CalvinBackup/gstack
1
0 Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-11-04 15:57:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

test(shared-libs): recognize Claude Code 2.1.292's internal git probe prefix (format.pretty and per-hook disables), with its CI receipt

Browse Source
This commit is contained in:
garrytan committed 2026-10-07 22:32:29 +00:00
1 parent c2d1aa1976
commit 1912604284
2 files changed
+117 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/helpers/shared-libs-eval-fixture.ts
+15 -3
View File
@@ -490,15 +490,27 @@ export function isGuardedGitRequest(request: SourceRequest): boolean {
/** Claude's own workspace probes are not commands requested by the skill. */
export function isInternalClaudeGitRequest(request: SourceRequest, commands: string[]): boolean {
const hostPrefix = ['-c', 'protocol.ext.allow=never', '-c', 'submodule.recurse=false',
'-c', 'log.showSignature=false', '-c', 'gc.auto=0', '-c', 'maintenance.auto=false',
const head = ['-c', 'protocol.ext.allow=never', '-c', 'submodule.recurse=false', '-c', 'log.showSignature=false'];
const tail = ['-c', 'gc.auto=0', '-c', 'maintenance.auto=false',
'--literal-pathspecs', '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=',
'-c', 'core.askPass=', '-c', 'core.quotePath=false', '-c', 'core.safecrlf=false'];
// Observed host prefixes: Claude Code 2.1.284, and 2.1.292, which adds format.pretty=medium,
// then disables every git hook by name before --literal-pathspecs.
const hooks292 = [
'applypatch-msg', 'pre-applypatch', 'post-applypatch', 'pre-commit', 'pre-merge-commit', 'prepare-commit-msg',
'commit-msg', 'post-commit', 'pre-rebase', 'post-checkout', 'post-merge', 'pre-push',
'pre-receive', 'update', 'proc-receive', 'post-receive', 'post-update', 'reference-transaction',
'push-to-checkout', 'pre-auto-gc', 'post-rewrite', 'sendemail-validate', 'fsmonitor-watchman', 'p4-changelist',
'p4-prepare-changelist', 'p4-post-changelist', 'p4-pre-submit', 'post-index-change',
].flatMap(hook => ['-c', `hook.${hook}.enabled=false`]);
const [gc, gcAuto, maint, maintAuto, ...afterMaintenance] = tail;
const hostPrefixes = [[...head, ...tail],
[...head, '-c', 'format.pretty=medium', gc!, gcAuto!, maint!, maintAuto!, ...hooks292, ...afterMaintenance]];
// Require direct process ancestry AND the exact observed host prefix AND no
// matching model request. A shell/model-issued unguarded Git call still fails.
return request.tool === 'git' && !!request.ppid &&
/(?:^|[/\\])claude(?:\.exe)?$/.test(request.parentExecutable || '') &&
JSON.stringify(request.args.slice(0, hostPrefix.length)) === JSON.stringify(hostPrefix) &&
hostPrefixes.some(prefix => JSON.stringify(request.args.slice(0, prefix.length)) === JSON.stringify(prefix)) &&
!commands.some(command => command.includes('core.safecrlf=false') || command.includes('protocol.ext.allow=never'));
}
test/shared-libs-fixture.test.ts
+102
View File
@@ -1477,6 +1477,108 @@ test('outer-timeout', () => captures.runAttempt('outer-timeout', ['audit'], 50,
const nativeCallbackReceipts = {
"intrinsic": [
{
"source": "https://github.com/garrytan/gstack/actions/runs/37694473528/job/113044020494 (Claude Code 2.1.292, shared-libs-read-only)",
"source_sha256": "a2523bdfe2289e207127af58c83ab69268f1201922a9c30ba063dc77dbf0e023",
"public_request": {
"tool": "git",
"args": [
"-c",
"protocol.ext.allow=never",
"-c",
"submodule.recurse=false",
"-c",
"log.showSignature=false",
"-c",
"format.pretty=medium",
"-c",
"gc.auto=0",
"-c",
"maintenance.auto=false",
"-c",
"hook.applypatch-msg.enabled=false",
"-c",
"hook.pre-applypatch.enabled=false",
"-c",
"hook.post-applypatch.enabled=false",
"-c",
"hook.pre-commit.enabled=false",
"-c",
"hook.pre-merge-commit.enabled=false",
"-c",
"hook.prepare-commit-msg.enabled=false",
"-c",
"hook.commit-msg.enabled=false",
"-c",
"hook.post-commit.enabled=false",
"-c",
"hook.pre-rebase.enabled=false",
"-c",
"hook.post-checkout.enabled=false",
"-c",
"hook.post-merge.enabled=false",
"-c",
"hook.pre-push.enabled=false",
"-c",
"hook.pre-receive.enabled=false",
"-c",
"hook.update.enabled=false",
"-c",
"hook.proc-receive.enabled=false",
"-c",
"hook.post-receive.enabled=false",
"-c",
"hook.post-update.enabled=false",
"-c",
"hook.reference-transaction.enabled=false",
"-c",
"hook.push-to-checkout.enabled=false",
"-c",
"hook.pre-auto-gc.enabled=false",
"-c",
"hook.post-rewrite.enabled=false",
"-c",
"hook.sendemail-validate.enabled=false",
"-c",
"hook.fsmonitor-watchman.enabled=false",
"-c",
"hook.p4-changelist.enabled=false",
"-c",
"hook.p4-prepare-changelist.enabled=false",
"-c",
"hook.p4-post-changelist.enabled=false",
"-c",
"hook.p4-pre-submit.enabled=false",
"-c",
"hook.post-index-change.enabled=false",
"--literal-pathspecs",
"-c",
"core.hooksPath=/dev/null",
"-c",
"core.fsmonitor=",
"-c",
"core.askPass=",
"-c",
"core.quotePath=false",
"-c",
"core.safecrlf=false",
"ls-files",
"-z",
"--stage"
],
"env": {
"GIT_OPTIONAL_LOCKS": "0",
"GIT_NO_LAZY_FETCH": "1",
"GIT_TERMINAL_PROMPT": "0"
},
"cwd": "/home/runner/.cache/gstack-paid-shard-g3tk70/tmp/gstack-shared-read-only-9Ndx49/repo",
"pid": 4849,
"ppid": 4497,
"parentExecutable": "/usr/local/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe",
"parentCommand": "claude -p --model claude-fable-5-1 --output-format stream-json --verbose --dangerously-skip-permissions --max-turns 24 --allowed-tools Bash Read Write Edit Glob Grep --tools Bash,Read,Write,Edit,Glob,Grep --include-partial-messages --strict-mcp-config "
},
"matching_model_commands": []
},
{
"source": "/home/user/.capy/work/shared-libs-captures/1790267940497-shared-libs-read-only-1-1.json",
"source_sha256": "5c4b660f37f0a100e5eef97896241b1b139ec4c57f38d9d450fb153543da6fac",