[ptr727]

Summary

_push_targets in the write guard read an all-letter short-option word as a cluster of flags anywhere in it, so a push option attached to -o was read as more flags. When the word ended in o, the next word was also consumed as the option's value. So git push -ofoo origin develop read f as --force, consumed origin, and judged the push as a bare push of the current branch. It was allowed while git pushed develop.

The walk now stops at the first o, as git does. The rest of the word is the push option's value, and the next word is consumed only when nothing follows the o. A cluster carrying a digit, such as -4f (-4 is git push's IPv4 option), is walked too, where before it was skipped and its f missed. A word whose flag part carries a run-time character, such as -$o, consumes no next word, as before.

Changes

• host-setup/agent-safety/claude/gh-write-guard.py: the short-cluster branch of _push_targets, plus self-test rows for -ofoo, -o foo, -fofoo, -ofoo to a main whose rules allow an update, -4f, and -uo ci.skip, a cluster ending in o that takes the next word as its value.
• host-setup/agent-safety/README.md: requirement 4 states how a short-option cluster and its push option are read.

Verification

• gh-write-guard.py --selftest passes. The same rows run against the guard from origin/develop fail on -ofoo origin develop, -fofoo origin main, and -4f origin main, each allowed there. A mutant that never consumes the next word fails the -uo ci.skip row.
• tests/test_guard_size.py and host-setup/agent-safety/claude/test_install.py pass. The guard is 2208 lines against its 2500 ceiling.

Pre-existing findings, filed

• host-setup/agent-safety/claude/gh-write-guard.py _skips_hooks, the clean reader in _primary_checkout_verdict, and the git branch rename check, the same cluster-reading class on commit, clean, and branch, plus the shared-helper consolidation across all three sites (pre-existing, correctness): Read Commit and Clean Short-Option Clusters Only Up to a Value-Taking Letter in the Write Guard #3783.

Closes on promotion: #3720

🤖 Generated with Claude Code

[ptr727]

A recorded local strict-review pass covers head b6767ad0c64ab5276d581dc65f8b09dcfcd03870, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ptr727/ProjectTemplate
• Branch: feature/burn-3720
• File: .coderabbit.yaml
• Commit: b6767ad
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ca799528-157b-44c0-8467-13adb2947f46

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Copilot]

🟢 Approval recommended

No active review issues remain, and the change includes targeted parsing updates with accompanying documentation and regression coverage.

No open issues 🎉

What changed in this PR

This pull request fixes short-option parsing in the write guard so attached git push -o values are treated as values rather than additional flags. It also documents the behavior and adds regression coverage.

Changes:

• Stops parsing short-option clusters at the first o.
• Consumes the following word as the push-option value only when no attached value exists.
• Preserves flag detection in digit-bearing clusters such as -4f.
• Adds self-tests and updates the agent-safety requirements.

File	Description
host-setup/​agent-safety/​README.md	Documents how push short-option clusters and -o values are interpreted.
host-setup/​agent-safety/​claude/​gh-write-guard.py	Fixes push-option parsing and adds regression self-tests.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.34%. Comparing base (27d1ca4) to head (b6767ad).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #3784   +/-   ##
========================================
  Coverage    82.34%   82.34%           
========================================
  Files           28       28           
  Lines         9454     9454           
========================================
  Hits          7785     7785           
  Misses        1669     1669           

Flag	Coverage Δ
python-3.13	82.34% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.