Rectify: Write Guard Path Resolution Immunity - #3555
Merged
Trecek merged 6 commits intoJun 1, 2026
Merged
Conversation
Add TestResolveWriteTarget, TestExtractRedirectTargetsCwd, TestRedirectRelativePathResolution, TestGhCommandRedirectChecking, TestWriteGuardCrossProductMatrix, and arch test for resolve_write_target usage enforcement. All tests expected to fail until implementation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add resolve_write_target() to _command_classification.py as the single
path resolution function for all extraction pathways. Update
extract_redirect_targets() to accept cwd parameter and use
resolve_write_target() instead of inline startswith("/") checks.
Remove vestigial has_non_gh gate in _extract_bash_write_targets() so
redirect checking runs unconditionally — the token-based parser (PR
#3300) correctly identifies redirect targets without confusing
positional arguments.
Refactor all 6 inline resolution sites in _extract_segment_targets()
to use resolve_write_target(), eliminating duplicated path resolution
logic.
Fixes #3549
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…th calls
The arch test for extract_redirect_targets was checking for any
"startswith" string in the AST dump, but the function legitimately uses
tok.startswith("(") for subshell depth tracking. Narrow the check to
specifically detect .startswith("/") calls which indicate inline path
resolution that should use resolve_write_target() instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…o exact return type The function returns [] (not None) when a redirect is detected but the relative path cannot be resolved without CWD. Pin assertion to == [] for a stronger test contract. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…solution Prevents file descriptor leak by using with-statement instead of bare open().read(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When no CWD is set, the redirect path cannot be resolved, so found_any_write is never set and the function returns None (not []). Pin to assert result is None for a stronger test contract. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Trecek
force-pushed
the
write-guard-extract-redirect-targets-drops-relative-paths-ha/3549
branch
from
June 1, 2026 21:35
8fd44fb to
11b1aed
Compare
Trecek
deleted the
write-guard-extract-redirect-targets-drops-relative-paths-ha/3549
branch
June 1, 2026 21:45
This was referenced Jun 2, 2026
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The write guard has three independent path extraction pathways for Bash commands: segment-verb extraction (
sed,tee,mv...), redirect extraction (>,>>,2>...), and interpreter extraction (python3 -c "open(...)"). Each pathway independently implements CWD-relative path resolution — or fails to. The redirect pathway silently drops relative paths, and a vestigialhas_non_ghgate bypasses redirect checking entirely for gh-only commands.The architectural weakness is decentralized path resolution — each extraction function must independently implement the same
if path.startswith("/") ... elif cwd: os.path.join(cwd, path)pattern, and new or modified extraction functions routinely miss it. The write guard has been rectified 10+ times in 90 days; each fix addresses one bypass while leaving adjacent ones open.The immunity plan introduces a centralized
resolve_write_target()function that all extraction pathways must use, eliminates the vestigialhas_non_ghgate, and adds a cross-product test matrix that catches missing resolution by design.Closes #3549
Implementation Plan
Plan file:
/home/talon/projects/autoskillit-runs/remediation-20260601-132207-687449/.autoskillit/temp/rectify/rectify_write_guard_path_resolution_immunity_2026-06-01_140500.md🤖 Generated with Claude Code via AutoSkillit
Token Usage Summary
* Step used a non-Anthropic provider; caching behavior may differ.
Token Efficiency
Model Usage Breakdown