Skip to content

fix(setup): teach the verify skill's whole-user check about the dispatcher hook flavour #1358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
potiuk merged 1 commit into from
Sep 23, 2026
+40 −19
Merged

fix(setup): teach the verify skill's whole-user check about the dispatcher hook flavour #1358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/mode-economics.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,15 +114,15 @@ arithmetic, which is now tested rather than graded.

<!-- BEGIN GENERATED SKILL TOKEN COUNTS -->

Measured on (UTC): 2026-09-22.
Measured on (UTC): 2026-09-23.

Tokenizer: **tiktoken 0.14.0, `cl100k_base`**. Method: full UTF-8 file,
including frontmatter and comments; line endings normalized to LF;
special-token spellings counted as ordinary text.
Coverage: **75 of 75 local `skills/*/SKILL.md` files**.
External `source.md` redirects and harness symlinks are excluded.

Measurement manifest SHA-256: `85d0fe4f7152f2d8e57b5a92ee1b2f23bf4af93606409da954d15db39e095b40`.
Measurement manifest SHA-256: `81b7316102c485194ddcd519a69ddf6d84e150ada81cced81da97868419e0253`.

| Skill file | Measured tokens | Source SHA-256 (first 16 characters) |
|---|---:|---|
Expand Down Expand Up @@ -192,7 +192,7 @@ Measurement manifest SHA-256: `85d0fe4f7152f2d8e57b5a92ee1b2f23bf4af93606409da95
| [setup-isolated-setup-doctor](../skills/setup-isolated-setup-doctor/SKILL.md) | 4,720 | `f24d416c966167f7` |
| [setup-isolated-setup-install](../skills/setup-isolated-setup-install/SKILL.md) | 3,879 | `9c7d49c9e7ff947d` |
| [setup-isolated-setup-update](../skills/setup-isolated-setup-update/SKILL.md) | 4,017 | `0ff14e482853f519` |
| [setup-isolated-setup-verify](../skills/setup-isolated-setup-verify/SKILL.md) | 4,556 | `5c50d8fd6d5f0df4` |
| [setup-isolated-setup-verify](../skills/setup-isolated-setup-verify/SKILL.md) | 4,562 | `b3f315456ebe2edf` |
| [setup-override-upstream](../skills/setup-override-upstream/SKILL.md) | 3,681 | `968f51a19ccd4d10` |
| [setup-privacy-llm](../skills/setup-privacy-llm/SKILL.md) | 2,055 | `b89f1f5e421df5cc` |
| [setup-shared-config-sync](../skills/setup-shared-config-sync/SKILL.md) | 3,836 | `d8715462e3c23f38` |
Expand Down
2 changes: 1 addition & 1 deletion plugins/magpie-setup/skills/isolated-setup-verify/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ Walk each in order:
It reads **project-local** `settings.local.json`, not user-scope —
[why](../../../../docs/setup/secure-agent-setup.md#project-root-coverage-in-the-sandbox-allowlists).

**Scope detection.** `git config --global --get core.hooksPath` equal to `$HOME/.claude/git-hooks` means **whole-user** scope, which has its own sub-checks and a reminder that per-repo `.git/hooks/*` are inert host-wide:
**Scope detection.** `git config --global --get core.hooksPath` equal to `$HOME/.claude/git-hooks` means **whole-user** scope, in its simple or dispatcher flavour, which has its own sub-checks and a reminder of whether per-repo `.git/hooks/*` still fire:
[`conditional-checks.md`](conditional-checks.md#check-8--whole-user-scope-detection).
Unset or pointing elsewhere means per-project scope, the default, fully covered by the two sub-checks above.

Expand Down
51 changes: 36 additions & 15 deletions plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,24 +17,45 @@ reading this file; read the section for a check whose condition holds.
```

If the output equals `$HOME/.claude/git-hooks` (or its tilde-
resolved form), the operator is in **whole-user** scope:

- ✓ if `~/.claude/git-hooks/post-checkout` exists, is
executable, and matches the framework's
`tools/agent-isolation/git-global-post-checkout.sh` content.
resolved form), the operator is in **whole-user** scope.
Install Step P.0b offers two flavours of it, and the shape of
`~/.claude/git-hooks/` tells them apart:

- **Simple flavour** — `post-checkout` is a regular file, a copy
of `tools/agent-isolation/git-global-post-checkout.sh`.
- **Dispatcher flavour** — `post-checkout` (and every other hook
name) is a symlink to `git-hook-dispatcher.sh` in the same
directory, a copy of `tools/agent-isolation/git-hook-dispatcher.sh`.
The dispatcher supersedes the standalone post-checkout script,
so do **not** compare `post-checkout` against
`git-global-post-checkout.sh` here; read the hook-name symlinks
as the installed shape, not as drift.

Resolve `post-checkout` (`readlink -f`) and check the script it
lands on:

- ✓ if it exists, is executable, and matches its own framework
source (`git-global-post-checkout.sh` for the simple flavour,
`git-hook-dispatcher.sh` for the dispatcher flavour).
- ⚠ if the hook is missing or non-executable — the `core.hooksPath`
pointer is set but the hook content is gone. Remediation:
re-run `setup-isolated-setup-install` Step P.3-whole-user,
re-run `setup-isolated-setup-install` Step P.3-whole-user
(simple) or Step P.3b-whole-user (dispatcher),
or `setup-isolated-setup-update` to refresh the script copy.
- ⚠ if the hook content drifted from the framework's source-of-
truth — surface the diff, propose `setup-isolated-setup-update`.
- **Loud reminder** (every run, not a ✗): when in whole-user
scope, surface a one-line note that per-repo `.git/hooks/*`
are inert across the host (per [`docs/setup/secure-agent-setup.md` → *Per-project vs whole-user scope*](../../../../docs/setup/secure-agent-setup.md#per-project-vs-whole-user-scope)).
This is informational, not a failure — the operator chose it
deliberately during install. Surface so a future self
debugging "why didn't my pre-commit fire" recognises the
cause.
- ⚠ if the script drifted from its framework source-of-truth —
surface the diff, propose `setup-isolated-setup-update`.
- **Loud reminder** (every run, not a ✗), by flavour:
- *Simple:* surface a one-line note that per-repo
`.git/hooks/*` are inert across the host (per [`docs/setup/secure-agent-setup.md` → *Per-project vs whole-user scope*](../../../../docs/setup/secure-agent-setup.md#per-project-vs-whole-user-scope)).
This is informational, not a failure — the operator chose it
deliberately during install. Surface so a future self
debugging "why didn't my pre-commit fire" recognises the
cause.
- *Dispatcher:* surface instead that per-repo `.git/hooks/*`
still fire, because the dispatcher chains to each repo's own
hook (per [`docs/setup/secure-agent-setup.md` → *Whole-user with the per-repo dispatcher*](../../../../docs/setup/secure-agent-setup.md#whole-user-with-the-per-repo-dispatcher)).
Do not report them as inert; that is the simple flavour's
cost, which this flavour exists to remove.

If `core.hooksPath` is unset (or points elsewhere), the
operator is in **per-project** scope (the default). No further
Expand Down