mirror of
https://github.com/hanzoai/kai.git
synced 2026-10-17 11:18:06 +00:00
zeekay
621d446b19
examples/claude-code holds a Stop hook, a PreToolUse hook and the kai skill. .claude-plugin/marketplace.json makes this repo the marketplace "kai" (not "hanzo", a name another Hanzo marketplace already holds), so /plugin install kai@kai installs it. Kai does not yet read agent work reliably: its zero-shot answers to "done", "verified" and "risky" are near chance. So rules in code decide first, Kai can only tighten (send a turn back, or ask before an action; never allow), both hooks fail open on any error or timeout, and the default mode, shadow, logs Kai's answers and changes nothing. The log holds probabilities and verdicts only, 0600 in a 0700 directory. A state sent to Kai is redacted and at most 3,000 characters of JSON; only https, or http on loopback, is called, and no redirect is followed. Against the first draft: plugin options are read as CLAUDE_PLUGIN_OPTION_<KEY> uppercased, as Claude Code exports them (the draft read lowercase names and never saw the plugin's key or mode). The floor is checked before the read-only shortcut, which let "env rm -rf" and awk's system() through, and now catches "git checkout -- .", "rm -Rf" and split rm flags. A background-task notice no longer starts a new turn. Stop answers with decision "block" as JSON. Only the last 8 MiB of a transcript is read: a 745 MB one made the hook throw. test/kai.test.mjs runs both hooks offline against a stand-in for Kai on 127.0.0.1, 25 tests; test.sh runs it with the rest. In a live Claude Code 2.1.296 session against the stand-in, the Stop block came back as "Stop hook feedback", the PreToolUse ask denied an allowed command under -p, and shadow showed a notice and let it run.