[ptr727]

Summary

Closes the write guard's bare-push and @{push} allow gaps, plus one #2943 item. Every changed verdict goes from allow to deny.

• Read a Bare Push's Destination From Branch Config, Not a Remote-Tracking Ref, in the Write Guard #3019, the destination comes from branch config too. _current_push_branch keeps the @{push} read and adds _configured_push_branches. That function reads push.default and branch.<name>.merge. current and simple give the branch's own name, and upstream and tracking give each merge branch. A push.default that cannot be read, or holds a value git does not define, gives both. The two readings are combined, so a fetch refspec that maps under refs/remotes/origin/mirror/*, or a missing remote-tracking ref, no longer hides develop.
• Read a Persisted remote.<name>.mirror on a Bare Push in the Write Guard #3020, persisted mirror. _remote_mirrors reads remote.<name>.mirror for a push with no refspec and no --mirror, in the directory the push runs in. It reads the named remote's key, or every remote's key when the push names none. A true value, a value that is not a boolean, or a read that cannot answer adds a mirror op on each protected default. That op denies where the rules forbid a force, a delete, or a direct write.
• Fail Closed When the Write Guard's @{push} Read Times Out or Cannot Run #3036, failed reads. _git_read returns the exit status beside the output, and _git_stdout now wraps it. In _read_branch and the branch config reads, a read that times out or cannot run is unresolved, which denies. Only a non-zero exit still means "not there".
• Read a Dash-Named Refspec After End-of-Options in the Write Guard #3029, end of options. A push reading with a dash-named word after its first -- or --end-of-options is read a second time, with every word after that boundary taken as the remote or a refspec. The first reading is unchanged, so a word there that develop read as an option still counts.
• Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943, partly: the checkout a push runs in. _push_targets now returns (op, branch, repo). The repo is the origin of the checkout a -C or leading cd moves the push to, from the new _push_repo. _check_push_bypass checks each target against the session origin, as before, and also against its own push's checkout. A checkout or origin the guard cannot name counts as having undetermined rules, which denies only main, master, and develop. That covers a missing directory, sudo -D, env -C, a wrapper shell, a git directory variable, a later cd a loop or a function may run first, and git run by a command not in _STAYING_LAUNCHERS. That reading is _repo_may_move. A command that may move HEAD, such as a checkout, does not count, since it changes the branch and not the repository. Only that Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 item is addressed. Every other Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 item stays open, and so does Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943.

The READMEs describe each new reading.

Verification

• Gaps confirmed at develop's tip. Each was probed against throwaway repositories under mktemp -d with git push --dry-run --porcelain (git 2.47.3), and develop's classify allowed every one. The probes were the mirror-namespace fetch refspec and the single-branch clone (git wrote develop both times), a persisted mirror (git deleted a remote-only branch, and with --tags it deleted develop), a timed-out @{push} read, --x:refs/heads/develop after -- and after --end-of-options, and -C, cd, sudo -D, and wrapped pushes into a checkout whose origin requires a pull request.
• Develop-versus-branch differential. Both guards' classify ran over the same inputs: every develop _GIT_CASES row (301), 99,603 generated push shapes over seven constructed repositories and three rule maps, the 133 _PUSH_DIR_CASES, and 189 runs of extra shapes. 0 deny -> allow, 13,007 allow -> deny. By mechanism, those are 5,138 pushes into a missing directory, 2,569 each under sudo -D, env -C, and a wrapper shell, 146 in a checkout with a persisted mirror, and 16 dash-named refspecs after the boundary. A plain push, a timeout prefix, a run-time word elsewhere, a later cd, git tag/git commit before a push, a glob refspec, and a checkout tracking origin/develop under push.default unset or current each kept develop's verdict.
• Revert proof. With develop's _check_push_bypass, _push_targets, _current_push_branch, _read_branch, and _git_stdout swapped into the branch module, all 19 new deny cases in the selftest fail and every control passes.
• gh-write-guard.py --selftest passes, and passes too with an empty PATH, as the installer's no-git test runs it. test_install.py passes (161 tests), and so does the root tests/ suite (2,813 tests). Ruff format and check, mypy, prose_lint.py, the eol and eol-coverage gates, spec/validate.py, and markdownlint, editorconfig-checker, and cspell in Docker pass too.

Local Review

Frontier local-strict-review passes ran before every push. These findings were fixed:

• A run-time word anywhere, a timeout prefix, or a later cd had marked a push's checkout unnamed. That over-denied, so _repo_may_move replaced it.
• The checkouts of all pushes in a command had been applied to every target. Each push now carries its own.
• A README claim, a control row that proved nothing, a live git read in the offline selftest rows, and sentence length were also fixed.
• One deny -> allow was found and removed: a decoding change on the origin URL read was reverted to develop's strict form.

The opening push listed four introduced findings from its final pass. Three are fixed on later pushes, and the fourth is filed:

• A later cd now moves a push's checkout only where a loop or a function definition may run it first, so a pipe, a background job, or a subshell after the push no longer counts.
• The launcher test skips options, numbers, and redirections, and setsid, gtimeout, time, flock, and winpty keep their directory.
• The _repo_may_move docstring names uv as its moving example.
• Read Every Launcher in Front of a Push in the Write Guard #3050: only the first launcher word is read, so a staying launcher in front of a moving one hides it. Develop allows those shapes too.

Filed rather than widened here:

• Read Push Config a Command Rewrites Before the Push in the Write Guard #3046: a git config or git remote command before the push can rewrite the config the guard reads.
• Tell a Timed-Out Persisted Alias Read From No Alias in the Write Guard #3047: a timed-out persisted alias read reads as no alias.
• Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048: a push to a remote other than origin is judged against the origin's rules.
• Read Every Launcher in Front of a Push in the Write Guard #3050: a launcher that keeps its directory can hide one that moves it.
• A persisted remote.<name>.push and push.default=matching are already Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 items.

Partially addressed: #2943, its item on the directory a push runs in only.

Closes on promotion: #3019, #3020, #3029, #3036

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0da264f4-4ba8-4807-b1e1-d74cb1ae0490

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 13729a2837cffd49ff1ce3a9e2aead4a3149764d, the content this pull request carries at that commit against develop, and it recorded 6 findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@4720440). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #3049   +/-   ##
==========================================
  Coverage           ?   61.21%           
==========================================
  Files              ?       17           
  Lines              ?     9062           
  Branches           ?        0           
==========================================
  Hits               ?     5547           
  Misses             ?     3515           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	61.21% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

Fix repository-move detection and quoting handling, and correct the contradictory timeout documentation.

2 open findings

• Limit repository-move detection to commands affecting the active push · New
• Fix the timeout example in the repository-resolution docstring · New

What changed in this PR

This PR hardens the Git push write guard by detecting configured destinations, persisted mirrors, failed reads, option-boundary refspecs, and alternate checkouts.

Changes:

• Expands push destination and mirror detection.
• Fails closed on unresolved metadata and checkout paths.
• Updates documentation and self-tests.

File	Summary
host-setup/​agent-safety/​README.md	Documents expanded push detection behavior.
host-setup/​agent-safety/​claude/​README.md	Updates Claude hook behavior documentation.
host-setup/​agent-safety/​claude/​gh-write-guard.py	Implements push analysis, checkout resolution, and tests.

🧠 Review effort: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

A recorded local strict-review pass covers head 1eb4d5c9b4c72d04b2c0783c3d0797f07485f96a, the content this pull request carries at that commit against develop, and it recorded 2 findings.