Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Signed hook events: a per-agent token so no agent (or engine bridge) can impersonate another

Open
  • Is something wrong?
#61 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@agentvivekkumar is already working on this.

Since Oct 10, 2026.

  • #327 by @codedbygo — open

Assessment

This issue has not been assessed yet.

Description

enhancement Require Customer
Problem / motivation

Every agent reports its lifecycle (SessionStart, Stop, tool use, cost) to one shared hook channel, HIVE_SOCK (set at spawn for Claude in hive.ts:1258 and for the other engines' bridges in hive.ts:1120). HookServer takes the agent's identity from the payload itself (hooks.ts:331), and the shim fills that from the AGENT_ID env var (hive.ts:4270-4272). Nothing ties a frame to the process that sent it.

So a frame naming another agent is accepted as that agent. Concretely, it can:

  • overwrite that agent's saved session id (hooks.ts:387), the id used for claude --resume on restart (hive.ts:1444), so the agent comes back on the wrong thread;
  • write cost rows for any agent via CostSample (hooks.ts:395);
  • fire a fake Stop: the "Finished" notification and idle signal (hooks.ts:465), and for Michael the owner-notes path (hooks.ts:462).

This is already tracked as P2 in TODOS.md ("an agent can send a fake Stop or SessionStart event naming Michael"). The random Windows pipe name keeps outside programs off the channel, but every agent is handed it in HIVE_SOCK, and Windows has no shell sandbox (hive.ts:1505).

It grows with every engine: the Codex, Gemini, Antigravity, Grok, pi and opencode shims and the qwen proxy sidecar all post to this same channel. Worth closing before BUILD_ENGINES grows past ['claude'].

Proposed solution
  1. At spawn, hive.ts mints a random per-agent token (crypto.randomBytes) and keeps the token → agent id map in main-process memory only, never in the hive folder.
  2. Each bridge gets its token the way it already gets per-agent config (the agent's settings.json hook command, its CODEX_HOME hooks, or env for the agy shim and the proxy sidecar), and every shim includes it in each frame.
  3. HookServer resolves the agent from the token, not from the payload's agent_id, and drops frames with a missing or unknown token (logged like hook-frame-rejected). A subagent_id is honoured only under its parent's token. An agent can still read its own token, which only lets it speak as itself.
  4. Rotate the token on every respawn/restart, so an old one dies with its session.
  5. One test per bridge kind (Claude settings hook, hooks shim, proxy) asserting a frame with a forged agent_id or no token is rejected. Any new engine has to pass it before joining BUILD_ENGINES.
  6. Second half of the same TODO: move ownerSentDir / ownerStatePath (agents/human, hive.ts:2597) out of the folder agents can write.

Why: a contained change (hooks.ts, the spawn path in hive.ts, the shim templates) that closes a known P2 gap and makes multi-engine support safe by default, since every engine is authenticated the same way whatever its hook format. It complements #48 (per-engine policy enforcement) rather than overlapping it.

Screenshot, mockup or recording

Sketch: today vs. proposed (a frame forged by one agent, naming Michael)

sequenceDiagram
    participant A as Agent sales (its own shell)
    participant H as HookServer (main process)
    Note over A,H: Today
    A->>H: Stop, agent_id = michael, session_id = x
    H->>H: identity read from payload (hooks.ts:331)
    H-->>H: accepted as Michael, session id overwritten, Finished fired
    Note over A,H: Proposed
    A->>H: Stop, agent_id = michael, token = sales token
    H->>H: token resolves to sales (map held in main memory)
    H-->>A: agent_id does not match token owner, frame rejected and logged
Alternatives considered

Matching the frame to the agent's process id: weaker, because hook shims run as child processes of the CLI and the proxy sidecar is a separate process, so there is no single pid to check. Relying on the OS sandbox alone: it is off on Windows and does not apply the same way to every engine. A per-agent token works identically for every bridge kind and every OS.

Area

The hive (memory, routing, GOD agent)

Pre-flight
  • I attached a screenshot, mockup or recording above.
  • I searched existing issues and discussions, and this isn't a duplicate.
Dominant language
TypeScript
Stars
273
Forks
211
Avg merge
14h 24m
Merged PRs (30d)
203

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentvivekkumar/dontbemichael

All issues in agentvivekkumar/dontbemichael

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.