Skip to content

feat(plugins): add in-process intercept hooks after secret-guard and permission gate #1330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
TheGreatAxios wants to merge 2 commits into from
Closed

feat(plugins): add in-process intercept hooks after secret-guard and permission gate #1330

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a11370f
feat(plugins): add in-process intercept hooks after secret-guard and …
TheGreatAxios Oct 5, 2026
7b7ad78
fix(plugins): re-gate hook-mutated calls through secret-guard and per…
TheGreatAxios Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions src/agent/posix-tool-plugins.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,13 @@ import {
type ReadFileGuardPluginOptions,
} from "../plugins/read-file-guard-plugin.js";
import type { PermissionGate } from "../permission/gate.js";
import {
hasInterceptHooks,
interceptHookPlugin,
normalizeInterceptHooks,
type InterceptHookRegistration,
type InterceptHookRegistry,
} from "../plugins/intercept-hooks.js";
import { createWorktreeRootsProvider } from "../permission/worktree-roots.js";
import type { CompactionArchive } from "../session/compaction-archive.js";
import type { ShellOutputFeedMap } from "../session/shell-output-feed.js";
Expand Down Expand Up @@ -59,6 +66,18 @@ export interface CorePosixToolPluginsArgs {
* only — the default settings file stays covered either way.
*/
secretGuardExtraDeniedPaths?: readonly string[];
// CL-9888 in-process intercept hooks (beforeModel/afterTool stages;
// beforePrompt is a prompt-assembly pure function, not middleware).
// Composed immediately after secret-guard/permission: a denied call
// short-circuits at the gate above this layer and never reaches a hook.
// The stack gate is forwarded into the hook middleware so a hook-replaced
// call is re-run through secret-guard + permission before it executes —
// mutated still gated. Hook-mutated calls also still pass the downstream
// guards below.
interceptHooks?: InterceptHookRegistration | InterceptHookRegistry;
// Warning sink for hook failures (hooks never throw into the run).
// Defaults to stderr; interactive callers pass a diagnostics-backed sink.
onInterceptHookWarning?: (msg: string) => void;
}

// Middleware order matches docs/ARCHITECTURE.md: path escape through truncation,
Expand Down Expand Up @@ -99,6 +118,8 @@ export function buildCorePosixToolPlugins(
getShellOutputFeeds,
getEvidenceArchive,
secretGuardExtraDeniedPaths,
interceptHooks,
onInterceptHookWarning,
} = args;
// Pre-gate sandboxes honor yolo mode so outside-workspace path tools and shell
// cwd are not hard-denied after the gate already auto-allows. Pass a live
Expand Down Expand Up @@ -144,6 +165,20 @@ export function buildCorePosixToolPlugins(
: undefined,
),
permissionPlugin(permissionGate),
...(interceptHooks !== undefined &&
hasInterceptHooks(normalizeInterceptHooks(interceptHooks))
? [
interceptHookPlugin(interceptHooks, {
...(onInterceptHookWarning !== undefined
? { onWarning: onInterceptHookWarning }
: {}),
permissionGate,
...(secretGuardExtraDeniedPaths !== undefined
? { secretGuardExtraDeniedPaths }
: {}),
}),
]
: []),
shellGuardPlugin(cwd, shellTimeout, shellEnv, {
allowOutsideCwd: allowOutside,
...(getBackgroundShellRegistry !== undefined
Expand Down
Loading
Loading