fix(hooks): false fail-closed H-09b block on semicolon-bearing commit messages#169
Merged
Conversation
The harness's own signal is authoritative; a hook subprocess is not guaranteed to start inside the project (/ca:doctor, /ca:preview run elsewhere too), and rev-parse from a foreign cwd can resolve to the plugin's marketplace clone. Env-first is also cheaper; one git spawn saved per hook invocation. Every test harness that spawns hooks into fixture repos now pins or strips the variable — a value leaking in from a live Claude session would point every guard at the developer's real repo, not the fixture.
pre-bash's COMMIT_RE captured args with [^|;&]*, which stops at the
first `;`, `|`, or `&` even inside a quoted -m string or a heredoc
body. A commit message containing `diff-scoped; nothing` truncated
there; the unterminated `$(cat <<'EOF'` fragment defeated the heredoc
stripper, message words leaked into the pathspec parse, and a token
like `/ca:checkpoint)` made `git diff HEAD -- ...` fatal ("outside
repository") — so H-09b failed CLOSED on a clean, already-reviewed
commit (the 2026-07-01 "flaky hook"; it was deterministic per message
shape, not timing).
Three-part fix, no gate weakening: (1) heredoc bodies are stripped
from the whole command before matching, with the raw command kept as
a fallback matcher so a heredoc fed TO a shell (`bash <<EOF`) is
still guarded; (2) the args capture is quote-aware, consuming quoted
strings whole while still stopping at unquoted separators; (3) the
fail-closed block message now carries git's actual stderr, so a
future read failure is diagnosable in one look.
CHANGELOG: Fix a false fail-closed H-09b/H-14 block on commits whose
message body contains `;`, `|`, `&`, or a `git -C` mention (heredoc
and quoted -m forms); block messages now include the underlying git
error.
Payload change (hooks fix) requires the bump; the overrides.log line is this session's /ca:dev entry, committed per the append-only audit-trail rule (ORCHESTRATOR §7).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the "flaky" H-09b commit-gate failure that blocked 5 of 6 commit attempts on 2026-07-01. It was never timing:
COMMIT_RE's args capture ([^|;&]*) truncated at the first;inside the commit message body (heredoc or quoted-m). The unterminated$(cat <<'EOF'fragment defeated the heredoc stripper, message words leaked into the pathspec parse, and the token/ca:checkpoint)madegit diff HEAD -- ...fatal ("outside repository") —added_linesreturned None and H-09b failed closed. Deterministic per message shape; reproduced offline from the failing session's transcript, byte for byte.Fix (no gate weakening — correctness over velocity, hierarchy L2)
COMMIT_RE/PUSH_RE/ADD_RE, with the raw command kept as a fallback matcher so a heredoc fed to a shell (bash <<EOF ... EOF) is still guarded. Detection is a union, never a substitution.|/;/&, so&& git push --forceis still independently caught.project_root()trustsCLAUDE_PROJECT_DIRfirst (the harness's authoritative signal; also one git spawn saved per hook invocation). All hook-spawning test harnesses now pin/strip the variable so fixtures stay hermetic.Verification
;,-F -heredoc with;, quoted-m "a; b",git -Cmentioned in a message,commit && push --forcestill blocked, heredoc tail pathspec still scanned, shell-fed heredoc commit still guarded.;,|,&,$(cat <<'EOF',git -C,/ca:checkpoint)) — the exact shapes that failed last night.-Cinside a shell-fed heredoc body no longer steering the H-01 cwd — both consistent with the documented lexical-guard posture).Closes the root cause behind the 2026-07-01 SECURITY-OVERRIDE log entry.
https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa