fix: attribution footer drift, checklist staleness, commit-skill bypass lint#203
Conversation
…ss lint Closes decisions #38, #71, #72 (Decisions Log: https://claude.ai/code/artifact/232ecdce-8316-4880-8c0a-dc3c7dcf3a63). - #38 (formatting-create-md-attribution-footer-drift): create.md's PR-body heredoc now emits the attribution footer it documents elsewhere. - #71 (naming-work-items-checklist-template-staleness): templates/checklist.md reconciled to add.md's actual current behavior (--force, --type native Issue Type resolution, --agent-ready body template, --recurring title prefix), all previously undocumented in the checklist. - #72 (tooling-gov-commit-skill-composition-lint): new guardrails hook flag-commit-pr-skill-bypass.sh — advisory PreToolUse/Bash guard flagging direct `git commit`/`gh pr create` calls that bypass the marketplace's own /commit and /pull-request skills, gated on the consuming project actually having source-control enabled (fails quiet otherwise). 19/19 tests pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The SCOPE comment cited `anthropics/claude-code#27247` inline, which trips this repo's own comment-hygiene `tracker-ref:repo-issue` rule (outstanding work belongs in the issue tracker, not code comments). The issue is already documented in the guardrails README and the claude-config-audit known-issues reference; the hook comment only needed the behavioral fact, not the citation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e24fff2c90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| while [[ "$tok" == "sudo" || "$tok" == *=* ]] \ | ||
| && [[ -n "$cmd" && "$cmd" == *[[:space:]]* ]]; do | ||
| cmd="${cmd#*[[:space:]]}" | ||
| cmd="${cmd#"${cmd%%[![:space:]]*}"}" | ||
| tok="${cmd%%[[:space:]]*}" |
There was a problem hiding this comment.
When HOOK_TELEMETRY_SINK is configured and source-control is enabled, this whitespace tokenizer can leak fragments of quoted env-assignment values into telemetry: for example TOKEN="top secret" echo ok is emitted with subject Bash:secret". That violates the hook's privacy contract for every Bash command this advisory hook observes, even when it has no finding; use the shared hook::extract_bash_subject behavior or bail out when an assignment token contains quotes.
Useful? React with 👍 / 👎.
Summary
Closes decisions #38, #71, #72 (Decisions Log: https://claude.ai/code/artifact/232ecdce-8316-4880-8c0a-dc3c7dcf3a63).
formatting-create-md-attribution-footer-drift:create.md's PR-body heredoc now emits the🤖 Generated with Claude Codeattribution footer it documents elsewhere but previously didn't actually emit.naming-work-items-checklist-template-staleness:templates/checklist.md'saddaction reconciled toadd.md's actual current behavior —--forceskip,--typenative-Issue-Type resolution (org repos) vs.type:label (personal/non-org repos),--agent-readybody template,--recurringtitle prefix — none of which the checklist previously mentioned.tooling-gov-commit-skill-composition-lint: newguardrailsplugin hookflag-commit-pr-skill-bypass.sh— advisoryPreToolUse/Bashguard that flags directgit commit(missing the canonical-F -+--trailershape) or anygh pr create, nudging toward this marketplace's own/commit//pull-request createskills. Gated on the consuming project actually havingsource-controlenabled in its own.claude/settings.json(fails quiet on uncertain state, per the plugin's existing advisory-guard posture). Mirrorsblock-hook-bypass.sh's literal-stripping detection and the shared telemetry envelope.Verification
shellcheckon both the hook and its test — clean.guardrailsversion bumped 0.3.2 → 0.4.0 (new toggleable guard), README's guard table/kill-switch table/consumer-seams section updated to match.