3 Commits

• fix: close block-no-verify bypass holes

  Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

  SeungHyun · 2026-05-12 22:28:12 -04:00
  6be241a463
• fix: parse block-no-verify flags by shell words
  Affaan Mustafa · 2026-04-29 21:59:12 -04:00
  0dcde13384
• fix: address PR review comments on block-no-verify hook

  - Add `minimal` profile so the security hook runs in all profiles
  - Scope -n/--no-verify flag check to the detected subcommand region,
    preventing false positives on chained commands (e.g. `git log -n 10`)
  - Guard stdin listeners with `require.main === module` so require()
    from run-with-flags.js does not register unnecessary listeners
  - Verify subcommand token is preceded only by flags/flag-args after
    "git", preventing misclassification of argument values as subcommands
  - Add integration tests for block-no-verify hook
  
  Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

  Ke Wang · 2026-04-12 20:29:01 -05:00
  809e0fa0a9