Hooks

Hooks run shell commands automatically before or after agent events. Place YAML hook files in ~/.openaf-mini-a/hooks/.

Supported events: before_goal · after_goal · before_tool · after_tool · before_shell · after_shell

# Load extra hook directories
mini-a extrahooks=/path/to/team-hooks,/path/to/project-hooks

Available environment variables inside hook commands:

Variable	Set during
`$MINI_A_GOAL`	`before_goal`, `after_goal`
`$MINI_A_RESPONSE`	`after_goal`
`$MINI_A_TOOL_NAME`	`before_tool`, `after_tool`
`$MINI_A_TOKENS_IN`	`after_tool`
`$MINI_A_TOKENS_OUT`	`after_tool`
`$MINI_A_SHELL_COMMAND`	`before_shell`, `after_shell`

hook

Shell Guard

Blocks destructive shell commands (rm -rf, mkfs, dd) before they are executed. Exits with code 1 to abort the tool call.

securitysafetyshell

event: before_shell
command: >
  echo "$MINI_A_SHELL_COMMAND" |
  grep -qE '(rm\s+-[a-zA-Z]*r[a-zA-Z]*f|mkfs|dd\s+if=|:\(\)\{|>\s*/dev/sda)' &&
  exit 1 || exit 0
timeout: 1500
failBlocks: true

Event: before_shell

hook

Response Logger

Appends every model response to a session log file. Useful for audit trails and post-session review.

loggingauditdebugging

event: after_goal
command: >
  mkdir -p ~/.openaf-mini-a/logs &&
  echo "--- $(date -Iseconds) ---" >> ~/.openaf-mini-a/logs/session.log &&
  echo "$MINI_A_RESULT" >> ~/.openaf-mini-a/logs/session.log
timeout: 2000
failBlocks: false

Event: after_goal

hook

Pre-Goal Banner

Prints a formatted banner to the terminal before each goal starts. Helps visually separate runs in long sessions.

uxloggingproductivity

event: before_goal
command: >
  echo "" >> ~/.openaf-mini-a/logs/session.log &&
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" >>  ~/.openaf-mini-a/logs/session.log &&
  echo "  mini-a  ▸  $(date '+%H:%M:%S')" >> ~/.openaf-mini-a/logs/session.log &&
  echo "  Goal: $(echo "$MINI_A_GOAL" | head -c 80)"  >> ~/.openaf-mini-a/logs/session.log &&
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"  >> ~/.openaf-mini-a/logs/session.log
timeout: 1000
failBlocks: false

Event: before_goal

hook

Tool Allow-List

Only allows a predefined set of MCP tool names to be called. All other tools are blocked before execution.

securitysafetytools

event: before_tool
# Edit the ALLOWED list to match your permitted tools
command: >
  ALLOWED="read_file,list_directory,search_files,get_current_time" &&
  echo "$ALLOWED" | tr ',' '\n' | grep -qxF "$MINI_A_TOOL_NAME" ||
  exit 1
timeout: 500
failBlocks: true

Event: before_tool

hook

Kubectl Read-Only Guard

Blocks mutating `kubectl` shell commands while allowing read-only inspection commands like `get`, `describe`, and `logs`.

kubernetesshellsecuritysafety

name: kubectl-readonly
event: before_shell
failBlocks: true
injectOutput: false
timeout: 3000
command: |
  bash -c '
    cmd="$MINI_A_SHELL_COMMAND"
    if ! echo "$cmd" | grep -qE "(^|[|;&[:space:]])kubectl([[:space:]]|$)"; then
      exit 0
    fi
    subcmd=$(echo "$cmd" | grep -oP "kubectl\s+\K\S+")
    readonly_cmds="get describe logs explain top version api-resources api-versions cluster-info diff"
    for allowed in $readonly_cmds; do
      [ "$subcmd" = "$allowed" ] && exit 0
    done
    echo "BLOCKED: kubectl \"$subcmd\" is not a read-only command" >&2
    exit 1
  '

Event: before_shell