fallback hook: ask surfaces to the harness, unknown verdicts fail closed - #14
Merged
Conversation
The embedded govern.mjs fallback handled deny only — an ask verdict (or any decision value it didn't recognize) silently allowed the call, the same fell-open class the gateway's step_up→deny change closed for the canonical hook. ask now emits permissionDecision:"ask" (deny for codex, which has no ask primitive, matching the canonical hook's mapping); unrecognized decisions deny with a re-run-the-installer reason. Cloud verdict handling gets its first tests: a stub gateway drives the exact heredoc bytes through allow/deny/ask/codex-ask/unknown. Refs gatewaystack-connect#718, #597.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The embedded
govern.mjsfallback (written when the installer can't fetch the canonical plugin hook) handleddenyonly. Anaskverdict — and any decision value it didn't recognize — silently allowed the tool call: the same fell-open class the gateway's step_up→deny change closed for the canonical hook.ask→ emitspermissionDecision:"ask"with the approval reason; forACP_CLIENT=codex(no ask primitive) it denies instead, matching the canonical hook's mappingTests
New
test/govern-cloud-verdicts.test.mjs— the first coverage of the fallback's cloud path: extracts the exact heredoc bytes, runs them against a local stub gateway returning canned verdicts (async spawn so the stub can actually respond), asserts allow/deny/ask/codex-ask/unknown. Verified red on the unfixed heredoc (3/5 fail), 46/46 across the whole suite with the fix.One meta-note for the backlog: writing this test through governed tooling PII-redacted the literal loopback IP (one-two-seven dot zero dot zero dot one) inside the file into an invalid host — the test now assembles it from octets. Loopback/RFC1918 addresses in code files are a transform false-positive class worth excluding.
Refs gatewaystack-connect#718, gatewaystack-connect#597.
🤖 Generated with Claude Code