Repository navigation
Guard precision: classify only write targets, read globs, jq/awk, managed scripts, .env stem - #1098
Merged
Merged
Conversation
A repository or file name such as Org.DS.EnvironmentalReporting or Cratis.Environments.Specs no longer counts as a protected .env reference. .env, .env.local, app.env and .envrc stay protected.
…es (#1041) Extended-glob groups in a write target are read as one star, and a brace span holding quoting or expansion syntax now fails the classifier closed. Quoted text is neutralized first so quoted literals keep their verdicts.
The shell write guard gains a targets mode: when every command in the text is accepted by the read-only policy, the words of pure readers are no longer classified; redirects, git commit -F and directory changes still are. Any unparsed or non-accepted command falls back to whole-text classification.
… the shell write guard (#1024)
…ser failure (#1041) A command that is not read-only is refused whatever the reference classifier could model, so program text in an interpreter heredoc no longer surfaces as a parser failure. Read-only commands keep the fail-closed parser failure.
The whole-stem boundary no longer applies when glob syntax sits in or after the stem, so .en?r? and .e?vx stay protected. Hostile specs cover the cases.
The .env stem boundary is now an allowlist: it is released only when the stem is literal and the rest of its path component is [a-z0-9._-]. Any expansion, quote, escape, glob, brace or tilde keeps it protected. jq --rawfile/--slurpfile file operands are now judged like other operands.
Collaborator
Author
|
Tier 1 green; deep security review passed in round 3, and every finding is fixed with hostile-case specs. |
This was referenced Nov 10, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hook change: run
cratis ai updatein each consuming repository to pick up the new guard behavior.Fixed
awk,jq,cat,lsand similar commands with braces or brackets in their program text are no longer refused; commands it cannot parse stay fail-closed, and extended globs and quoted brace spans in write targets are refused (Shell write guard: classify only write-target words as protected references #1041)ls *.csproj,git ls-files *.csprojand similar read-only glob arguments tocat,head,tail,wc,ls,grepandgit ls-filesare allowed again; writes to dotfile-shaped targets stay refused (Shell write guard refuses read-only commands with a*.csprojglob #1083)jqfilters with[/]and{/}, for examplejq '{a: .[0]}', no longer fail the guard's parser (part of Shell write guard fails closed on read-only jq filters containing '[' #1052)node .cratis/ai/hooks/scripts/cratis-check-pr.mjsandbash .cratis/ai/hooks/scripts/cratis-cleanup-worktrees.shwith their documented options pass the shell write guard in consuming repositories, while writes to those files stay refused; paths built from variables are not resolved, as the hooks README now states (cratis-guard-shell-writes blocks the corpus's own cratis-check-pr.mjs and cleanup scripts #1024).envas a protected file only as a whole file stem, so names such asOrg.DS.EnvironmentalReporting,Cratis.Environments.Specsand*.environment.txtare no longer refused;.env,.env.local,app.envand.envrcstay protected (cratis-guard-secrets treats.envinside a longer word (e.g. a repo named *.EnvironmentalReporting) as a protected file #1019)