You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Tracking issue. No work is done here — this coordinates four command-classification guard defects and records the one hard ordering constraint between them.
Origin
All four were found in a single interactive autoskillit cook session that was trying to do one ordinary thing: push a branch and open a PR. Three of them blocked benign work; the fourth was found while verifying the third and lets genuinely dangerous work through.
None are fixed by upgrading. Every one reproduces identically on installed 0.10.1013 and repo 0.10.1103.
Heredoc body consumer never determined — inert bodies classified as commands, executed bodies invisible
both
recipe:remediation
~50-90
~120-200
Medium-High
Ordering
There is only one hard dependency, and it is internal to #4941: consumer recognition must be built and tested before any inert-body carve-out ships, or the carve-out silently removes the only coverage currently catching an executing bash <<EOF heredoc. That constraint is documented in #4941 with a before/after regression table.
The three recipe:implementation issues touch different files and functions and have no technical dependencies on each other or on #4941. The sequence below is by risk and payoff, not by necessity — reorder freely.
#4938 ~4 lines, zero coupling. Unblocks multi-line gh api immediately.
↓
#4940 contained conditional. Unblocks the batched gh reads AGENTS.md § 3.3 asks for.
↓
#4937 largest day-to-day unblock — git push to a named remote currently always fails.
↓
#4941 security boundary, both directions, self-constraining. Land last, alone.
If optimising for user-visible impact rather than risk, #4937 can move first — it is the one that stops work outright.
#4938, #4940 and #4937 each have a known, localized fix: a missing branch, a too-coarse conditional, and a wrong assumption in one function. Each issue carries the intended fix.
#4941 is a missing concept, not a missing branch. Nothing in command classification models which consumer evaluates a heredoc body, and that single omission produces two opposite defects that constrain each other's fix. It spans several functions, needs new logic in _segment_evaluates_shell_payload (which today returns False for (['bash'], <body>)), needs _HEREDOC_BODY_RE to capture delimiter quoting it currently discards, and sits on a security boundary reached by many guards.
#4938 was originally filed as part of #4941 and split back out once it was confirmed independent of heredocs entirely — that split is what reduced it to a ~4-line change.
Each issue's claims were reproduced by executing the real classifiers rather than by reading
alone, and were then reviewed adversarially. That process corrected three wrong root causes and
one unsafe fix proposal before these were finalised — notably, an earlier version of #4941's fix
direction would have opened a security hole, and an earlier version of #4937 cited a test gap
that does not exist (the test exists but is vacuous, because it runs against a non-git tmp_path).
Tracking issue. No work is done here — this coordinates four command-classification guard defects and records the one hard ordering constraint between them.
Origin
All four were found in a single interactive
autoskillit cooksession that was trying to do one ordinary thing: push a branch and open a PR. Three of them blocked benign work; the fourth was found while verifying the third and lets genuinely dangerous work through.None are fixed by upgrading. Every one reproduces identically on installed
0.10.1013and repo0.10.1103.The four
gh apiwith a\line-continuation denied as "multiple routes"recipe:implementationghinside a shell loop denied, including read-only subcommandsrecipe:implementationgit pushto a named remote denied against all checked-out refsrecipe:implementationrecipe:remediationOrdering
There is only one hard dependency, and it is internal to #4941: consumer recognition must be built and tested before any inert-body carve-out ships, or the carve-out silently removes the only coverage currently catching an executing
bash <<EOFheredoc. That constraint is documented in #4941 with a before/after regression table.The three
recipe:implementationissues touch different files and functions and have no technical dependencies on each other or on #4941. The sequence below is by risk and payoff, not by necessity — reorder freely.If optimising for user-visible impact rather than risk, #4937 can move first — it is the one that stops work outright.
Why #4941 is the only remediation
#4938, #4940 and #4937 each have a known, localized fix: a missing branch, a too-coarse conditional, and a wrong assumption in one function. Each issue carries the intended fix.
#4941 is a missing concept, not a missing branch. Nothing in command classification models which consumer evaluates a heredoc body, and that single omission produces two opposite defects that constrain each other's fix. It spans several functions, needs new logic in
_segment_evaluates_shell_payload(which today returnsFalsefor(['bash'], <body>)), needs_HEREDOC_BODY_REto capture delimiter quoting it currently discards, and sits on a security boundary reached by many guards.#4938 was originally filed as part of #4941 and split back out once it was confirmed independent of heredocs entirely — that split is what reduced it to a ~4-line change.
Shared context
_command_classification.pyis the common surface for gh api with a backslash line-continuation is denied as multiple routes #4938 and Heredoc body consumer is never determined: cat-written bodies are classified as commands, bash-executed bodies are invisible #4941; Any gh command inside a shell loop is denied as an unresolved mutation, including read-only subcommands #4940 is in_github_mutation_analysis.py; git_ops_guard denies every git push to a named remote: _same_repository treats the remote name as a filesystem path #4937 is inguards/_git_command_classification.py.git_ops_guardandgithub_mutation_guard— so Heredoc body consumer is never determined: cat-written bodies are classified as commands, bash-executed bodies are invisible #4941 in particular has two blast sites for one fix.
Protect cook's primary checkout from branch-changing Git commands #4751 (opposite direction — a real hazard), Write Guard Heredoc False Positive: shlex.split Includes Heredoc Body in Redirect Detection #3648 (earlier heredoc false positive, closed;
its
strip_heredoc_bodieshelper works correctly and is not the gap in Heredoc body consumer is never determined: cat-written bodies are classified as commands, bash-executed bodies are invisible #4941),review-pr force-updates shared develop ref and corrupts primary checkout #4588 / PR Rectify: review-pr checked-out ref mutation immunity #4592 (added the checked-out-ref immunity that git_ops_guard denies every git push to a named remote: _same_repository treats the remote name as a filesystem path #4937 over-applies and Heredoc body consumer is never determined: cat-written bodies are classified as commands, bash-executed bodies are invisible #4941
Defect B bypasses).
Verification note
Each issue's claims were reproduced by executing the real classifiers rather than by reading
alone, and were then reviewed adversarially. That process corrected three wrong root causes and
one unsafe fix proposal before these were finalised — notably, an earlier version of #4941's fix
direction would have opened a security hole, and an earlier version of #4937 cited a test gap
that does not exist (the test exists but is vacuous, because it runs against a non-git
tmp_path).