Renn F 1605d187f1 fix(security): bash-guard git-ops check inspects commands, not file content (#165) ...

The git network/auth deny rule matched its regex against the whole
command string, so heredoc bodies and echo/printf arguments that merely
documented git verbs (a README, a notes file) were treated as git
invocations and denied. This wedged smoke-13's dev: after wiping the
README via an Edit/Write fallback it could not restore it because every
`cat > README.md << EOF ... git commit ... EOF` was blocked.

The git-ops check now runs against a skeleton of the command with
heredoc bodies and echo/printf literal args stripped (both are data the
shell writes, never executed). Quoted args to a shell interpreter
(`bash -c "... && git fetch"`) ARE executed, are not echo/printf/heredoc
bodies, and so survive untouched — the hook's core purpose is preserved.
A sentinel prefix distinguishes a legitimately-empty skeleton from a
python failure (fail closed on failure). All other rules, including the
#164 import-bypass rule, still inspect the full command.

2026-05-16 02:20:08 +02:00

..

__init__.py

fix(bash-guard): deny internal curl to orchestrator/localhost

2026-05-03 06:11:38 +02:00

test_bash_guard.py

fix(security): bash-guard git-ops check inspects commands, not file content (#165)

2026-05-16 02:20:08 +02:00