fix(guardrails): read the payload cwd, and stop env -S hiding commands from every git guard - #2147

Merged

kyle-sexton merged 6 commits into

mainfrom

fix/block-dangerous-git-payload-cwd

Aug 10, 2026

Commits on Aug 10, 2026

fix(guardrails): measure the lease width in the repository the push runs in

kyle-sexton
and
claude
committed
3f08964
test(guardrails): pin the PowerShell payload's cwd and document the GIT_DIR residual

kyle-sexton
and
claude
committed
59b31cd
docs(guardrails): correct a false git semantic and name the gap's real symptom

kyle-sexton
and
claude
committed
d39f49e
fix(guardrails): key the alias re-expansion memo on the effective base

kyle-sexton
and
claude
committed
bc3cf8e
test(guardrails): pin the memo's base keying, and measure what the fix costs

kyle-sexton
and
claude
committed
ab6b3da
docs(guardrails): explain the `:2` slice at the alias reparse call site

kyle-sexton
and
claude
committed
d40420d