dojo CLI advancement wave 2 — blocking hooks, permissions, model routing, guardrails, external skills - #3
Merged
Conversation
…nt wave Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…event Fire() stays signature-stable for existing callers; FireChecked returns FireResult distinguishing clean / non-blocking failure / blocked. Only command-type hooks in rules marked blocking:true can block. UserPromptSubmit command hooks receive the prompt via DOJO_PROMPT env (4096-byte cap, never shell-interpolated). prompt/agent hook types now warn once per plugin instead of silently no-oping. Inspired by Claude Code PreToolUse/UserPromptSubmit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… agent streams internal/guardrail Tracker counts consecutive identical failures per key; Dispatch prints escalating advisories (warn at 3, hard at 5, config guardrails.*), StreamGuard in the renderer flags repeated same-signature tool failures via the Warning path. Advisory-only, never blocks. Inspired by Hermes tool_loop_guardrails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…m guard PreCommand blocks now abort before Dispatch with [hooks] blocked message; free-text chat fires UserPromptSubmit before anything reaches the Gateway (a block returns to the prompt); StreamGuard observes the chat event stream. Carries the REPL wiring for both the hooks and guardrail tracks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
permissions.mode = default (confirm per action, refuses when non-TTY) | allowlist (permissions.allowed dot-path globs) | yolo (--yolo, loud). Gated: code.undo, plugin.install, plugin.rm, craft.adr, craft.claude-md --fix, craft.scaffold. Replaces the ad-hoc craftConfirm/InstallConfirmed prompts at those sites (single prompt, allowlist deny not overridable by --yes). Inspired by Claude Code permission modes + Crush allowed_tools/--yolo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
skills.external_dirs (default .claude/skills) is scanned read-only for Agent-Skills-convention SKILL.md files; /skill ls appends an External (read-only) section, /skill get ext:<name> forces external, plain get falls back on Gateway miss. /skill extracted verbatim from cmd_workflow.go into cmd_skill.go. package-all never sweeps external dirs. Inspired by Crush Agent Skills + Hermes external_dirs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
/agent dispatch and /agent chat accept --model (both forms, any position); precedence flag > delegation.model > Gateway default; resolved model printed before streaming; /model ls shows the delegation default. Model field is forward-compat (Gateway may ignore today). Operationalizes the Sonnet-80/Opus-20 lane doctrine at the point of dispatch. Inspired by Claude Code per-Task model + Hermes delegation split. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…e hooks example README gains Craft Workbench, Permissions, and Guardrails sections plus config/env additions; Plugin System example corrected to the real hooks/hooks.json format (the old inline plugin.json form never matched a rule). CHANGELOG dated section for the wave with inspiration lineage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ayout README tree showed 5 of ~25 internal packages, singular plugin/skill dirs, and a Cobra claim (the CLI uses its own command Registry, no Cobra). Both trees now enumerate the real packages with roles from their package doc comments. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Orchestrated feature wave building on the merged overnight fest (#2). Four-source inspiration recon (Claude Code capability audit, Hermes/fleet-orchestration, Charm's Crush, workspace notes/ ACI-AXI research) → six tracks, contracts-first, strict per-file agent ownership.
What's in
UserPromptSubmit—FireCheckedcontract distinguishes clean / non-blocking failure / blocked; per-rule"blocking": true(command-type hooks only); free-text chat now passes through a hook before reaching the Gateway, prompt delivered viaDOJO_PROMPTenv (4 KB cap, never shell-interpolated);prompt/agenthook types warn honestly instead of silently no-oping. (Claude Code PreToolUse/UserPromptSubmit)permissions.mode=default(confirm per action; refuses when non-TTY) /allowlist(dot-path globs inpermissions.allowed) /yolo(--yolo, loud). Gates:code.undo,plugin.install,plugin.rm,craft.adr,craft.claude-md --fix,craft.scaffold. Single-prompt guarantee — the old ad-hoc confirms folded in;plugin rmgains a gate it never had. (Claude Code permission modes + Crushallowed_tools/--yolo)/agent dispatch|chat --model <name>; precedence flag >delegation.model> Gateway default;/model lsshows the delegation default. Operationalizes the Sonnet-80/Opus-20 lane doctrine at the point of use. Forward-compat: Gateway may ignore the field today. (CC per-Task model + Hermes delegation split)tool_loop_guardrails)skills.external_dirs(default.claude/skills) read-only SKILL.md discovery;/skill lsExternal section,/skill get ext:<name>;package-allnever sweeps external dirs./skillextracted verbatim fromcmd_workflow.gointocmd_skill.go. (Crush Agent Skills + Hermesexternal_dirs)/craftsuite documented for the first time (1,243-line file, 8 subcommands); stale Plugin System hooks example corrected (documented format never matched a real rule); dated CHANGELOG section.Verification
make all(vet + full test suite with-race+ build): green, all 23 testable packagesKnown residuals (deliberate)
/agentstreams (documented as such) — candidate for next wavecraft memory prune/seed elevatekeep their older confirm (Gateway-state mutations, not file writes — outside this wave's permission-key scope)dojo mcp-serverself-exposure,dojo servedaemon, LSP-fed context, Ctrl+L model picker, checkpoint/rewind + compaction (Gateway-owned), protocol re-injection drop-detection,/session <id>gateway verificationFixes DGS-76
🤖 Generated with Claude Code