fix(pre-bash,worktree-guard): block filesystem-root wipes and empty-collapse expansions - #10

Merged

andrei-hasna merged 14 commits into

mainfrom

fix/destructive-guard-root-and-empty-collapse

Jul 27, 2026

Commits on Jul 26, 2026

fix(pre-bash,worktree-guard): block filesystem-root wipes and empty-collapse expansions

andreihasna
authored and
andrei-hasna
committed
2fe8426
fix(pre-bash,worktree-guard): close four bypasses found in adversarial review
andreihasna
committed
bb3fbe2
fix(pre-bash): bound brace expansion so it cannot stall the hook into failing open
andreihasna
committed
df0d539
fix(pre-bash): make the brace-expansion cap fall back conservatively, not permissively
andreihasna
committed
e35eb74
fix(pre-bash): make every analysis limit fail closed, and fix quoted parens in substitutions
andreihasna
committed
9b471e5
fix(pre-bash): close 30 escapes and 16 false positives from adversarial review round 3
andreihasna
committed
f6def3c
fix(pre-bash): close three critical regressions found in adversarial review round 4
andreihasna
committed
e8bc5a1
fix(pre-bash): replace the glob regex with a linear matcher; handle popd and rebinding builtins
andreihasna
committed
1e53837

Commits on Jul 27, 2026

fix(pre-bash): make bracket handling fail closed by design, not by enumeration
andreihasna
committed
fe21e8a
fix(pre-bash): bound the class-terminator search; certify only from command position
andreihasna
committed
3261656
fix(pre-bash): fail closed on the bracket BOUNDARY, not just its contents
andreihasna
committed
f38fca5
fix(pre-bash): track conditionality by context; sweep on any unanchored first component
andreihasna
committed
70c2afd
fix(pre-bash): unfreeze the cwd cap, count keywords in command position, bound oversized input
andreihasna
committed
53505e2
fix(pre-bash): give every bound ONE fail-closed answer instead of its own fallback
andreihasna
committed
cc24af0