Problem
The #2112 fix (handoff #2123) adds, on the ordinary path of host-setup/agent-safety/claude/gh-write-guard.py, a reading that strips every heredoc body a line opens in order. It builds that reading from every << token the line yields, including one bash never queues a body for, such as a quoted '<<' or a << inside a comment. That reading strips real command lines up to the false tag, and where the tag line sits inside a later document's body, the rest of the document is read as commands, so a document quoting a wait loop is denied rather than written. Develop allows it.
Reproduce (constructed)
cat <<A >/dev/null; echo '<<' B
a
A
cat > doc.md <<EOF
B
while [ ! -f /x ]; do sleep 1; done
EOF
Bash writes the loop into doc.md and runs nothing. The branch denies the command, and develop allows it. Writing the first line as cat <<A >/dev/null # like <<B behaves the same.
Done looks like
The in-order reading counts only openers bash queues a body for, the commands above are allowed, and self-test rows pin both as allows.
Found by the local strict review of the #2112 fix, and filed as a follow-up under decision #2126, which shipped that fix with its known false denies filed rather than fixed.
Problem
The #2112 fix (handoff #2123) adds, on the ordinary path of
host-setup/agent-safety/claude/gh-write-guard.py, a reading that strips every heredoc body a line opens in order. It builds that reading from every<<token the line yields, including one bash never queues a body for, such as a quoted'<<'or a<<inside a comment. That reading strips real command lines up to the false tag, and where the tag line sits inside a later document's body, the rest of the document is read as commands, so a document quoting a wait loop is denied rather than written. Develop allows it.Reproduce (constructed)
Bash writes the loop into
doc.mdand runs nothing. The branch denies the command, and develop allows it. Writing the first line ascat <<A >/dev/null # like <<Bbehaves the same.Done looks like
The in-order reading counts only openers bash queues a body for, the commands above are allowed, and self-test rows pin both as allows.
Found by the local strict review of the #2112 fix, and filed as a follow-up under decision #2126, which shipped that fix with its known false denies filed rather than fixed.