CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-10 06:58:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(redact): prepush guard fails closed on git failure; /ship owns hook install (#1946)

Browse Source 
Two gaps closed:

1. Fail closed. The git() helper returned "" on ANY non-zero exit or
   maxBuffer overflow (status null), addedLinesFor produced an empty
   string, and the push sailed through unscanned — fail-open on exactly
   the oversized-diff case where a large secret-bearing blob is most
   likely. The diff call now uses a strict variant that throws; main
   blocks with a clear message naming the GSTACK_REDACT_PREPUSH=skip
   escape valve. Probe calls (symbolic-ref, rev-parse, merge-base) keep
   the permissive helper — their failures are normal control flow.

2. Install path. The hook was installed by nothing ("opt-in, installed by
   nothing" was the issue's words). ./setup runs in the gstack checkout —
   the wrong repo for a per-project hook — so it gets a one-line hint
   only. /ship owns per-repo install: config redact_prepush_hook=true +
   hook missing → silent install (consent already given); config unset +
   no ~/.gstack/.redact-prepush-prompted marker → one-time machine-wide
   AskUserQuestion offer, answer persisted. ship/SKILL.md regenerated in
   this same commit (check-freshness bisect discipline).

Tests: unscannable diff (bogus SHAs) → exit 1 + valve named; empty-but-
successful diff → exit 0; static asserts pin setup as hint-only and the
ship template as the installer surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-06-11 20:58:47 -07:00
co-authored by Claude Fable 5
parent c8f078b482
commit 6bc00abb0f
8 changed files with 307 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/fixtures/golden/claude-ship-SKILL.md
Vendored
+43
View File
@@ -1218,6 +1218,49 @@ Claiming work is complete without verification is dishonesty, not efficiency.
## Step 17: Push
**Credential pre-push guard (#1946) — run before the push:**
```bash
_REDACT_PREPUSH=$(~/.claude/skills/gstack/bin/gstack-config get redact_prepush_hook 2>/dev/null || echo "false")
_HOOK_PATH=$(git rev-parse --git-path hooks/pre-push 2>/dev/null || echo "")
_HOOK_INSTALLED="no"
[ -n "$_HOOK_PATH" ] && [ -f "$_HOOK_PATH" ] && grep -q "gstack-redact" "$_HOOK_PATH" 2>/dev/null && _HOOK_INSTALLED="yes"
_PREPUSH_PROMPTED=$([ -f ~/.gstack/.redact-prepush-prompted ] && echo "yes" || echo "no")
echo "REDACT_PREPUSH: $_REDACT_PREPUSH"
echo "HOOK_INSTALLED: $_HOOK_INSTALLED"
echo "PREPUSH_PROMPTED: $_PREPUSH_PROMPTED"
```
Branch on the echoed values:
1. **`REDACT_PREPUSH: true` and `HOOK_INSTALLED: no`** — consent already
given; install silently (no question) and continue:
```bash
~/.claude/skills/gstack/bin/gstack-redact install-prepush-hook
```
2. **`REDACT_PREPUSH` not true AND `PREPUSH_PROMPTED: no`** — one-time
offer (fires once EVER, machine-wide). AskUserQuestion:
> gstack can install a per-repo git pre-push hook that blocks pushes
> containing credentials (API keys, tokens, private keys). It's a
> guardrail, not enforcement — `GSTACK_REDACT_PREPUSH=skip` bypasses it.
> Install it for repos you ship from?
Options:
- A) Yes — install the credential guard (recommended)
- B) No — never ask again
If A: run `~/.claude/skills/gstack/bin/gstack-config set redact_prepush_hook true`
then `~/.claude/skills/gstack/bin/gstack-redact install-prepush-hook`.
If B: run `~/.claude/skills/gstack/bin/gstack-config set redact_prepush_hook false`.
ALWAYS (after either answer, but NOT if the question itself failed to
render — a failed AskUserQuestion must re-offer next time):
```bash
touch ~/.gstack/.redact-prepush-prompted
```
3. **Anything else** (declined earlier, or already installed) — continue
without comment.
**Idempotency check:** Check if the branch is already pushed and up to date.
```bash
test/fixtures/golden/codex-ship-SKILL.md
Vendored
+43
View File
@@ -2385,6 +2385,49 @@ Claiming work is complete without verification is dishonesty, not efficiency.
## Step 17: Push
**Credential pre-push guard (#1946) — run before the push:**
```bash
_REDACT_PREPUSH=$($GSTACK_ROOT/bin/gstack-config get redact_prepush_hook 2>/dev/null || echo "false")
_HOOK_PATH=$(git rev-parse --git-path hooks/pre-push 2>/dev/null || echo "")
_HOOK_INSTALLED="no"
[ -n "$_HOOK_PATH" ] && [ -f "$_HOOK_PATH" ] && grep -q "gstack-redact" "$_HOOK_PATH" 2>/dev/null && _HOOK_INSTALLED="yes"
_PREPUSH_PROMPTED=$([ -f ~/.gstack/.redact-prepush-prompted ] && echo "yes" || echo "no")
echo "REDACT_PREPUSH: $_REDACT_PREPUSH"
echo "HOOK_INSTALLED: $_HOOK_INSTALLED"
echo "PREPUSH_PROMPTED: $_PREPUSH_PROMPTED"
```
Branch on the echoed values:
1. **`REDACT_PREPUSH: true` and `HOOK_INSTALLED: no`** — consent already
given; install silently (no question) and continue:
```bash
$GSTACK_ROOT/bin/gstack-redact install-prepush-hook
```
2. **`REDACT_PREPUSH` not true AND `PREPUSH_PROMPTED: no`** — one-time
offer (fires once EVER, machine-wide). AskUserQuestion:
> gstack can install a per-repo git pre-push hook that blocks pushes
> containing credentials (API keys, tokens, private keys). It's a
> guardrail, not enforcement — `GSTACK_REDACT_PREPUSH=skip` bypasses it.
> Install it for repos you ship from?
Options:
- A) Yes — install the credential guard (recommended)
- B) No — never ask again
If A: run `$GSTACK_ROOT/bin/gstack-config set redact_prepush_hook true`
then `$GSTACK_ROOT/bin/gstack-redact install-prepush-hook`.
If B: run `$GSTACK_ROOT/bin/gstack-config set redact_prepush_hook false`.
ALWAYS (after either answer, but NOT if the question itself failed to
render — a failed AskUserQuestion must re-offer next time):
```bash
touch ~/.gstack/.redact-prepush-prompted
```
3. **Anything else** (declined earlier, or already installed) — continue
without comment.
**Idempotency check:** Check if the branch is already pushed and up to date.
```bash
test/fixtures/golden/factory-ship-SKILL.md
Vendored
+43
View File
@@ -2791,6 +2791,49 @@ Claiming work is complete without verification is dishonesty, not efficiency.
## Step 17: Push
**Credential pre-push guard (#1946) — run before the push:**
```bash
_REDACT_PREPUSH=$($GSTACK_ROOT/bin/gstack-config get redact_prepush_hook 2>/dev/null || echo "false")
_HOOK_PATH=$(git rev-parse --git-path hooks/pre-push 2>/dev/null || echo "")
_HOOK_INSTALLED="no"
[ -n "$_HOOK_PATH" ] && [ -f "$_HOOK_PATH" ] && grep -q "gstack-redact" "$_HOOK_PATH" 2>/dev/null && _HOOK_INSTALLED="yes"
_PREPUSH_PROMPTED=$([ -f ~/.gstack/.redact-prepush-prompted ] && echo "yes" || echo "no")
echo "REDACT_PREPUSH: $_REDACT_PREPUSH"
echo "HOOK_INSTALLED: $_HOOK_INSTALLED"
echo "PREPUSH_PROMPTED: $_PREPUSH_PROMPTED"
```
Branch on the echoed values:
1. **`REDACT_PREPUSH: true` and `HOOK_INSTALLED: no`** — consent already
given; install silently (no question) and continue:
```bash
$GSTACK_ROOT/bin/gstack-redact install-prepush-hook
```
2. **`REDACT_PREPUSH` not true AND `PREPUSH_PROMPTED: no`** — one-time
offer (fires once EVER, machine-wide). AskUserQuestion:
> gstack can install a per-repo git pre-push hook that blocks pushes
> containing credentials (API keys, tokens, private keys). It's a
> guardrail, not enforcement — `GSTACK_REDACT_PREPUSH=skip` bypasses it.
> Install it for repos you ship from?
Options:
- A) Yes — install the credential guard (recommended)
- B) No — never ask again
If A: run `$GSTACK_ROOT/bin/gstack-config set redact_prepush_hook true`
then `$GSTACK_ROOT/bin/gstack-redact install-prepush-hook`.
If B: run `$GSTACK_ROOT/bin/gstack-config set redact_prepush_hook false`.
ALWAYS (after either answer, but NOT if the question itself failed to
render — a failed AskUserQuestion must re-offer next time):
```bash
touch ~/.gstack/.redact-prepush-prompted
```
3. **Anything else** (declined earlier, or already installed) — continue
without comment.
**Idempotency check:** Check if the branch is already pushed and up to date.
```bash
test/redact-prepush-hook.test.ts
+40
View File
@@ -107,6 +107,46 @@ describe("diff direction + special refs", () => {
});
});
describe("fail closed on unscannable diffs (#1946)", () => {
test("a diff git cannot compute BLOCKS the push and names the escape valve", () => {
// Bogus-but-well-formed SHAs: git diff exits non-zero, the old git()
// helper returned "" and the push sailed through unscanned.
const bogusLocal = "a".repeat(40);
const bogusRemote = "b".repeat(40);
const { code, stderr } = runHook(
`refs/heads/main ${bogusLocal} refs/heads/main ${bogusRemote}\n`,
);
expect(code).toBe(1);
expect(stderr).toContain("could not compute the pushed diff");
expect(stderr).toContain("GSTACK_REDACT_PREPUSH=skip");
});
test("an empty-but-successful diff still passes (no-op push)", () => {
const head = git(["rev-parse", "HEAD"]);
// remote == local: diff succeeds and is empty — must NOT block.
const { code } = runHook(`refs/heads/main ${head} refs/heads/main ${head}\n`);
expect(code).toBe(0);
});
});
describe("install UX surfaces (#1946 / eng review D3+D10)", () => {
const ROOT = path.resolve(import.meta.dir, "..");
test("setup carries the hint only — never a per-repo install (it runs in the wrong repo)", () => {
const setup = fs.readFileSync(path.join(ROOT, "setup"), "utf8");
expect(setup).toContain("redact_prepush_hook");
// The hint must not invoke the installer from setup.
expect(setup).not.toContain("install-prepush-hook");
});
test("ship template owns per-repo install: silent-install path + one-time offer marker", () => {
const tmpl = fs.readFileSync(path.join(ROOT, "ship", "SKILL.md.tmpl"), "utf8");
expect(tmpl).toContain("install-prepush-hook");
expect(tmpl).toContain(".redact-prepush-prompted");
expect(tmpl).toContain("redact_prepush_hook");
});
});
describe("escape valve", () => {
test("GSTACK_REDACT_PREPUSH=skip bypasses + logs", () => {
const base = git(["rev-parse", "HEAD"]);