End the Guard's Stdin Redirect Scan at a Trailing Comment

[ptr727]

Summary

The wait-loop rule's _redirects_stdin scan credited a redirect written inside a trailing comment as the loop's input bound, so yes | while read l; do sleep 30; done # < f (and the #< f spelling) was allowed although bash reads nothing after the #.

• The scan now ends at a word opening an unquoted comment, the way it already ends at a separator or a reserved word. The quoted mask the rule already computes says which # words are quoted, so done < '#f' still names a file.
• A comment keeps an earlier binding only where the scan is sure it is one: the quoting is known and no expansion that can hold a space precedes it. Otherwise ending early skipped the later binding bash applies, as in < ${g:- #x} < /dev/zero.
• A redirect whose target opens a comment has no target, so it bounds nothing.
• A command holding a carriage return passes no mask, since the lex splits words at one and bash does not, so log<CR>#x is one word rather than a comment.
• New --selftest cases cover each shape. Reverting the fix with the cases kept fails the new deny cases, and passing no mask fails the quoted-# allow case.

A local strict review pass also found a pre-existing sibling, a separator or parenthesis inside a target expansion ending the scan early, filed as #2225.

Closes on promotion: #2152

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@3c13429). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #2227   +/-   ##
==========================================
  Coverage           ?   56.61%           
==========================================
  Files              ?       16           
  Lines              ?     7482           
  Branches           ?        0           
==========================================
  Hits               ?     4236           
  Misses             ?     3246           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	56.61% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It modifies a security-critical agent-safety guard whose correctness depends on subtle shell-tokenization and quoting-mask behavior, warranting final human verification despite no defects being found.

Review effort: Balanced
Findings: None

What changed in this PR

This PR fixes a false-negative in the hub's Claude write guard (host-setup/agent-safety/claude/gh-write-guard.py). The _redirects_stdin scan, which decides whether a while read ... done wait loop is bounded by a finite input, previously credited a redirect written inside a trailing shell comment (e.g. ... done # < f or ... done #< f) as the loop's input bound. Since bash reads nothing after #, such a loop actually drains its upstream pipe forever and should be denied. The guard is part of the fleet's agent-safety layer that blocks unbounded poll loops, so this closes a real bypass.

The fix ends the scan at an unquoted-# word the same way it already ends at a separator or reserved word, using the quoting mask the caller already computes to distinguish a real comment from a quoted #f filename, and it is deliberately deny-safe where quoting is unknown or an expansion that can hold a space precedes the #.

Changes:

• Add a quoted mask parameter to _redirects_stdin/_reads_its_input and thread the existing per-token mask from _unbounded_wait_loop (passing None when the command contains a carriage return, which the lexer splits on but bash does not).
• End the redirect scan at an unquoted # word, treat a redirect whose target opens a comment as unbound, and only carry an earlier binding past a # when the comment is certain.
• Add nine --selftest cases covering trailing/glued comments, comment-as-target, payload comments, quoted #, # inside an expansion, unknown quoting, and the carriage-return shape.

File	Description
host-setup/​agent-safety/​claude/​gh-write-guard.py	Ends the stdin-redirect scan at an unquoted trailing comment and threads a quoting mask so a quoted # still names a file, plus selftest coverage for each shape.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.