45 lines
1.3 KiB
Python
45 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
||
# -*- coding: utf-8 -*-
|
||
"""PreToolUse guard：人格鎖驗證 + 跨人格資料隔離（唯一的強制執行點）。
|
||
|
||
擋下的情形：
|
||
* 讀寫非「本 session 當前人格」的人格目錄（含 Read/Write/Edit/Glob/Grep/Bash）
|
||
* guest（persona-guest sub agent）寫入任何人格檔案，或換讀別的人格
|
||
* CLI 帶假的 --session（冒用其他程序身分）
|
||
* 目標人格的鎖屬於其他還活著的程序
|
||
"""
|
||
from __future__ import annotations
|
||
|
||
import json
|
||
import sys
|
||
from pathlib import Path
|
||
|
||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "scripts"))
|
||
import persona_lib as pl # noqa: E402
|
||
|
||
|
||
def main() -> int:
|
||
try:
|
||
event = json.load(sys.stdin)
|
||
except json.JSONDecodeError:
|
||
return 0
|
||
try:
|
||
decision, reason = pl.guard_decide(event)
|
||
except Exception as exc: # guard 自己壞掉不該擋住整個 session
|
||
print(f"persona guard 內部錯誤：{exc}", file=sys.stderr)
|
||
return 0
|
||
if decision != "deny":
|
||
return 0
|
||
print(json.dumps({
|
||
"hookSpecificOutput": {
|
||
"hookEventName": "PreToolUse",
|
||
"permissionDecision": "deny",
|
||
"permissionDecisionReason": f"[jsc-persona 隔離] {reason}",
|
||
}
|
||
}, ensure_ascii=False))
|
||
return 0
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main())
|