Repository navigation
Read a Hook-Bypass Flag an Alias Expansion Carries in the Write Guard #3305
Description
Context
Found by the local review of the change closing #3046, #3047, #3055, #3057, #3072, #3078, and #3081. Develop's guard shares it.
An Alias Can Carry a Hook-Bypass Flag the Bypass Rule Reads Only on a Literal Commit
host-setup/agent-safety/claude/gh-write-guard.py denies --no-verify and a commit's -n where the subcommand is written out as commit or push. An alias expanding to either, with the flag in its expansion, is not read for it.
Constructed cases, each allowed:
git -c alias.q="commit --no-verify" q -m x.- A persisted
alias.q = commit --no-verify, thengit q -m x.
The same alias surface now denies alias.q = -c core.hooksPath=/dev/null commit, so the two bypass spellings are judged differently.
Possible Direction
Read the --no-verify and -n checks against the subcommand and arguments an alias chain resolves to, inline and persisted, as the hooks-path check now reads an expansion's options.
Activity
Read Config and Alias Rewrites the Write Guard Missed (#3306)
ptr727 commentedon Oct 23, 2026
Closed as out of the write guard's scope under the maintainer's decision (ptr727, 2026-10-23) on #3391, item 1. The guard bounds a good-faith agent's mistake rather than an adversary, so a parse gap reached only by a command shape no agent plausibly types in a coding session is closed rather than fixed, and the guard's own growth is a cost each later review pays again. The scope statement lands in the guard's docstring and README under #3391. Reopen only with a command a session actually produced.