feat(hooks): add auditor timeout overrides - #13
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (29)
📝 WalkthroughWalkthroughThe plugin adds auditor lifecycle control for long-running audits, prompt-scoped force-pass overrides, shared Bash state libraries, separate Claude and Codex hook manifests, extensive contract tests, updated guidance, and version ChangesAuditor lifecycle and override flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Auditor
participant AuditorControl
participant Hook
participant User
Auditor->>Hook: Start audit
Hook->>AuditorControl: Start generation
AuditorControl->>AuditorControl: Escalate after timeout
AuditorControl->>User: Present keep-waiting or force-pass choice
User->>Hook: Submit selection or force-pass directive
Hook->>AuditorControl: Consume choice and close state
Auditor->>Hook: Return terminal verdict
Hook->>AuditorControl: Stop generation and record completion
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
DorianZheng
changed the title
DorianZheng
marked this pull request as ready for review
August 29, 2026 17:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Long-running
commit-push-auditorandverdict-auditortasks had no native,prompt-scoped escape hatch. A user could keep waiting or cancel the parent task, but
could not explicitly override only the auditor gates after the audit exceeded 30
seconds.
The lifecycle also crosses host-generated wake/completion notifications, replacement
generations, prompt epochs, and untrusted runtime cache files. Treating those as one
inline hook branch made the behavior difficult to reuse and left identity, replay, and
special-file boundaries too easy to loosen.
User impact
After 30 seconds, Claude Code now presents one native card with two choices:
running.
OVERRIDDEN BY USERfor bothauditor gates for the current prompt only. It never creates a PASS dossier.
Doing nothing leaves the auditor running. A stale card cannot authorize an override
after its exact audit generation completes or is replaced. Installation, guidance,
review, chained-hook, push-ref, permission, and remote-protection gates remain active.
Root cause
Auditor identity, serialized lifecycle transitions, cache persistence, and host prompt
rendering lived in one script-level control flow. Claude's exact custom-agent names and
Codex's transcript task paths were initially passed through the same fuzzy matcher.
Cache records were validated by content without consistently binding the exact expected
filename, and prompt fields were rendered without a reusable single-line boundary.
Fix
start, escalation, selection, completion, prompt, and terminal transitions.
choices, single-line fields, and explicit command labels.
separate and bound to the hook session and agent IDs.
paths; quarantine recoverable directories and reject forged, replayed, stale, FIFO,
symlink, and replacement-generation state.
those non-authorizing receipts suppress real user prompts.
asyncRewakeversusasync.shell-engineeringskill and project instruction so later Bashwork keeps the same namespacing, facade, state-safety, and verification conventions.
Call graph
Key: the executable composes identity, state, and rendering; each reusable module
owns one reason to change.
Validation
replay credits, prompt control-line injection, and lookalike Claude agent names.
bash -nand ShellCheck warning-level checks; the threerefactored production modules pass full
shellcheck -xanalysis.git diff --checkpass.Summary by CodeRabbit
New Features
Documentation
Chores
Tests