inkstone/ISEP
2
0
Fork 0
Code Issues 18 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity
Files
b8060ca263ab6d308bb1da46457f354e53e61ff9
ISEP/hooks/hooks.json
T
Leo b8060ca263 新增 leo21c-mcp-guard.sh：擋下打向 leo 真庫的 Arcrun/KBDB MCP 呼叫（ISEP#69） 
leo 2026-08-27：「我從頭的指令就叫你去打 youlin，stage 環境是它你不知道嗎？
為什麼打算用我的真庫測試？」

實況（總管當天實查）：這台機器同時掛兩條 Arcrun MCP 連線，工具名是兩串 UUID——
mcp__00402d88-...__* → logged_in_as: leo21c（真庫），mcp__d0eaf65b-...__* →
logged_in_as: youlin（測試場）。總管整天用第一條，測試資料卻寫在第二條，
造成三次假結論（「wiki 沒送上去」「排在 1691 筆後面」「ingest 沒寫進去」——
全是查錯庫），而總管自己每張派工單都寫著「測試一律用 youlin」，卻一次都沒套用。

判準：任何打向 leo21c 座標的 kbdb_*/arcrun_* MCP 呼叫一律擋，除非明說
（touch /tmp/.leo21c-mcp-ok，單次 15 分鐘、會留痕到 .claude/hooks/
leo21c-mcp-guard.log）。讀寫都擋，但訊息不同：唯讀提示「你可能查錯地方」，
寫入提示「這會汙染真資料」。arcrun_whoami 本身永遠放行（唯一能確認身份的
工具，擋它會造成死結）。

已知限制（查過但查不到穩定識別法，不是猜測）：MCP server 的 UUID 是這次連線
分配的，不是穩定識別碼，重裝/換 session 會換掉；~/.claude.json 等本機設定檔
裡找不到這兩條連線的來源設定，判斷是雲端 connector 層動態配的。因此這兩個
UUID 是寫死的（2026-08-27 由 arcrun_whoami 實測得到），且會過期。設計上不是
「表格以外的一律放行」，而是「不在表格裡的 UUID 一樣擋，且訊息明講清單可能
過期」——大聲失敗，不靜默放行到身份不明的目標（fail-closed）。

測試：hooks/tests/leo21c-mcp-guard.test.sh 19/19 通過，涵蓋擋(真庫讀/寫)、
放行(測試場讀/寫)、不擋(whoami 三種座標)、不擋(無關工具)、擋(未知UUID)、
戳記單次放行＋留痕。既有測試套件（ask-user-question/dispatch-format/
factory-idle/main-and-prod-push/prod-write/stage-before-prod/sdd-guard）
全部重跑一遍，均維持原本通過狀態，未受本次改動影響。

hooks.json 新增一條 PreToolUse matcher：.*mcp__[0-9a-fA-F-]+__(kbdb_|arcrun_).*
docs/hooks-inventory.md 補上新閘一行，並記錄目前實際磁碟數（49 檔/60 條）
跟這份表既有列表（47/57）之間還有既存落差（isep-presence-beacon.sh／
milestone-due-guard.sh 疑似兩支舊閘未收錄）——不是本票動的閘，未一併查證，
留給總管或後續票核實。

plugin.json 0.5.0 → 0.5.1（改完不升版沒人吃得到；check-version-consistency.sh
在本分支照慣例是紅的，tag 於 merge 時打）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-27 15:01:29 +08:00

361 lines
9.8 KiB
JSON
Raw Blame History

{
"description": "InkStone Environment Plugin (ISEP) —— leo 的 Claude Code 環境唯一真相源：所有機械閘、slash command、skill、腳本。本機與雲端裝同一份，總管自己也吃它（dogfood）。",
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/github-contact-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/kbdb-api-wall-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/stage-before-prod-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/main-and-prod-push-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/prod-write-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/not-my-branch-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/leo21c-write-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/release-tag-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/ticket-api-bypass-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/milestone-due-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/reply-identity-guard.sh"
}
]
},
{
"matcher": ".*(arcrun_push_workflow|arcrun_delete_workflow|arcrun_recipe_push|arcrun_recipe_delete|arcrun_create_tag|arcrun_delete_tag|arcrun_tag_resource|arcrun_untag_resource|kbdb_create_record|kbdb_create_template).*",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/prod-write-guard.sh"
}
]
},
{
"matcher": ".*mcp__[0-9a-fA-F-]+__(kbdb_|arcrun_).*",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/leo21c-mcp-guard.sh"
}
]
},
{
"matcher": "Write|Edit|MultiEdit",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/guard-cross-project.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/wiki-secret-scan.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/component-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/sdd-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/credential-only-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/arcrun-intent-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/kbdb-api-wall-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/subagent-first-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/mistake-needs-ticket-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/pending-changes-retired.sh"
}
]
},
{
"matcher": "Grep|Glob|Read|Bash",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/wiki-first-search.sh"
}
]
},
{
"matcher": "Task",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/subagent-wiki-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/kbdb-api-wall-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/micromanage-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/irreversible-dispatch-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/no-ticket-no-dispatch.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/dispatch-format-guard.sh"
}
]
},
{
"matcher": ".*arcrun_(push_workflow|validate_yaml).*",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/arcrun-intent-guard.sh"
}
]
},
{
"matcher": "Edit|MultiEdit",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/history-first-guard.sh"
}
]
},
{
"matcher": "Agent",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/micromanage-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/irreversible-dispatch-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/no-ticket-no-dispatch.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/dispatch-format-guard.sh"
}
]
},
{
"matcher": "AskUserQuestion",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/ask-user-question-guard.sh"
}
]
}
],
"SessionStart": [
{
"matcher": "startup|resume|clear",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/session-start-recall.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/skill-deploy-drift-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/isep-presence-beacon.sh"
}
]
}
],
"Stop": [
{
"hooks": [
{
"type": "command",
"command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/empty-handed-stop-guard.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/worklist-guard.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/factory-idle-guard.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/browser-verify-guard.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/self-drive-police.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/self-drive-judge.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/delivery-police.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/wiki-first-police.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/unpushed-police.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/claim-verify-police.sh"
}
]
}
],
"SubagentStop": [
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/subagent-claim-worksheet.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/worklist-guard.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/self-drive-police.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/self-drive-judge.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/delivery-police.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/wiki-first-police.sh"
}
]
},
{
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/unpushed-police.sh"
}
]
}
],
"PostToolUse": [
{
"matcher": ".*kbdb_(search|get_map|query|graph_neighbors).*",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/kbdb-asked-stamp.sh"
}
]
},
{
"matcher": "Agent|Task",
"hooks": [
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/subagent-first-stamp.sh"
},
{
"type": "command",
"command": "${CLAUDE_PLUGIN_ROOT}/hooks/issue-status-autoflip.sh"
}
]
}
]
}
}
Reference in New Issue View Git Blame Copy Permalink