mirror of
https://github.com/stablyai/orca.git
synced 2026-10-17 00:03:08 +00:00
brennanb2025andOrca
82ef739ea3
The managed shell/cmd hook scripts sourced the endpoint file (`. "$file"` / `call "%file%"`), so any shell/batch written into that path executed with the agent's privileges. They also passed the hook token and the raw payload as curl command-line arguments (readable by other same-UID processes via `ps`/`/proc/<pid>/cmdline`) and did not disable proxying for the loopback POST. Add a shared builder (`agent-hooks/managed-hook-script.ts`) used by every shell/cmd hook: - Parse only the four known ORCA_AGENT_HOOK_* keys from the endpoint file; never execute it. Values are assigned as literals, so a command substitution in the file is stored, not run. - Stream the token into curl as a header from stdin (`-H @-`) and read the payload from a private temp file (`--data-urlencode payload@<file>`), so neither appears on the command line. - Add `--noproxy 127.0.0.1` so a configured http_proxy/ALL_PROXY cannot route the token and prompt off-box. - Validate the port as digits-only; keep the Claude hook silent on stdout. The JS, Python, and PowerShell hooks already parsed the file and sent the token as an in-process header, so they are unchanged. On Windows cmd the token stays on argv (no mktemp; stdin is taken by the payload) — a documented, same-user-only exposure matching the already-ACL'd endpoint file. STA-1284 Co-authored-by: Orca <help@stably.ai>