fix(prometheus): enforce path constraints and atomic write protocol (#1414)

* fix(prometheus): enforce path constraints and atomic write protocol

- Add FORBIDDEN PATHS section blocking docs/, plan/, plans/ directories
- Add SINGLE ATOMIC WRITE protocol to prevent content loss from multiple writes
- Simplify PROMETHEUS_AGENTS array to single PROMETHEUS_AGENT string

* fix: reconcile Edit tool signature in interview-mode.ts with identity-constraints.ts

Identified by cubic: Edit tool usage was inconsistent between files.

- interview-mode.ts showed: Edit(path, content)
- identity-constraints.ts showed: Edit(path, oldString="...", newString="...")

Updated interview-mode.ts to use the correct Edit signature with oldString and newString parameters to match the actual tool API and prevent agent hallucination.
This commit is contained in:
YeonGyu-Kim
2026-02-03 12:11:52 +09:00
committed by GitHub
parent 7ebafe2267
commit ec1cb5db05
4 changed files with 57 additions and 6 deletions
+1 -1
View File
@@ -3,7 +3,7 @@ import { getAgentDisplayName } from "../../shared/agent-display-names"
export const HOOK_NAME = "prometheus-md-only"
export const PROMETHEUS_AGENTS = ["prometheus"]
export const PROMETHEUS_AGENT = "prometheus"
export const ALLOWED_EXTENSIONS = [".md"]
+2 -2
View File
@@ -1,7 +1,7 @@
import type { PluginInput } from "@opencode-ai/plugin"
import { existsSync, readdirSync } from "node:fs"
import { join, resolve, relative, isAbsolute } from "node:path"
import { HOOK_NAME, PROMETHEUS_AGENTS, ALLOWED_EXTENSIONS, ALLOWED_PATH_PREFIX, BLOCKED_TOOLS, PLANNING_CONSULT_WARNING, PROMETHEUS_WORKFLOW_REMINDER } from "./constants"
import { HOOK_NAME, PROMETHEUS_AGENT, ALLOWED_EXTENSIONS, ALLOWED_PATH_PREFIX, BLOCKED_TOOLS, PLANNING_CONSULT_WARNING, PROMETHEUS_WORKFLOW_REMINDER } from "./constants"
import { findNearestMessageWithFields, findFirstMessageWithAgent, MESSAGE_STORAGE } from "../../features/hook-message-injector"
import { getSessionAgent } from "../../features/claude-code-session-state"
import { log } from "../../shared/logger"
@@ -82,7 +82,7 @@ export function createPrometheusMdOnlyHook(ctx: PluginInput) {
): Promise<void> => {
const agentName = getAgentFromSession(input.sessionID)
if (!agentName || !PROMETHEUS_AGENTS.includes(agentName)) {
if (agentName !== PROMETHEUS_AGENT) {
return
}