Template
mrcharles
374288a105
Extract patterns from 18 projects across two machines (12 local infra + 6 remote personal/business via ssh survey). Ship a reusable Gitea template with AGENTS.md, 5 Crush PreToolUse hooks, git pre-commit/pre-push, a generalized rules engine, shared bash library, Makefile, lifecycle scripts, and gardening loop. Includes the canonical BASELINE-PROMPT.md (13 sections) and PATTERNS.md (standardization scorecard). The repo self-applies: it passes its own shellcheck (zero info-level), make fast, and all check-rules.sh checks. 💘 Generated with Crush Assisted-by: Crush via Crush <crush@charm.land>
31 lines
1.5 KiB
Bash
Executable File
31 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Hook: enforce-bash (PreToolUse, matcher: ^bash$)
|
|
# Intercepts every bash tool call and blocks two classes of violation:
|
|
# 1. Banned host-mutating / network commands (per AGENTS.md policy).
|
|
# 2. Host-level language toolchains — they must run inside Docker so the
|
|
# host stays clean.
|
|
set -euo pipefail
|
|
|
|
CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"
|
|
|
|
# --- 1. Banned commands -----------------------------------------------------
|
|
# Extend PROJECT_BANNED_COMMANDS (space-separated) via env to add project-specific bans.
|
|
BANNED_COMMANDS="${PROJECT_BANNED_COMMANDS:-sudo su doas apt apt-get dnf emerge pacman yum zypper apk opkg curl wget ssh scp telnet nc firefox chrome safari httpie}"
|
|
for bc in $BANNED_COMMANDS; do
|
|
if printf '%s' "$CMD" | grep -qE "(^|[[:space:]])${bc}([[:space:]]|$)"; then
|
|
echo "BLOCKED: AGENTS.md — '$bc' is a banned command. This project is Docker-only; do host work through containers or approved wrappers." >&2
|
|
exit 2
|
|
fi
|
|
done
|
|
|
|
# --- 2. Host-level language tools ------------------------------------------
|
|
# python3/go/node/npm/cargo/etc. must appear inside a `docker run|exec|build`.
|
|
if printf '%s' "$CMD" | grep -qE '(^|[[:space:]])(python3?|go test|go vet|gofmt|go run|node|npm|npx|yarn|pnpm|ruby|java|javac|rustc|cargo)([[:space:]]|$)'; then
|
|
if ! printf '%s' "$CMD" | grep -qE 'docker (run|exec|build)'; then
|
|
echo "BLOCKED: AGENTS.md — language tools must run inside Docker, not on the host. Use: scripts/docker-run.sh <pinned-image> <command>" >&2
|
|
exit 2
|
|
fi
|
|
fi
|
|
|
|
echo '{}'
|