What
.claude/hooks/block-git-exec-vectors.py denies two classes of legitimate command.
Measured 2026-08-26 by feeding each command to the hook as a PreToolUse Bash payload:
| command |
verdict |
correct? |
git grep -eOK |
BLOCK |
no — -e takes an attached value, so the O is pattern text, not a flag |
git grep -A2 -B2 -nO |
BLOCK |
yes (real -O), listed for contrast |
heredoc body containing the line git grep -O runs a pager command |
BLOCK |
no — prose, not a command |
Attack coverage is intact; the same harness confirms git fetch --upload-pack=..., git fetch --upl=..., git ls-remote --u=..., git grep -lO/tmp/evil.sh, and true;git fetch --upload-pack=... are all still blocked, and ordinary git grep/git fetch/git ls-remote usage is allowed.
Why it happens
is_pager_short_bundle() tests "O" in token[1:], which cannot distinguish a flag character from the attached argument of a value-taking short flag (-e, -f, -m, and the numeric forms of -A/-B/-C).find_violations() tokenizes the whole Bash command string, so an unquoted heredoc body is scanned as if it were command tokens. This matters in this repo specifically, since the site's own prose discusses these flags.
Suggested fix
Stop scanning at the first << / <<- token, and in the short-bundle test walk the token left to right, stopping at the first value-taking short flag rather than testing for O anywhere in the token.
Not urgent — a false positive here is a recoverable deny, and the hook is the load-bearing half of the PR #60/#61 allowlist fix, so it should be narrowed rather than disabled.
What
.claude/hooks/block-git-exec-vectors.pydenies two classes of legitimate command.Measured 2026-08-26 by feeding each command to the hook as a
PreToolUseBashpayload:git grep -eOK-etakes an attached value, so theOis pattern text, not a flaggit grep -A2 -B2 -nO-O), listed for contrastgit grep -O runs a pager commandAttack coverage is intact; the same harness confirms
git fetch --upload-pack=...,git fetch --upl=...,git ls-remote --u=...,git grep -lO/tmp/evil.sh, andtrue;git fetch --upload-pack=...are all still blocked, and ordinarygit grep/git fetch/git ls-remoteusage is allowed.Why it happens
is_pager_short_bundle()tests"O" in token[1:], which cannot distinguish a flag character from the attached argument of a value-taking short flag (-e,-f,-m, and the numeric forms of-A/-B/-C).find_violations()tokenizes the wholeBashcommand string, so an unquoted heredoc body is scanned as if it were command tokens. This matters in this repo specifically, since the site's own prose discusses these flags.Suggested fix
Stop scanning at the first
<</<<-token, and in the short-bundle test walk the token left to right, stopping at the first value-taking short flag rather than testing forOanywhere in the token.Not urgent — a false positive here is a recoverable deny, and the hook is the load-bearing half of the PR #60/#61 allowlist fix, so it should be narrowed rather than disabled.