All checks were successful
CD Pipeline / deploy (push) Successful in 1m8s
回應 vuln-verifier 對前版規則 3e 的 8/9 PoC 繞過警告。 新增/強化擋點: - psql -f / heredoc / 重定向:hook 看不到 SQL 內容 → 一律擋 - multi-statement: ; 後接內容(去 -- 與 /* */ 註解後判斷)→ 擋 - writable CTE: WITH ... DELETE/INSERT/UPDATE → 擋 - /run/secrets, /proc/*/environ → 擋 - pg_read_file / pg_read_binary_file / lo_export / lo_import → 擋 - COPY ... FROM PROGRAM → 擋 - VACUUM FULL / REINDEX / REFRESH MATERIALIZED / CLUSTER 加入寫入黑名單 - env 加 (?!\\s+\\w+=) lookahead,避免誤殺 env VAR=value - alias/function 包裝 docker exec:警告(無法靜態判斷後續呼叫) - 白名單 prefix 不收 WITH(防 writable CTE 漏網),改收 SELECT/EXPLAIN/SHOW/VALUES/TABLE settings.json: 累積本輪 session 的 read-only 工具放行(py_compile、python3)。
107 lines
5.7 KiB
JSON
107 lines
5.7 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(bash \"/Users/ooo/Library/Mobile Documents/com~apple~CloudDocs/momo-pro-system/.claude/hooks/__test__/commit-quality.test.sh\")",
|
|
"Read(//Users/ooo/.nvm/versions/**)",
|
|
"Bash(command -v node)",
|
|
"Bash(env)",
|
|
"Bash(awk -F: '$1>=4647 && $1<=4950')",
|
|
"Bash(python -m py_compile services/telegram_templates.py services/telegram_bot_service.py)",
|
|
"Bash(/bin/zsh -ilc 'echo PATH=$PATH; which node; node -v')",
|
|
"Bash(git clean *)",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('routes/openclaw_bot_routes.py'\\).read\\(\\)\\); print\\('routes OK'\\)\")",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('services/telegram_bot_service.py'\\).read\\(\\)\\); print\\('service OK'\\)\")",
|
|
"Bash(awk 'NR>=2912 && NR<=2920; NR>=3007 && NR<=3015; NR>=3109 && NR<=3117; NR>=3178 && NR<=3186; NR>=3257 && NR<=3265; NR>=3296 && NR<=3304' routes/openclaw_bot_routes.py)",
|
|
"Bash(awk 'NR>=4347 && NR<=4520' routes/openclaw_bot_routes.py)",
|
|
"Bash(awk 'NR>=2164 && NR<=2180; NR>=2720 && NR<=2740; NR>=1287 && NR<=1295; NR>=1384 && NR<=1395; NR>=1474 && NR<=1490; NR>=4327 && NR<=4345; NR>=4512 && NR<=4550' routes/openclaw_bot_routes.py)",
|
|
"Bash(awk 'NR>=1979 && NR<=2000; NR>=2164 && NR<=2180; NR>=1962 && NR<=1978' routes/openclaw_bot_routes.py)",
|
|
"Bash(awk -F: '{print $1}')",
|
|
"Bash(python3 -c ' *)",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('services/telegram_bot_service.py'\\).read\\(\\)\\); print\\('bot_service OK'\\)\")",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('services/telegram_templates.py'\\).read\\(\\)\\); print\\('templates OK'\\)\")",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('services/mcp_context_service.py'\\).read\\(\\)\\); print\\('mcp_context OK'\\)\")",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('config.py'\\).read\\(\\)\\); print\\('config OK'\\)\")",
|
|
"Bash(node -e \"require\\('./.claude/hooks/commit-quality.js'\\)\")",
|
|
"Bash(/Users/ooo/.nvm/versions/node/*/bin/node -e \"require\\('./.claude/hooks/commit-quality.js'\\); console.log\\('hook loads OK'\\)\")",
|
|
"Bash(python -c \"import ast; ast.parse\\(open\\('services/telegram_templates.py'\\).read\\(\\)\\); print\\('AST OK'\\)\")",
|
|
"Bash(python -c \"from services.telegram_templates import decision_result, ops_action_result; print\\('IMPORT OK'\\); print\\(decision_result\\('原訊息 <test>', 'approve', 'owen'\\)\\); print\\('---'\\); print\\(ops_action_result\\('原運維訊息', 'pause1h', 'owen', {'status':'ok','task_name':'momo_crawler','duration_min':60,'message':'已暫停'}\\)\\); print\\('---'\\); print\\(ops_action_result\\('x', 'retry', 'owen', {'status':'error','error':'conn refused'}\\)\\)\")",
|
|
"Bash(python -c \"import ast; [ast.parse\\(open\\(f\\).read\\(\\)\\) for f in ['services/ai_orchestrator.py','services/hermes_analyst_service.py','services/nemoton_dispatcher_service.py','services/openclaw_strategist_service.py','telegram_ai_integration.py']]; print\\('syntax OK'\\)\")",
|
|
"Bash(python -c \"from services.ai_orchestrator import AIOrchestrator; print\\('import OK'\\)\")",
|
|
"Bash(python3 -c \"import sqlalchemy; print\\(sqlalchemy.__version__\\)\")",
|
|
"Bash(./bin/python3 -c \"import sqlalchemy; print\\('sqlalchemy', sqlalchemy.__version__\\)\")",
|
|
"Bash(python3 -c \"import ast; [ast.parse\\(open\\(f\\).read\\(\\)\\) for f in ['services/ai_orchestrator.py','services/hermes_analyst_service.py','services/nemoton_dispatcher_service.py','services/openclaw_strategist_service.py','telegram_ai_integration.py']]; print\\('syntax OK'\\)\")",
|
|
"Read(//Users/ooo/**)",
|
|
"Bash(mkdir -p ~/Code)",
|
|
"Bash(python3)",
|
|
"Bash(python3 -c \"import py_compile; py_compile.compile\\('routes/daily_sales_routes.py', doraise=True\\); print\\('SYNTAX OK'\\)\")",
|
|
"Bash(python3 -c \"import py_compile; py_compile.compile\\('services/daily_sales_service.py', doraise=True\\); py_compile.compile\\('utils/df_helpers.py', doraise=True\\); print\\('ALL SYNTAX OK'\\)\")"
|
|
],
|
|
"defaultMode": "bypassPermissions",
|
|
"additionalDirectories": [
|
|
"/tmp",
|
|
"/Users/ooo/Library/Mobile Documents/com~apple~CloudDocs/momo-pro-system/.claude/hooks",
|
|
"/Users/ooo/Code/momo-pro-system"
|
|
]
|
|
},
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/momo-prod-guard.js"
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/large-file-warner.js"
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/mcp-health.js"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": "Edit|Write|MultiEdit|Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/commit-quality.js"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"PostToolUse": [
|
|
{
|
|
"matcher": "",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/audit-log.js"
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/suggest-compact.js"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Stop": [
|
|
{
|
|
"matcher": "",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/cost-tracker.js"
|
|
},
|
|
{
|
|
"type": "command",
|
|
"command": "node $CLAUDE_PROJECT_DIR/.claude/hooks/session-summary.js"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|