3 people 50e31274f2 fix(bash-guard): deny git verbs hidden in command substitutions (#226) ...

Closes the real bypass antfleet flagged in PR #223 (credit to them for the
finding): a denied git verb inside $(...) or backticks is expanded by the
shell before the wrapping echo/printf runs, so the skeletonizer's strip hid it
from the git check. This reworks it correctly where #223's fix could not land:

- targets the live source (docker/scripts/bash-guard-hook.sh, COPY'd to
  /app/scripts/), not a path that doesn't exist;
- runs INSIDE the ROBOCO_GUARD_SKIP_GIT guard, so on grok it stays the native
  --deny's job and never hard-cancels the run (#223 ran it unconditionally);
- excludes single-quoted strings and heredoc bodies (literal / data, matching
  the skeletonizer), so a README documenting git verbs isn't a false positive;
- fails closed (a non-sentinel / python failure denies).

44 bash-guard tests pass (5 new: dollar/backtick/double-quoted substitution
deny, single-quoted literal allow, grok-skip allow).

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

2026-06-19 20:51:02 +02:00

..

__init__.py

fix(bash-guard): deny internal curl to orchestrator/localhost

2026-05-03 06:11:38 +02:00

test_bash_guard.py

fix(bash-guard): deny git verbs hidden in command substitutions (#226)

2026-06-19 20:51:02 +02:00