Repository navigation
fix(lua-agent-builder): deploy hook stops treating a /lua/ folder as a lua command (F3), 1.19.1 - #34
Merged
Merged
Conversation
…n a path as a lua command (F3)
Live build session QA: `cd ~/Documents/lua/... && T=./tools/x.sh; $T $SID '{}'`
and a Python heredoc run from a /lua/ folder were blocked as
`lua <unresolved command>`. "Mentions lua" was a substring regex over the whole
command, so a /lua/ path segment let any computed head + computed word match.
- mentionsLuaToken(): lua/heylua/lua-ai/lua-cli counts only as a whole word,
a path's last segment or an entry point; the regex stays a fast negative.
This alone fixes the QA heredoc: Python's quotes and braces no longer read
as `$BIN $VERB` once nothing in the command is a lua token.
- Heredoc/herestring bodies fed to python/node/ruby/perl/awk are still parsed
as shell AND searched as text, unchanged from origin/main: their backticks
and `${...}` templates run a computed binary (perl/ruby backticks, node
template literals), so text-only search would have weakened the gate.
- A computed head with a literal verb and no lua token anywhere is
`unresolvedHead`: confirm-deploy answers permissionDecision "ask"
interactively, and only when the PreToolUse permission_mode is default,
acceptEdits or plan. bypassPermissions, dontAsk, auto (a classifier settles
prompts and only some Claude Code versions stop it approving a hook ask; the
plugin cannot enforce a minimum version), a missing field (older Claude
Code) or an unknown value keep the DEPLOY_DENIED_BARE block (fail closed);
headless and build sessions still block. classify's public shape is
unchanged (classifyProductionCommandDetailed carries the flag).
- --help is not relaxed.
Tests: tokenizer-hardening (allow /lua/ cwd cases, the QA heredoc and a node
`${x} ${y}` heredoc; block L=lua, $(printf lua), which lua, "$DIR/lua", npx,
-- --help, piped prefixed promote; perl/node/ruby heredocs running a computed
binary stay gated), confirm-deploy (ask under default/acceptEdits/plan vs block
under bypassPermissions/dontAsk/auto/missing/unknown mode and headless/session,
ask envelope), confirm-deploy.integration (spawned hook: ask envelope + exit 0
under default, exit 2 DEPLOY_DENIED_BARE under bypassPermissions and auto).
npm test 2632/2632, npm run lint, test:coverage thresholds green.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bump every version the release workflow and lint-release-version read to 1.19.1: plugin package.json, .claude-plugin/plugin.json, marketplace.json, mcp/lua-platform package.json and package-lock.json, src/api-client.mjs (X-Lua-Client) and src/server.mjs (server version, plugin_version x2). dist/server.js is rebuilt with `npm ci && npm run build` in mcp/lua-platform (Node 22), so the bundle and its inline sourcemap both carry 1.19.1 and CI's `git diff --exit-code -- dist/` after a rebuild stays clean. CHANGELOG heading "Unreleased (next: 1.19.1)" becomes "1.19.1 — 2026-11-04". release-prod.yml cuts v<package.json version> on merge and fails if the tag exists, so 1.19.0 would fail the release. Test: npm run lint prints "Release version 1.19.1 is consistent"; a second `npm run build` leaves `git diff --exit-code -- dist/` clean; mcp/lua-platform npm test 149/149 and npm run typecheck green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Correction (post-merge): the description says unresolved commands keep the block in headless mode and build sessions. That holds for every gated verb, but one narrow class of fully shell-computed commands is now allowed where it was previously blocked only incidentally. The server-side session proxy remains the enforcement boundary; details are recorded with the session-image plugin bump in the platform repo. 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes F3 from the live build-session QA (2026-11-04): the
confirm-deployPreToolUse hook blocked harmless commands aslua <unresolved command>whenever any folder in the command was namedlua(for example a working directory under~/Documents/lua/). Examples blocked during QA: a plain script call (T=./tools/x.sh; $T $SID '{}'), a Python heredoc run from a/lua/folder, and read-only status loops.Release: lua-agent-builder 1.19.1.
What changes
lua,heylua,lua-aiandlua-clicount as a lua mention only as a whole word, a path's last segment, or an entry point, not as any folder in a path.unresolvedHead. Interactively (permission modedefault,acceptEditsorplan) the hook answers ask, so a person decides. In every other case it still blocks withDEPLOY_DENIED_BARE(fail closed):bypassPermissions,dontAsk,auto, a missing or unknown mode, headless runs and build sessions.${…}in them can run a computed binary.--helpis not relaxed. ClassifyingL=lua; $L deploy all,$(printf lua),"$DIR/lua"and npx as unresolved is unchanged: still blocked.Safety
classify's public shape is unchanged (classifyProductionCommandDetailedcarries the new flag).SECURITY.mdline 35 still describes the old wording. Stale PR fix(hooks): 1.7.1 — production gate classifies what a command runs, not text it mentions #18 also toucheslib/tokenizer.mjsand should be rebased or closed after this lands.Tests
npm test: 72 suites, 2632/2632 pass.npm run lint: all lints pass, with release version 1.19.1 consistent.tokenizer-hardening:/lua/cwd cases now allowed; the QA heredoc; node${x} ${y};L=lua,$(printf lua),which lua, npx,-- --helpand piped prefixed promote still blocked; perl/node/ruby heredocs running a computed binary still gated.confirm-deployunit and integration: ask vs block for each permission mode, headless and session.Both commits are SSH-signed (verified).
🤖 Generated with Claude Code