v0.2.0

System layer v0.2.0

Land via:

agents repo pull system
agents sync

Highlights

• Multi-harness hooks (claude/codex/kimi/grok/cursor/droid/antigravity)
• Stop/done contract (no PR handoffs; headless self-exit with recap)
• SessionStart: Linear projects+milestones, project-aware in-flight
• Teams/feed contracts; new /triage, /dispatch, /work:dispatch, /fork, /profile
• Artifacts-cli plan pipeline

Security defaults in this cut

• expand-bang-commands default off (opt-in shell-from-prompt)
• /finish secret + redacted gist only on private repos
• Personal contact placeholders in escalate/hibernate

Known risks

See CHANGELOG under Known risks — Linear/PR inject fences, session_id path validation, escalate watcher quoting, and a first-class agents hooks enable|disable CLI are still planned.

Full notes: CHANGELOG.md → [0.2.0].

v0.1.10 — rm-guard + large-file-add-guard + git-guard sh -c hotfix

What's new

hooks/rm-guard.sh (new)

PreToolUse:Bash hook blocking rm -r / rm -R on protected paths. Symmetric with git-guard for the "agent wipes data" vector.

Protected paths: /, $HOME, ~/.agents, ~/.ssh, ~/.config, ~/.claude, ~/.codex, ~/.gemini, ~/Library, ~/Documents, ~/Desktop, ~/Downloads, ~/src, ~/Phoenix, ~/Rush, /Users, /Applications, /System, /Library.

Variable-expansion targets denied: rm -rf "$VAR" — value unknown at hook time, deny rather than guess.

hooks/large-file-add-guard.sh (new)

PreToolUse:Bash hook blocking git add <path> when file is >5 MiB or has binary magic bytes (Mach-O, ELF, PE, zip/jar/docx, gzip, bzip2, xz, 7z, tar). Catches build artifacts escaping into commits.

Threshold tunable via LARGE_FILE_GUARD_MAX_KB env var (0 disables).

git add -A / git add . / git add -u out of scope (tree-walk too expensive at hook time — git itself surfaces those).

hooks/git-guard.sh — sh -c bypass hotfix (v0.1.9 regression)

The v0.1.9 git-guard silently allowed sh -c "git reset --hard" because the naive set -- \$cmd splitter shredded the quoted -c argument into tokens like "git, reset, --hard" — none matched the git|*/git pattern.

Fix: detect sh|bash -c at the raw-string level BEFORE token splitting via new extract_sh_c_inner helper. Extracts the quoted argument, strips wrapping quotes, recurses into check_command_string. Also fixed IFS: unbound variable under set -u when recursing through check_segment's unset IFS.

Verified

• 31/31 direct hook invocations including all bypass forms: git -C, sh -c (dq + sq), env-var prefix (FOO=bar), absolute path (/usr/bin/git), chained (&&, ||, ;, |), $VAR expansion targets
• 27/27 PTY end-to-end across Claude 2.1.143 / Codex 0.134.0 / Gemini 0.43.0 synced version homes
• No regression in v0.1.9 git-guard scope: reset, branch -D, config write, push --force, worktree remove on dirty/unpushed trees all still blocked

Overhead

• Fast path (no git/rm/git*add*): ~3-4ms per hook, ~10ms cumulative for non-trigger Bash commands
• Slow path (matches fast-path substring): ~14ms — jq parse + segment scan

v0.1.9 — git-guard PreToolUse hook

What's new

hooks/git-guard.sh — deterministic git deny-list enforcement

PreToolUse hook fired on every Bash invocation. Blocks destructive git operations at the tool boundary even when an agent uses bypass forms the classifier misses (git -C <path> reset, sh -c 'git reset', absolute paths to git binary).

Blocks: reset, checkout, stash, rebase, cherry-pick, revert, clean, reflog, filter-branch, gc, prune, fsck, branch -D/-d/-m/-M, config (write form), push --force, merge --abort, worktree remove on dirty/unpushed trees.

Allows: all read-only git, add, commit, push (without --force), worktree add, worktree remove on clean/pushed worktrees.

cli/jq.yaml — declared dependency

jq is required for correct JSON unescape of tool_input.command (sed alone misses \n, \", \\). agents pull will prompt to brew install jq when missing.

agents.yaml registration

Hook is wired for Claude, Codex, and Gemini under hooks.git-guard with matcher: Bash, events: [PreToolUse], timeout: 5.

Behavior

• Hot-path overhead: ~7ms for non-git Bash commands (fast-path), ~14ms for git commands (jq + segment scan).
• Coverage: handles multi-line, sh -c wrappers, absolute paths, quoted tokens, env-var prefixes, git -C peeling.
• Out of scope (documented in hooks/git-guard.md): eval, xargs git, \$(...) subshells, base64-decoded payloads, sourced aliases.

Tested

23 test cases pass including bypass forms (git -C, sh -c, absolute /usr/bin/git).