Skip to content

hook: a script handed to the user is a claim that it runs - #506

Open
EdbertChan wants to merge 1 commit into
mainfrom
stack/EdbertChan/reflect/ui-input-guard-hook-freshness-20260908/script-handed-user-claim-runs--2f495bfe
Open

hook: a script handed to the user is a claim that it runs#506
EdbertChan wants to merge 1 commit into
mainfrom
stack/EdbertChan/reflect/ui-input-guard-hook-freshness-20260908/script-handed-user-claim-runs--2f495bfe

Conversation

@EdbertChan

@EdbertChan EdbertChan commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

This safety hook checks whether a reply gives a person a script that the current session has not run.

The problem was that a reply could hand over a script after checking only its wrapper, even when the remote part was broken.

The cause was that existing checks did not compare the handed-over script with commands actually run in the session.

The fix adds a fail-open check, safe exceptions for interactive work, installation wiring, its own guide, and checks that prove it works.

Review Claim

Approve a safety check that stops untested script handoffs while allowing honest explanations for work that needs the user.

Review Lane

behavior

Review Unit

engine-runtime

Safety Invariant

Only the new safety check, its installation and documentation wiring, and its tests change. Existing checks fail open when they cannot inspect a session.

Slice Rationale

This slice keeps the handoff check, its wiring, and its proof together so the behavior can be reviewed and installed as one unit.

Non-goals

  • No changes to authentication, stored data, or core runtime paths.
  • No changes to unrelated checks or command handling.
  • No requirement to run interactive sign-ins from the agent session.
  • The main README row for this hook is in the docs PR at the top of this stack, not here.

Test Plan

Test Plan
  • python3 -m unittest discover -s engine/hooks/handoff-needs-smoke-test/tests -v
  • python3 -m unittest tests.test_install -v

Revert Plan

Revert Plan
  • Safe to revert? Yes.
  • Revert command: git revert <merge-commit-sha>
  • Post-revert steps: Re-run the installation and test commands above.
  • Data migration? No.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01KU2pPKob4MJ1NqjsfTNyYJ

@EdbertChan EdbertChan mentioned this pull request Sep 12, 2026
Open
2 tasks
@EdbertChan

EdbertChan commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

This pull request is part of a Mergify stack:

# Pull Request Link
1 hook: a script handed to the user is a claim that it runs #506 👈
2 audit(token_audit): count "bogus" and "it didn't run" as the same class #507
3 hook: refuse a quoted command string passed through a login shell #508
4 gate: a branch taken per operating system needs a test that injects one #509
5 audit(token_audit): one submission carrying two slash commands is one message #510
6 audit: use the transcript's own markers for what the human actually sent #511
7 README: list the handoff-needs-smoke-test and remote-payload-collapses hooks #535

@cursor

cursor Bot commented Sep 12, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_95c70e5c-dc3b-44a8-b7a3-468708f4af11)

This was referenced Sep 12, 2026
Open
Open
Open
Open
EdbertChan added a commit that referenced this pull request Sep 13, 2026
@EdbertChan
invoker: wf-1789272584168-2/verify-pr-506-live-body — Re-run the PR b…
230f473 
…ody checker on PR #506's live body after the rewrite.

Goal: Prove the body passes as published.
Motivation: A PATCH that returned 200 is not proof the live body passes.
Safety invariant: Read-only; a failed fetch fails the task instead of passing.
Verify: exit code 0 and output PR body validation passed.
Effectiveness measurement: The same checker the required GitHub check runs passes on the live body, so the PR is no longer blocked on its text.

Exit code: 0
@EdbertChan EdbertChan mentioned this pull request Sep 13, 2026
Open
3 tasks
@EdbertChan @claude
hook: a script handed to the user is a claim that it runs
6697642 
A reply ended with `! bash <path>` for a login script whose remote half
had collapsed into a single line. The wrapper passed `bash -n`; the wrapper
was never what executed. Eight existing Stop hooks read that reply and
allowed it.

The hook fires when a reply hands over a script this session never ran
through an interpreter, and stays silent when the reply names why the run
cannot happen here, which is the honest case for an interactive sign-in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KU2pPKob4MJ1NqjsfTNyYJ
Change-Id: I2f495bfe35ba16304833cb3868c8c30537189b8b
EdbertChan added a commit that referenced this pull request Sep 13, 2026
@EdbertChan
invoker: wf-1789272584168-2/verify-pr-506-live-body — Re-run the PR b…
5f7f401 
…ody checker on PR #506's live body after the rewrite.

Goal: Prove the body passes as published.
Motivation: A PATCH that returned 200 is not proof the live body passes.
Safety invariant: Read-only; a failed fetch fails the task instead of passing.
Verify: exit code 0 and output PR body validation passed.
Effectiveness measurement: The same checker the required GitHub check runs passes on the live body, so the PR is no longer blocked on its text.

Exit code: 0
@EdbertChan
EdbertChan force-pushed the stack/EdbertChan/reflect/ui-input-guard-hook-freshness-20260908/script-handed-user-claim-runs--2f495bfe branch from a0fe18d to 6697642 Compare September 13, 2026 05:55
@cursor

cursor Bot commented Sep 13, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_09a815de-be54-426c-8d06-b473be2cb447)

@EdbertChan EdbertChan mentioned this pull request Sep 13, 2026
Open
@EdbertChan

EdbertChan commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

Revision history

# Type Changes Reason Date
1 initial a0fe18d 2026-09-13 05:55 UTC
2 content a0fe18d → 6697642 (raw) 2026-09-13 05:55 UTC

EdbertChan added a commit that referenced this pull request Sep 13, 2026
@EdbertChan @claude
make-pr preflight: read the review-unit rules instead of a copy
9261699 
preflight.py kept its own hand-copied version of drafter.config.json's
path rules, and the copy drifted: it counted every file outside engine/,
scripts/, .github/ and the skill folders as neutral. PR #506 mixed a hook
with a root README.md row; preflight passed it while validate-pr-body.mjs
rejected it as engine-runtime mixed with docs.

preflight now reads drafter.config.json and matches its path globs in
Python, so it stays one standalone file that the pre-push hook can run
as a temp copy. With no config beside the script it reads origin/main's
copy. A test compares its answer with drafter-core's for every tracked
path. Rules that cannot be read exit 3 as unchecked, never a pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014uqkMWYjsKGenUSA1CqBVv
Change-Id: I4dc0ae8c981e7025ee6cbe37fca579ec9dee7b6d
@EdbertChan

EdbertChan commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

Mergify repair stopped: required check failed: validate. The retry cap was reached for current head 6697642.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EdbertChan