DietrichGebert
215777d835
The SessionStart nudge built a statusLine command by interpolating the plugin's __dirname path into a double-quoted shell string. A clone path containing shell metacharacters (quotes, &, $, backtick, ;) could break out when the suggested command later runs via the statusline shell. Low severity in practice: the path is the install location, so triggering it requires installing into a maliciously-named directory, i.e. the attacker already controls the filesystem. Hardening it anyway. Gate the snippet behind isShellSafe() (allowlist of ordinary path chars, allowing : \ / for normal Windows and POSIX paths). Unsafe paths fall back to a manual-setup instruction instead of an embeddable command. An allowlist beats a per-shell escaper, which is its own edge-case bug farm. Refs #200
92 lines
3.5 KiB
JavaScript
92 lines
3.5 KiB
JavaScript
#!/usr/bin/env node
|
|
// ponytail — Claude Code SessionStart activation hook
|
|
//
|
|
// Runs on every session start:
|
|
// 1. Writes flag file at $CLAUDE_CONFIG_DIR/.ponytail-active (defaults to ~/.claude; statusline reads this)
|
|
// 2. Emits ponytail ruleset as hidden SessionStart context
|
|
// 3. Detects missing statusline config and emits setup nudge
|
|
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { getDefaultMode, getClaudeDir, isShellSafe } = require('./ponytail-config');
|
|
const { getPonytailInstructions } = require('./ponytail-instructions');
|
|
const {
|
|
clearMode,
|
|
isCodex,
|
|
isCopilot,
|
|
setMode,
|
|
writeHookOutput,
|
|
} = require('./ponytail-runtime');
|
|
|
|
const claudeDir = getClaudeDir();
|
|
const settingsPath = path.join(claudeDir, 'settings.json');
|
|
|
|
const mode = getDefaultMode();
|
|
|
|
// "off" mode — skip activation entirely, don't write flag or emit rules
|
|
if (mode === 'off') {
|
|
clearMode();
|
|
const hookOutput = (isCodex || isCopilot) ? '' : 'OK';
|
|
writeHookOutput('SessionStart', 'off', hookOutput);
|
|
process.exit(0);
|
|
}
|
|
|
|
// 1. Write flag file
|
|
try {
|
|
setMode(mode);
|
|
} catch (e) {
|
|
// Silent fail -- flag is best-effort, don't block the hook
|
|
}
|
|
|
|
// 2. Emit the ponytail ruleset, filtered to the active intensity level.
|
|
let output = getPonytailInstructions(mode);
|
|
|
|
// 3. Detect missing statusline config — nudge Claude to help set it up
|
|
if (!isCodex && !isCopilot) try {
|
|
let hasStatusline = false;
|
|
if (fs.existsSync(settingsPath)) {
|
|
// Strip UTF-8 BOM some editors prepend on Windows (breaks JSON.parse)
|
|
const raw = fs.readFileSync(settingsPath, 'utf8').replace(/^\uFEFF/, '');
|
|
const settings = JSON.parse(raw);
|
|
if (settings.statusLine) {
|
|
hasStatusline = true;
|
|
}
|
|
}
|
|
|
|
if (!hasStatusline) {
|
|
const isWindows = process.platform === 'win32';
|
|
const scriptName = isWindows ? 'ponytail-statusline.ps1' : 'ponytail-statusline.sh';
|
|
const scriptPath = path.join(__dirname, scriptName);
|
|
if (isShellSafe(scriptPath)) {
|
|
const command = isWindows
|
|
? `powershell -ExecutionPolicy Bypass -File "${scriptPath}"`
|
|
: `bash "${scriptPath}"`;
|
|
const statusLineSnippet =
|
|
'"statusLine": { "type": "command", "command": ' + JSON.stringify(command) + ' }';
|
|
output += "\n\n" +
|
|
"STATUSLINE SETUP NEEDED: The ponytail plugin includes a statusline badge showing active mode " +
|
|
"(e.g. [PONYTAIL], [PONYTAIL:ULTRA]). It is not configured yet. " +
|
|
"To enable, add this to ~/.claude/settings.json: " +
|
|
statusLineSnippet + " " +
|
|
"Proactively offer to set this up for the user on first interaction.";
|
|
} else {
|
|
// ponytail: install path has shell metacharacters — don't embed it in a
|
|
// command snippet; have the agent wire it up by hand instead.
|
|
output += "\n\n" +
|
|
"STATUSLINE SETUP NEEDED: The ponytail plugin includes a statusline badge showing active mode. " +
|
|
"Its install path contains characters unsafe to embed in a shell command, so configure it manually: " +
|
|
"add a statusLine command of type \"command\" that runs " + scriptName +
|
|
" from the plugin's hooks directory to ~/.claude/settings.json, quoting/escaping the path for your shell. " +
|
|
"Proactively offer to set this up for the user on first interaction.";
|
|
}
|
|
}
|
|
} catch (e) {
|
|
// Silent fail — don't block session start over statusline detection
|
|
}
|
|
|
|
try {
|
|
writeHookOutput('SessionStart', mode, output);
|
|
} catch (e) {
|
|
// Silent fail — stdout closed/EPIPE at hook exit must not surface as a hook failure
|
|
}
|