4 Commits

• fix: close block-no-verify bypass holes

  Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

  SeungHyun · 2026-05-12 22:28:12 -04:00
  6be241a463
• fix: parse block-no-verify flags by shell words
  Affaan Mustafa · 2026-04-29 21:59:12 -04:00
  0dcde13384
• fix: address PR review comments on block-no-verify hook

  - Add `minimal` profile so the security hook runs in all profiles
  - Scope -n/--no-verify flag check to the detected subcommand region,
    preventing false positives on chained commands (e.g. `git log -n 10`)
  - Guard stdin listeners with `require.main === module` so require()
    from run-with-flags.js does not register unnecessary listeners
  - Verify subcommand token is preceded only by flags/flag-args after
    "git", preventing misclassification of argument values as subcommands
  - Add integration tests for block-no-verify hook
  
  Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

  Ke Wang · 2026-04-12 20:29:01 -05:00
  809e0fa0a9
• fix: route block-no-verify hook through run-with-flags.js

  Replace inline `npx block-no-verify@1.1.2` with a standalone Node.js
  script routed through `run-with-flags.js`, matching every other hook.
  
  Fixes two bugs:
  1. npx inherits the project cwd and triggers EBADDEVENGINES in
     pnpm-only projects that set devEngines.packageManager.onFail=error.
  2. The hook bypassed run-with-flags.js so ECC_DISABLED_HOOKS had no
     effect — the isHookEnabled() check never ran.
  
  The new script replicates the full block-no-verify@1.1.2 detection
  logic (--no-verify, -n shorthand for commit, core.hooksPath override)
  with zero external dependencies.
  
  Closes #1378

  Ke Wang · 2026-04-12 19:53:15 -05:00
  dae663d856