hook-augment: prove the hook's build identity without hashing the whole executable in every hook process
Los mantenedores suelen responder en 2 días
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 28/100
- Tipo de issue
- Nueva funcionalidad
- Claridad
- Bastante claro
- Estado de actividad
- Activo
- Stack tecnológico
- c
- Área
- backend, performance
Línea de trabajo
Read the hook identity and peer verification work in #2335, plus the version-cohort and activation contract issues #2178, #1955, and #2335; review the #1767 Windows metadata discussion. Compare the three listed options against the macOS, Linux, and Windows identity requirements. Done means a work counter proves the hook path hashes no executable bytes, identity remains valid on all three platforms, and CPUs without SHA instructions return context before the default deadline.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Problem
Before a hook-augment process can ask the daemon for graph context, it computes the SHA-256 of its own executable (about 300 MB) as its daemon build identity.
Since #2575 (e93e4386, first released in v0.12.0) that hash runs on the CPU's SHA instructions where they exist. Measured on current main (354ccecb), Apple arm64, over the 305 MB image:
| path | time per hash |
|---|---|
| hardware (ARMv8 SHA2) | 0.10 s |
| portable fallback | 0.95 s |
CPUs without SHA instructions take the portable path on every hook call. Reporters measured about 2.3 s of startup CPU on their machines (#1335, #1388, #2441), which is past the 2000 ms hook deadline, so the hook exits 0 with no output. Even when it stays under the deadline, every Grep/Glob/Bash call pays that latency.
Constraints
- The build identity is part of the version-cohort and activation contract (#2178, #1955, #2335). A hook process must not be able to pass as a different build.
- A cache keyed on file metadata (size, timestamps, file index) is not a stable identity on Windows for any file other than the running image, because the change time can be set through
SetFileInformationByHandle. This came up in the #1767 review. - Hooks stay fail-open and never add noise to stdout.
Options to evaluate
- Daemon-side verification. The daemon verifies the connecting hook's image, as #2335 does for peers with the verified handle held open, and the hook process does not hash itself.
- A read-only hook channel with a narrower identity requirement, since
hook-augmentonly reads the graph. - An install-time digest, recorded by the installer in an owner-only file and checked by the daemon against its own verification of the peer image.
Done when
- A hook process does no full-image hash on the hook path, asserted by a work counter (bytes hashed), never by wall time.
- The identity contract holds on macOS, Linux and Windows.
- Hooks on CPUs without SHA instructions return context at the default deadline.
- Lenguaje dominante
- C
- Estrellas
- 45.8k
- Forks
- 3.8k
- Merge medio
- 3 d 4 h
- PR fusionados (30 d)
- 208
Preparar el entorno
Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de DeusData/codebase-memory-mcp
-
bug editor/integration
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
DeusData/codebase-memory-mcp#2787 · 1 comentario ·
Los mantenedores suelen responder en 2 días
-
editor/integration parsing/quality
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
DeusData/codebase-memory-mcp#2286 ·
Los mantenedores suelen responder en 2 días
-
install writes an unsupported `args` key into the Claude Code SubagentStart hook, so it never runsAbiertobug editor/integration priority/high stability/performance ux/behavior
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
DeusData/codebase-memory-mcp#2239 · 1 comentario ·
Los mantenedores suelen responder en 2 días
-
bug priority/high ux/behavior
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
DeusData/codebase-memory-mcp#2232 · 2 comentarios ·
Los mantenedores suelen responder en 2 días
-
documentation editor/integration parsing/quality priority/normal
Dificultad 2/5 1-3 horas Aptitud para principiantes 85/100
DeusData/codebase-memory-mcp#2169 ·
Los mantenedores suelen responder en 2 días
Todos los issues de DeusData/codebase-memory-mcp
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
HexaCluster/credcheck#86 ·
-
Wheels for Python 3.15Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 66/100
mongodb/winkerberos#175 ·
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 74/100
AOMediaCodec/SVT-AV1#3320 ·
-
Add `CPC_TAKE_TILL_CHARS`Abiertodifficulty: easy
Dificultad 2/5 1-3 horas Aptitud para principiantes 64/100