garrytan / garrytan/gstack

/careful hook triggers false positives on patterns inside commit messages

Open
#1,060 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
133k
Forks
19.9k
Avg merge
18h 46m
Merged PRs (30d)
26

Description

## Summary

The `/careful` hook uses string matching against the full bash command, including the contents of `git commit -m` arguments. This means commit messages that *describe* destructive commands (e.g., "this hook catches recursive deletes and database drops") trigger the safety warning even though no destructive command is being run.

## Steps to reproduce

1. Activate `/careful`
2. Run a commit whose message mentions a blocked pattern:

```bash
git add file.txt && git commit -m "feat: add guard for recursive delete and database drop patterns"
```

3. The hook fires on patterns found inside the quoted commit message string, not as an actual command.

## Expected behavior

The hook should only match destructive patterns in the executable portions of the command, not inside string arguments to `git commit -m`, `echo`, `printf`, or heredoc bodies.

## Suggested fix

Before pattern matching, split the command on shell operators (`&&`, `||`, `;`), then skip any segment that starts with `git commit`, `echo`, `cat`, or `printf` since those are producing text output, not executing destructive operations.

Found this while building a similar hook inspired by gstack's `/careful` approach. Happy to submit a PR if useful.

Contributor guide

Open the contributing guide

Research direction

Start at the /careful hook entry point and reproduce the provided git commit command, then trace how the full bash command is split and matched. Done means destructive patterns in git commit -m, echo, printf, and heredoc text no longer trigger warnings, while patterns in executable command portions still do.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, git, typescript
Domain
cli, security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.