everything-claude-code

fix: cover remaining gateguard tokenizer bypasses

Affaan Mustafa · 2026-05-13 02:30:06 -04:00

25ea9a771d

fix: address PR #1853 review feedback (force-if-includes, switch, subshell, +refspec)

Five additional review findings on top of the round-1 tokenizer fix.
Combined patch surface is small (one push branch, new switch branch,
exploded subshell handling); all six review issues are now closed.

P1 — --force --force-if-includes still destructive (Greptile, line 217):
  Previous logic treated --force-if-includes as a safety guarantee
  alongside --force-with-lease. Per git-scm.com/docs/git-push,
  --force-if-includes is a no-op WITHOUT --force-with-lease, so a
  combination of --force --force-if-includes is just --force. Push
  branch now treats only --force-with-lease as a lease, and reports
  force when --force / -f is present.

P2 — git switch destructive forms not detected (Greptile, line 234):
  Added a switch branch to isDestructiveGit covering:
    --discard-changes   (explicit discard)
    --force / -f        (ignore conflicts, overwrite)
    -C <branch>         (force-create, overwrites existing branch)

P0 — backtick + $(...) subshell bypass (CodeRabbit, line 64):
  Added explodeSubshells() that promotes `...` and $(...) contents
  to top-level segment separators. Run on both the SQL/dd regex
  input and the per-segment shell tokenizer input. Loops up to 4
  passes to catch a layer of nesting. Without this,
  `echo y | $(rm -rf /tmp)` slipped past the segment splitter
  because the destructive command lived inside a sub-expression.

P0 — +refspec force push (CodeRabbit, line 217):
  `git push origin +main`, `+refs/heads/main:refs/heads/main`, etc.
  force a non-fast-forward update of that specific ref. Push branch
  now also flags any positional arg starting with `+` that matches
  a refspec shape. Excludes bare `+` and numeric-only tokens.

P2 — missing --force --force-if-includes regression test
  (Greptile, line 1202): added.

Tests (+10 on top of the round-1 +10):
  Bypass-now-blocked:
    - git push --force --force-if-includes (force-if-includes is no-op
      without lease — bare force is still in effect)
    - git push origin +main (+refspec bare branch)
    - git push origin +refs/heads/main:refs/heads/main (+refspec full)
    - git switch --discard-changes
    - git switch --force
    - git switch -f (short form)
    - git switch -C (force-create)
    - echo y | `rm -rf /tmp` (backtick subshell)
    - echo y | $(rm -rf /tmp) (dollar-paren subshell)
  Still-allowed:
    - git switch feature (plain)

67/67 in gateguard-fact-force.test.js. 2380/2380 across the full
suite. yarn lint clean. All seven CI validators pass.

Refs #1843.

Jamkris · 2026-05-13 15:26:03 +09:00

12353c52c4

fix: close gateguard destructive-bash regex bypasses with tokenizer

Six classes of bypass in scripts/hooks/gateguard-fact-force.js
DESTRUCTIVE_BASH regex, plus a separate false-positive class.
Same shape of issue as the block-no-verify holes addressed in
#1843: a single-regex shell parser can never cover the flag-order
variations git and rm allow.

Real bypasses observed locally (all ALLOW today, should BLOCK):

  git push -f origin main                       (short form of --force)
  git -c core.foo=bar reset --hard              (intervening -c global)
  rm -fr /tmp/junk                              (reverse flag order)
  rm -r -f /tmp/junk                            (split flag form)
  git reset HEAD --hard                         (intervening ref token)
  git clean -fd                                 (combined -f + -d flag)

False positive observed locally (BLOCK today, should ALLOW):

  git commit -m "fix: rm -rf race in worker"   (destructive phrase
                                                inside quoted message)

Behavior fix that comes along: --force-if-includes is now exempted
alongside --force-with-lease. Both are safety-checked variants;
the previous regex used a negative lookahead that only spelled out
--with-lease, so --force-if-includes blocked under the old code
even though it is the safer-not-harder choice.

Fix shape (mirrors block-no-verify #1843):

  - DESTRUCTIVE_SQL_DD regex kept for `drop table`, `delete from`,
    `truncate`, `dd if=` — these are stable keyword phrases. Quoted
    strings are stripped before the regex runs so the phrase is not
    matched inside a commit message body.
  - isDestructiveBash() tokenizes the command into segments at
    unquoted ; | & boundaries, then per segment:
      * isDestructiveRm  — detects `rm` with both r and f set
        across combined or split flag tokens.
      * isDestructiveGit — finds the git subcommand after skipping
        global options (-c key=val, -C path, --git-dir=, etc.),
        then handles reset, checkout --, clean -f*, push --force
        (with --force-with-lease / --force-if-includes exemption),
        commit --amend, and rm -r* preservation.
  - Command tokens go through commandBasename() so /usr/bin/rm,
    rm.exe, and RM all normalize to "rm".

Tests (+10 in tests/hooks/gateguard-fact-force.test.js):

  Bypass-now-blocked (7):
    - denies short-form git push -f
    - denies git reset --hard with intervening -c global option
    - denies rm -fr (reverse flag order)
    - denies rm -r -f (split flag form)
    - denies git reset HEAD --hard
    - denies git clean -fd
    - denies destructive command in second chained segment

  False-positive-now-allowed (3):
    - allows destructive phrase inside `-m` commit message (rm -rf)
    - allows SQL phrase inside `-m` commit message (drop table)
    - allows --force-if-includes as a safety-checked variant

Local verification:
  yarn lint                                                 clean
  scripts/ci/validate-*  (agents/commands/rules/skills/hooks/
                          install-manifests/no-personal-paths)  pass
  node tests/run-all.js                              2380/2380 pass

Caveat (unrelated): yarn test still fails at check-unicode-safety
on skills/windows-desktop-e2e/SKILL.md (U+2605) per #1843's
caveat — independent of this change.

Provenance: discovered during a security pass on ECC after PR
#1843 (block-no-verify shell-words rewrite) landed. Same class of
regex-based shell parser issue, same shape of fix.

Refs #1843.

Jamkris · 2026-05-13 14:54:27 +09:00

231c1fdbe8

fix: close block-no-verify bypass holes

Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

SeungHyun · 2026-05-12 22:28:12 -04:00

6be241a463

feat: add ECC statusline observability hooks

Salvages the useful statusline/context monitor work from stale PR #1504 while preserving the current continuous-learning hook runner wiring.

Adds the metrics bridge, context monitor, statusline script, shared cost/session bridge utilities, and tests. Fixes the reviewed false loop-detection hash collision for non-file tools, avoids default-session cost inflation, sanitizes statusline task lookup, and records hook payload session IDs in cost-tracker.

Affaan Mustafa · 2026-05-11 23:44:06 -04:00

940135ea47

fix: scope SessionStart context injection

Affaan Mustafa · 2026-05-11 22:56:29 -04:00

03108bea62

fix: salvage remaining stale queue fixes (#1754 )

Affaan Mustafa · 2026-05-11 16:41:08 -04:00

c45aeee57f

fix: port Windows hook safety fixes (#1719 )

Affaan Mustafa · 2026-05-11 03:56:51 -04:00

f442bac8c9

fix: port continuous-learning observer fixes

Ports continuous-learning observer signal, storage, remote normalization, and v1 deprecation fixes onto current main.

Affaan Mustafa · 2026-05-11 03:35:42 -04:00

12e1bc424d

fix: port hook session and dashboard safety fixes

Ports suggest-compact session_id isolation and dashboard terminal/document launch safety onto current main.

Affaan Mustafa · 2026-05-11 02:53:28 -04:00

1abc3fb381

fix: bypass GateGuard file gates in subagents (#1710 )

Affaan Mustafa · 2026-05-11 01:51:24 -04:00

7b964402ee

fix(hooks): resolve MCP health-check spawn ENOENT on Windows (#1456 )

* fix(hooks): resolve MCP health-check spawn ENOENT on Windows

On Windows, commands like 'npx' are batch files (npx.cmd) that require
shell expansion to resolve via PATH. Without shell: true, Node.js
spawn() fails with ENOENT.

However, absolute paths (e.g. C:\Program Files\nodejs\node.exe) must
NOT use shell mode because cmd.exe misparses paths containing spaces.

Fix: enable shell mode only for non-absolute commands on Windows, using
path.isAbsolute() to distinguish. This matches how attemptReconnect()
already handles the shell option.

Fixes #1455

* fix(hooks): harden Windows shell spawn — validate command for metacharacters

Addresses bot review feedback on PR #1456:

- Add UNSAFE_SHELL_CHARS regex to guard against shell injection when
  needsShell=true: cmd.exe operators (&, |, <, >, ^, %, !, (), ;,
  whitespace) are rejected before shell mode is enabled
- Add typeof command === 'string' check so path.isAbsolute() cannot
  throw on malformed non-string command values
- Rename test to 'via PATH resolution' (not Windows-only; runs all platforms)
- Fix misleading test comment: 'node' resolves via PATH like npx.cmd but
  does not itself use .cmd; comment now accurately reflects the intent

* fix(hooks): kill full process tree on Windows when shell mode is used

When needsShell=true, the spawned child is cmd.exe. Calling child.kill()
only terminates the shell, leaving the real server process orphaned.

Use taskkill /PID <pid> /T /F on Windows+shell to kill the entire
process tree rooted at cmd.exe. Fall back to SIGTERM+SIGKILL on all
other platforms or when shell mode is not active.

* fix(hooks): fall back to child.kill() when taskkill fails

Windows taskkill can fail if it's not on PATH, the process already
exited, or permissions are denied. Previously the failure was silently
ignored and no kill signal reached the child.

Now: capture the spawnSync result and fall back to child.kill('SIGKILL')
on any taskkill error or non-zero status. This still may leak a
detached server process but at least guarantees the cmd.exe shell is
signaled.

Michael · 2026-05-11 01:13:37 -04:00

600072ebd8

fix: show correct gateguard hook recovery id

Affaan Mustafa · 2026-04-30 11:26:15 -04:00

bb40978e31

fix: keep gateguard destructive gate strict

Affaan Mustafa · 2026-04-30 11:26:15 -04:00

7c5452f4fa

fix: add gateguard recovery escape hatch

Affaan Mustafa · 2026-04-30 11:26:15 -04:00

cfe770a735

fix: cap session-start context injection

Affaan Mustafa · 2026-04-30 08:41:52 -04:00

b1456bd954

fix: fail open on gateguard state write errors

Affaan Mustafa · 2026-04-30 08:15:27 -04:00

95bef977c1

fix: inject learned skills at session start

Affaan Mustafa · 2026-04-30 01:31:41 -04:00

d26d66fd3b

fix: refine gateguard destructive git detection

Affaan Mustafa · 2026-04-29 22:41:22 -04:00

1188aeafc4

fix: parse block-no-verify flags by shell words

Affaan Mustafa · 2026-04-29 21:59:12 -04:00

0dcde13384

fix: route continuous learning observe hooks through node

Affaan Mustafa · 2026-04-29 21:28:59 -04:00

3fadc37802

fix: preserve gateguard concurrent state writes (#1623 )

Affaan Mustafa · 2026-04-29 19:31:11 -04:00

c3ea7a1e5e

fix: run pre-bash linters through windows wrappers

Affaan Mustafa · 2026-04-29 18:59:10 -04:00

b5bdd9352f

fix: fail open on insaits monitor errors

Affaan Mustafa · 2026-04-29 18:03:33 -04:00

1c2d5dd389

fix: support windows insaits python shims

Affaan Mustafa · 2026-04-29 17:53:07 -04:00

63485a26bf

test: cover hook bootstrap and InsAIts monitor

Affaan Mustafa · 2026-04-29 17:45:22 -04:00

fe40a3d27b

fix: install native Cursor hook and MCP config (#1543 )

* fix: install native cursor hook and MCP config

* fix: avoid false healthy stdio mcp probes

Affaan Mustafa · 2026-04-21 18:35:21 -04:00

92e0c7e9ff

Merge pull request #1495 from ratorin/fix/session-end-transcript-path-isolation

fix(hooks): isolate session-end.js filename using transcript_path UUID (#1494)

Affaan Mustafa · 2026-04-21 18:14:23 -04:00

601c626b03

fix(hooks): wrap SessionStart summary with stale-replay guard (#1536 )

The SessionStart hook injects the most recent *-session.tmp as
additionalContext labelled only with 'Previous session summary:'.
After a /compact boundary, the model frequently re-executes stale
slash-skill invocations it finds inside that summary, re-running
ARGUMENTS-bearing skills (e.g. /fw-task-new, /fw-raise-pr) with the
last ARGUMENTS they saw.

Observed on claude-opus-4-7 with ECC v1.9.0 on a firmware project:
after compaction resume, the model spontaneously re-enters the prior
skill with stale ARGUMENTS, duplicating GitHub issues, Notion tasks,
and branches for work that is already merged.

ECC cannot fix Claude Code's skill-state replay across compactions,
but it can stop amplifying it. Wrap the injected summary in an
explicit HISTORICAL REFERENCE ONLY preamble with a STALE-BY-DEFAULT
contract and delimit the block with BEGIN/END markers so the model
treats everything inside as frozen reference material.

Tests: update the two hooks.test.js cases that asserted on the old
'Previous session summary' literal to assert on the new guard
preamble, the STALE-BY-DEFAULT contract, and both delimiters. 219/219
tests pass locally.

Tracked at: #1534

Vishnu Pradeep · 2026-04-21 18:02:19 -04:00

b27551897d

fix(gateguard): rewrite routineBashMsg to use fact-presentation pattern (#1531 )

* fix(gateguard): rewrite routineBashMsg to use fact-presentation pattern

The imperative 'Quote user's instruction verbatim. Then retry.' phrasing
triggers Claude Code's runtime anti-prompt-injection filter, deadlocking
the first Bash call of every session. The sibling gates (edit, write,
destructive) use multi-point fact-list framing that the runtime accepts.

Align routineBashMsg with that pattern to restore the gate's intended
behavior without changing run(), state schema, or any public API.

Closes #1530

* docs(gateguard): sync SKILL.md routine gate spec with new message format

CodeRabbit flagged that skills/gateguard/SKILL.md still described the
pre-fix imperative message. Update the Routine Bash Gate section to
match the numbered fact-list format used by the new routineBashMsg().

Junming · 2026-04-21 18:02:16 -04:00

20041294d9

review: broaden CLAUDE_TRANSCRIPT_PATH fallback to cover missing/empty JSON fields

Previously the env fallback ran only when JSON.parse threw. If stdin was valid
JSON but omitted transcript_path or provided a non-string/empty value, the
script dropped to the getSessionIdShort() fallback path, re-introducing the
collision this PR targets.

Validate the parsed transcript_path and apply the env-var fallback for any
unusable value, not just malformed JSON. Matches coderabbit's outside-diff
suggestion and keeps both input-source paths equivalent.

Refs #1494

Taro Kawakami · 2026-04-19 14:35:21 +09:00

0c3fc7074e

review: apply sanitizeSessionId to UUID shortId, fix test comment

- Route the transcript-derived shortId through sanitizeSessionId so the
  fallback and transcript branches remain byte-for-byte equivalent for any
  non-UUID session IDs that still land in CLAUDE_SESSION_ID (greptile P1).
- Clarify the inline comment in the first regression test: clearing
  CLAUDE_SESSION_ID exercises the transcript_path branch, not the
  getSessionIdShort() fallback (coderabbit P2).

Refs #1494

Taro Kawakami · 2026-04-19 14:30:00 +09:00

01d816781e

review: address P1/P2 bot feedback on shortId derivation

- Use last-8 chars of transcript UUID instead of first-8, matching
  getSessionIdShort()'s .slice(-8) convention. Same session now produces the
  same filename whether shortId comes from CLAUDE_SESSION_ID or transcript_path,
  so existing .tmp files are not orphaned on upgrade.
- Normalize extracted hex prefix to lowercase to avoid case-driven filename
  divergence from sanitizeSessionId()'s lowercase output.
- Explicitly clear CLAUDE_SESSION_ID in the first regression test so the env
  leak from parent test runs cannot hide the fallback path.
- Add regression tests for the lowercase-normalization path and for the case
  where CLAUDE_SESSION_ID and transcript_path refer to the same UUID (backward
  compat guarantee).

Refs #1494

Taro Kawakami · 2026-04-19 14:19:29 +09:00

93cd5f4cff

fix(hooks): isolate session-end.js filename using transcript_path UUID

When session-end.js runs and CLAUDE_SESSION_ID is unset, getSessionIdShort()
falls back to the project/worktree name. If any other Stop-hook in the chain
spawns a claude subprocess (e.g. an AI-summary generator using 'claude -p'),
the subprocess also fires the full Stop chain and writes to the same project-
name-based filename, clobbering the parent's valid session summary with a
summary of the summarization prompt itself.

Fix: when stdin JSON (or CLAUDE_TRANSCRIPT_PATH) provides a transcript_path,
extract the first 8 hex chars of the session UUID from the filename and use
that as shortId. Falls back to the original getSessionIdShort() when no
transcript_path is available, so existing behavior is preserved for all
callers that do not set it.

Adds a regression test in tests/hooks/hooks.test.js.

Refs #1494

Taro Kawakami · 2026-04-19 11:37:32 +09:00

a35b2d125d

fix: consolidate bash hooks without fork storms

Affaan Mustafa · 2026-04-14 21:23:57 -07:00

1fabf4d2cf

Merge pull request #1445 from affaan-m/fix/plugin-installed-hook-root-resolution

fix: resolve plugin-installed hook root on marketplace installs

Affaan Mustafa · 2026-04-14 20:43:40 -07:00

5427c27930

fix: bootstrap plugin-installed hook commands safely

Affaan Mustafa · 2026-04-14 20:24:21 -07:00

1b7c5789fc

fix: harden urgent install and gateguard patch

Affaan Mustafa · 2026-04-14 19:44:08 -07:00

8776c4f8f3

fix: restore urgent PR CI health

Affaan Mustafa · 2026-04-14 19:26:24 -07:00

3be24a5704

fix: unblock urgent install and gateguard regressions

Affaan Mustafa · 2026-04-14 19:23:07 -07:00

76b6e22b4d

Merge pull request #1367 from ozoz5/feat/gateguard

feat(hooks,skills): add gateguard fact-forcing pre-action gate

Affaan Mustafa · 2026-04-13 01:05:20 -07:00

e0ddb331f6

fix: keep gateguard session state alive

Affaan Mustafa · 2026-04-13 00:58:50 -07:00

6c67566767

fix: 5 bugs + 2 tests from 3-agent deep bughunt

Bugs fixed:
- B1: JS gate messages still said "cat one real record" -> redacted/synthetic
- B2: Destructive bash key used 200-char truncation (collision bypass) -> SHA256 hash
- B3: sanitizePath only stripped \n\r -> now strips null bytes, bidi overrides, all control chars
- B4: Tool name matching was case-sensitive (latent bypass) -> lookup map normalization
- B5: SKILL.md Gate Types missing MultiEdit -> added with explanation

Tests added:
- T1: MultiEdit gate denies first unchecked file (CRITICAL - was untested)
- T2: MultiEdit allows after all files gated

11/11 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 16:32:46 +09:00

dd2962ee92

fix: cubic-dev-ai round 2 — 3 issues across SKILL.md + pruning

P1: Gate message asked for raw production data records — changed to
    "redacted or synthetic values" to prevent sensitive data exfiltration

P2: SKILL.md description now includes MultiEdit (was missing after
    MultiEdit gate was added in previous commit)

P2: Session key pruning now caps __prefixed keys at 50 to prevent
    unbounded growth even in theoretical edge cases

9/9 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 16:11:33 +09:00

4dbed5ff5b

fix: remove unnecessary disk I/O + fix test cleanup

- isChecked() no longer calls saveState() — read-only operation
  should not write to disk (was causing 3x writes per tool call)
- Test cleanup uses fs.rmSync(recursive) instead of fs.rmdirSync
  which failed with ENOTEMPTY when .tmp files remained

9/9 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 15:41:58 +09:00

5540282dcb

fix: P1 test state-file PID mismatch + P2 session key eviction

P1 (cubic-dev-ai): Test process PID differs from spawned hook PID,
so test was seeding/clearing wrong state file. Fix: pass fixed
CLAUDE_SESSION_ID='gateguard-test-session' to spawned hooks.

P2 (cubic-dev-ai): Pruning checked array could evict __bash_session__
and other session keys, causing gates to re-fire mid-session. Fix:
preserve __prefixed keys during pruning, only evict file-path entries.

9/9 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 15:40:13 +09:00

67256194a0

fix: MultiEdit gate bypass — handle edits[].file_path correctly

P1 bug reported by greptile-apps: MultiEdit uses toolInput.edits[].file_path,
not toolInput.file_path. The gate was silently allowing all MultiEdit calls.

Fix: separate MultiEdit into its own branch that iterates edits array
and gates on the first unchecked file_path.

9/9 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 15:37:39 +09:00

6ed1c643e7

fix: session-scoped state to prevent cross-session race

Addresses reviewer feedback from @affaan-m:

1. State keyed by CLAUDE_SESSION_ID / ECC_SESSION_ID
   - Falls back to pid-based isolation when env vars absent
   - State file: state-{sessionId}.json (was .session_state.json)

2. Atomic write+rename semantics
   - Write to temp file, then fs.renameSync to final path
   - Prevents partial reads from concurrent hooks

3. Bounded checked list (MAX_CHECKED_ENTRIES = 500)
   - Prunes to last 500 entries when cap exceeded
   - Stale session files auto-deleted after 1 hour

9/9 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

seto · 2026-04-13 15:30:34 +09:00

45823fcede

Merge pull request #1384 from KeWang0622/fix/lint-md028-eqeqeq

fix: resolve markdownlint MD028 + ESLint eqeqeq lint failures

Affaan Mustafa · 2026-04-12 23:03:19 -07:00

2b09308224

Merge pull request #1385 from KeWang0622/fix/block-no-verify-hook

fix: route block-no-verify hook through run-with-flags.js

Affaan Mustafa · 2026-04-12 23:02:19 -07:00

5f55484fa9

165 Commits