Repository navigation
Read a Push Option Attached to -o as Its Value in the Write Guard #3720
Description
Found by the local strict review of the fix for #3716, on code that change did not touch.
_push_targets in host-setup/agent-safety/claude/gh-write-guard.py reads an all-letter short-option word as a cluster of flags, force, delete = force or "f" in a, delete or "d" in a, then i += a.endswith("o"). A push option attached to -o is not a cluster, since git reads every character after -o as the option's value. Two misreads follow, both constructed:
git push -ofoo origin developreadsfas--force. Because the word ends ino, the reading also consumesoriginas the option's value, sodevelopis read as the remote and the push as a bare push of the current branch.- With live rules where
developrequires a pull request and the current branchfeature/xhas no rule, that shape is judged as a force push offeature/xand allowed, while git pushesdevelop.
The fix is to stop the cluster walk at the first value-taking letter (o), the way _skips_hooks does, so the rest of the word is the value and the next word is consumed only when nothing follows -o. Self-test cases for -ofoo and -o foo would pin it.
Activity
Read env's Directory and Environment Options in the Write Guard (#3722)
Promote Develop: Read a Push's Remote in the Repository Git Uses, Rea…
ptr727 commentedon Nov 1, 2026
Decision needed (decision triage, 2026-11-01)
Question: Is the fix approved that makes
_push_targetsin host-setup/agent-safety/claude/gh-write-guard.py stop reading a short-option cluster ato, so the rest of a word like-ofoois read as the push option's value rather than as flags?Options, recommended first:
git push -ofoo origin developreadsfas force and consumesoriginas the option's value, then judges a bare push of the current feature branch and allows it while git pushesdevelop. The fix copies the walk_skips_hooksalready uses (lines 983-997), and-o <option>is git push's only value-taking short option. Add rows for-ofoo,-o foo,-fofoo. No work in flight.Evidence: gh-write-guard.py:861-863
force, delete = force or "f" in a, delete or "d" in atheni += a.endswith("o").git help pushlists-o <option>, --push-option=<option>. Unchanged since #3722 (8d71126).Blocks: none
ptr727 commentedon Nov 1, 2026
Maintainer answer (decision triage, 2026-11-01): Option 1: approved. Fix _push_targets in gh-write-guard.py to stop reading a short-option cluster at 'o' and take the rest of the word as its value, with self-test rows for -ofoo, -o foo, and -fofoo. Ship it as its own fix. This agent-safety edit is approved for implementation.
ptr727 commentedon Nov 1, 2026
Released (2026-11-01): worktree and branch removed, so this claim holds no files. Its fix merged to develop in PR #3784.
Backlog burndown claim (round 2, group R2G1). Branch:
feature/burn-3720. Issues: #3720.Predicted file set:
host-setup/agent-safety/claude/gh-write-guard.py,host-setup/agent-safety/claude/test_install.py,host-setup/agent-safety/README.md,tests/test_guard_size.pyThis group edits the agent-safety tree. The worker drives the pull request to the Merge Gate and does not merge it. The merge waits on the maintainer's go-ahead after reading the diff.
Read a Push Option Attached to -o as Its Value in the Write Guard (#3784