fix(guardrails): narrow or retire block-hook-bypass now that shell file changes are checked #6689

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 9, 2026
2. github-actions commented on Oct 9, 2026

   

   github-actionsbot

   on Oct 9, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the write-up. I understand this as a follow-up to #6674: once check-bash-file-changes runs the Write/Edit content guards against every file a Bash/PowerShell command touches, block-hook-bypass.sh's shape-based detection (cat >, echo >, etc.) becomes mostly redundant, and the proposal is to narrow it to the gaps the outcome check can't see (files outside the repo, gitignored files, missed writes) or retire it, with stay-quiet tests landing first per the hook-precision convention.

   Scope and next step look clear; this is explicitly blocked on the #6674 (step 1) pull request merging first, so it isn't actionable yet on its own. I didn't find an existing duplicate — #5668 and the other block-hook-bypass issues listed are related but cover different gaps.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   priority: lowNice-to-have, cosmetic, or speculative; opportunistic.Nice-to-have, cosmetic, or speculative; opportunistic.

   on Oct 9, 2026
4. kyle-sexton

   removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 15, 2026
5. kyle-sexton

   added the

   Task

   issue type on Oct 15, 2026
6. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   This was generated by AI during backlog shaping.

   Closing as not planned. The owner decided (2026-10-10, option A) to drop the narrowing and keep block-hook-bypass as on main after four security review rounds found new bypasses; PR #6708 closed on that decision.

   Evidence:

   • fix(guardrails): narrow block-hook-bypass to a single plain shell write #6708 (closing comment: 'Closing per owner decision (2026-10-10, option A): drop the narrowing and keep main's block-hook-bypass')
   • feat(guardrails): check repository files a shell command changed #6690

   The owner approved this in an attended backlog-shaping session on 2026-10-17.
7. kyle-sexton

   closed this as not plannedon Oct 18, 2026