magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS3024: a hook names no agent host

A hook script (magus-command, magus-path, magus-observe or magus-checkpoint, in either its sh or Buzz form) ran without being told which agent host called it:

[MGS3024] this hook did not pass --agent-name, so magus cannot tell which agent
host it is answering, and nothing was judged. Run `magus agent harness
apply` to rewrite the host's hook configuration; the commands it writes name the host.

On a guard surface the call is denied. On the observe and checkpoint surfaces nothing is recorded and the message goes to stderr.

Why

The glue picks the reply a host can parse from the host's name. Claude Code takes permissionDecision: "ask" and prompts; Codex marks the same reply a failed hook and runs the call. So a reply chosen for the wrong host can let a call through that should have been stopped.

magus does not work the host out from the event's shape or default to one host. The host says who it is, and the configuration magus agent harness apply writes for each host passes its name, the harness spell's own mgs_getName(), on every hook command: -- --agent-name claude-code after a Buzz script, --agent-name codex after an sh one. See Told, never guessed.

What to do

Run magus agent harness apply --id <host> to rewrite the configuration, or add --agent-name <host> to the hook command by hand if you wrote the configuration yourself.

sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. magus\guard.commandRegister one Buzz function the agent guard calls on every agent shell command, to add a deny or an advisory from your repository's own rules. magus ships the seam and no rules. magus\guard.spawnRegister one Buzz function the agent guard calls on every subagent spawn and continuation, to add a deny or an advisory from your own rules. magus ships the seam and no rules. Agent skillsEvery skill magus installs, in both curated forms, generated from the embedded bodies.
MGS3024guardhooksagentsharnessagent-name
Last updated (a9ff8609)
Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. See spells.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs - magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

Placeholders

Angle brackets mark a value you replace with your own - never type the brackets:

magus run <target>
magus completion <shell>    # e.g. bash, zsh, fish

<target>, <path>, <shell>, <name> and the like are stand-ins, not literal text.