Skip to content

fix: guard hooks against null payload - #1074

Merged
rohitg00 merged 1 commit into
mainfrom
0-9-28
Jul 19, 2026
Merged

fix: guard hooks against null payload#1074
rohitg00 merged 1 commit into
mainfrom
0-9-28

Conversation

@rohitg00

@rohitg00 rohitg00 commented Jul 19, 2026

Copy link
Copy Markdown
Owner

bump 0.9.28 across manifests/deploy/export-import set; refresh stale README/AGENTS stats (tests 1,423+ -> 7,000+, files/LOC/functions/KV); CHANGELOG 0.9.28 section; remove the rate-limited star-history chart from README and all 11 translations.

Summary by CodeRabbit

  • Security
    • Hardened agent-scoped context retrieval to prevent cross-agent leakage; requests now fail safely when an agent id can’t be determined.
  • Bug Fixes
    • Improved robustness for hook and automation entrypoints by safely handling missing/invalid JSON payloads.
    • Failures now exit cleanly instead of leaving unhandled errors.
    • Import/export compatibility updated to support the latest export format.
  • Release
    • Updated to version 0.9.28 across packages and deployment builds.
  • Documentation
    • Refreshed README/AGENTS/Changelog stats and badges, and removed Star History embeds from localized README pages.

@vercel

vercel Bot commented Jul 19, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
agentmemory Ready Ready Preview, Comment Jul 19, 2026 10:31am

Request Review

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bbba87b2-9a59-4deb-b90f-39f025d4772a

📥 Commits

Reviewing files that changed from the base of the PR and between 1fd53c2 and 08f742c.

⛔ Files ignored due to path filters (2)
  • assets/tags/light/stat-tests.svg is excluded by !**/*.svg
  • assets/tags/stat-tests.svg is excluded by !**/*.svg
📒 Files selected for processing (59)
  • AGENTS.md
  • CHANGELOG.md
  • README.md
  • READMEs/README.de-DE.md
  • READMEs/README.es-ES.md
  • READMEs/README.fr-FR.md
  • READMEs/README.hi-IN.md
  • READMEs/README.ja-JP.md
  • READMEs/README.ko-KR.md
  • READMEs/README.pt-BR.md
  • READMEs/README.ru-RU.md
  • READMEs/README.tr-TR.md
  • READMEs/README.zh-CN.md
  • READMEs/README.zh-TW.md
  • deploy/coolify/Dockerfile
  • deploy/coolify/docker-compose.yml
  • deploy/fly/Dockerfile
  • deploy/railway/Dockerfile
  • deploy/render/Dockerfile
  • deploy/render/render.yaml
  • package.json
  • packages/mcp/package.json
  • plugin/.claude-plugin/plugin.json
  • plugin/.codex-plugin/plugin.json
  • plugin/plugin.json
  • plugin/scripts/notification.mjs
  • plugin/scripts/post-commit.mjs
  • plugin/scripts/post-tool-failure.mjs
  • plugin/scripts/post-tool-use.mjs
  • plugin/scripts/pre-compact.mjs
  • plugin/scripts/pre-tool-use.mjs
  • plugin/scripts/prompt-submit.mjs
  • plugin/scripts/session-end.mjs
  • plugin/scripts/session-start.mjs
  • plugin/scripts/stop.mjs
  • plugin/scripts/subagent-start.mjs
  • plugin/scripts/subagent-stop.mjs
  • plugin/scripts/task-completed.mjs
  • src/functions/context.ts
  • src/functions/export-import.ts
  • src/hooks/notification.ts
  • src/hooks/post-commit.ts
  • src/hooks/post-tool-failure.ts
  • src/hooks/post-tool-use.ts
  • src/hooks/pre-compact.ts
  • src/hooks/pre-tool-use.ts
  • src/hooks/prompt-submit.ts
  • src/hooks/session-end.ts
  • src/hooks/session-start.ts
  • src/hooks/stop.ts
  • src/hooks/subagent-start.ts
  • src/hooks/subagent-stop.ts
  • src/hooks/task-completed.ts
  • src/triggers/api.ts
  • src/triggers/events.ts
  • src/types.ts
  • src/version.ts
  • test/export-import.test.ts
  • website/lib/generated-meta.json
💤 Files with no reviewable changes (11)
  • READMEs/README.zh-TW.md
  • READMEs/README.tr-TR.md
  • READMEs/README.de-DE.md
  • READMEs/README.zh-CN.md
  • READMEs/README.fr-FR.md
  • READMEs/README.ru-RU.md
  • READMEs/README.es-ES.md
  • READMEs/README.pt-BR.md
  • READMEs/README.ja-JP.md
  • READMEs/README.hi-IN.md
  • READMEs/README.ko-KR.md
🚧 Files skipped from review as they are similar to previous changes (42)
  • plugin/.codex-plugin/plugin.json
  • deploy/coolify/docker-compose.yml
  • plugin/.claude-plugin/plugin.json
  • test/export-import.test.ts
  • deploy/render/render.yaml
  • deploy/render/Dockerfile
  • src/version.ts
  • packages/mcp/package.json
  • src/hooks/pre-compact.ts
  • package.json
  • deploy/railway/Dockerfile
  • src/hooks/notification.ts
  • src/hooks/prompt-submit.ts
  • src/types.ts
  • src/hooks/session-end.ts
  • src/hooks/subagent-stop.ts
  • plugin/scripts/session-end.mjs
  • src/hooks/subagent-start.ts
  • src/triggers/events.ts
  • src/hooks/post-tool-failure.ts
  • src/hooks/stop.ts
  • plugin/scripts/subagent-stop.mjs
  • src/hooks/post-commit.ts
  • src/hooks/pre-tool-use.ts
  • src/functions/context.ts
  • src/hooks/task-completed.ts
  • plugin/scripts/prompt-submit.mjs
  • plugin/scripts/stop.mjs
  • src/hooks/session-start.ts
  • plugin/scripts/notification.mjs
  • AGENTS.md
  • CHANGELOG.md
  • src/hooks/post-tool-use.ts
  • plugin/scripts/post-tool-use.mjs
  • src/triggers/api.ts
  • plugin/scripts/pre-tool-use.mjs
  • plugin/scripts/session-start.mjs
  • plugin/scripts/subagent-start.mjs
  • plugin/scripts/post-tool-failure.mjs
  • plugin/scripts/task-completed.mjs
  • plugin/scripts/post-commit.mjs
  • plugin/scripts/pre-compact.mjs

📝 Walkthrough

Walkthrough

Release 0.9.28 adds agent-scoped context propagation and filtering, hardens hook input and failure handling, updates export compatibility and package/deployment versions, and revises release and project documentation.

Changes

0.9.28 release

Layer / File(s) Summary
Agent-scoped context propagation
src/functions/context.ts, src/triggers/api.ts, src/triggers/events.ts
agentId flows through context APIs and session triggers; isolated context retrieval filters sessions by agent and fails when no agent identity is available.
Hook payload and failure handling
src/hooks/*, plugin/scripts/*
Hook entrypoints reject non-object JSON payloads and handle rejected main() calls with a clean exit.
Version and import compatibility
src/version.ts, src/types.ts, src/functions/export-import.ts, test/export-import.test.ts, package.json, packages/mcp/package.json, plugin/*.json
Version metadata and export validation accept and report 0.9.28.
Deployment and release documentation
deploy/*, CHANGELOG.md, AGENTS.md, README.md, READMEs/*, website/lib/generated-meta.json
Deployment references use 0.9.28, release notes document the changes, statistics are updated, and Star History embeds are removed.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ContextAPI
  participant MemContext
  participant SessionStore
  Client->>ContextAPI: POST context with optional agentId
  ContextAPI->>MemContext: forward agentId and context filters
  MemContext->>SessionStore: query matching agent-scoped sessions
  SessionStore-->>MemContext: return filtered sessions
  MemContext-->>ContextAPI: return injected context
Loading

Possibly related issues

Possibly related PRs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 34.62% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly reflects the main behavioral change: hardening hooks against null or non-object payloads.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 0-9-28

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

#1047: JSON.parse("null") returns null without throwing, so every hook's parse guard passed it through and the first data.xxx access threw a TypeError. Bare main() turned that into an unhandled rejection -> exit 1 -> host reported 'hook failed' on every affected tool call. All 13 hook entrypoints now guard non-object payloads before dereferencing and wrap main() in .catch() to fail closed (silent exit 0).

#1057: mem::context and api::context filtered candidate sessions by project only, leaking cross-agent observations/summaries under AGENTMEMORY_AGENT_SCOPE=isolated. Now applies the same agent-scope filter as mem::search (#817); api::context, api::session::start, and event::session::started forward agentId.

Also: bump 0.9.28 across manifests/deploy/export-import set; refresh stale README/AGENTS stats (files/LOC/functions/KV; AGENTS tests 950+ -> 1,428+) and regenerate the website meta snapshot to 0.9.28; CHANGELOG 0.9.28 section; remove the rate-limited star-history chart from README and all 11 translations.
@rohitg00
rohitg00 merged commit 6761a99 into main Jul 19, 2026
7 checks passed
@rohitg00
rohitg00 deleted the 0-9-28 branch July 19, 2026 10:40
healdigital pushed a commit to healdigital/agentmemory that referenced this pull request Jul 27, 2026
rohitg00#1047: JSON.parse("null") returns null without throwing, so every hook's parse guard passed it through and the first data.xxx access threw a TypeError. Bare main() turned that into an unhandled rejection -> exit 1 -> host reported 'hook failed' on every affected tool call. All 13 hook entrypoints now guard non-object payloads before dereferencing and wrap main() in .catch() to fail closed (silent exit 0).

rohitg00#1057: mem::context and api::context filtered candidate sessions by project only, leaking cross-agent observations/summaries under AGENTMEMORY_AGENT_SCOPE=isolated. Now applies the same agent-scope filter as mem::search (rohitg00#817); api::context, api::session::start, and event::session::started forward agentId.

Also: bump 0.9.28 across manifests/deploy/export-import set; refresh stale README/AGENTS stats (files/LOC/functions/KV; AGENTS tests 950+ -> 1,428+) and regenerate the website meta snapshot to 0.9.28; CHANGELOG 0.9.28 section; remove the rate-limited star-history chart from README and all 11 translations.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant