fix(guardrails): consult HOOK_JQ_FIELDS_NUL in verdict-owning hooks

[kyle-sexton]

Fixes #2136

Summary

• Add HOOK_JQ_FIELDS_NUL checks to five verdict-owning hooks that were missing them: block-convention-violation, block-hook-bypass, block-noncanonical-commit, secret-pattern-detection, and hardcoded-path-check.
• Refuse (exit 2) before matching/scoring when any requested field carried a NUL byte — the helper strips NULs, so a clean verdict would not reflect the bytes the payload carried.
• block-dangerous-git and block-no-verify already consulted the flag.

Test plan

• secret-pattern-detection.test.sh (54/0)
• hardcoded-path-check.test.sh (96/0)
• block-convention-violation.test.sh (44/0)
• block-hook-bypass.test.sh (413/0)
• block-noncanonical-commit.test.sh (204/0)

Related

• perf(guardrails): parse each hook payload in one jq process, not two or three #2120 / guardrails: a NUL byte in a payload value makes block-no-verify and block-dangerous-git fail open #2122 — HOOK_JQ_FIELDS_NUL signal in the helper
• guardrails: hook::jq_fields returning non-zero allows the command, collapsing jq-absent with payload-unparsable #2157 — unparsable-payload fail-closed (separate PR)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 1m 46s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Read repo CLAUDE.md for guidelines
• Review changed hook scripts for security issues
• Review test file changes
• Post final findings

I reviewed the diff (git diff origin/main...HEAD) for all 12 changed files in this PR, focused on the security-relevant hook logic in plugins/guardrails/hooks/*.sh.

Findings

No security issues found.

The five new NUL-byte checks added to block-convention-violation.sh, block-hook-bypass.sh, block-noncanonical-commit.sh, hardcoded-path-check.sh, and secret-pattern-detection.sh are byte-for-byte consistent with the existing, already-shipped pattern in block-dangerous-git.sh and block-no-verify.sh:

• Each check is placed immediately after the hook::jq_fields ... || exit 0 call and before any field is read into a local var and matched — so the fail-closed exit 2 fires ahead of any use of the tainted value. Correct ordering in all five files.
• HOOK_JQ_FIELDS_NUL is unconditionally set to 0 at the top of hook::jq_fields() (hook-utils.sh:828) before either of its two early-return paths, so ((HOOK_JQ_FIELDS_NUL)) is always defined under set -uo pipefail — no risk of an unset-variable crash masking a fail-open.
• The echo ... >&2 diagnostics on the block path are static strings with no payload interpolation, so there's no injection/leak surface via the block message itself.
• exit 2 is the correct PreToolUse block signal, matching the convention used elsewhere in this plugin.

This is a net security hardening (closing a fail-open gap where a NUL-bearing field could pass a match check after silent stripping) and doesn't loosen any permission, trigger, or matching logic elsewhere.

Non-security note (FYI, not part of this review's scope)

plugins/guardrails/CHANGELOG.md currently contains unresolved git conflict markers (<<<<<<< HEAD, =======, >>>>>>> 8325074a) and a duplicate ## [0.28.1] heading — looks like a rebase against #2157 that wasn't fully cleaned up. Not a security concern, but worth fixing before merge since it breaks the changelog file. Fix this →

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9b34fb334

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31578579769
• Failure class: other
• Last SDK result: (no execution file was produced)

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31578579729
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).