Skip to content

Block +<refspec> force pushes in the pre-bash guard #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cgraf78 merged 1 commit into from
Jul 2, 2026
Merged

Block +<refspec> force pushes in the pre-bash guard #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions bin/agent-hook-pre-bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,6 +513,13 @@ _hook_run_guards() {
_GUARD_GIT_PUSH_FORCE=1
break
} ;;
+?*)
# A refspec that leads with `+` (e.g. `+main`, `+HEAD:main`,
# `+refs/heads/x:y`) forces the push without `--force`/`-f`, so it
# must be caught too. --force-with-lease stays allowed above.
_GUARD_GIT_PUSH_FORCE=1
break
;;
esac
((i++))
done
Expand Down
16 changes: 16 additions & 0 deletions test/suites/agent-hook-bash-guards-test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,11 +150,27 @@ _assert_not_contains "git push --force-with-lease=ref: no BLOCKED" "BLOCKED" "$H
_run_hook "$PRE_BASH" '{"tool_input":{"command":"git -C /tmp/repo push -f"}}'
_assert_eq "git -C push -f: blocked" "2" "$HOOK_EXIT"

# `+<refspec>` forces the push without --force/-f and must also be blocked.
_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push origin +main"}}'
_assert_eq "git push origin +main: blocked" "2" "$HOOK_EXIT"
_assert_contains "git push origin +main: BLOCKED msg" "BLOCKED" "$HOOK_STDERR"

_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push origin +HEAD:main"}}'
_assert_eq "git push origin +HEAD:main: blocked" "2" "$HOOK_EXIT"

_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push origin +refs/heads/x:refs/heads/y"}}'
_assert_eq "git push origin +refspec: blocked" "2" "$HOOK_EXIT"

# normal push is fine
_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push origin main"}}'
_assert_eq "git push (no force): allowed" "0" "$HOOK_EXIT"
_assert_not_contains "git push (no force): no BLOCKED" "BLOCKED" "$HOOK_STDERR"

# a non-force src:dst refspec (no leading +) must NOT be flagged as force
_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push origin HEAD:main"}}'
_assert_eq "git push src:dst (no force): allowed" "0" "$HOOK_EXIT"
_assert_not_contains "git push src:dst: no BLOCKED" "BLOCKED" "$HOOK_STDERR"

_run_hook "$PRE_BASH" '{"tool_input":{"command":"git push -u origin feat/foo"}}'
_assert_eq "git push -u: allowed" "0" "$HOOK_EXIT"

Expand Down
Loading