CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-17 18:32:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(freeze): mark the decision written after the helper prints, not before

Browse Source 
If gstack_hook_decision ever failed between the flag and its output the
backstop would have stayed silent; setting the flag after the print keeps
the deny backstop armed until a decision is actually on stdout.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-09-04 18:14:31 +00:00
co-authored by Claude Fable 5.1
parent 8e1e520fe5
commit 85aaefb42d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
freeze/bin/check-freeze.sh
+2 -2
View File
@@ -99,8 +99,8 @@ set -e
# Unparseable payload (or no parser available): DENY. A boundary hook that # Unparseable payload (or no parser available): DENY. A boundary hook that
# allows what it cannot read is not a boundary. # allows what it cannot read is not a boundary.
if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then
_FREEZE_DECIDED=1
gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR" gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR"
_FREEZE_DECIDED=1
exit 0 exit 0
fi fi
@@ -163,7 +163,7 @@ case "$FILE_PATH" in
# The reason is JSON-encoded by the shared helper. Never interpolate paths # The reason is JSON-encoded by the shared helper. Never interpolate paths
# into hand-built JSON: a path containing a quote or newline produced # into hand-built JSON: a path containing a quote or newline produced
# malformed JSON here, and the deny silently no-oped. # malformed JSON here, and the deny silently no-oped.
_FREEZE_DECIDED=1
gstack_hook_decision deny "[freeze] Blocked: $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed." gstack_hook_decision deny "[freeze] Blocked: $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed."
_FREEZE_DECIDED=1
;; ;;
esac esac