From 8402fa3dde876a69b8c1542ac5de5eb5ad2bf3bf Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 16 Sep 2026 07:56:13 +0000
Subject: [PATCH 1/2] fix(hooks): guard-governed-enqueue reads one slug, and it
 strips the `.git` a clone URL carries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`slug_of` and the inlined copy in the bare `gh pr merge <n>` target derivation
ran the same sed, and the path character class owns `.` and is greedy, so the
optional `\(\.git\)` group matched EMPTY: an origin of
`https://github.com/objectstack-ai/cloud.git` read back as the slug
`objectstack-ai/cloud.git`, which equals no `owner/repo` this guard is ever
asked about. A sibling cloned with the URL `git clone` hands out therefore
resolved nothing and was never audited, and a bare `gh pr merge <n>` in such a
clone derived a slug the API answers 404 for — this guard's fail-open branch.

One reader now, called from both sites, and the suffix comes off after the
match rather than out of the character class, which still has to own `.`
(`objectstack.ai` is a legitimate repository name) and whose race with the
group GNU and BSD sed are free to settle differently.

The self-test pins both shapes: four unpinned spellings of the sibling's origin
(https/ssh x with and without `.git`, plus a trailing slash) resolve and are
audited, and a bare `gh pr merge <n>` run from a checkout whose origin carries
the suffix derives `objectstack-ai/objectstack#13794`. 56 passed / 0 failed
before, 62 / 0 after.

Claude-Session: https://claude.ai/code/session_01Bz6hxDBqK62NP2W1LATvnt
Co-authored-by: Claude <noreply@anthropic.com>
---
 .../hooks/guard-governed-enqueue.selftest.sh  | 72 ++++++++++++++++++-
 .claude/hooks/guard-governed-enqueue.sh       | 32 +++++++--
 2 files changed, 98 insertions(+), 6 deletions(-)

diff --git a/.claude/hooks/guard-governed-enqueue.selftest.sh b/.claude/hooks/guard-governed-enqueue.selftest.sh
index ecab98961e..81b686f34b 100755
--- a/.claude/hooks/guard-governed-enqueue.selftest.sh
+++ b/.claude/hooks/guard-governed-enqueue.selftest.sh
@@ -30,6 +30,11 @@ set -uo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 hook="$here/guard-governed-enqueue.sh"
+# The hook `run`/`stderr_of` actually invoke. It is `$hook` for every case but
+# one: the bare `gh pr merge <n>` case asks the hook about a DIFFERENT checkout's
+# origin, and the hook derives its repo root from its own path, so that case runs
+# a copy sitting in a checkout it built — and restores this on the next line.
+hook_under_test="$hook"
 repo_root="$(cd "$here/../.." && pwd)"
 pass=0
 fail=0
@@ -112,7 +117,7 @@ MERGE=mcp__github__merge_pull_request
 run() { # run <payload> [env assignments…] -> allow | block | exitN
   local payload="$1"; shift
   local rc
-  printf '%s' "$payload" | env "$@" "$hook" >/dev/null 2>&1
+  printf '%s' "$payload" | env "$@" "$hook_under_test" >/dev/null 2>&1
   rc=$?
   case "$rc" in
     0) printf 'allow' ;;
@@ -123,7 +128,7 @@ run() { # run <payload> [env assignments…] -> allow | block | exitN
 
 stderr_of() { # stderr_of <payload> [env…]
   local payload="$1"; shift
-  printf '%s' "$payload" | env "$@" "$hook" 2>&1 >/dev/null
+  printf '%s' "$payload" | env "$@" "$hook_under_test" 2>&1 >/dev/null
 }
 
 expect() { # expect <block|allow> <label> <payload> [env…]
@@ -290,6 +295,38 @@ expect allow 'the same Bash spelling on an approved PR' \
   "$(bash_call 'gh pr merge 13794 -R objectstack-ai/objectstack')" \
   "OS_GOVERNED_ENQUEUE_FIXTURE=$F_PINNED"
 
+echo "== a bare \`gh pr merge <n>\` derives the slug from the checkout's OWN origin =="
+# The second half of this card's defect, and the expensive half: with no `-R` the
+# target repo comes from the checkout's `origin`, so a `.git` suffix left on the
+# slug rides into the API URL — `GET /repos/objectstack-ai/objectstack.git/pulls/N`
+# answers 404 and this guard's read-failure branch ALLOWS. On any clone made with
+# the URL `git clone` hands out by default, that spelling was unguarded.
+#
+# The checkout is BUILT here: the hook derives its repo root from its own path
+# (`BASH_SOURCE`), so the only way to ask it about another origin is to run a copy
+# that sits in one. `.claude/hooks/` and `scripts/` are symlinked back at this
+# tree, so both predicates are the same files, running the same way.
+#
+# ⛔ The allow/block verdict is deliberately NOT asserted here, and that is
+# measured rather than cautious: `OS_GOVERNED_ENQUEUE_FIXTURE` answers EVERY path,
+# so the 404 that makes the real guard fail open cannot be reproduced without the
+# network — under the fixture the wrong slug blocks exactly like the right one,
+# and a verdict row here would pass in both worlds. What discriminates is the slug
+# itself, which the refusal prints as `<owner>/<repo>#<n>`: it read
+# `objectstack-ai/objectstack.git#13794` until `slug_of` stripped the suffix.
+DOTGIT_CLONE="$root/dotgit-url-clone"     # under $root: the existing trap removes it
+mkdir -p "$DOTGIT_CLONE/.claude/hooks"
+ln -s "$hook" "$DOTGIT_CLONE/.claude/hooks/guard-governed-enqueue.sh"
+ln -s "$repo_root/scripts" "$DOTGIT_CLONE/scripts"
+git -C "$DOTGIT_CLONE" init -q >/dev/null 2>&1
+git -C "$DOTGIT_CLONE" remote add origin https://github.com/objectstack-ai/objectstack.git >/dev/null 2>&1
+hook_under_test="$DOTGIT_CLONE/.claude/hooks/guard-governed-enqueue.sh"
+expect_says 'objectstack-ai/objectstack#13794' 'the slug the guard reads is the one the API answers for' \
+  "$(bash_call 'gh pr merge 13794 --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
+expect_lacks 'objectstack.git' 'no .git suffix rides into the repo path the guard reads' \
+  "$(bash_call 'gh pr merge 13794 --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
+hook_under_test="$hook"                   # every case below is back on the real hook
+
 echo "== an UNQUOTED \\\" opens no quote, so the merge behind it is still seen =="
 # The #11738 class, carried by all three Bash-reading guards in this directory:
 # segmentation used to read the escaped `\"` as OPENING a region that never
@@ -433,6 +470,37 @@ expect "$sibling_want" 'a sibling checkout that resolves is audited, never waved
 # worlds and discriminated nothing. The verdict row above is the discriminator,
 # and it is the one that goes red when the sibling stops being resolved.
 
+echo "== every spelling of that same origin URL resolves to that same sibling =="
+# The other half of this card's defect. `git clone` hands out
+# `https://github.com/objectstack-ai/cloud.git`, and until `slug_of` stripped that
+# suffix the slug read back as `objectstack-ai/cloud.git` — equal to no
+# `owner/repo` this guard is ever asked about, so a sibling cloned the
+# conventional way resolved NOTHING and the case above silently degraded into a
+# second copy of the "cannot resolve" one. That is why its origin is pinned to the
+# bare form in place; these are the four spellings it does not cover.
+#
+# Same `$sibling_want`, and deliberately the same variable rather than four more
+# register calls: every tree here is built exactly as that one is (an empty
+# `git init` plus an `origin`), so the register would be answering the identical
+# question about identical content — and the verdict still comes FROM the register
+# rather than from a word copied into this file.
+spelling_n=0
+for spelling_url in \
+  'https://github.com/objectstack-ai/cloud.git' \
+  'git@github.com:objectstack-ai/cloud' \
+  'git@github.com:objectstack-ai/cloud.git' \
+  'https://github.com/objectstack-ai/cloud.git/' \
+  ; do
+  spelling_n=$((spelling_n + 1))
+  spelling_root="$root/sibling-spelling-$spelling_n"    # under $root: the trap removes it
+  mkdir -p "$spelling_root/cloud"
+  git -C "$spelling_root/cloud" init -q >/dev/null 2>&1
+  git -C "$spelling_root/cloud" remote add origin "$spelling_url" >/dev/null 2>&1
+  expect "$sibling_want" "origin $spelling_url resolves and is audited" \
+    "$(mcp $AUTO 999 objectstack-ai cloud)" \
+    "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CROSS_REGEN" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$spelling_root"
+done
+
 echo "== the deliberate exception switch =="
 expect allow 'OS_ALLOW_GOVERNED_ENQUEUE=1 on the blocking case' \
   "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" OS_ALLOW_GOVERNED_ENQUEUE=1
diff --git a/.claude/hooks/guard-governed-enqueue.sh b/.claude/hooks/guard-governed-enqueue.sh
index 498ddc81bf..3c25d9cfbd 100755
--- a/.claude/hooks/guard-governed-enqueue.sh
+++ b/.claude/hooks/guard-governed-enqueue.sh
@@ -284,6 +284,31 @@ url_target() { # url_target <word> -> "owner repo pull" or empty
   printf '%s %s %s' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}"
 }
 
+# The `owner/repo` a checkout's `origin` names, or nothing. ONE reader with two
+# call sites — the bare `gh pr merge <n>` target derivation just below, and the
+# sibling admission rule further down — because the two inlined copies it
+# replaces agreed on a defect: the path character class owns `.` and is greedy,
+# so the optional `\(\.git\)` group matched EMPTY and
+# `https://github.com/objectstack-ai/cloud.git` read as the slug
+# `objectstack-ai/cloud.git`, which equals no `owner/repo` this guard is ever
+# asked about. A sibling cloned with the conventional URL therefore never
+# resolved, and a bare `gh pr merge <n>` in such a clone derived a slug the API
+# answers 404 for — this guard's fail-open, on the clone URL `git clone` hands
+# out by default.
+#
+# The suffix is stripped AFTER the match rather than carved out of the class:
+# the class still has to own `.` (a repository may legitimately be called
+# `objectstack.ai`), and which of the two the class-vs-group race gives it up to
+# is exactly the kind of thing GNU and BSD sed are free to disagree about. A
+# trailing `.git` is removed by the shell either way, and nothing legitimate is
+# lost with it — GitHub refuses a repository name that ends in `.git`.
+slug_of() { # slug_of <checkout dir> -> owner/repo, or empty
+  local slug
+  slug="$(git -C "$1" remote get-url origin 2>/dev/null \
+    | sed -n 's#.*github\.com[:/]\([A-Za-z0-9._-]*/[A-Za-z0-9._-]*\)/*$#\1#p')"
+  printf '%s' "${slug%.git}"
+}
+
 # The enqueue-class target one shell segment names, or nothing.
 segment_target() { # segment_target <segment> -> "owner repo pull" or empty
   local seg="$1"
@@ -354,8 +379,7 @@ segment_target() { # segment_target <segment> -> "owner repo pull" or empty
     return 1
   fi
   if [ -z "$slug" ]; then
-    slug="$(git -C "$repo_root" remote get-url origin 2>/dev/null || true)"
-    slug="$(printf '%s' "$slug" | sed -n 's#.*github\.com[:/]\([A-Za-z0-9._-]*/[A-Za-z0-9._-]*\)\(\.git\)\{0,1\}/*$#\1#p')"
+    slug="$(slug_of "$repo_root")"
   fi
   [ -n "$slug" ] || return 1
   printf '%s %s %s' "${slug%%/*}" "${slug#*/}" "$num"
@@ -473,8 +497,8 @@ done < "$work/files.txt"
 # has to be the target repo's own tree. Resolve a checkout whose origin actually
 # declares owner/repo — never audit one repo's paths against another's files.
 
-slug_of() { git -C "$1" remote get-url origin 2>/dev/null | sed -n 's#.*github\.com[:/]\([A-Za-z0-9._-]*/[A-Za-z0-9._-]*\)\(\.git\)\{0,1\}/*$#\1#p'; }
-
+# `slug_of` is defined once, up beside the Bash pass that shares it.
+#
 # WHERE a sibling is looked for is injectable (OS_GOVERNED_ENQUEUE_SIBLING_ROOT,
 # header); WHAT is accepted as one is not. The slug comparison below is the whole
 # admission rule and is untouched by it, so the variable can only move the

From 1696da61120962477c79ca917d28cb422331fda2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 16 Sep 2026 08:00:28 +0000
Subject: [PATCH 2/2] =?UTF-8?q?test(hooks):=20the=20ssh=20spellings=20own?=
 =?UTF-8?q?=20their=20premise=20=E2=80=94=20this=20box=20rewrites=20`git@g?=
 =?UTF-8?q?ithub.com:`=20to=20https?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`git remote get-url` honours `url.<base>.insteadOf`, and this container injects
one through `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_n`, so the two `git@github.com:`
rows were handed `https://github.com/…` and were second copies of the https
rows — green over a branch of the reader they never reached. Measured, not
assumed: with the injection unset the same remote reads back as the ssh URL.

Claude-Session: https://claude.ai/code/session_01Bz6hxDBqK62NP2W1LATvnt
Co-authored-by: Claude <noreply@anthropic.com>
---
 .claude/hooks/guard-governed-enqueue.selftest.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.claude/hooks/guard-governed-enqueue.selftest.sh b/.claude/hooks/guard-governed-enqueue.selftest.sh
index 81b686f34b..c3b54c7ee4 100755
--- a/.claude/hooks/guard-governed-enqueue.selftest.sh
+++ b/.claude/hooks/guard-governed-enqueue.selftest.sh
@@ -484,6 +484,17 @@ echo "== every spelling of that same origin URL resolves to that same sibling ==
 # `git init` plus an `origin`), so the register would be answering the identical
 # question about identical content — and the verdict still comes FROM the register
 # rather than from a word copied into this file.
+#
+# ⚠️ `-u GIT_CONFIG_COUNT -u GIT_CONFIG_PARAMETERS` is what makes the two
+# `git@github.com:` rows MEAN what they say, and it was measured here rather than
+# assumed: this container injects `url.https://github.com/.insteadOf
+# git@github.com:` through the environment, and the hook reads the origin with
+# `git remote get-url`, which HONOURS that rewrite — so without the unset git
+# hands the hook `https://…` and both ssh rows silently become second copies of
+# the https ones, green forever over a reader they never reach. A row whose
+# premise is a property of the box is the defect the cross-repo case above was
+# repaired for; these rows own theirs. On a machine that injects nothing, `env -u`
+# on an unset name is a no-op.
 spelling_n=0
 for spelling_url in \
   'https://github.com/objectstack-ai/cloud.git' \
@@ -498,6 +509,7 @@ for spelling_url in \
   git -C "$spelling_root/cloud" remote add origin "$spelling_url" >/dev/null 2>&1
   expect "$sibling_want" "origin $spelling_url resolves and is audited" \
     "$(mcp $AUTO 999 objectstack-ai cloud)" \
+    -u GIT_CONFIG_COUNT -u GIT_CONFIG_PARAMETERS \
     "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CROSS_REGEN" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$spelling_root"
 done