Repository navigation

fix(hooks): commit-guard heredoc false positive, and a one-model data strip - #2

Merged

roadhero merged 39 commits into

mainfrom

fix/heredoc-strip

Sep 6, 2026

Commits on Sep 6, 2026

fix(hooks): strip heredoc bodies before classifying, so a file body that mentions git flags is not a command
roadhero
committed
e43df62
fix(hooks): one quote model for the data strip, carried across lines
roadhero
committed
28ce2c9
fix(hooks): the walker never treats bash code as data: arithmetic, comments after ), ANSI-C strings; fail closed if the strip fails
roadhero
committed
3eb4d53
fix(hooks): unquoted heredoc bodies still expand substitutions; join continuations inside the walker; parens inside arithmetic
roadhero
committed
843f28a
fix(hooks): comments start only at a word start; frames for ${ } and [ ]; case patterns; continuations joined with nothing; delimiter continuation refused
roadhero
committed
2e607ae
fix(hooks): bodies start and end on parser state, not the physical line; nested and same-line markers fail closed; segment cap
roadhero
committed
51ea0c5
fix(hooks): case counted only in command position; a ) unwinds to the frame it closes; no comments inside ${ }; open frame or quote at end fails closed; here-strings instead of pipes
roadhero
committed
2fa95cc
fix(hooks): separators are text inside expansion and arithmetic frames; # after (( )) is a comment; secrets scan reads every added line
roadhero
committed
0d94b8e
fix(hooks): glue short quoted fragments back into their word; fast path retries dequoted; every tool status-checked; heredoc queue capped; function definitions and coproc set command position
roadhero
committed
1c26efb
fix(hooks): quoted separators are data; ANSI-C numeric escapes fail closed; linear fast-path retry; -F is not a force flag
roadhero
committed
02845b7
test(hooks): the unicode-escape case actually uses a unicode escape
roadhero
committed
fb4540a
fix(hooks): the fast-path retry runs for any unmatched payload; every walker refusal names its construct
roadhero
committed
b36ad83
fix(hooks): a newline separates commands only at the top level; continuation state carries into the next line; command position after coproc and time; quoted hooksPath; every grep and git call stat…
roadhero
committed
3617ab9
fix(hooks): separators inside $( ) never split the enclosing command; absolute-path shell wrappers; --no-color on the diff; symlinks, $'EOF' delimiters, and numeric escapes without git
roadhero
committed
7a2f4cd
fix(hooks): a newline ends the enclosing command only outside every expansion frame; the secrets diff is read as text without textconv or relative paths; wrapper flags before -c
roadhero
committed
1bd0577
fix(hooks): stdin-fed shells, trap, and -c clusters are wrappers; process substitution is a word; added lines come from git's own indicator
roadhero
committed
50bbd77
fix(hooks): the wrapper rule is stated, not enumerated; same-call git aliases refused; env -S; git 2.28 floor; JSON-escape tests really contain escapes
roadhero
committed
31273da
fix(hooks): real command boundaries are a sentinel byte; redirection operators and escaped separators are text; wrappers next to parens, after redirections, and glued to redirects; env options befo…
roadhero
committed
17b47e6
fix(hooks): keep a dropped quoted span as one argument; refuse a raw boundary byte
roadhero
committed
d60b5d9
fix(hooks): subscripts are text, expansions leave a mark, run-time patterns and identity overrides are checked
roadhero
committed
b6c7680
docs: say the guard strips data before checking and refuses what it cannot classify; note the git 2.28 floor
roadhero
committed
192a225
fix(hooks): a ${...} word is its `$`; `)` inside it is text; `[` outside command position is a pattern
roadhero
committed
1832493
fix(hooks): `[` inside ${...} is text; a `}` over an open inner frame is refused
roadhero
committed
90d648a
fix(hooks): a ${...} spanning lines emits nothing; case patterns end at their `)`; config through the environment is one rule
roadhero
committed
7642359
fix(hooks): a heredoc pending inside an open ${...} is refused; backticks and redirects in the pathspec loop
roadhero
committed
b5c5f02
fix(hooks): a heredoc before a substitution is refused; whole-arg-quoted committer, empty-arg and literal-mark pathspecs
roadhero
committed
b6e7509
fix(hooks): an empty quote is an argument only when it is a whole word; XDG_CONFIG_HOME is a config route; anchor includeIf
roadhero
committed
0f7b305
fix(hooks): a bare $name expansion leaves a mark, like ${...}, so an empty one cannot glue to a flag
roadhero
committed
a24c28a
fix(hooks): a possibly-empty expansion inside double quotes cannot glue to or hide a flag
roadhero
committed
e986453
fix(hooks): refuse a ${parameter:-default} whose default value is a flag
roadhero
committed
991fc08
fix(hooks): the flag-default refuse also covers alternate operators and a space before the dash
roadhero
committed
e1a97c4
fix(hooks): a brace-default value that is a flag, a +refspec, or a config/identity token is refused
roadhero
committed
1ae042e
fix(hooks): a config or identity value built from an expansion is caught even when the key is split
roadhero
committed
ff4bf18
fix(hooks): a same-call `git config user.name/email` to a bot is refused, mirroring the hooksPath rule
roadhero
committed
1126b90
fix(hooks): the config-identity check reads the stripped text and refuses a value built from an expansion
roadhero
committed
8d9c372
fix(hooks): the config-identity refuse skips short option flags too (git config -f <file> user.name)
roadhero
committed
d398035
fix(hooks): the config-identity refuse also skips an equals-glued option flag (git config --type=path user.name)
roadhero
committed
38ccdba
fix(hooks): the config-identity expansion refuse is case-insensitive, like git config keys
roadhero
committed
9794db5
docs: set §19.4 live version to v1.0.7
roadhero
committed
b0d8a8e