perf(hooks): parse Write/Edit payloads once, in the C locale, and drop per-edit spawns

[kyle-sexton]

No related issue: WSL hook-latency program, rounds 1 to 5 (Write/Edit PostToolUse window); no GitHub issue was filed for it.

Summary

Every Write and Edit waits on the PostToolUse hooks, and on WSL the window was 85 ms p50 for a small .txt edit and 399 ms for a 33 KB Markdown edit. Most of it was not the hooks' work. Round 1: the builtin JSON parse ran under the UTF-8 locale, hook::begin re-piped its buffered payload through a byte-at-a-time read, guardrails parsed and resolved the same payload once per verifier, and repo_relative_path_to probed every PATH directory for a Windows-only cygpath. Round 2: every hook paid a #!/usr/bin/env bash hop, a realpath process, and stale-path-verify ran up to nine grep/sed/sort/head processes per Markdown edit. Round 4: the JSON skeleton spent about 3.6 ms per parse compiling one regex per token. Round 5: a 33 KB Markdown edit still started two jq processes that could be answered in the shell. No hook's output changes.

Fix

Merge with #4450 (a74f8e8, 1c5ebf1; merge 0d17cdd). #4450 moved every row to bash "${CLAUDE_PLUGIN_ROOT}"/hooks/<script> with "shell": "bash" and added exit-before-source on every event. Both hold here. The rows this PR changed keep exec on top of #4450's shape: bash-format (2), markdown-format (2), guardrails post-verify (5), and context-guard zone-crossing (2). Claude Code runs a row through sh -c (dash) on Linux, and dash forks for a trailing bash ...; exec bash ... does not (strace: 1 fork vs 0). The eol-normalizer and typos-format rows are now byte-identical to main. In zone-crossing-inject.sh, this PR's no-context-dir exit and #4450's hoisted kill switch both run before the first source; both are silent exit 0. Every overlapping carrier moves one patch above main again (claude-ops 0.61.1, source-control 0.58.1).

Round 5 (0c3960e, 65fab8c; merges a80cd01, eeae865):

• lib/hook-utils.sh (17 carriers): hook::_fast_fields also proves .key // false | tostring and .key.sub // false | tostring (absent or null -> false, a boolean -> its name, a string -> itself; anything else -> jq). Fuzzed against jq on 6000 payloads under C.UTF-8, C and OSTYPE=msys (1131 answered, 0 mismatches); the old filter shapes are unchanged on the round-4 corpora.
• guardrails/hooks/skill-reference-verify.sh: the plugins-root gate runs before the payload read. With the lib change, the post-verify dispatcher starts no jq on a .md edit outside a marketplace repo (it had one per edit, for the structuredPatch filter). Inside a marketplace repo nothing changes: one jq, shared with stale-path-verify through the cache. run-guards test covers both.
• typos-format/hooks/typos-format.sh: in report-only mode (the default) the finding classifier is built with builtins, byte-identical to the jq program's output, when every output line is a typo finding in typos' field order with printable-ASCII text and no quote or backslash, and the output is at most 16 KB. Anything else, write mode, and Windows bash run jq. 0.2 ms vs 2.9 ms for jq (primitive). Fuzzed on 7000 synthetic typos outputs (1857 answered, 0 mismatches); parity cases in typos-format.test.sh.

Round 4 (5db7897; merges 98209f4, 8c049af, e681934):

• lib/hook-utils.sh (17 carriers): hook::_json_skeleton checks the grammar with whole-string rewrites instead of one anchored regex (a regcomp) per token: one regex for whitespace inside a token or between two scalars, one for every scalar token, then a reduction loop over a grammar string (per pass k:v, s:v, v,v, m,m, {m}, {}, [v], [], root wrapped as <k:ROOT>). Escapes and control bytes are one search over the whole neutralized payload. A structure past 8192 characters outside strings goes to jq. Parse of the S1 payload 3.6 -> 0.64 ms, S3 5.0 -> 2.1 ms (primitive).
• markdown-format.sh (normalize_path_entry, once per PATH entry on the missing-markdownlint notice) and powershell-format.sh (to_pwsh_path): cygpath only on msys/cygwin/win32; both trust gates test for a drive-letter path before the lookup.
• Not done: the S3 timed stdin read. bash 5.3 masks SIGCHLD around every character of a timed read (read.def 731-742; TMOUT too), any untimed phase blocks forever on a never-closed pipe, and no standard tool implements the sliced idle bound, so no replacement keeps the stall semantics identical.
• Every carrier re-bumped one patch above main's after fix(guardrails): grant the temp-tree exemption on Windows drive paths #4394 took the same numbers; CHANGELOG bullets under the new version.

Round 3 (cd1b9d9, 21c1ef5; merges b0a5009, 0eda101):

• bash-format/hooks/bash-format.sh: cygpath is looked up only on msys/cygwin/win32, as in hook::repo_relative_path_to. Elsewhere the miss probed every PATH directory, including 9 /mnt/c entries on WSL; bash-format was the slowest .sh PostToolUse hook because of it.
• guardrails/hooks/stale-path-verify.sh: a word anchor's occurrence count uses spv_word_occurrences (awk split on non-word bytes under C) instead of a per-character walk (33 KB file: 14 -> 2 ms); a word anchor with . or - skips the count, which the walk never matched. Non-word anchors keep the walk. Parity test against the walk added.
• typos-format/hooks/typos-format.sh: the classifier returns counts and arrays through tostring, so hook::jq_fields reads them with the builtin parser instead of a second jq.
• lib/hook-utils.sh (17 carriers): the skeleton's control-byte and escape checks are one regex search each on Linux and macOS (Windows bash keeps the glob checks, its regex decodes UTF-8 under C), and the key walks take a key's text from its split part when no escape was rewritten in it, instead of slicing the whole payload per string.
• CHANGELOG bullets added to each carrier's existing entry.

Round 2 (2540560, 9cc5cdf, 99d6205):

• hooks.json (superseded in part by feat(ci): hook slow-shapes gate, bash-prefix sweep, and exit-before-source on every event #4450, which shipped the bash prefix and "shell": "bash" on every row and exec bash on the typos-format and eol-normalizer rows): what remains of this PR is exec in front of bash on the markdown-format (2), bash-format (2), guardrails post-verify (5) and context-guard zone-crossing (PostToolBatch, UserPromptSubmit) rows. bash-format's launch-gate test accepts both forms.
• lib/hook-utils.sh (synced to all 17 carriers): new hook::_physical_builtin_to answers realpath's question with builtin cd -P in one subshell, Linux only, for absolute existing directories and existing non-symlink files; every other path, and Git Bash and macOS, still runs realpath. Used by hook::_physical_prime and hook::physical_path_to.
• guardrails/hooks/stale-path-verify.sh: builtin twins of the code-span scan, the reconstruction token set, its anchor lines and its recovered context, used only for printable-ASCII text; any other byte keeps the pipelines.
• context-guard/hooks/zone-crossing-inject.sh: exits before sourcing its libraries when ~/.claude/context-guard/context does not exist and jq is on PATH (no snapshot and no compaction marker for any session, so the hook could only reach a silent unknown).
• Tests: stale-path twins vs pipelines on 14 fixed texts plus the gate; _physical_builtin_to vs realpath per shape and its declined shapes; the unresolved-path probe disables the builtin with enable -n cd; run-guards expects 0 realpath on Linux.
• CHANGELOG bullets added to each carrier's existing entry for this PR (versions were bumped in round 1).

Round 1 (7630993 .. c8daa81): C-locale builtin JSON parse (hook::_c_locale), buffer_stdin_to without jq -e . for a proven object, read_file_path_to/raw_file_path_to on the buffered payload, cygpath lookup only on Windows bashes, _uncached twins; run-guards caches path, root and fields per event; eol-normalizer skips git rev-parse with no sink; context-guard starts its resolver only with a readable snapshot; instruction-placement SC2154 init.

Final verdicts

• S1 .txt, S2 .md, S2 .sh: MET. Every exec-count target: MET.
• S3 (33 KB .md): NOT MET. 70 ms p50 against a 60 ms target, per the independent verifier at 0d17cdd.
• The guardrails post-verify exec count of 3 on a .md edit holds only outside a marketplace repo; inside one, the dispatcher still starts one jq.
• Part of the before -> after speedup comes from main commits merged in after base 3fa014b, not from this PR alone.
• The implementer's windows.py dropped the first call per log; the verifier's own cuts, which keep it, gave the same verdicts.
• Modes not exercised: markdown-format lint output, bash-format shfmt/shellcheck output, and the Windows cygpath branches (covered by test-windows CI only).
• Head f155042 adds main merges and a test-only fix (secret-pattern-detection.test.sh, guardrails CHANGELOG) after the measured 0d17cdd. Main changed two runtime guardrails hook files in those merges: secret-pattern-detection.sh (fix(guardrails): decline temp-tree targets in secret-pattern-detection no wider than the Bash exemption #4475, fix(guardrails): scan NotebookEdit cell source in secret-pattern-detection #4486; PreToolUse, outside the measured window) and guard-requires.sh (chore: prompt audit for Fable 5.1 and Opus 5.5, then repo-wide comment dissolve #4480, comment-only, sourced by run-guards). lib/hook-utils.sh is unchanged by main. Not re-measured.

Verification

Post-merge re-measure (#4450) (head 0d17cdd, main 0fb4e95). Differential, 11068 cases, run twice. Against base 3fa014b: identical except the go-format telemetry counter (Edit m.go and Write m.go, Go's random telemetry/local/weekends under HOME, same output) and the same 13 lib-level deltas as round 5. Against origin/main itself: the same 15 and nothing else. Every row-* case is identical, so exec bash vs main's bash changes no behavior, and #4450's zone-crossing hoist behaves as on main. CI dispatched at 0d17cdd: ci.yml (lint, lint-2, hook-utils, test-linux 0-3, ci-status) and test-windows.yml green.

One interleaved run at 0d17cdd (5 rounds x 4 strata, base / after / safe; no local load; host qualified before and after, spread 1.67x / 1.74x, floor 0.3 / 0.4 ms). Write/Edit PostToolUse window, ms p50 / p95 (n):

Stratum	base	after	safe	target	status
S1 .txt	89 / 106 (35)	42 / 50 (35)	13 / 28 (35)	p50 <= 50, p95 <= 90	met
S2 .md	94 / 115 (30)	43 / 61 (30)	13 / 59 (30)	<= S1 + 20 = 62	met
S2 .sh	86 / 136 (30)	43 / 53 (30)	13 / 321 (30)	<= 62	met
S3 33 KB .md	398 / 450 (30)	70 / 87 (30)	12 / 52 (30)	<= S1 + 15 = 57	missed by 13

Counters (strace census, W/E post Edit, medians) are identical to round 5. Successful execs: typos-format S1 4 and S3 4, guardrails post-verify .md 3 and S3 5, eol-normalizer 3, markdown-format 3, bash-format 4, context-guard 2. Processes per hook are also unchanged (bash-format 6, markdown-format 7, post-verify 6 / 4, context-guard 1), so exec still saves the fork. Failed execve: 46 per hook. Failed probes: typos S3 308, post-verify .md 260, S3 368.

Round 5, final (head eeae865). Differential extended to 11068 cases (replace_all as absent, null, false, true, "x", "", 1, [], {} in a marketplace repo and in a git repo without plugins/, a null tool_input, MultiEdit, typos content with ambiguous corrections and non-ASCII words): identical except the go-format telemetry counter and the same 13 lib-level deltas as round 4. Run at 65fab8c; the merge to eeae865 changes no file under lib/ or any tested plugin (git diff --stat empty). CI dispatched at eeae865: ci.yml (lint, lint-2, hook-utils, test-linux 0-3, ci-status) and test-windows.yml green.

One interleaved run at eeae865 (5 rounds x 4 strata, base / after / safe; no local load; host qualified before and after, spread 1.67x / 1.64x, floor 0.3 ms). Write/Edit PostToolUse window, ms p50 / p95 (n):

Stratum	base	after	safe	target	status
S1 .txt	85 / 100 (35)	41 / 47 (35)	13 / 31 (35)	p50 <= 50, p95 <= 90	met
S2 .md	93 / 144 (30)	43 / 53 (30)	12 / 21 (30)	<= S1 + 20 = 61	met
S2 .sh	86 / 103 (30)	44 / 79 (30)	14 / 40 (30)	<= 61	met
S3 33 KB .md	414 / 1828 (30)	68 / 103 (30)	13 / 26 (30)	<= S1 + 15 = 56	missed by 12

Counters (strace census, W/E post Edit, medians): successful execs typos-format S1 4, S3 5 -> 4; guardrails post-verify .md 4 -> 3, S3 6 -> 5; eol-normalizer 3; markdown-format 3; bash-format 4; context-guard 2. No jq in the typos or post-verify rows for Edit any more. Failed execve 46 per hook, unchanged.

S3 floor (primitives, idle host): the S3 - S1 difference that no code change here can remove is the timed stdin read on the 35 KB payload (+7.5 ms, bash's per-character signal mask), the typos scan of 33 KB against 2 bytes (13.1 vs 11.5 ms, +1.6), and a minimal file_path extraction (+0.4): about 9.5 ms. So the S3 floor is about S1 + 10 and the S1 + 15 target sits above it; the measured gap is 27 ms, so about 17 ms of it is still removable in principle (payload validation and copies in buffer_stdin_to, about +3 ms; the rest of hook::begin, about +2.7 ms; guardrails' stale-path scan of the 33 KB file and its remaining parse, now the last hook to finish at 52 ms native against typos' 48).

Round 4 (head e681934). Grammar proof: all 2,396,744 token strings up to 7 tokens over { } [ ] , : "x" 1 give the previous walk's verdict exactly; 32k random payloads under C, C.UTF-8 and OSTYPE=msys give identical verdicts, skeletons, offsets, file paths and fields. Differential extended to 9114 cases (13 grammar payloads with a file_path, a structure past the cap, markdown-format's PATH remediation with and without an identity cygpath): identical except the go-format telemetry counter and 13 lib-level deltas (round 3's 12 plus the cap's builtin -> jq fallback, same answer); run at e681934. CI dispatched at e681934: ci.yml and test-windows.yml green.

One interleaved run at e681934 (5 rounds x 4 strata, base / after / safe; no local load; host qualified, spread 1.5x / 1.81x). Write/Edit PostToolUse window, ms p50 / p95 (n):

Stratum	base	after	safe	target	status
S1 .txt	86 / 99 (35)	41 / 50 (35)	9 / 16 (35)	p50 <= 50, p95 <= 90	met
S2 .md	93 / 107 (30)	42 / 49 (30)	12 / 20 (30)	<= S1 + 20 = 61	met
S2 .sh	84 / 95 (30)	41 / 51 (30)	11 / 33 (30)	<= 61	met
S3 33 KB .md	402 / 1264 (24)	71 / 81 (30)	12 / 25 (30)	<= S1 + 15 = 56	missed by 15

The host ran faster than round 3 (safe 9-12 vs 14-15), so part of S1's 53 -> 41 is drift. Counters: exec counts unchanged from round 3; traced walls down about 3 ms of CPU per parse (typos S1 68 -> 59, guardrails S3 130 -> 115, strace-inflated).

Round 3 (head 0eda101). Differential extended to 7899 cases (word anchors beside non-ASCII, invalid UTF-8, CR and a 40 KB line; typos content with 0, ~30 and ~3000 findings incl. write mode; an identity cygpath on PATH): identical except the same go-format telemetry counter and the same 12 lib-level deltas as rounds 1-2. Fuzz: occurrence counter 3000 cases, skeleton/fast-field parser 4000 payloads (C, C.UTF-8, OSTYPE=msys), 0 mismatches. CI dispatched at 0eda101: ci.yml and test-windows.yml green.

One interleaved run at 0eda101 (4 rounds x 4 strata, base / after / safe; host qualified, spread 1.43x / 1.81x). Write/Edit PostToolUse window, ms p50 / p95 (n):

Stratum	base	after	safe	target	status
S1 .txt	98 / 130 (28)	53 / 76 (28)	14 / 69 (28)	p50 <= 50, p95 <= 90	p50 missed by 3 (host ran slower: base +13, safe +3 vs round 2)
S2 .md	93 / 151 (24)	47 / 56 (24)	15 / 41 (24)	<= S1 + 20 = 73	met
S2 .sh	87 / 128 (24)	49 / 77 (24)	15 / 24 (24)	<= 73	met (61 at round 2)
S3 33 KB .md	449 / 723 (24)	88 / 152 (24)	15 / 30 (24)	<= S1 + 15 = 68	missed by 20

Counters (strace census): typos-format S3 execs 6 -> 5; bash-format /mnt probes 9 -> 0. The remaining S3 cost includes a timed-read floor (2 rt_sigprocmask per byte, ~7 ms per hook at 37 KB) that only a stall-semantics change would remove; not done.

Round 2 and earlier:

Behavior differential (no timing; diff.py, base = origin/main 3fa014b vs this head, same fixture path, fresh HOME/data/TMPDIR per run; stdout, stderr, exit code, fixture/HOME/data/TMPDIR/sink contents). 6102 cases: every changed hook and every hook::begin caller, the guardrails dispatcher on its three lanes and the verifiers standalone, context-guard, a lib-level probe, and now the hooks.json rows themselves run as sh -c <row> from each arm (1905 row cases). Round 2 adds a fixture history with deleted, moved and non-ASCII-named paths (so stale-path-verify reports findings), 30 stale-path cases (spans, unclosed and double backticks, CRLF, tabs, whitespace lines, fences, root basenames, self-repeating anchors, replace_all with over 40 hits, non-ASCII and ESC in new_string and in recovered lines, 40 KB ASCII, the 33 KB doc), context-guard with no context directory, and a HOME-unset mode, on top of round 1's corpus and modes. Result: every hook-level case identical except go-format Write/Edit m.go, whose only difference is Go's own random telemetry counter under HOME. 12 lib-level deltas, the same 12 as round 1 (base lacks round 1; none reachable as hook output). Verdict: no behavior change.

Also: the twins were fuzzed on 3000 random texts under C and C.UTF-8 against this host's grep (ugrep 7.8.4); CI runs the fixed-case parity test on GNU grep and Git Bash. _physical_builtin_to matched uutils and GNU realpath on 29 path shapes wherever it answers.

Suites (local): hook-utils 513/0, typos-format 178/0, eol-normalizer 85/0, bash-format 55/0, run-guards 242/0, stale-path-verify 121/0, skill-reference-verify 151/0, cli-flag-verify 96/0, zone-crossing-inject 103/0, claude-ops fleet-state pass; markdown-format 172/2 (the same 2 fail at c8daa81: this host has no jq in /usr/bin). shellcheck, shfmt, killswitch-hoist, hook-exec-form, userconfig-argv, shell-portability, hooks-description, silent-skips, wiring-liveness, changelog-parity, sync-hook-utils.sh --check and --check-bump origin/main, markdownlint: pass.

CI at 99d6205, dispatched: ci.yml (lint, lint-2, hook-utils, test-linux 0-3, ci-status) and test-windows.yml: all green.

Measurement (WSL2, claude -p Haiku; one run at 99d6205, arms base / after / --safe-mode interleaved, 4 rounds x 4 strata; host qualified before and after, is_measurable True, spread 1.72x / 1.42x). Write/Edit PostToolUse window, ms:

Stratum	base p50 / p95 (n)	after p50 / p95 (n)	safe p50 / p95 (n)	target	status
S1 .txt	85 / 98 (28)	43 / 52 (28)	11 / 17 (28)	p50 <= 50, p95 <= 90	met
S2 .md	90 / 94 (24)	44 / 46 (24)	13 / 20 (24)	<= S1 + 20	met
S2 .sh	83 / 87 (24)	61 / 70 (24)	10 / 16 (24)	<= S1 + 20	met
S3 33 KB .md	399 / 444 (24)	89 / 95 (24)	11 / 28 (24)	<= S1 + 15	missed by 31

Counters per W/E post Edit call (strace census, 2 traced sessions per arm per stratum), base -> after: successful execs typos-format 7 -> 4, eol-normalizer 7 -> 3, markdown-format 6 -> 3, bash-format 7 -> 4, guardrails post-verify .md 16 -> 4 (.sh 7 -> 3, 33 KB 23 -> 6), context-guard PostToolBatch 4 -> 2. Failed file probes typos 580 -> 290, eol 409 -> 212, post-verify .md 1060 -> 298. Failed execve stay 46 per hook: dash's exec bash walks PATH with execve as env did; plain bash would walk with stat but forks, and measured slower (1.5 vs 1.3 ms, hyperfine primitive).

The context-guard early exit applies only on a host without the context-guard status line (this one); with the status line the directory exists and the full path runs as before.

Related

• Overlaps feat(ci): hook slow-shapes gate, bash-prefix sweep, and exit-before-source on every event #4450 (row shape, exit-before-source); merged in and reconciled as described under Fix.
• Pattern precedent: perf(guardrails): run the guard chain in-process and answer payload fields without jq #4185 (dispatcher cache, _uncached twins, 17-carrier sync); row shape: perf(autonomy): check lane-stop-gate opt-in before sourcing its libraries #4421, perf(disk-hygiene): cheaper guard-launch-monitor Stop hook #4422.
• Plugin README cost tables (guardrails, bash-format, typos-format, eol-normalizer) are dated measurements of earlier versions and were not re-measured here.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T10:50:49.368101Z	2aeec26	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 11s —— View job

---

Reviewing PR #4418

• Gather context (PR body, changed files, diff)
• Confirm this is the CI code-review lane (/review:code-review), scoped to correctness/maintainability
• Review core lib/hook-utils.sh JSON/locale/path-cache changes
• Review guardrails hook changes (stale-path-verify.sh, skill-reference-verify.sh, run-guards.sh, cli-flag-verify.sh)
• Review formatter / context-guard hook changes (bash-format, markdown-format, powershell-format, eol-normalizer, typos-format, zone-crossing-inject, index-drift)
• Adversarially verify candidate findings
• Post inline comments + summary

[claude]

Claude finished @kyle-sexton's task in 5m 31s —— View job

---

Security review complete

• Load repo instructions (CLAUDE.md/AGENTS.md) and the /review:security-review skill
• Run skip gate (PR open; touches shell hooks parsing untrusted JSON/paths — security-relevant surface, proceeded)
• Fetch PR diff (gh pr diff 4418) and enumerate changed hook scripts
• Review lib/hook-utils.sh builtin JSON parser (17 carriers) for parsing-bypass / injection risk
• Review per-plugin guardrail changes (stale-path-verify, skill-reference-verify, cli-flag-verify, run-guards) for check-bypass logic
• Review remaining hook changes (bash-format, markdown-format, powershell-format, typos-format, eol-normalizer, zone-crossing-inject, index-drift)
• Adversarially verify candidate concerns
• Report findings

No security issues found.

What was reviewed

This PR's real logic surface (the 358/-163 hook-utils.sh diff is duplicated identically across 17 plugin carriers, so it was audited once):

• lib/hook-utils.sh: the new builtin JSON grammar checker (hook::_json_skeleton's whole-string-rewrite reduction), hook::_json_object_proven (the builtin stand-in for jq -e . that gates whether hook::buffer_stdin_to skips spawning jq at all — the one place a parser discrepancy could matter, since it decides whether untrusted-shaped payload text is treated as valid JSON), hook::_fast_fields/hook::_fast_file_path_to field extraction, and hook::_physical_builtin_to (the cd -P realpath stand-in used by the temp-tree membership check that secret-pattern-detection.sh's D1 control depends on).
  • The C-locale gating (hook::_c_locale) is applied consistently: hook::_json_skeleton is only ever reached after LC_ALL=C is confirmed by its callers, so its cache (_HOOK_JSON_SK_TEXT/_HOOK_JSON_SK_RC) can't return a stale cross-locale answer.
  • hook::_json_split's _HOOK_JSON_PARTS=($__hu_t) unquoted expansion is deliberately safe: IFS='"' is scoped locally and globbing is disabled (set -f) around it.
  • hook::_physical_builtin_to only answers for absolute, //-free, newline-free paths that are either an existing directory or an existing non-symlink file, falling back to realpath for every other shape (symlinks, missing paths, relative paths) — matching the doc comment, and the Round-6 commit (2aeec26) specifically re-verified the D1 temp-tree resolver-shim control stays meaningful now that Linux takes this path instead of spawning realpath.
  • Every builtin fast path (typos_classify_report_only, stale-path-verify's spv__* twins) gates on a strict printable-ASCII/no-quote-or-backslash regex before interpolating captured values into hand-built JSON/text, and falls back to the jq/grep pipeline otherwise — no string-escaping gap found.
• plugins/guardrails/hooks/{stale-path-verify,skill-reference-verify,cli-flag-verify,run-guards}.sh: the plugins-root gate in skill-reference-verify.sh moved earlier but keeps identical conditions; run-guards.sh's new per-event caches for hook::read_file_path_to/hook::repo_root_to key correctly on CLAUDE_PROJECT_DIR/scope/$PWD and only serve the cache for the event's own already-validated payload.
• plugins/{bash-format,markdown-format,powershell-format} cygpath gating, context-guard/zone-crossing-inject.sh's new no-snapshot early exit (reuses the same $SESSION-keyed path the resolver itself already checks — no new trust surface), and eol-normalizer.sh/instruction-placement/index-drift.sh: all perf-only reorderings/OS gates with no behavior change on the check outcome.

No command/path/JSON-injection surface, authorization gap, or secret-handling issue was found in the diff. GitHub Actions hardening is out of scope for this lane (zizmor's advisory) and none of the changed files touch .github/workflows.

[claude]

Claude finished @kyle-sexton's task in 7m 9s —— View job

---

Reviewing PR #4418 (CI code-review lane)

• Load /review:code-review skill and confirm scope (correctness/maintainability; security is out — a separate security lane already reviewed this PR with no findings)
• Skip-gate check (PR open, not draft, meaningful diff, no prior review at this head — last review was at 2aeec26, this run is at f155042, one merge commit later)
• Fetch diff (git diff origin/main...HEAD) and enumerate changed files (74 files, +7494/-3065)
• Review lib/hook-utils.sh (17 carriers) — JSON skeleton parser rewrite, hook::_c_locale gating, hook::_json_object_proven, _fast_fields' new // false | tostring suffix handling, hook::_physical_builtin_to
• Review guardrails hooks (stale-path-verify.sh's builtin grep/sed/sort twins and word-anchor shortcut, skill-reference-verify.sh's reordered plugins-root gate, run-guards.sh's new per-event caches for read_file_path_to/repo_root_to/jq_fields, cli-flag-verify.sh)
• Review formatter/context-guard hooks (bash-format, markdown-format, powershell-format cygpath OS-gating; eol-normalizer's eol_root_to shortcut; typos-format's builtin report-only classifier; zone-crossing-inject's no-snapshot early exit; index-drift)
• Adversarially verify candidate findings (traced through call sites and shared helpers by hand rather than trusting the PR's own claims)
• Report findings

Result: no findings

Scope was correctness and maintainability only — security was intentionally left to the separate /review:security-review lane, which already ran on this PR and reported no issues.

What I actually checked by hand (not just read the PR's own verification claims for):

• Confirmed all 17 hook-utils.sh carriers are byte-identical (sha256sum), so the dense logic only needed auditing once.
• Traced hook::_fast_fields's new // false | tostring suffix path end-to-end against its true|false acceptance branches — the __hu_df gating correctly rejects a bare boolean for a plain (non-suffixed) filter, matching pre-PR fallback-to-jq behavior.
• Verified stale-path-verify.sh's new word-anchor shortcut (spv_word_occurrences, an awk split on [^A-Za-z0-9_]+) against the general character-walk it bypasses: for anchors containing ./- the walk's [A-Za-z0-9_]-only token boundary can never match such an anchor, so occ is always 0 there too — the shortcut's unconditional continue for those anchors is behaviorally identical, not just faster.
• Verified zone-crossing-inject.sh's new no-snapshot early exit and the [[ -r "$HOME/.claude/context-guard/context/$SESSION.json" ]] pre-check against context-zone.sh's own logic (scripts/context-zone.sh:104-107): the constructed path matches exactly, and even for a malformed $SESSION the shortcut is conservative — it either matches the resolver's own unknown outcome directly, or falls through to invoke the resolver, which re-validates the session id itself before touching any file. No output divergence, no information-disclosure risk from skipping that regex check locally.
• Verified eol-normalizer.sh's eol_root_to shortcut: hook::begin --repo-root calls it with $2 = FILE_DIR (not the raw path), and the shortcut only fires when FILE_DIR is absolute — consistent with FILE_DIR derivation (lib/hook-utils.sh around hook::begin). The result feeds only git -C "$root" check-attr -- "$FILE" with an absolute $FILE (normalize-eol.sh:131), for which any same-repo -C directory is equivalent — and telemetry (the one consumer needing the real root) explicitly opts back into hook::repo_root_to.
• Spot-checked the typos_classify_report_only regex/field-extraction against the jq path it replaces (group numbering, tostring-shaped fields, uncapped findings vs. MAX_REPORT-capped display text) — consistent.
• Confirmed the cygpath OS-gating changes (bash-format, markdown-format, powershell-format) are simple, correct short-circuits with no behavior change on Linux/macOS/Windows.
• Confirmed run-guards.sh's new hook::read_file_path_to/hook::repo_root_to/hook::jq_fields caches only serve a hit when the payload text (and, for repo-root, $PWD) matches the event's own already-validated input, falling through to the uncached path otherwise.

Nothing here rose to a "a careful senior reviewer would block this" finding — the changes are performance-only reorderings/builtin-twins with behavior explicitly designed (and, per the PR's own differential/fuzz harness, tested) to match what they replace, and my own tracing through the actual call sites didn't turn up a divergence.
· branch perf/hook-we-post

[claude]

Claude finished @kyle-sexton's task in 54s —— View job

---

Security review — skipped (no new PR content since last review)

• Load repo instructions (CLAUDE.md/AGENTS.md) and the /review:security-review skill
• Run skip gate
• Fetch PR diff for new head f155042 (git diff origin/main...HEAD) and compare against the last-reviewed head
• Confirm no security-relevant delta
• Report result

Skip gate hit: condition 3 — this head already has a successful security review that still applies.

The only commits added since the last completed security review (at 2aeec26) are a merge of origin/main (98463ca, a repo-wide comment-dissolve chore touching ~472 unrelated files) and the merge commit itself (f155042). git diff origin/main...HEAD on the new head is identical in scope to the prior review: same 74 files, same +7494/-3065. The merge did pull in one runtime-hook change from main — plugins/guardrails/hooks/secret-pattern-detection.sh (#4475, PreToolUse) — but that file is not part of this PR's diff against origin/main (it's already on main; only its test file, secret-pattern-detection.test.sh, is in this PR's own changed-file set), so it's outside this lane's review scope, consistent with the PR body's own note ("not re-measured").

No new security-relevant surface to review. The prior finding stands: no security issues found in this PR's actual changes (lib/hook-utils.sh's builtin JSON parser/grammar checker and its 17 carrier copies, the guardrails verifier changes, and the formatter/context-guard cygpath/early-exit changes) — see the previous security-review comment on this PR for the full breakdown of what was audited.