FIRE-1947 | Cowork block modal (stacked on #40)

[yuval-qf]

Stacked PR. Base is hotfix/cowork-actor-fix (#40), not main.
main → #40 hotfix/cowork-actor-fix → this PR hotfix/cowork-osascript
Merge #40 first; this PR's base then retargets to main automatically and its
diff shrinks to just the commit below.

Re-adds the native block modal that c31ee5a deleted — for Claude Cowork local sessions only. The CLI and the Claude Desktop app keep getting no modal.

Why

c31ee5a removed security-alert.{sh,ps1} on the grounds that "Claude Desktop now displays hook blocks natively, so the plugin is pure relay". That was correct for the surfaces that existed then, and is still correct for both of them. Claude Cowork was not a surface when that commit landed, and it discards hook-authored text on every documented channel.

Measured 2026-08-18, one session per surface, with a probe plugin that recorded its own uname/whoami/HOME/process ancestry/env from inside the hook process:

block channel	Cowork cloud	Cowork local
{"decision":"block","reason":R}	spinner hangs forever, no text	turn stops, no text
{"continue":false,"stopReason":R}	spinner hangs forever, no text	turn stops, no text
systemMessage alongside a block	—	turn stops, no text
hook exit code 2 + message on stderr	—	turn stops, no text
hookSpecificOutput.additionalContext	renders (model relays it)	renders (model relays it)
native osascript modal	impossible — no GUI	works

Four independent documented channels reach the same dead end, so no JSON shape fixes this. additionalContext is not a substitute — it reaches the model, which may or may not repeat it. In a local session the OS modal is the only channel that reaches the user.

The gate

_rogue_want_alert (hook.sh) / Test-WantAlert (hook.ps1), four tests, cheap ones first:

1. Cowork only — reuses ROGUE_INSTALL_AGENT == "claude_cowork" from install-id.sh rather than re-deriving the surface. Local Cowork's entrypoint is local-agent, not a *cowork* value, so entrypoint matching alone files it as the CLI; install-id.sh already handles that, and a second copy would drift from the roster's.
2. Local only — CLAUDE_CODE_REMOTE set means the cloud container (Linux, root, HOME=/root, no osascript, no DISPLAY, no DBUS). Excluded explicitly rather than left to fail silently, so ~/.rogue/hook.log stays honest.
3. Escape hatches — ROGUE_ALERT=0 disables; ROGUE_ALERT_EVENTS is a space-separated event allowlist.
4. Capability last — command -v osascript. The env vars above are undocumented and will move.

A declined alert logs alert_skipped=1 entrypoint=… cowork=… remote=… agent=…; a fired one logs alert_rc=<exit> (TCC denials and osascript failures are otherwise invisible).

The relay is untouched. The modal is a side-channel — the server body still goes back verbatim, and every path still exits 0.

Two deviations from the plan, both deliberate

• security-alert.sh is NOT restored byte-for-byte. The historical version wraps its osascript in tell application "System Events". A cross-app tell is an Automation request, so macOS attributes it to the host app and prompts "Claude" wants access to control "System Events" on the first block — a consent dialog in front of a security alert, which a user can deny, permanently killing it. plugins/copilot already learned this under PyCharm and CLAUDE.md documents it. Replaced with the bare display alert + top-level activate form (needs no permission). Everything else is byte-for-byte, including the bash-only \n conversion — hence bash, not sh, at the call site.
• The gate reuses install-id.sh's surface resolution instead of re-deriving the Cowork cascade inline, per CLAUDE.md's "resolve host/version/agent in ONE place per plugin".

No version bump in this PR. #40 already carries 1.0.23 → 1.0.24, and the two merge together, so a second bump would ship two releases for one merge. (The plan asked for 1.0.25 plus a bump to install.{sh,ps1}; those installer files carry no version literal anyway — 1.0.24's installer edits were the agent-id fix.)

Tests

• tests/test_hook_sh.sh — 10 new end-to-end cases: Cowork local fires, cloud skips, CLI/Desktop skip, no-osascript skips, an allow response fires nothing, a failing osascript is still fail-open, ROGUE_ALERT_EVENTS narrows, ROGUE_ALERT=0 kills. Every case also asserts the body is relayed verbatim.
  • A hanging osascript stub regression-tests the fd detachment from dbfd3ee. Verified to fail (30 s wait) when the >/dev/null 2>&1 </dev/null is removed — without it the subshell holds Claude's read pipe open until the dialog is dismissed, Claude times the hook out, and the block fails open.
  • Cases run against a sandboxed PATH holding no osascript, so a dev Mac's real /usr/bin/osascript can neither defeat the capability case nor pop a dialog on the tester's screen. (It did both on the first draft.)
• tests/test_hook_ps1.ps1 — 13 new cases: the full gate matrix, plus static assertions that the response is relayed before the launch and that the launch stays detached / hidden / -EncodedCommand.
• tests/test_hooks_json.sh passes unchanged — no hooks.json change; the 27-command polyglot lint is undisturbed.

Local run: 40 hook.sh assertions pass under both sh and dash; 70 hook.ps1 assertions pass; all shell scripts parse; all .ps1 parse; manifest/version-sync gates pass. (tests/test_hook_ps1_antigravity.ps1 has 2 failures — a Resolve-Url $script: scope lint in the antigravity plugin — which pre-exist on the base branch and are not in CI's list.)

Open question, deliberately left open

PreToolUse permissionDecision:deny does render in Cowork cloud (observed twice — CREDENTIAL_THEFT, DANGEROUS_OPERATION, reason visible, no hang). It has not been tested in Cowork local. If tool denials render locally too, the modal should narrow to UserPromptSubmit — the one event with no visible channel — or tool blocks get reported twice. Until that is measured, firing on every block event matches pre-c31ee5a behaviour, and ROGUE_ALERT_EVENTS="UserPromptSubmit" narrows it without a release.

Verification still owed (needs a real Cowork session)

1. Local Cowork, prompt with two email addresses → turn stops, modal reads ⛔ Rogue blocked this prompt, log shows outcome=block then alert_rc=0 entrypoint=local-agent.
2. Cloud Cowork, same prompt → no modal, alert_skipped=1 … remote=true, no osascript: command not found.
3. CLI, same prompt → block rendered natively, alert_skipped=1 … cowork=unset.

Delete this whole path once Cowork renders the reason itself, exactly as it was deleted once Claude Desktop did.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 61bfb5d6-813c-41ae-aba2-f92fbd3ed166

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}