Repository navigation
repo-hygiene: clean's destructive guard stays armed after the run and matches quoted argument text #7333
Description
Refs: #7332
Problem
/repo-hygiene:clean registers a session-scoped PreToolUse hook (skills/clean/scripts/destructive-guard.sh). In one session, a read-only scan-batch run at the start left the guard armed for over an hour. It then blocked two gh commands (an issue comment, and the gh issue create for this issue) whose --body merely contained the text git branch -D. It would equally have blocked a user-confirmed worktree branch deletion done through /source-control:worktree cleanup.
Two defects
- Lifetime: the guard outlives the clean run that armed it, so it gates unrelated work later in the session. It should disarm when the run ends, or arm only for tiers that mutate (not
scan/scan-batch). - Precision: it matches destructive patterns inside quoted argument text, not only in commands that execute. Per the hook-precision convention, the fix needs a stay-quiet test that fails before it (a
gh issue comment --body '... git branch -D ...'case).
🤖 Generated with Claude Code
Activity
github-actions commentedon Oct 12, 2026
Understood as two related defects in
/repo-hygiene:clean's session-scopeddestructive-guard.shPreToolUse hook: (1) the guard stays armed for the rest of the session after a run finishes, including read-onlyscan/scan-batchruns, so it can gate unrelated later commands; (2) it matches destructive-looking text inside quoted argument strings (e.g. agh issue comment --bodycontaininggit branch -D) rather than only text that would actually execute as a command. Reproduction, affected script paths, and the two fix directions (disarm on run end or scope to mutating tiers; add a stay-quiet regression test for the quoted-argument case) are all included, so this looks actionable as written. Referenced issue #7332 is a separatesource-control:worktreescoping report from the same session and does not appear to be a duplicate of this one. No related open issue duplicates this report.Automated triage. A maintainer reviews it.
kyle-sexton commentedon Oct 13, 2026
Owner decision (2026-10-13): approved the recommendation.
Basis: https://code.claude.com/docs/en/hooks (skill frontmatter hooks, once, session_id); origin/main plugins/repo-hygiene/skills/clean/scripts/destructive-guard.sh:2
Basis: origin/main lib/hook-utils.sh:4553, 4593; docs/conventions/hook-precision/README.md
Basis: origin/main scripts/shared-copies.txt
Next: an agent lane, via admission, opens one PR; it narrows a guard, so a human merges it.
This was generated by AI.
kyle-sexton commentedon Oct 13, 2026
Owner ratified this admission in an attended session on 2026-10-13: work-class: scoped. It touches a guard, CI script, settings or trust surface, so an agent may build it but the owner merges the PR: put 'Hold: a human merges this' in the PR body.
kyle-sexton commentedon Oct 18, 2026
Decision recorded.
Question: Admit this issue to the issue lane with the brief below, which implements the decision already discussed in this thread? (Premise holds: destructive-guard.sh:1-3 still claims it is active only while the skill runs, matches raw text, and repo-hygiene carries no hook-utils.sh copy; the owner's decision fixes the design (run-open marker, per-segment argv via hook::bash_parse_segments, one new shared-copies line); about 5 hand-edited files, 1 generated copy, 1 fragment; no open PR touches repo-hygiene.)
Owner's answer: Yes. The owner was asked "Admit the 7 shared-copy issues and #6888 to the paced queue, recording each one's decision as a 'Decision recorded.' comment, and close #6227? #7373 and #6109 wait for their overlapping PRs." and answered "Yes (Recommended)" in an attended backlog-shaping session on 2026-10-18.
Posted by AI from the owner's answer in that session.
kyle-sexton commentedon Oct 18, 2026
Agent Brief
Type: Bug
Summary: Arm repo-hygiene clean's destructive guard only while a mutating clean run is open, and match parsed command words instead of raw text, using a generated copy of the canonical
lib/hook-utils.sh.Current behavior:
The clean skill's frontmatter registers its destructive guard as a PreToolUse hook. Skill hooks stay active for the rest of the session, so after any clean run, read-only
scanandscan-batchincluded, the guard keeps blocking unrelated commands. Its header claims it is active only while the skill is invoked.is_destructive()regex-matches the raw command string, sogh issue comment --body '... git branch -D ...'is blocked.Desired behavior:
CLAUDE_PLUGIN_DATA), keyed by the hook input'ssession_id. The mutating tiers write it before their first apply call;scanandscan-batchnever write it. It is cleared when the run reaches its final outcome, and an idle timeout clears a stale one.once: true.is_destructive()runs over each segment's argv fromhook::bash_parse_segments, not over the raw string, with no second quote-stripping regex. The PowerShell branch keeps raw matching or gets its own handling.lib/hook-utils.shas a generated copy where the guard sources it, through one new line in the shared-copy registry.Key interfaces:
lib/hook-utils.shinto the clean skill's scripts directory.Acceptance criteria:
gh issue comment --body '... git branch -D ...'with a live marker) fails before the fix and passes after.git branch -D x; with a live marker it blocks it; a marker past the idle timeout allows it; the scan tiers write no marker.scripts/run-test-file.sh plugins/repo-hygiene/skills/clean/scripts/destructive-guard.test.shpasses.scripts/sync-shared-copies.shto regenerate the copies, andscripts/sync-shared-copies.sh --checkexits 0..changes/repo-hygiene/whose bump is notnone.plugins/skill-quality/scripts/check-skill.shpasses on it.Out of scope:
lib/hook-utils.shitself.scripts/sync-shared-copies.sh --check-bump, which runs only in CI.This was generated by AI during backlog shaping. The owner approved its admission in an attended backlog-shaping session on 2026-10-18.