fix(go): sync hardened Copilot hooks
This commit is contained in:
ZacharyZhang-NY committed
1 parent
5384565b4f
commit
b6112cffd9
9 files changed
+1566
-206
No files matched your search
@@ -4,258 +4,162 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// CopilotPlugin manages the Elydora audit hook for GitHub Copilot CLI.
|
||||
// It writes/merges into .github/hooks/hooks.json (project-relative) using
|
||||
// hooks.preToolUse[]/postToolUse[] with bash/powershell command fields.
|
||||
type CopilotPlugin struct{}
|
||||
|
||||
func (p *CopilotPlugin) configPath() (string, error) {
|
||||
cwd, err := os.Getwd()
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("resolve working directory: %w", err)
|
||||
}
|
||||
return filepath.Join(cwd, ".github", "hooks", "hooks.json"), nil
|
||||
// CopilotPlugin manages GitHub Copilot CLI native user hooks.
|
||||
type CopilotPlugin struct {
|
||||
rename renameFunc
|
||||
}
|
||||
|
||||
func (p *CopilotPlugin) Install(config InstallConfig) error {
|
||||
scriptPath, err := hookScriptPath(config.AgentID)
|
||||
if config.AgentID == "" {
|
||||
return fmt.Errorf("agent ID is required")
|
||||
}
|
||||
sources, err := readCopilotSources()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if config.HookScript != "" {
|
||||
scriptPath = config.HookScript
|
||||
if sources.user.disabled {
|
||||
return fmt.Errorf(
|
||||
"GitHub Copilot user hooks are disabled by disableAllHooks at %s",
|
||||
sources.user.filePath,
|
||||
)
|
||||
}
|
||||
|
||||
if err := GenerateHookScript(scriptPath, config); err != nil {
|
||||
return fmt.Errorf("generate hook script: %w", err)
|
||||
runtimeRoot, err := AgentRuntimeRoot()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
guardPath := config.GuardScriptPath
|
||||
if guardPath == "" {
|
||||
guardPath, err = guardScriptPath(config.AgentID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
agentDirectory, err := ResolveAgentRuntimeDirectory(config.AgentID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
configPath, err := p.configPath()
|
||||
expectedGuard := filepath.Join(agentDirectory, copilotGuardScript)
|
||||
if !sameCopilotPath(config.GuardScriptPath, expectedGuard) {
|
||||
return fmt.Errorf("Elydora guard runtime must use the managed agent directory: %s", expectedGuard)
|
||||
}
|
||||
if err := requireCopilotRuntime(expectedGuard, "Elydora guard runtime"); err != nil {
|
||||
return err
|
||||
}
|
||||
auditPath := filepath.Join(agentDirectory, copilotAuditScript)
|
||||
if config.HookScript != "" && !sameCopilotPath(config.HookScript, auditPath) {
|
||||
return fmt.Errorf("Elydora audit runtime must use the managed agent directory: %s", auditPath)
|
||||
}
|
||||
nodePath, err := resolveNodeRuntime()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
settings, err := readJSONFile(configPath)
|
||||
userHooks := removeManagedCopilotHooks(sources.user.hooks, runtimeRoot, "")
|
||||
userHooks["preToolUse"] = append(
|
||||
userHooks["preToolUse"],
|
||||
buildCopilotHandler(nodePath, expectedGuard),
|
||||
)
|
||||
userHooks["postToolUse"] = append(
|
||||
userHooks["postToolUse"],
|
||||
buildCopilotHandler(nodePath, auditPath),
|
||||
)
|
||||
userRendered, err := renderCopilotDocument(sources.user, userHooks)
|
||||
if err != nil {
|
||||
return fmt.Errorf("render GitHub Copilot user hooks: %w", err)
|
||||
}
|
||||
rendered := []*copilotRenderedDocument{userRendered}
|
||||
if sources.legacy != nil {
|
||||
legacyHooks := removeManagedCopilotHooks(sources.legacy.hooks, runtimeRoot, "")
|
||||
legacyRendered, renderErr := renderCopilotDocument(sources.legacy, legacyHooks)
|
||||
if renderErr != nil {
|
||||
return fmt.Errorf("render GitHub Copilot project hooks: %w", renderErr)
|
||||
}
|
||||
rendered = append(rendered, legacyRendered)
|
||||
}
|
||||
changes, err := prepareCopilotInstallationChanges(
|
||||
config,
|
||||
agentDirectory,
|
||||
auditPath,
|
||||
rendered,
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Ensure version field is set
|
||||
settings["version"] = float64(1)
|
||||
|
||||
// Ensure hooks object exists
|
||||
hooks, _ := settings["hooks"].(map[string]interface{})
|
||||
if hooks == nil {
|
||||
hooks = make(map[string]interface{})
|
||||
}
|
||||
|
||||
// --- preToolUse (guard — freeze enforcement) ---
|
||||
preToolUse, _ := hooks["preToolUse"].([]interface{})
|
||||
var preFiltered []interface{}
|
||||
for _, entry := range preToolUse {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if isCopilotElydoraEntry(m) {
|
||||
continue
|
||||
}
|
||||
}
|
||||
preFiltered = append(preFiltered, entry)
|
||||
}
|
||||
guardEntry := map[string]interface{}{
|
||||
"type": "command",
|
||||
"bash": "node " + guardPath,
|
||||
"powershell": "node " + guardPath,
|
||||
"timeoutSec": float64(5),
|
||||
}
|
||||
preFiltered = append(preFiltered, guardEntry)
|
||||
hooks["preToolUse"] = preFiltered
|
||||
|
||||
// --- postToolUse (audit logging) ---
|
||||
postToolUse, _ := hooks["postToolUse"].([]interface{})
|
||||
var postFiltered []interface{}
|
||||
for _, entry := range postToolUse {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if isCopilotElydoraEntry(m) {
|
||||
continue
|
||||
}
|
||||
}
|
||||
postFiltered = append(postFiltered, entry)
|
||||
}
|
||||
hookEntry := map[string]interface{}{
|
||||
"type": "command",
|
||||
"bash": "node " + scriptPath,
|
||||
"powershell": "node " + scriptPath,
|
||||
"timeoutSec": float64(5),
|
||||
}
|
||||
postFiltered = append(postFiltered, hookEntry)
|
||||
hooks["postToolUse"] = postFiltered
|
||||
|
||||
settings["hooks"] = hooks
|
||||
|
||||
if err := writeJSONFile(configPath, settings); err != nil {
|
||||
if err := writeChanges(changes, "Install GitHub Copilot hooks", p.rename); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Printf("Installed Elydora hook for Copilot CLI at %s\n", configPath)
|
||||
fmt.Printf(" GitHub Copilot CLI hooks: %s\n", sources.user.filePath)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (p *CopilotPlugin) Uninstall(agentID string) error {
|
||||
configPath, err := p.configPath()
|
||||
sources, err := readCopilotSources()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
settings, err := readJSONFile(configPath)
|
||||
runtimeRoot, err := AgentRuntimeRoot()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
hooks, _ := settings["hooks"].(map[string]interface{})
|
||||
if hooks == nil {
|
||||
fmt.Println("No Copilot CLI hooks found.")
|
||||
return nil
|
||||
documents := []*copilotDocument{sources.user}
|
||||
if sources.legacy != nil {
|
||||
documents = append(documents, sources.legacy)
|
||||
}
|
||||
|
||||
// Remove preToolUse Elydora entries
|
||||
preToolUse, _ := hooks["preToolUse"].([]interface{})
|
||||
var preFiltered []interface{}
|
||||
for _, entry := range preToolUse {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if isCopilotElydoraEntry(m) {
|
||||
continue
|
||||
}
|
||||
changes := make([]*fileChange, 0, len(documents))
|
||||
for _, document := range documents {
|
||||
hooks := removeManagedCopilotHooks(document.hooks, runtimeRoot, agentID)
|
||||
rendered, renderErr := renderCopilotDocument(document, hooks)
|
||||
if renderErr != nil {
|
||||
return fmt.Errorf("render GitHub Copilot hook source: %w", renderErr)
|
||||
}
|
||||
preFiltered = append(preFiltered, entry)
|
||||
}
|
||||
if len(preFiltered) == 0 {
|
||||
delete(hooks, "preToolUse")
|
||||
} else {
|
||||
hooks["preToolUse"] = preFiltered
|
||||
}
|
||||
|
||||
// Remove postToolUse Elydora entries
|
||||
postToolUse, _ := hooks["postToolUse"].([]interface{})
|
||||
var postFiltered []interface{}
|
||||
for _, entry := range postToolUse {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if isCopilotElydoraEntry(m) {
|
||||
continue
|
||||
}
|
||||
change, changeErr := prepareRenderedCopilotChange(rendered)
|
||||
if changeErr != nil {
|
||||
return changeErr
|
||||
}
|
||||
postFiltered = append(postFiltered, entry)
|
||||
changes = append(changes, change)
|
||||
}
|
||||
if len(postFiltered) == 0 {
|
||||
delete(hooks, "postToolUse")
|
||||
} else {
|
||||
hooks["postToolUse"] = postFiltered
|
||||
}
|
||||
|
||||
if len(hooks) == 0 {
|
||||
delete(settings, "hooks")
|
||||
} else {
|
||||
settings["hooks"] = hooks
|
||||
}
|
||||
|
||||
if err := writeJSONFile(configPath, settings); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if agentID != "" {
|
||||
scriptPath, _ := hookScriptPath(agentID)
|
||||
if scriptPath != "" {
|
||||
os.Remove(scriptPath)
|
||||
}
|
||||
gPath, _ := guardScriptPath(agentID)
|
||||
if gPath != "" {
|
||||
os.Remove(gPath)
|
||||
}
|
||||
}
|
||||
fmt.Println("Uninstalled Elydora hook for Copilot CLI.")
|
||||
return nil
|
||||
return writeChanges(changes, "Uninstall GitHub Copilot hooks", p.rename)
|
||||
}
|
||||
|
||||
func (p *CopilotPlugin) Status() (PluginStatus, error) {
|
||||
configPath, err := p.configPath()
|
||||
if err != nil {
|
||||
return PluginStatus{}, err
|
||||
}
|
||||
|
||||
userPath, _, pathErr := copilotConfigPaths()
|
||||
entry := SupportedAgents[copilotAgentKey]
|
||||
status := PluginStatus{
|
||||
AgentName: "copilot",
|
||||
DisplayName: "Copilot CLI",
|
||||
ConfigPath: configPath,
|
||||
AgentName: copilotAgentKey, DisplayName: entry.Name, ConfigPath: userPath,
|
||||
}
|
||||
|
||||
settings, err := readJSONFile(configPath)
|
||||
if pathErr != nil {
|
||||
return status, pathErr
|
||||
}
|
||||
sources, err := readCopilotSources()
|
||||
if err != nil {
|
||||
return status, err
|
||||
}
|
||||
runtimeRoot, err := AgentRuntimeRoot()
|
||||
if err != nil {
|
||||
return status, err
|
||||
}
|
||||
contracts := activeCopilotContracts(sources, runtimeRoot)
|
||||
status.ConfigPath = configuredCopilotPath(sources, runtimeRoot)
|
||||
status.HookConfigured = len(contracts) > 0
|
||||
if !status.HookConfigured {
|
||||
return status, nil
|
||||
}
|
||||
|
||||
hooks, _ := settings["hooks"].(map[string]interface{})
|
||||
if hooks != nil {
|
||||
preConfigured := hasCopilotElydoraEntry(hooks["preToolUse"])
|
||||
postConfigured := hasCopilotElydoraEntry(hooks["postToolUse"])
|
||||
status.HookConfigured = preConfigured && postConfigured
|
||||
|
||||
// Extract hook script path from the configured command
|
||||
scriptPath := extractCopilotElydoraScriptPath(hooks["postToolUse"])
|
||||
if scriptPath != "" {
|
||||
if _, err := os.Stat(scriptPath); err == nil {
|
||||
status.HookScriptExists = true
|
||||
}
|
||||
}
|
||||
status.HookScriptExists, err = copilotRuntimeFilesExist(contracts)
|
||||
if err != nil {
|
||||
return status, err
|
||||
}
|
||||
|
||||
status.Installed = status.HookConfigured && status.HookScriptExists
|
||||
status.Installed = status.HookScriptExists
|
||||
return status, nil
|
||||
}
|
||||
|
||||
// isCopilotElydoraEntry checks if a Copilot hook entry (bash/powershell fields) is an Elydora hook.
|
||||
func isCopilotElydoraEntry(m map[string]interface{}) bool {
|
||||
if bash, _ := m["bash"].(string); strings.Contains(bash, "elydora") {
|
||||
return true
|
||||
func requireCopilotRuntime(path, label string) error {
|
||||
if path == "" {
|
||||
return fmt.Errorf("%s path is required", label)
|
||||
}
|
||||
if ps, _ := m["powershell"].(string); strings.Contains(ps, "elydora") {
|
||||
return true
|
||||
info, err := os.Lstat(path)
|
||||
if os.IsNotExist(err) {
|
||||
return fmt.Errorf("%s is missing: %s", label, path)
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// hasCopilotElydoraEntry checks if a Copilot hook array contains an Elydora entry.
|
||||
func hasCopilotElydoraEntry(hookArray interface{}) bool {
|
||||
arr, _ := hookArray.([]interface{})
|
||||
for _, entry := range arr {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if isCopilotElydoraEntry(m) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
if err != nil {
|
||||
return fmt.Errorf("read %s at %s: %w", label, path, err)
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// extractCopilotElydoraScriptPath extracts the script path from a Copilot hook array's Elydora command.
|
||||
func extractCopilotElydoraScriptPath(hookArray interface{}) string {
|
||||
arr, _ := hookArray.([]interface{})
|
||||
for _, entry := range arr {
|
||||
if m, ok := entry.(map[string]interface{}); ok {
|
||||
if bash, _ := m["bash"].(string); strings.Contains(bash, "elydora") {
|
||||
return extractPathFromNodeCommand(bash)
|
||||
}
|
||||
if ps, _ := m["powershell"].(string); strings.Contains(ps, "elydora") {
|
||||
return extractPathFromNodeCommand(ps)
|
||||
}
|
||||
}
|
||||
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
||||
return fmt.Errorf("%s path is not a physical file: %s", label, path)
|
||||
}
|
||||
return ""
|
||||
return nil
|
||||
}
|
||||
Reference in new issue
Block a user