alexion
e684ac481e
Adopt the convention that a Module's option path mirrors its directory under modules/, with an index file naming the directory's own segment. - Group agent Modules under modules.agents.*: claude-code (whole directory), pi (flattened to a file), skills (renamed from agent-skills), and gitea-axi under an agents/tools/ subgroup. The agents/ and tools/ folders are pure namespace prefixes with no aggregator enable. - Nest hypridle and hyprlock under modules.desktop.hyprland.*, with hyprland.nix as the index, and update the desktop aggregator. - Remove the obsolete example Module. - Record the convention in CONTEXT.md and ADR 0004, and update the neogaia host, the two live CLAUDE.md gotchas, and the skills Module's intentional Enable-convention exception comment.
30 lines
1.2 KiB
Bash
Executable File
30 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# agent-sudo-guard.sh — refuse a privileged command while sudo's credential
|
|
# cache is cold, naming the command that warms it.
|
|
#
|
|
# Commands arrive here from subprocesses holding no terminal, so an uncached
|
|
# sudo fails with a bare non-zero exit and no output, reading as an unexplained
|
|
# stall. The probe below reads a cache keyed per user rather than per terminal,
|
|
# so an authentication made in the operator's own terminal counts.
|
|
|
|
input=$(cat)
|
|
command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
|
|
|
|
# Anchored to a command position so a `sudo` appearing as an argument or inside
|
|
# a string does not trip the guard.
|
|
if ! printf '%s' "$command" | grep -qE '(^|[;&|(]|&&|\|\|)[[:space:]]*sudo([[:space:]]|$)'; then
|
|
exit 0
|
|
fi
|
|
|
|
if sudo -n true 2>/dev/null; then
|
|
exit 0
|
|
fi
|
|
|
|
# Exit 2 blocks the call and feeds stderr back to the agent.
|
|
echo 'Blocked: sudo has no cached credential, and this command cannot answer a password prompt.
|
|
Ask the operator to run `sudo -v` in their own terminal, then retry.
|
|
Never attempt to supply a password directly.
|
|
If this still blocks immediately after the operator runs `sudo -v`, the cache is
|
|
not the cause: check that this hook can reach sudo at all.' >&2
|
|
exit 2
|