main() recognised exactly two subcommands and let everything else fall through
to the stdin scan. On empty stdin that prints "(no findings)" and exits 0, so:
$ gstack-redact install-prepush-hooks # plural typo
gstack-redact scan — repo UNKNOWN
(no findings)
$ echo $?
0
No hook was installed, and the operator has every reason to believe the
credential guard is armed. A guard that silently no-ops must never exit 0.
Two smaller faults in the same dispatch, both of which lead people here:
- There was no --help handler, so `gstack-redact --help` fell through to the
scanner. Piping a credential to it scanned the secret and exited 3.
- With no piped input and no --from-file, readInput() blocks on readSync(fd 0)
until an EOF that an interactive terminal never sends. That prints nothing
at all, so it reads as a hang rather than as "this is a filter, feed it".
Now: --help/-h/help prints usage and exits 0; an unrecognised positional
prints the offender and exits 1; a TTY with nothing piped in prints usage
instead of blocking. "scan" stays accepted, because the human output header
reads "gstack-redact scan — repo …" and that is what people type.
Usage errors exit 1, deliberately not 2 or 3. Those mean MEDIUM and HIGH
findings and callers gate dispatch on them, so a usage error exiting 2 would
be read as "medium findings — prompt the user". A test pins that.
Tests: 4 written failing first, then fixed. Full suite 7,722 pass / 0 fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
