fix(guard): cross-repo scope + companion-rescue Bash for tri-review - #96
Merged
Conversation
Two fixes for tri-review blockers reported in #95: - PreToolUse guard now honours state.RepoRoot the same way the stop-guard does since #91. A wedged workflow in repo A no longer blocks unrelated tool calls in repo B for the full TTL window. - Prompt+hard allows Bash when the command invokes codex-companion or gemini-companion — the rescue subagents require that nested Bash to reach external models, and tri-review's model-diversity invariant fails silently without it. readToolNameFromStdin is renamed readToolInvocationFromStdin and now also extracts tool_input.command so the Bash carve-out can inspect the payload without a second parse pass.
Prevents a trivial bypass where a Bash comment token like `# codex-companion` would satisfy the substring match. Both real companions ship as .mjs so the tightening doesn't break any intended invocation style. A future .js/.cjs adapter must update this allowlist deliberately rather than relying on the loose match.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the two tri-review blockers from #95 that are in devkit's scope.
runPreToolGuardnow honoursstate.RepoRootthe same wayrunStopGuardhas since devkit-stop-guard fires across repos — hook is session-scoped, should be repo/branch-scoped #91. A wedged workflow in repo A no longer blocks unrelated tool calls in repo B for the 30-min TTL window. The block remains active in the originating repo.codex-companion.mjsorgemini-companion.mjs. Required bycodex:codex-rescue/gemini:gemini-rescuesubagents that forward to external models through those scripts. Carve-out is pinned to the.mjsextension so a bash comment like# codex-companioncan't satisfy the check.openai-codex1.0.3 — no devkit change required. Noted for the record.Closes #95.
Changes
src/cmd/guard.go— cross-repo scope check inrunPreToolGuard, companion-rescue carve-out in the prompt+hard branch,readToolNameFromStdin→readToolInvocationFromStdin(also parsestool_input.command),isCompanionRescueCommandhelper with.mjs-suffix match.src/cmd/guard_test.go— 4 new rows inTestGuardPreToolUse(companion allow × 2, unrelated Bash block, command-step rescue-looking Bash still blocks); newTestGuardPreToolUseRepoScope(5 subtests covering cross-repo allow, matching-repo block, emptyRepoRootfail-closed, unresolvable current repo fail-closed, command-step session cross-repo).Test plan
go test ./...— 371 tests pass across 6 packagesgo vet ./...cleangofmt -l .cleanTestGuardPreToolUseRepoScope(5 subtests) greenTestGuardPreToolUserescue-Bash rows green/devkit:tri-reviewon a multi-model PR and confirm both Codex and Gemini rescue paths produce output