Function main

ci/hooks/check_forbidden_commands.py:204–313

()

def main():
    # Read JSON input from stdin
    try:
        input_data = json.load(sys.stdin)
    except json.JSONDecodeError:
        # If we can't parse input, allow the command
        sys.exit(0)

    # Only check Bash commands
    tool_name = input_data.get("tool_name", "")
    if tool_name != "Bash":
        sys.exit(0)

    # Extract command
    tool_input = input_data.get("tool_input", {})
    command = extract_command(tool_input)

    if not command:
        sys.exit(0)

    # Type narrowing: command is guaranteed to be str here
    assert command is not None

    # Check for override environment variable
    # First check if it's set in the command string (e.g., FL_AGENT_ALLOW_ALL_CMDS=1 ninja)
    command_env_vars = parse_env_vars_from_command(command)
    override_in_command = OVERRIDE_ENV_VAR in command_env_vars and command_env_vars[
        OVERRIDE_ENV_VAR
    ] in ("1", "true", "True", "TRUE")

    # Then check if it's set in the process environment
    override_in_env = bool(os.environ.get(OVERRIDE_ENV_VAR))

    # Override is enabled if set in either location
    override_enabled = override_in_command or override_in_env

    # Check 1: Forbidden commands
    forbidden_result = is_forbidden_command(command)
    if forbidden_result:
        forbidden_cmd, recommendation = forbidden_result

        if override_enabled:
            if DRY_RUN:
                print(
                    f"[DRY-RUN] Would allow '{forbidden_cmd}' due to {OVERRIDE_ENV_VAR}",
                    file=sys.stderr,
                )
            sys.exit(0)

        # Comprehensive error message: what's forbidden, why, alternative, and override
        error_msg = (
            f"{forbidden_cmd} is forbidden - {recommendation}. "
            f"To override this check, use: {OVERRIDE_ENV_VAR}=1 {command}"
        )

        if DRY_RUN:
            print(f"[DRY-RUN] Would block: {error_msg}", file=sys.stderr)
            sys.exit(0)