Repository navigation
Narrow the Write Guard's Launcher Assignment and Nesting-Cap Over-Denials #3341
Description
Context
Found by the third local review pass on the change for #3050, #3083, #3085, #3304, and #3307 (branch feature/guard-directory-tokenizer-launchers). Each is an over-denial that change introduces. Develop's guard allows each one. They are filed rather than narrowed in the lane that wrote them, since narrowing a deny while allow gaps are open has repeatedly opened a new allow. Each was confirmed with a classify probe on constructed commands.
Over-Denials
- Every assignment after an unknown launcher is read as its environment.
_launcher_prefixnow collects everyNAME=valueword after a launcher the guard does not know, not only one after anenv. So an assignment that is an argument of the launcher reads as git's environment:docker run --rm -e HOME=/tmp example/image git statusis denied as aHOMEconfig directory the guard does not read.docker run --rm -e GIT_CONFIG_GLOBAL=/example/config example/image git statusis denied.ssh example HOME=/x git statusis denied.
- The rule 6 check past the nesting cap reads words, not subcommands.
_MUTATING_SUB_WORDmatches a subcommand name anywhere in the overflowed text oncegitappears in it, where_may_run_aliasalready reads each git word's real subcommand.echo github && rm -rf build,git log --grep=reset, andgit status && mv a b, each nested sixbash -clevels deep, are denied.
Possible Direction
Read an assignment after an unknown launcher only where an env precedes it among the launcher's words. Read the overflowed text's git subcommands through _unquoted and _git_subcommand_index as _may_run_alias does.
Activity
ptr727 commentedon Oct 22, 2026
The first item here is fixed in #3342 before it merges:
_launcher_prefixnow reads an assignment after an unknown launcher only after anenvamong its words, sodocker run --rm -e HOME=/tmp example/image git statusandssh example HOME=/x git statusare allowed again. The nesting-cap item remains open.ptr727 commentedon Oct 22, 2026
Two more over-denials #3342 introduces, from its seventh local pass, each allowed by develop:
BASH_BIN="$(command -v bash)"; git push --tags originandbash -c 'command -v sh'; git push --tags origin._prefix_walkpassescommand -vas a precommand, so the shell name it looks up reads as a shell run with no command string, now read inside substitutions and wrapper bodies too._EVAL_RUNNER_OPTIONS["command"]already says only-pand--keepcommanda runner.flock /example/watch git push origin develop, in a checkout whose origin allows develop._repo_may_movematches any word whose base name iswatchin front of git, a lock-file path included, rather than awatchthe walk passes as a launcher.Read Every Launcher and Exported Git Directory in the Write Guard (#3342
Read Tokenizer, Directory-Value, and Launched-String Gaps in the Writ…
Read a Backslash-Newline by Its Quoting in the Write Guard (#3357)
ptr727 commentedon Oct 22, 2026
Probed on develop after #3357 with offline
classifyseams:BASH_BIN="$(command -v bash)"; git push --tags originandbash -c 'command -v sh'; git push --tags originboth classify as allow, so thecommand -vitem no longer reproduces. The nesting-cap andflock /example/watchitems remain.ptr727 commentedon Oct 23, 2026
Closed under the maintainer's decision (ptr727, 2026-10-23) on #3391: the backlog keeps real bugs with a stated failure, features the maintainer wants, and open decisions. A finding the review loop filed on code or text a change did not touch, a refactor or consolidation chore, a tracker, a wording item, or a guard shape no session has produced is closed rather than worked. Reopen with the input and the wrong result if this issue states one.