Guard against agent git operations that require a branch-rule bypass

[ptr727]

Extends the gh-write-guard PreToolUse hook with Rule 4: deny any git operation that would only succeed by bypassing an active branch rule - the gap behind the direct-push-to-develop incident this session, where an admin-bypass identity makes a plain git push origin develop silently land on a PR-gated branch.

What it denies

• Direct update to a branch whose live rules require a pull request (every main; code-style develop). A config-style develop has no such rule and stays allowed - decided by the live rules, no hardcoded repo list.
• Force where non_fast_forward/required_linear_history is active.
• Delete where deletion is active.
• Explicit-bypass flags: gh pr merge --admin, git commit/push --no-verify.

Behavior

• The branch's rules come from repos/{owner}/{repo}/rules/branches/{branch} (visible even to a bypass actor).
• Fail-closed on main/master/develop when the rules cannot be read; fail-open elsewhere (feature branches).
• Each denial names the bypassed rule, the protocol path, and hands the exact command to the maintainer to run.
• Injectable rules_lookup/current_branch keep --selftest deterministic and offline.

Verification

• --selftest: 44/44 (existing 21 write-footgun cases + 22 new Rule-4 cases: code/config develop, main, feature, HEAD/sha/bare/+refspec/delete refspecs, fail-closed vs fail-open, the explicit flags).
• Live end-to-end against real branch rules: develop/main deny, this feature branch allow, --admin/--no-verify deny.

Docs/tooling only - no release. Deploy to ~/.claude/hooks/ is held until this and the develop->main promotion both pass review.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR extends the host-setup/agent-safety/gh-write-guard.py PreToolUse hook with a new Rule 4 that blocks git operations which would only succeed by bypassing active branch rules (plus explicit bypass flags like gh pr merge --admin and --no-verify).

Changes:

• Adds live branch-rule lookups (gh api repos/{owner}/{repo}/rules/branches/{branch}) to deny direct pushes, force pushes, and branch deletions when the branch rules prohibit them.
• Adds explicit bypass-flag detection for gh pr merge --admin and git commit/push --no-verify (plus git commit -n).
• Expands --selftest to cover the new Rule 4 cases deterministically via injectable rules_lookup and current_branch.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

host-setup/agent-safety/gh-write-guard.py:186

• _push_targets() only stops parsing at redirection tokens (>/<). Shell control operators like &&, ||, ;, |, and & can also appear after git push and are not part of git argv. Today git push && echo ok is mis-parsed as having a remote of &&, which can prevent the bare-push branch resolution and potentially let a protected-branch push slip past Rule 4.

    while i < len(toks):
        t = toks[i]
        if ">" in t or "<" in t:
            break  # a redirection operator (>, 2>, >>, <, 2>&1): end of git argv, start of shell syntax
        if t in ("--force", "-f") or t.startswith("--force-with-lease"):

host-setup/agent-safety/gh-write-guard.py:303

• Rule 4's gate if _GIT_PUSH.search(cmd): only matches git push with no global git options. A real push like git -C /path push origin develop (or git -c key=val push ...) won't run _check_push_bypass() at all, which defeats the branch-rule bypass protection for a common invocation style.

    # `_push_targets` tokenizes with shlex and keys off a real `git push` argv adjacency, so a push named
    # only inside a quoted argument yields no target - the raw substring is just a cheap pre-filter.
    if _GIT_PUSH.search(cmd):
        dec, reason = _check_push_bypass(cmd, cwd, origin, current_branch, rules_lookup)
        if dec == "deny":

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

host-setup/agent-safety/gh-write-guard.py:344

• Rule-4's git push pre-filter runs on the raw command string, so a git push mentioned inside a quoted body/title can still trigger _check_push_bypass(), which in turn can run unnecessary git remote get-url origin / branch-resolution subprocesses. This is avoidable and was explicitly called out as a goal in earlier iterations: use the quoted-span-stripped string only to decide whether an executable push exists, but keep passing the original cmd into _check_push_bypass() for accurate parsing.

    # `_push_targets` tokenizes with shlex and keys off a real `git push` argv adjacency, so a push named
    # only inside a quoted argument yields no target - the raw substring is just a cheap pre-filter.
    if _GIT_PUSH.search(cmd):
        dec, reason = _check_push_bypass(cmd, cwd, origin, current_branch, rules_lookup)
        if dec == "deny":

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

host-setup/agent-safety/gh-write-guard.py:312

• _check_bypass_flags() only recognizes git commit via the _GIT_COMMIT regex, which does not allow git global options between git and commit (for example git -C /repo commit -n ... or git -c k=v commit --no-verify ...). Those forms are valid and would bypass the intended --no-verify/-n denial.

    # --no-verify / commit -n skip the git hooks, so they only matter for a git commit or push - other
    # tools use --no-verify for unrelated things, and denying those would be a false positive.
    is_commit = _GIT_COMMIT.search(bare) is not None
    is_push = bool(_push_arg_lists(bare))
    long_no_verify = (is_commit or is_push) and _NO_VERIFY_LONG.search(bare)
    short_n_commit = is_commit and _COMMIT_SHORT_N.search(bare)  # `-n` is --no-verify for commit (push -n is dry-run)

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

host-setup/agent-safety/gh-write-guard.py:311

• _check_bypass_flags() treats --no-verify / -n as a bypass whenever the token appears anywhere in the git commit/git push argv. That can false-deny valid commands when the token is actually a value to a value-taking flag (for example git commit -m --no-verify where the commit message is "--no-verify", or git push --push-option --no-verify ... where the push-option value happens to be "--no-verify"). Since the hook is explicitly "precision over recall", the bypass detection should skip values consumed by known value flags before deciding a bypass flag is present.

    commit_lists = _git_subcommand_arglists(cmd, "commit")
    push_lists = _push_arg_lists(cmd)
    commit_bypass = any(("--no-verify" in a) or ("-n" in a) for a in commit_lists)
    push_bypass = any("--no-verify" in a for a in push_lists)
    if commit_bypass or push_bypass:

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

host-setup/agent-safety/gh-write-guard.py:334

• _check_bypass_flags() treats any --no-verify token in a git commit argv as a bypass flag, but git commit -m --no-verify is valid and sets the commit message to --no-verify (i.e., --no-verify is an option value, not a flag). This can false-deny legitimate commits and contradicts the stated "precision over recall" goal.

    # --no-verify / commit -n skip the git hooks, so they only matter as an actual arg to a git commit or
    # push (other tools use --no-verify for unrelated things; shlex keeps a quoted mention out of the argv).
    # `-n` is --no-verify only for commit; `git push -n` is --dry-run.
    commit_lists = _git_subcommand_arglists(cmd, "commit")
    push_lists = _push_arg_lists(cmd)
    commit_bypass = any(("--no-verify" in a) or ("-n" in a) for a in commit_lists)
    push_bypass = any("--no-verify" in a for a in push_lists)
    if commit_bypass or push_bypass:
        return "deny", (
            "This uses --no-verify, which skips the git hooks (signing, lint, and pre-push gates). "
            "Skipping verification is a bypass; run the command without it." + _handoff(cmd)
        )

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.