Repository navigation
MLAI-1333 - Run skill-governance hooks through a node launcher for Windows - #88
Merged
Merged
Conversation
VS Code runs hook strings with PowerShell on Windows, which cannot parse the POSIX env prefix and $(date) in the old one-liner, so skills ran unchecked. - plugin/scripts/enforce-skill.mjs: computes the enforcement deadline, sets the npm fetch bounds, and spawns `npx @jfrog/agent-guard --enforce-skill --client vscode` (npx.cmd through cmd.exe on Windows). Exit 2 and stdout pass through; a spawn failure fails open. - hooks.json: UserPromptSubmit and PreToolUse (--prefer-offline) start the launcher. - validate-skill-governance.mjs: asserts the launcher wiring and the Windows spawn plan, and executes the real hook strings against a stub npx. Mirrors the same launcher in jfrog/claude-plugin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
All contributors have signed the CLA ✍️ ✅ |
davida-jfrog
requested changes
Oct 26, 2026
VS Code's PreToolUse denies the tool call on any non-zero exit other than
2, so the launcher's exit 1 on a spawn error, signal or npx failure blocked
every tool call instead of failing open. The launcher now buffers the
child's stdout and passes through only exit 0 or 2 with that output; every
other outcome prints {} and exits 0.
On Windows it runs npm's npx-cli.js with node and no shell, falling back
to npx.cmd under cmd.exe only when npm is not beside node.exe. The fallback
refuses arguments cmd.exe cannot carry (%, ", CR/LF) instead of the %%
escaping, which cmd /c does not undo. The registry comes from the shared
resolveAgentGuardNpmRegistry.
Spawn-plan and exit-code coverage moves to plugin/scripts/enforce-skill.test.mjs
with a fake spawn. The validator now asserts exit 0 and {} for fail-open,
and drops the date(1), POSIX-sh and top-level ';' checks that no longer
test anything.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every fail-open path in the launcher now writes one stderr line naming the cause and stating that the skill was not governed, so a silent allow is diagnosable. The README no longer claims a missing node fails open: the hook command fails before the launcher starts, and PreToolUse denies any exit other than 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
davida-jfrog
approved these changes
Oct 26, 2026
Collaborator
Author
|
I have read the CLA Document and I hereby sign the CLA |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
VS Code runs hook strings with PowerShell on Windows, which cannot parse the POSIX env prefix and $(date) in the old one-liner, so skills ran unchecked.
npx @jfrog/agent-guard --enforce-skill --client vscode(npx.cmd through cmd.exe on Windows). Exit 2 and stdout pass through; a spawn failure fails open.Mirrors the same launcher in jfrog/claude-plugin.