fix(adapters): parse() crashed on a malformed tool_input, and a crash is an allow (#63)

parse() raised AttributeError whenever tool_input was a truthy non-dict,
on six adapters, and whenever edits contained non-dicts, on three.
dispatch.run wraps only the JSON decode, so the exception killed the hook
with exit 1 -- a non-blocking error on almost every vendor in the matrix.
The tool call proceeded. A guard that crashes is a guard that allows.

Harden every site with an isinstance check, and add a fourth CI invariant:
parse() never raises, over nine hostile payload shapes x every adapter,
108 cases. Suite 857 -> 965 passing.

Author: jothimani-rajendran

CHANGELOG.md

@@ -87,6 +87,21 @@ versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   the explicit allow**, because `updatedInput` is the only way to express a rewrite and
   approving the *substituted* call is what the handler asked for. `codex_cli` already
   behaved this way, for a different vendor reason.
+- **Six adapters crashed on a malformed `tool_input`, and a crash is an allow.** `parse()`
+  raised `AttributeError` whenever `tool_input` was a truthy non-dict (a string, a list, a
+  number), and three raised on an `edits` list holding non-dicts. `dispatch.run` wraps only
+  the JSON decode — everything after it runs unprotected — so the exception killed the hook
+  with exit 1, which almost every vendor here treats as a non-blocking error. The call
+  proceeds. The one failure this library exists to prevent, caused by the library.
+
+  Five adapters already hardened with `isinstance`; the inconsistency is what kept it
+  invisible. `tool_input` is whatever the agent chose to serialise, and its shape is not
+  ours to assume.
+
+### Added
+- **A fourth invariant: `parse()` never raises.** Nine hostile payload shapes × every
+  adapter, 108 cases. None exotic — a vendor adding a scalar-argument tool, or a serialiser
+  that flattens, produces them.
 
 - **`installed()` answered a substring question, not an ownership one.** It was
   `owner in json.dumps(config)`, a text search over the whole serialised file. Two ways that

src/agentseam/adapters/claude_code.py

@@ -111,13 +111,18 @@ def claims(raw):
 
 
 def parse(raw):
-    ti = raw.get("tool_input") or {}
+    ti = raw.get("tool_input")
+    # A guard that crashes is a guard that allows: dispatch only wraps the JSON decode, so
+    # an exception here kills the hook with exit 1, which most vendors treat as a
+    # non-blocking error and let the call through. tool_input is whatever the agent chose
+    # to serialise, so it is not ours to assume the shape of.
+    ti = ti if isinstance(ti, dict) else {}
     tool = raw.get("tool_name")
     # new_source is NotebookEdit's cell body -- the tool is in WRITE_TOOLS, so claiming to
     # handle it while dropping its content is an internal contradiction, not a vendor guess.
     content = ti.get("content") or ti.get("new_string") or ti.get("new_source") or None
     if content is None and isinstance(ti.get("edits"), list):
-        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"])
+        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"] if isinstance(e, dict))
         content = joined or None
     out = raw.get("tool_output")
     if isinstance(out, (dict, list)):

src/agentseam/adapters/devin.py

@@ -105,7 +105,12 @@ def claims(raw):
 
 
 def parse(raw):
-    ti = raw.get("tool_input") or {}
+    ti = raw.get("tool_input")
+    # A guard that crashes is a guard that allows: dispatch only wraps the JSON decode, so
+    # an exception here kills the hook with exit 1, which most vendors treat as a
+    # non-blocking error and let the call through. tool_input is whatever the agent chose
+    # to serialise, so it is not ours to assume the shape of.
+    ti = ti if isinstance(ti, dict) else {}
     content = ti.get("content") or ti.get("new_string") or None
     out = raw.get("tool_output")
     if isinstance(out, (dict, list)):

src/agentseam/adapters/gemini_cli.py

@@ -90,7 +90,12 @@ def claims(raw):
 
 
 def parse(raw):
-    ti = raw.get("tool_input") or {}
+    ti = raw.get("tool_input")
+    # A guard that crashes is a guard that allows: dispatch only wraps the JSON decode, so
+    # an exception here kills the hook with exit 1, which most vendors treat as a
+    # non-blocking error and let the call through. tool_input is whatever the agent chose
+    # to serialise, so it is not ours to assume the shape of.
+    ti = ti if isinstance(ti, dict) else {}
     tool = raw.get("tool_name")
     content = None
     if tool in WRITE_TOOLS:

src/agentseam/adapters/junie.py

@@ -95,7 +95,7 @@ def parse(raw):
     # the same fallback chain claude_code.parse uses -- not a guess, a claim we already made.
     content = ti.get("content") or ti.get("new_string") or ti.get("new_source") or None
     if content is None and isinstance(ti.get("edits"), list):
-        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"])
+        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"] if isinstance(e, dict))
         content = joined or None
     return Event(
         AGENT,

src/agentseam/adapters/kimi_code.py

@@ -116,7 +116,7 @@ def parse(raw):
     # same fallback chain claude_code.parse uses -- not a guess, a claim we already made.
     content = ti.get("content") or ti.get("new_string") or ti.get("new_source") or None
     if content is None and isinstance(ti.get("edits"), list):
-        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"])
+        joined = "\n".join(str(e.get("new_string", "")) for e in ti["edits"] if isinstance(e, dict))
         content = joined or None
     out = raw.get("tool_output")
     if isinstance(out, (dict, list)):

src/agentseam/adapters/vscode_copilot.py

@@ -78,8 +78,7 @@
 _CURSOR_MARKERS = ("model", "cursor_version", "conversation_id", "generation_id", "workspace_roots")
 
 #: Copilot CLI's camelCase names, which no other vendor uses -- the name alone identifies
-#: these. Derived from EVENT_MAP: a hand-kept list drifted, leaving payloads claimed by
-#: the matrix but by no adapter, and so allowed through.
+#: these. Derived from EVENT_MAP: a hand-kept list drifted and left payloads unclaimed.
 _CLAIMABLE = tuple(name for name in EVENT_MAP if name[:1].islower())
 
 #: executeHook merges {timestamp, hook_event_name, session_id?, transcript_path?} into
@@ -115,12 +114,14 @@ def claims(raw):
     if name in _CLAIMABLE:
         return True
     # memory-tool payloads are unmistakable
-    ti = raw.get("tool_input") or {}
+    # The isinstance guard also keeps a non-dict tool_input from raising here.
+    ti = raw.get("tool_input")
     return raw.get("tool_name") in MEMORY_TOOLS and isinstance(ti, dict) and "command" in ti
 
 
 def parse(raw):
-    ti = raw.get("tool_input") or {}
+    ti = raw.get("tool_input")
+    ti = ti if isinstance(ti, dict) else {}
     tool = raw.get("tool_name") or raw.get("toolName")
     path = content = None
     if tool in MEMORY_TOOLS:
@@ -158,15 +159,15 @@ def parse(raw):
 
 def is_memory_write(event):
     """True when this event is a memory-tool content write (VS Code's memory surface)."""
-    ti = event.raw.get("tool_input") or {}
+    ti = event.raw.get("tool_input")
+    ti = ti if isinstance(ti, dict) else {}
     return event.tool in MEMORY_TOOLS and ti.get("command") in MEMORY_WRITE_COMMANDS
 
 
-#: Events whose block verdict is a TOP-LEVEL {decision: "block", reason}.
-#: UserPromptSubmitHookOutput declares exactly those two fields and
-#: defaultIntentRequestHandler reads `typedOutput.decision` off the root object;
-#: executePostToolUseHook reads the same two off a PostToolUse response's root, where a
-#: block feeds the reason back to the model instead of the tool result.
+#: Block verdict at the TOP LEVEL: {decision: "block", reason}.
+#: UserPromptSubmitHookOutput declares exactly those two and
+#: defaultIntentRequestHandler reads `typedOutput.decision` off the root;
+#: executePostToolUseHook reads the same two off a PostToolUse response's root.
 _TOP_LEVEL_BLOCK = (PROMPT_SUBMIT, POST_TOOL)
 
 #: Block verdict NESTED in hookSpecificOutput. executeStopHook requires BOTH decision and
@@ -253,10 +254,9 @@ def respond(decision, event):
 #:
 #: PascalCase, i.e. VS Code's spelling, because CONFIG_PATH is VS Code's file.
 #: `parseCopilotHooks` resolves each key with `resolveCopilotCliHookType(id) ?? toHookType
-#: (id)`, so both spellings work there -- but only one may be written: it does
-#: `result.set(hookType, ...)`, an overwrite, so two keys resolving to the same HookType
-#: silently drop one. SESSION_END is therefore unwireable: `sessionEnd` is a Copilot CLI
-#: name VS Code never fires, claimed for parsing and not offered for installing.
+#: (id)`, so both spellings work -- but only one may be written: it does `result.set(...)`,
+#: an overwrite, so two keys resolving to the same HookType silently drop one. SESSION_END
+#: is therefore unwireable: a Copilot CLI name VS Code never fires.
 REVERSE_EVENT_MAP = {
     PRE_TOOL: "PreToolUse",
     POST_TOOL: "PostToolUse",

tests/test_parse_is_total.py

@@ -0,0 +1,56 @@
+"""`parse()` must not raise, whatever the payload looks like.
+
+A guard that crashes is a guard that allows. `dispatch.run` wraps only the JSON decode --
+everything after it, including `parse()`, runs unprotected -- so an exception here kills the
+hook process with exit 1, and exit 1 is a non-blocking error on almost every vendor here.
+The call proceeds. The one thing this library exists to prevent, caused by the library.
+
+Six adapters crashed on a non-dict `tool_input` and three on an `edits` list containing
+non-dicts, while five others already hardened with `isinstance` -- the inconsistency is what
+made it invisible. `tool_input` is whatever the agent chose to serialise; its shape is not
+ours to assume.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from agentseam import adapters  # noqa: E402
+
+#: Shapes a payload could take that are not the one the adapter expects. Not exotic: a
+#: vendor adding a scalar-argument tool, or a serialiser that flattens, produces these.
+_HOSTILE = {
+    "tool_input is a string": {"tool_input": "rm -rf /"},
+    "tool_input is a list": {"tool_input": ["a"]},
+    "tool_input is a number": {"tool_input": 7},
+    "tool_input is null": {"tool_input": None},
+    "edits holds non-dicts": {"tool_input": {"edits": ["oops", None, 3]}},
+    "edits is not a list": {"tool_input": {"edits": "nope"}},
+    "content is a dict": {"tool_input": {"content": {"nested": True}}},
+    "tool_output is a list": {"tool_input": {}, "tool_output": [1, 2]},
+    "no tool_input at all": {},
+}
+
+
+@pytest.mark.parametrize("agent", sorted(adapters.ADAPTERS))
+@pytest.mark.parametrize("label", sorted(_HOSTILE))
+def test_parse_never_raises(agent, label):
+    mod = adapters.get(agent)
+    raw = dict(
+        {
+            "hook_event_name": "PreToolUse",
+            "hookEventName": "preToolUse",
+            "tool_name": "Write",
+            "client_type": getattr(mod, "CLIENT_TYPE", None),
+        },
+        **_HOSTILE[label],
+    )
+    try:
+        mod.parse(raw)
+    except Exception as exc:  # noqa: BLE001 -- the whole point is that nothing escapes
+        pytest.fail("%s.parse raised %s on %s: %s" % (agent, type(exc).__name__, label, exc))