Skip to content

Fix Droid file edit hook not extracting edit content#9

Merged
tanuj-corridor merged 2 commits into
mainfrom
fix-droid-edit-field-names
Mar 2, 2026
Merged

Fix Droid file edit hook not extracting edit content#9
tanuj-corridor merged 2 commits into
mainfrom
fix-droid-edit-field-names

Conversation

@tanuj-corridor

@tanuj-corridor tanuj-corridor commented Mar 2, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Factory Droid sends old_str/new_str in tool_input for the Edit tool, while Claude Code sends old_string/new_string
  • The droid-after-file-edit handler only checked for Claude Code's field names, so edits arrived as empty strings
  • Empty edits caused the security check to early-return safe: true (no diff summaries) without running the actual analysis
  • Simplified the Droid handler to only use old_str/new_str directly, since this handler is a separate code path that never receives Claude input — no need for dual-field fallback logic

Test plan

  • Tested locally with Factory Droid — security check now correctly receives edit content and returns the expected result
  • All Go tests pass

Stop hook working after this PR:

droid-stop-hook-demo.mp4

Factory Droid sends old_str/new_str in tool_input for the Edit tool,
while Claude Code sends old_string/new_string. The droid-after-file-edit
handler only checked for Claude Code's field names, causing empty edits
to be sent to the security check — which then returned safe:true without
actually running the check.

@corridor-security corridor-security Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary: This PR adjusts JSON parsing in OnAfterFileEdit to support alternate field names for edit strings and sets precedence without introducing execution, filesystem, or network actions.

Risk: Low risk. The changes only transform parsed input for handlers and do not affect command execution, path handling, or external integrations; no exploitable security vulnerabilities were identified.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

Open in Devin Review

The Droid handler is a separate code path that only receives Droid
input, so it will never see Claude's old_string/new_string fields.
Remove the unnecessary dual-field struct and fallback logic.
@tanuj-corridor
tanuj-corridor merged commit 87a7197 into main Mar 2, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants