[P1] Shell indirection bypasses pre-bash commit, push, staging, and security gates

[tg12]

Severity: P1 critical

Problem

pre-bash.py gates dangerous git operations by regex-matching the literal Bash/PowerShell command string. It does not evaluate shell indirection.

Source evidence:

• plugins/ca/hooks/pre-bash.py:29-35 defines regexes for literal git ... commit, git ... push, and git ... add spellings.
• plugins/ca/hooks/pre-bash.py:339-352 only enforces H-01 direct-commit blocking if COMMIT_RE.search(cmd) matched.
• plugins/ca/hooks/pre-bash.py:413-467 only runs the H-09b/H-10b security scan inside the same if commit: branch.
• plugins/ca/hooks/pre-bash.py:469-524 only runs the H-14 migration scan inside if commit: as well.

A command that constructs git commit through shell variables is still a real commit, but the hook sees no git commit token sequence and exits 0.

Reproduction

In a throwaway arbiter-enabled repo on main:

git commit -m x
exit 2
stderr BLOCKED [H-01]: Direct commit to main is prohibited (ORCHESTRATOR §3). Create a feature branch.

g=git; c=commit; $g $c -m x
exit 0
stderr

The second command would execute git commit -m x after the hook allows it.

Impact

This bypasses the product's load-bearing shell hook for:

• direct commits to main/master
• protected-branch pushes and force pushes
• wildcard staging restrictions
• H-09b/H-10b crypto/secret commit backstops
• H-14 migration commit backstop

The bypass does not require exotic shell features; variable assignment and expansion are normal Bash/PowerShell usage.

Smallest credible fix

Regex over a shell command string is not a reliable enforcement boundary for git mutations.

Possible directions:

• Install repo-level pre-commit / pre-push hooks for the hard backstops, so enforcement triggers on the git operation rather than the model's spelling.
• Fail closed on complex shell constructs in enabled repos when the command contains assignment/expansion/control operators near a git operation.
• Route commits/pushes through a sanctioned command path and block arbitrary Bash git mutation commands unless explicitly classified safe.

Add regression tests for at least variable indirection (g=git; c=commit; $g $c ...) and command-substitution/alias forms if supported by the shell surface.

Duplicate check

Checked existing issues with:

gh issue list --repo arbiterForge/codeArbiter --state all --search "pre-bash shell variable git commit bypass OR lexical bypass OR H-09b bypass OR H-01 bypass"
gh issue list --repo arbiterForge/codeArbiter --state all --search "security gate bypass commit hook pre-bash git variable"

No matching issue was returned.