    TOCTOU race conditions (file deleted between existsSync and read)
  - Remove redundant existsSync in post-edit-format.js (exec already
    handles missing files via its catch block)
  - Resolve path upfront in post-edit-typecheck.js before tsconfig walk
  - Add type guard in getGitModifiedFiles() to skip non-string and
    empty patterns before regex compilation

  Affaan Mustafa · 2026-02-12 15:28:30 -08:00
  e7b5c62eb7
• fix: path traversal in install.sh, error logging in hooks

  - Validate language names in install.sh to prevent path traversal via
    malicious args like ../../etc (only allow [a-zA-Z0-9_-])
  - Replace silent catch in check-console-log.js with stderr logging so
    hook failures are visible to the user for debugging
  - Escape backticks in session-end.js user messages to prevent markdown
    structure corruption in session files

  Affaan Mustafa · 2026-02-12 14:14:21 -08:00
  6e5b45ed28
• fix: harden error handling, fix TOCTOU races, and improve test accuracy

  Core library fixes:
  - session-manager.js: wrap all statSync calls in try-catch to prevent
    TOCTOU crashes when files are deleted between readdir and stat
  - session-manager.js: use birthtime||ctime fallback for Linux compat
  - session-manager.js: remove redundant existsSync before readFile
  - utils.js: fix findFiles TOCTOU race on statSync inside readdir loop
  
  Hook improvements:
  - Add 1MB stdin buffer limits to all PostToolUse hooks to prevent
    unbounded memory growth from large payloads
  - suggest-compact.js: use fd-based atomic read+write for counter file
    to reduce race window between concurrent invocations
  - session-end.js: log when transcript file is missing, check
    replaceInFile return value for failed timestamp updates
  - start-observer.sh: log claude CLI failures instead of silently
    swallowing them, check observations file exists before analysis
  
  Test fixes:
  - Fix blocking hook tests to send matching input (dev server command)
    and expect correct exit code 2 instead of 1

  Affaan Mustafa · 2026-02-12 13:40:14 -08:00
  36864ea11a
• fix: improve error handling, fix bugs, and optimize core libraries

  utils.js:
  - Fix countInFile: enforce global flag on regex to prevent silent
    under-counting (match() without /g returns only first match)
  - Add 5s timeout to readStdinJson to prevent hooks hanging forever
  - Handle EEXIST race condition in ensureDir
  - Pre-compile regex patterns in getGitModifiedFiles to avoid N*M
    compilations and catch invalid patterns before filtering
  - Add JSDoc documentation to all improved functions
  
  session-manager.js:
  - Fix getSessionById triple file read: pass pre-read content to
    getSessionStats instead of re-reading from disk
  - Allow getSessionStats to accept content string directly
  
  session-aliases.js:
  - Wrap temp file cleanup in try/catch to prevent cascading errors
  
  check-console-log.js:
  - Refactor to use shared utils (isGitRepo, getGitModifiedFiles, log)
    instead of raw execSync calls
  - Add exclusion patterns for test files, config files, and scripts/
    where console.log is intentional
  
  session-end.js:
  - Log count of skipped unparseable transcript lines for diagnostics
  
  suggest-compact.js:
  - Guard against NaN from corrupted counter files
  
  package-manager.js:
  - Remove dead fallbackOrder parameter (unused after #162 fix)

  Affaan Mustafa · 2026-02-12 07:06:53 -08:00
  18c5a76a96
• fix: resolve ESLint errors and update tests for project-name fallback

  - Fix 16 ESLint no-unused-vars errors across hook scripts and tests
  - Add eslint-disable comment for intentional control-regex in ANSI stripper
  - Update session file test to use getSessionIdShort() instead of hardcoded 'default'
    (reflects PR #110's project-name fallback behavior)
  - Add marketing/ to .gitignore (local drafts)
  - Add skill-create-output.js (terminal output formatter)
  
  All 69 tests now pass. CI should be green.

  Affaan Mustafa · 2026-01-29 02:58:51 -08:00
  a44a0553bb
• Fix: Move Stop hook inline code to separate script file

  Fixes #78
  
  ## Problem
  The Stop hook used inline JavaScript code with `node -e`, which caused
  shell syntax errors on macOS/zsh due to special characters (parentheses,
  braces, arrow functions) being misinterpreted by the shell.
  
  Error message:
  /bin/sh: -c: line 0: syntax error near unexpected token \`('
  
  ## Solution
  - Created scripts/hooks/check-console-log.js with the hook logic
  - Updated hooks/hooks.json to reference the external script
  - This follows the same pattern as other hooks in the plugin
  
  ## Benefits
  - Fixes shell compatibility issues across different environments
  - Improves code maintainability (separate, well-documented script)
  - Follows plugin's own best practices
  - Makes the code easier to test and debug
  
  ## Testing
  Tested on macOS with zsh - no more syntax errors.
  The hook still functions correctly to detect console.log statements.

  李成喆 · 2026-01-26 12:00:39 +08:00
  a0b84f7b86