fix/cursor: inline creds and --env into every Cursor hook - #36
Merged
Conversation
Cursor hooks other than sessionStart read their credentials from $AGENT_HOOK_ENDOR_* env that endorctl injected via the sessionStart hook's `env` output. Cursor staff have confirmed that env is lost when a conversation is resumed after a restart and is never inherited by hooks fired inside subagents, so those sessions ran endorctl with empty flags and silently failed open (no audit, no enforcement). Render the literal --api/--namespace/--api-key/--api-secret flags and the --env behavior settings into every Cursor hook command instead, the way the Codex builder already does. Each hook is now self-contained. Both builders share the new posix_inline / ps_inline strings; Codex and Claude output is byte-identical to before. Also regenerate examples/codex/requirements.windows.toml, which was never regenerated after 4a41f77 fixed the missing newline before the `$in |` line. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Resolve examples/codex/requirements.windows.toml by regenerating all examples with the merged render.sh; tests/run-tests.sh passes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
oh, interesting, did not realize that they had these bugs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Cursor hooks other than
sessionStartread their credentials from$AGENT_HOOK_ENDOR_*env that endorctl injected through thesessionStarthook'senvoutput. Cursor staff have confirmed two unfixed bugs with that mechanism:In both cases every later hook ran endorctl with empty flags and Cursor failed open: no audit, no enforcement. The same happened whenever the
sessionStartbootstrap exited non-zero.What
render.sh: render the literal--api/--namespace/--api-key/--api-secretflags and the--envbehavior settings into every Cursor hook command, as the Codex builder already did. Each hook is now self-contained. Cursor and Codex share the newposix_inline/ps_inlinestrings.README.md: update the behavior-settings and credential-isolation wording; add a "Self-contained hooks (Cursor)" security note.sessionStartis byte-identical.Verification
mainscript and this one. Claude and Codex output is byte-identical; Cursor differs in exactly 11 lines per target.$env:lines, inlined endorctl call.', a secret containing$and", and an--envvalue with a space and;. Per-hook command matches the session hook's inline form exactly.origin/main(nonblocking bootstrap, [AI-536] agent-governance: stop the endorctl download from blocking session start #21) and regenerated all 8 examples with the merged generator;tests/run-tests.shpasses 71/71, including the examples-in-sync check.Follow-ups
sessionStarthandler can drop itsenvoutput once fleets are on this config.ai_governance_demo'sbuild_hooks.pystill generates hooks against the oldAGENT_HOOK_ENDOR_*contract.🤖 Generated with Claude Code