- Trust-policy lookup fails closed on any git failure that is not 'no such
remote' or 'not a git repository' (a corrupt or unreadable .git/config and
dubious ownership exit 128 and used to read as 'no remote').
- pickAdditionalContext takes the first complete top-level JSON object, so a
vendor whose background helper appends a line to stdout (or prints a banner
first) does not lose its answer.
- The hook-errors.log rate limiter keys on a stable string (a vendor's
timestamped stderr no longer defeats it); the log is chmod 0600 on every
append because sibling hooks create the same file without a mode.
- Scan admission is sized by payload bytes (scan() is uninterruptible).
- The receipt payload class is a stable token; the prose moved to the docs.
- Header, constants and comments match the behaviour (silent skips vs logged
refusals; HIGH/MEDIUM withholding; STAGE_CAP_MS scope; runExternal in the
spawn-bin header; the ledger lock budget doc).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- Vendor failures are logged even with empty stderr (a silently hanging
vendor taxed every prompt invisibly); the stderr tail is withheld when the
redaction engine finds a credential or PII shape in it; hook-errors.log is
created 0600.
- Trust-policy veto fails closed when git cannot run or answer in time (it
read as 'no remote' before); the policy script spawn is bounded by the
hook's clock; a payload cwd that is not a directory falls back.
- Each secret scan is admitted by the deadline clock (the engine's cost grows
with match density); stdin is decoded once.
- The pre-spawn gate re-check logs a config failure instead of swallowing it;
an incomplete stdin read is named as such, not as 'not JSON'.
- Carriage returns are stripped with the other controls.
- The vendor env allowlist adds the standard proxy, TLS and XDG variables so
a vendor behind a corporate proxy or private CA still reaches its service.
- A stdin EPIPE on a delivered answer is recorded in the outcome, not treated
as a spawn error.
- Stage caps and the truncation marker are named constants; a test-only
GSTACK_MEMORABLE_TEST_BUDGET_MS can shorten (never widen) the budget.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The PR's hook exec'd the vendor binary with the full environment and
passed its stdout to Claude verbatim. It is now the house pattern: a
fail-open bash shim over a .ts twin that (1) gates on the memorable_recall
consent key, (2) skips repos whose trust policy is deny or read-only,
(3) scans the prompt (raw bytes and decoded string leaves) and refuses to
hand over a HIGH-tier credential shape, (4) writes a fail-closed egress
receipt naming the local executable it ran, (5) spawns the vendor in its
own process group with an allowlisted environment and group-kills it on
timeout, (6) accepts only a string additionalContext back, caps it at
8 KiB on a UTF-8 boundary and wraps it in the trust envelope, and (7)
records an `output-written` outcome after the stdout write completes.
One deadline clock (4.5 s) undercuts Claude Code's 5 s kill and bounds
both ledger writes through the new lockBudgetMs option on
writeReceipt/writeOutcome (default unchanged).
spawn-bin gains runExternal for external executables (detached group,
stderr drained, stdin EPIPE handled, stdout capped, win32 refused).
The wiring test pins the sink fail-closed and sweeps hosts/.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
