Skip to content

fix(hooks): verify tmux socket exists before trusting TMUX env var #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xiaolai wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(hooks): verify tmux socket exists before trusting TMUX env var #329

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion hooks/scripts/block-dev-server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
const fs = require("fs");

const input = JSON.parse(process.argv[2] || "{}");
const command = (input.command || "").toLowerCase();

Expand All @@ -24,7 +26,8 @@ if (!isDevServer) {
process.exit(0);
}

const inTmux = !!process.env.TMUX;
const tmuxVal = process.env.TMUX || "";
const inTmux = tmuxVal !== "" && fs.existsSync(tmuxVal.split(",")[0]);
const inScreen = !!process.env.STY;
Comment on lines +29 to 31
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Inspect existing project docs/tests for expected tmux/screen support and socket assumptions.
rg -n -C3 '\b(TMUX|STY|screen|tmux|block-dev-server)\b'

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 32265

🏁 Script executed:

# Look for tests or documentation related to block-dev-server.js
find . -type f \( -name "*.test.*" -o -name "*.spec.*" \) | xargs grep -l "block-dev-server\|TMUX\|STY" 2>/dev/null || echo "No test files found"

# Check for any documentation about multiplexer expectations
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.json" \) | xargs grep -l "screen.*socket\|tmux.*socket\|STY" 2>/dev/null || echo "No socket docs found"

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 120

🏁 Script executed:

# Check for references to STY usage anywhere in the codebase
rg -i '\bSTY\b' --type-list | head -20
rg -i '\bSTY\b' 2>/dev/null || echo "STY not referenced elsewhere"

# Check if there are comments explaining the STY/screen usage in the file
sed -n '20,45p' hooks/scripts/block-dev-server.js

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 1263

🏁 Script executed:

# Look for socket validation patterns in similar Node.js files
rg 'isSocket|statSync' --type-list | head -5
rg 'isSocket|statSync' 2>/dev/null || echo "No socket validation patterns found"

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 560

🏁 Script executed:

# Check the full context of block-dev-server.js to understand purpose and any comments
cat -n hooks/scripts/block-dev-server.js

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 1453

🏁 Script executed:

# Search for any usage of tmux or screen in shell scripts or config
rg 'tmux|screen' hooks/ --type-list 2>/dev/null || rg 'tmux|screen' hooks/ 2>/dev/null | head -20

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 691

🏁 Script executed:

# Check if there are any tests at all for hooks
find . -path "*/hooks/*test*" -o -path "*/test*hooks*" 2>/dev/null | head -10
ls -la hooks/ 2>/dev/null

Repository: rohitg00/awesome-claude-code-toolkit

Length of output: 340

Harden beyond path existence to prevent environment variable spoofing.

Lines 30–31 are vulnerable:

  • TMUX=/tmp,1,1 passes fs.existsSync() even though /tmp is not a tmux socket; any existing path bypasses the check.
  • STY=fake bypasses the guard entirely with zero validation.

To close both spoofing vectors, validate that paths are actually Unix sockets:

Recommended fix 
 const tmuxVal = process.env.TMUX || "";
-const inTmux = tmuxVal !== "" && fs.existsSync(tmuxVal.split(",")[0]);
-const inScreen = !!process.env.STY;
+const isSocket = (socketPath) => {
+  if (!socketPath) return false;
+  try {
+    return fs.statSync(socketPath).isSocket();
+  } catch {
+    return false;
+  }
+};
+
+const inTmux = isSocket(tmuxVal.split(",")[0]);
+const inScreen = false; // screen socket validation not yet implemented

For tmux, the socket validation above is sufficient. For screen, no socket path assumptions are documented in the project, so inScreen is disabled until proper socket validation is added.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const tmuxVal = process.env.TMUX || "";
const inTmux = tmuxVal !== "" && fs.existsSync(tmuxVal.split(",")[0]);
const inScreen = !!process.env.STY;
const tmuxVal = process.env.TMUX || "";
const isSocket = (socketPath) => {
if (!socketPath) return false;
try {
return fs.statSync(socketPath).isSocket();
} catch {
return false;
}
};
const inTmux = isSocket(tmuxVal.split(",")[0]);
const inScreen = false; // screen socket validation not yet implemented
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@hooks/scripts/block-dev-server.js` around lines 29 - 31, The inTmux and
inScreen checks are vulnerable to env spoofing; update the TMUX validation to
parse tmuxVal.split(",")[0] into socketPath and then verify
fs.existsSync(socketPath) AND that fs.statSync(socketPath).isSocket() (catch and
treat stat errors as non-tmux), and disable the inScreen detection by setting
inScreen = false (remove relying on process.env.STY) until a proper Unix-socket
validation is implemented; refer to the tmuxVal, inTmux and inScreen symbols
when making these changes.


if (!inTmux && !inScreen) {
Expand Down