mirror of
https://github.com/wshobson/agents.git
synced 2026-09-14 18:04:20 +08:00
Seth Hobson
2d2b619edf
* fix(hooks): read the Claude Code hook payload from stdin in protect-mcp and review-agent-governance
Both plugins passed --tool "$TOOL_NAME" --input "$TOOL_INPUT" to protect-mcp.
Claude Code sends the hook event as JSON on stdin and never sets those
variables, so the policy always saw an empty tool name: with no policy file
every call was allowed, and with a policy file every call was denied.
Each plugin now ships hooks/evaluate.sh and hooks/sign.sh, run through
${CLAUDE_PLUGIN_ROOT}. The scripts read tool_name and tool_input from stdin
with node and pass them to protect-mcp 0.7.4 as flags. A missing policy file
warns on stderr and allows; an unreadable one denies (the CLI default). sign
drops --input and --output, which 0.7.4 ignores. Tests pipe fixtures through
the exact hooks.json command. Plugin versions 0.1.1 -> 0.1.2.
Closes #701
* fix(hooks): block when the evaluator cannot run; correct the signer wording
An npx exit other than 0 or 2 (for example 126 when a large tool input
exceeds the argument-length limit) is now mapped to exit 2 so the call is
blocked instead of allowed. Test 12 simulates the failure with a fake npx.
The setup skill now says sign.sh reads only tool_name.
Claude-Session: https://claude.ai/code/session_01DZazzWVyb8MxPCuLC1w5Qo