idd-all Phase 0.5: fork detection 改 fail-closed (gh repo view 失敗時預設 PR mode)

[kiki830621]

Problem

From verification of #1 (P3 finding 15 — security reviewer):
Phase 0.5 fork detection 用:

IS_FORK=$(gh repo view "$GITHUB_REPO" --json isFork -q .isFork 2>/dev/null || echo "false")

這是 fail-open:gh repo view 失敗時(網路不通、auth 過期、API rate limit)IS_FORK 被設為 "false",違反 spec scenario「fork forces PR path regardless of config」。

結果: 真的在 fork 上 + gh repo view 暫時失敗 + pr_policy: never → 落到 direct-commit,user 無法 push 到 upstream,但 mode resolution 沒提示為什麼。

Type

fix / security defensive

Why P3 not P1

需要三個 condition 同時成立 (fork + gh failure + pr_policy=never) 才會 trigger,但發生時 user 經驗很差。

Recommendation

改 fail-closed (錯時預設 PR mode,因為 PR 是更保守選擇 — 至少 user 會看到明確錯誤而不是 silent direct-commit):

IS_FORK_OUTPUT=$(gh repo view "$GITHUB_REPO" --json isFork -q .isFork 2>&1)
GH_EXIT=$?

if [ $GH_EXIT -ne 0 ]; then
  echo "⚠ Could not query fork status (gh exit $GH_EXIT): $IS_FORK_OUTPUT"
  echo "  Defaulting to PR mode for safety. Pass --no-pr to override."
  IS_FORK="true"  # fail-closed
else
  IS_FORK="$IS_FORK_OUTPUT"
fi

或 abort 比 fall-through 還清楚:

abort "Could not determine if $GITHUB_REPO is a fork. Re-auth gh or pass --pr/--no-pr explicitly."

Source

• Verify FAIL on commit 98b7a71 (idd-all: 增加 HITL（attended）模式 — direct-commit + 允許 sub-skill AskUserQuestion #1)
• Security reviewer finding 2 (introduced)
• Master comment: idd-all: 增加 HITL（attended）模式 — direct-commit + 允許 sub-skill AskUserQuestion #1 (comment)

Related: #1

[kiki830621]

Closing Summary

Problem

Phase 0.5 fork detection 用 IS_FORK=$(gh repo view ... 2>/dev/null || echo "false") — fail-OPEN。當 gh repo view 失敗(網路、auth、API rate limit),IS_FORK 被設 "false",違反 spec scenario「fork forces PR path regardless of config」。

真在 fork 上 + gh 暫時失敗 + pr_policy: never → 落到 direct-commit,user commits 哪都 push 不出去(沒 upstream 寫權限),且 mode resolution 沒提示為什麼。

Root Cause

fail-open 對網路問題的容忍度錯了方向 — 應該 fail-closed:不確定狀態下選更保守(PR mode),讓 user 看到明確 warning + override hatch。

Solution

捕捉 gh repo view exit code,失敗時:

echo "⚠ Could not query fork status (gh exit $IS_FORK_EXIT): $IS_FORK_RAW"
echo "  Defaulting to PR mode for safety. Pass --no-pr to override."
IS_FORK="true"

User 看到 warning 知道發生什麼;若真不是 fork 想 direct-commit,顯式 --no-pr override。

Verification

Smoke test Case C(fork=true + pr_policy=never)仍 PASS — gh 成功時行為不變。Failure path 改 fail-closed 在 gh 失敗時可手動測。

Changes

• a7a4e5e fix: idd-all/idd-issue P2/P3 follow-up batch (Refs idd-all: direct-commit mode 加 passive warning (dirty tree / on default branch) #2 idd-all SKILL.md: pseudocode quality (goto bash / branch-exists no-op / stale Failure Modes table) #3 idd-all Phase 4: ${MAX_ROUND} substitution missing in abort message #4 idd-all Phase 0.5: fork detection 改 fail-closed (gh repo view 失敗時預設 PR mode) #5 idd-all SLUG derivation: BSD/GNU sed alternation (\| not portable) #6 idd-all Phase 5: PR body heredoc 改 quoted (預防未來 RCE) #7 idd-all Phase 0.2: GITHUB_REPO post-derive shape assertion #8 idd-issue Step 2: 強制 sanitize incoming title (length cap / strip control chars) #9 idd-all Examples: 跨 repo invocation 段重複描述,合併 #10)