Repository navigation
fix(controlled-gate): ask only on a controlled file the check finds - #133
Merged
Merged
Conversation
- Let a call through when the check cannot finish: a directory past the walk limit, a glob past its limit, an unreadable payload, a script failure or garbled output, or no python3 - Check the first 5000 files under a directory and the first 500 paths of a glob, still asking on a held file found among them - Flip the four tests that pinned the asks to pin the pass - Say so in the README's "Permissions", SECURITY.md and design.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…mits - Assert a held file reached before WALK_LIMIT still asks, and a glob past GLOB_LIMIT over held files still asks - Say in the docstring that the hook passes when pre fails and records nothing when post fails - Word design.md's entry as a fact about the code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
hooks/controlled-gate.shruns before every Read, Grep, Bash and edit in every session with the plugin, and stops a call that would read past the first line of a.review/file markedControlled:. It also stopped whenever it could not finish checking: a.review/tree past 5000 files, a glob past 500 paths, a payload or script output it could not read, or nopython3. Those prompts named no item, so the person had nothing to judge; they halted work mid-task and were always answered yes. A.review/directory that grows past the walk limit made them routine. Once this merges, the gate asks only when it has found a held file, naming the item and its warning, and lets through what it cannot check.This is the rule
hooks/secret-gate.shalready follows (docs/design.md, "The secret scan stops only what it finds", #57). Past a limit the check does not give up: it still reads the first 5000 files or 500 glob paths and asks on any held file among them. README "Permissions" andSECURITY.mdnow list what the check does not see.Guarded by
test_past_the_walk_and_glob_limits_only_held_files_found_ask(a held file within either limit still asks; mutating either partial-result path fails it) and the pass-path tests for an unreadable payload, a crashing script and nopython3.Origin: the maintainer's complaint in a working session that "too many files in .review" prompts stop work and are always approved
Sandbox: the six controlled-content scenarios (
design-doc-controlled-notes,design-doc-controlled-cleared,design-doc-export-mention,ticket-draft-controlled,design-doc-controlled-two-items,pr-create-controlled-context),--check --repeat 2on Haiku: 12/12 on main, 12/12 on the parent4f951ab, 12/12 on the branch; the held file inpr-create-controlled-contextis stopped on every variant. No scenario reaches a limit, so the pass paths rest on the unit tests.Canary: none yet
checks.sh --allpasses excepttest_standard_file.sh's "without waiting on its watchdog", which fails the same way on4f951aband does not touch this hook.🤖 Generated with Claude Code. AI assistance level: 5/5 (not read by a person).