lywsvip/oh-my-claudecode
1
0
Fork 0
mirror of https://github.com/Yeachan-Heo/oh-my-claudecode.git synced 2026-09-03 06:25:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(hooks): treat bash -c +D as dump-strings, not executed code

Browse Source 
+D/-D/--dump-strings after -c dump translation strings and do not run
the following command string.
This commit is contained in:
gaebal-gajae
2026-08-31 03:06:31 +00:00
parent 6b621aa7c9
commit 6563b3a063
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
inventory/inventory-graph.json
View File

@@ -5,15 +5,15 @@
"provenance": {
"base": "05c800f40d1ad53b42a78609d2667ef4f726808b",
"planningHead": "0a91273e61dbbd47eb0af4c02844409251e08398",
"head": "403a40ca4cd080ae6fe1bcd7cf04f1e1a17e4d73",
"sourceSha256": "0d6eea19f36011c47bd0dadcebba72d306cfd21789c871f79aeb8125de950751",
"head": "6b621aa7c92b28f3ba34e1e87fda64736652a65b",
"sourceSha256": "afa8403bc6e809c8ed9019276c6f8d6a399f787ef865b8cef6bf8f8c6a74d0ae",
"generatedAt": null,
"generator": "scripts/generate-inventory-graph.mjs"
},
"base": "05c800f40d1ad53b42a78609d2667ef4f726808b",
"planningHead": "0a91273e61dbbd47eb0af4c02844409251e08398",
"head": "403a40ca4cd080ae6fe1bcd7cf04f1e1a17e4d73",
"sourceSha256": "0d6eea19f36011c47bd0dadcebba72d306cfd21789c871f79aeb8125de950751",
"head": "6b621aa7c92b28f3ba34e1e87fda64736652a65b",
"sourceSha256": "afa8403bc6e809c8ed9019276c6f8d6a399f787ef865b8cef6bf8f8c6a74d0ae",
"counts": {
"public": {
"skills": 35,
@@ -76776,5 +76776,5 @@
}
},
"inventorySha256": "f5ea9ebf29ba491f17b39431660e07f71eb3d78399d481c1c2b00fc34cf2ab50",
"manifestSha256": "8e308f82d0de9d9051f498a6c049e856e000da8df3919cf3b050bcb4b1db7409"
"manifestSha256": "3525afe90a6efd681ea4d89261fdb6c97f0fdd605f56c97e19e872525b8fbe72"
}

1
src/hooks/__tests__/pre-tool-use-template-source-ext.test.ts
View File

@@ -396,6 +396,7 @@ describe('pre-tool-use template source extension detection', () => {
['invalid printf option produces no stdout program', "printf -x 'rm src/app.ts' | bash", false],
['echo -E does not expand escapes into a stdin program', "echo -E 'true\\nrm src/app.ts' | bash", false],
['invalid plus option after -c is not a program', "bash -c +z 'rm src/app.ts'", false],
['plus-D after -c dumps strings and does not run the command', "bash -c +D 'rm src/app.ts'", false],
['named coprocess writing only a log', 'coproc worker bash verify.sh > results.log', false],
] as const)('stays quiet: %s', (_label, command, expectedWarning) => {
expect(hasDelegationNotice(runPreToolUseHook(command))).toBe(expectedWarning);

3
templates/hooks/pre-tool-use.mjs
View File

@@ -1438,7 +1438,8 @@ function checkSegment(segment, directory) {
if (!shellArgs[codeIndex + 1]) return true;
codeIndex += 2; continue;
}
if (/^[+-][abefhkmnptuvxBCEHPTcilsD]+$/.test(value) || /^(?:--norc|--noprofile|--posix|--restricted|--verbose|--debugger)$/.test(value)) {
if (/^[+-]D$/.test(value) || /^(?:--dump-strings|--dump-po-strings)$/.test(value)) return false;
if (/^[+-][abefhkmnptuvxBCEHPTcils]+$/.test(value) || /^(?:--norc|--noprofile|--posix|--restricted|--verbose|--debugger)$/.test(value)) {
codeIndex += 1; continue;
}
if (value.startsWith('-') || value.startsWith('+')) return false;