Repository navigation
The Guard's Wait-Loop Rule Reads an ANSI-C Quoted bash -c Payload Undecoded #2226
Closed as not planned
Description
The wait-loop rule in host-setup/agent-safety/claude/gh-write-guard.py reads a bash -c payload as the outer lex leaves it, which does not decode ANSI-C quoting, so a payload written as $'...' whose loop needs an escape decoded to be seen is allowed.
Allowed on develop, and the loop reads /dev/zero forever once bash decodes \r inside the word:
bash -c $'while read l; do sleep 30; done < f > log\\r#x < /dev/zero'The same loop written with single quotes is denied, so the payload's own quoting decides whether the rule sees it at all. #2138 is the sibling defect, where a loop keyword glued to $' goes unseen at the top level.
Found by a local strict review pass on feature/auto-2152 (#2152). The behavior predates that branch.
Activity
ptr727 commentedon Oct 1, 2026
Filed in error: this duplicates #2138. The outer lex reads
$'...'as a$glued to the payload, so it begins with$while, andbash -c $'while true; do sleep 30; done'is allowed on develop too, which is exactly #2138's first shape. @ptr727, please close this as a duplicate of #2138. Nothing here is for an unattended round to work.ptr727 commentedon Oct 8, 2026
Closed: Folded into #1959 per #2517, approved by the maintainer. This is a case of the guard's lexer splitting a command differently from bash, and #1959's single bash-aware scanner fixes the class, with this shape kept as a self-test row there.