brennanb2025 and Orca
82ef739ea3
fix(agent-hooks): parse endpoint file and keep hook secrets off argv
...
The managed shell/cmd hook scripts sourced the endpoint file
(`. "$file"` / `call "%file%"`), so any shell/batch written into that
path executed with the agent's privileges. They also passed the hook
token and the raw payload as curl command-line arguments (readable by
other same-UID processes via `ps`/`/proc/<pid>/cmdline`) and did not
disable proxying for the loopback POST.
Add a shared builder (`agent-hooks/managed-hook-script.ts`) used by every
shell/cmd hook:
- Parse only the four known ORCA_AGENT_HOOK_* keys from the endpoint
file; never execute it. Values are assigned as literals, so a command
substitution in the file is stored, not run.
- Stream the token into curl as a header from stdin (`-H @-`) and read
the payload from a private temp file (`--data-urlencode payload@<file>`),
so neither appears on the command line.
- Add `--noproxy 127.0.0.1` so a configured http_proxy/ALL_PROXY cannot
route the token and prompt off-box.
- Validate the port as digits-only; keep the Claude hook silent on stdout.
The JS, Python, and PowerShell hooks already parsed the file and sent the
token as an in-process header, so they are unchanged. On Windows cmd the
token stays on argv (no mktemp; stdin is taken by the payload) — a
documented, same-user-only exposure matching the already-ACL'd endpoint
file.
STA-1284
Co-authored-by: Orca <help@stably.ai >
2026-07-03 18:09:48 -07:00
..
2026-07-03 18:09:48 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 18:09:48 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 19:40:45 -04:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 16:52:08 -07:00
2026-07-03 18:09:48 -07:00
2026-07-03 17:49:29 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 14:12:33 -07:00
2026-07-03 18:09:48 -07:00
2026-07-02 17:01:41 -07:00
2026-06-08 19:23:32 -04:00
2026-06-29 22:38:29 -07:00
2026-07-03 18:09:48 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 18:09:48 -07:00
2026-06-30 01:21:07 -07:00
2026-07-03 18:09:48 -07:00
2026-07-02 23:06:32 -07:00
2026-07-03 18:09:48 -07:00
2026-05-16 14:36:46 -07:00
2026-07-03 18:09:48 -07:00
2026-07-03 17:12:47 -07:00
2026-07-03 18:09:48 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 19:40:45 -04:00
2026-06-17 16:08:14 -07:00
2026-07-03 17:25:32 -07:00
2026-07-03 16:24:01 -07:00
2026-07-03 18:09:48 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 20:02:28 -07:00
2026-07-03 17:52:59 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 18:09:48 -07:00
2026-04-20 19:41:12 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 20:17:46 -07:00
2026-06-28 15:43:07 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 18:32:56 -07:00
2026-05-30 02:46:28 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-06-30 22:14:54 -04:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-07-02 23:06:32 -07:00
2026-07-01 23:09:20 -07:00
2026-07-03 17:04:25 -07:00
2026-07-03 19:40:45 -04:00
2026-06-28 15:43:07 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-05-30 13:26:48 -07:00
2026-07-03 17:20:25 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 19:40:45 -04:00
2026-06-29 22:38:29 -07:00
2026-06-29 18:09:33 -07:00
2026-06-29 22:38:29 -07:00
2026-06-18 22:30:44 -07:00
2026-06-29 22:38:29 -07:00
2026-07-03 19:40:45 -04:00
2026-06-17 16:20:37 -07:00
2026-06-17 16:20:37 -07:00
2026-05-18 14:09:21 -07:00
2026-05-18 14:09:21 -07:00
2026-05-18 14:09:21 -07:00
2026-06-17 16:08:14 -07:00
2026-06-17 16:08:14 -07:00
2026-06-22 18:01:37 -07:00
2026-06-22 18:01:37 -07:00
2026-04-19 12:09:32 -07:00
2026-05-15 23:52:37 -07:00
2026-06-30 11:31:55 -07:00
2026-06-30 11:31:55 -07:00
2026-06-30 11:31:55 -07:00
2026-06-30 11:31:55 -07:00
2026-06-30 11:31:55 -07:00
2026-06-22 13:49:08 -07:00
2026-06-22 13:49:08 -07:00
2026-05-30 15:26:11 -04:00
2026-06-29 22:38:29 -07:00
2026-06-19 17:14:55 -07:00
2026-06-29 22:38:29 -07:00
2026-06-30 11:31:55 -07:00
2026-06-30 11:31:55 -07:00
2026-07-03 17:52:59 -07:00
2026-06-29 22:38:29 -07:00
2026-05-30 09:04:52 -07:00
2026-05-30 09:04:52 -07:00
2026-06-17 16:08:14 -07:00
2026-06-29 00:53:07 -07:00
2026-06-29 00:53:07 -07:00
2026-06-28 23:23:47 -07:00
2026-06-28 23:23:47 -07:00
2026-06-29 12:27:30 -07:00
2026-06-29 12:27:30 -07:00
2026-05-30 09:04:52 -07:00
2026-05-30 09:04:52 -07:00
2026-07-03 19:40:45 -04:00
2026-07-03 19:40:45 -04:00
2026-06-24 00:17:49 -07:00
2026-06-24 00:17:49 -07:00
2026-06-17 16:08:14 -07:00
2026-06-17 16:08:14 -07:00
2026-06-24 21:07:15 -04:00
2026-06-29 22:38:29 -07:00
2026-06-18 16:24:22 -07:00
2026-06-25 17:24:09 -07:00
2026-06-24 19:19:31 -07:00
2026-06-24 19:19:31 -07:00
2026-06-24 19:19:31 -07:00
2026-07-03 19:40:45 -04:00
2026-07-03 19:40:45 -04:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-05-31 02:21:17 -07:00
2026-06-28 11:38:23 -07:00
2026-07-03 17:52:59 -07:00
2026-07-03 17:52:59 -07:00
2026-06-21 18:51:44 -07:00
2026-06-13 14:16:05 -07:00
2026-05-21 21:52:26 -07:00
2026-05-21 21:52:26 -07:00
2026-05-21 21:52:26 -07:00
2026-05-21 21:52:26 -07:00
2026-05-30 10:11:48 -07:00
2026-06-29 22:38:29 -07:00
2026-06-17 16:08:14 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-04-14 10:25:55 -07:00
2026-04-14 10:33:25 -07:00
2026-06-20 16:39:42 -07:00
2026-05-26 20:56:11 -07:00
2026-06-17 16:20:37 -07:00
2026-05-30 13:09:17 -07:00
2026-05-30 13:09:17 -07:00
2026-05-27 00:47:01 -07:00
2026-05-27 00:47:01 -07:00
2026-05-27 00:47:01 -07:00
2026-05-15 23:52:37 -07:00
2026-05-26 20:56:11 -07:00
2026-06-20 16:39:42 -07:00
2026-06-21 13:10:25 -07:00
2026-06-20 16:39:42 -07:00
2026-05-31 10:11:51 -07:00
2026-05-31 10:11:51 -07:00
2026-05-06 23:30:03 -07:00
2026-06-29 22:38:29 -07:00
2026-05-20 22:09:35 -07:00
2026-06-10 16:41:22 -04:00
2026-05-30 11:01:09 -07:00
2026-05-21 13:22:37 -07:00
2026-05-30 11:01:09 -07:00
2026-06-30 11:31:55 -07:00
2026-06-29 18:02:10 -07:00
2026-06-03 12:25:54 -07:00
2026-06-03 12:25:54 -07:00
2026-06-29 22:38:29 -07:00
2026-07-02 11:24:07 -07:00
2026-07-02 11:24:07 -07:00
2026-07-02 11:24:07 -07:00
2026-06-15 14:54:50 -07:00
2026-06-29 22:38:29 -07:00
2026-05-29 16:06:33 -07:00
2026-05-29 16:06:33 -07:00
2026-05-29 16:06:33 -07:00
2026-06-29 00:32:36 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00
2026-06-29 22:38:29 -07:00