fix(claude-code): make install work + hook never crashes the session#39
Merged
Merged
Conversation
… installed The claude-code README documents `/plugin marketplace add agentrust-io/integrations` + `/plugin install agentrust-claude-code`, but no `.claude-plugin/marketplace.json` existed at the repo root, so both commands failed and nobody could install the plugin. Adds the manifest listing the single plugin (source ./claude-code). Passes `claude plugin validate .`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hardens the capture engine so malformed on-disk state degrades gracefully instead of dumping a traceback at session start: - _policy: tolerate malformed settings.json and a non-dict permissions block; still hash the real file bytes so hand-edits are detected as drift. - _mcp_from_config: tolerate malformed or misshaped ~/.claude.json (e.g. mcpServers as a list). - _skills: tolerate ~/.claude/skills being a file, and unreadable SKILL.md. - _load: treat a corrupt baseline/latest as absent so a truncated baseline.json (crash mid-write, disk full, racing sessions) self-heals on the next run instead of bricking every future session. - cmd_hook: wrap the body in a last-resort guard that always emits valid SessionStart output and exits 0. - sign_all: a clear "pip install -r requirements.txt" message when the crypto packages are absent, instead of a raw ModuleNotFoundError. Adds 6 regression tests (13 total). Verified: every crash vector now exits 0 with a benign message, a corrupt baseline self-heals, drift detection still fires, and the full 0.3.0 signing path still passes the TRACE suite. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-launch hardening pass on the claude-code plugin. Found and fixed one install blocker and five hook crash vectors before real users hit them.
🔴 Install blocker
The README tells users to run
/plugin marketplace add agentrust-io/integrationsthen/plugin install agentrust-claude-code, but there was no.claude-plugin/marketplace.jsonat the repo root, so nobody could install the plugin. Added it (single entry,source: ./claude-code). Passesclaude plugin validate ..🟠 SessionStart hook crashes (broke the "never blocks session start" promise)
Each of these threw an uncaught traceback; all now degrade gracefully and exit 0:
settings.json(JSON typo)permissionsnot a dict.claude.jsonmcpServerswrong shape~/.claude/skillsis a filebaseline.jsonFixes: input-hardened
_policy/_mcp_from_config/_skills/_load, plus a last-resorttry/exceptincmd_hookso any unexpected failure still emits valid SessionStart output and exits 0._policystill hashes the real file bytes, so a hand-edit is detected as drift even when the JSON is broken.🟡 UX
/traceandapprove --signwithout the crypto packages now print apip install -r requirements.txthint instead of a rawModuleNotFoundError.Validation
pytest claude-code/tests/test_capture.py-> 13 passed (added 6 regression tests).ruff check ... --select E,F,W --ignore E501-> clean.claude plugin validate .-> passed.report-> TRACE suite PASS (8/8), manifest validates under agent-manifest 0.3.0.Also passed (no change needed)
First-run empty home, missing/partial settings, empty skill folders, unicode + emoji names, non-JSON hook stdin, corrupt
session-latest.json(verify re-snapshots).🤖 Generated with Claude Code