You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Dual-host git-hook shims fail open when one plugin is uninstalled #265
Dual-host git-hook shims fail open when one plugin is uninstalled
Codex multi-host support (ADR-0011). Code under review is on branch feat/codex-support-m0, not main. ca-codex ships BETA; these are blocking-severity for the affected code but nothing is merged to the default branch yet.
(reliability-009) The pre-commit/pre-push shim embeds the ABSOLUTE enforcer path of whichever plugin last ran SessionStart (E="{enforcer}" from _enforcer_path() = this vendored copy's dir), and the shim is deliberately fail-open when that file is missing: [ -f "$E" ] || exit 0. With ca and ca-codex both installed against one repo, every alternation of host rewrites both shims (plus the .git/codearbiter-hooksd
(reliability-009 impact) A window (potentially long, e.g. Codex-was-last-used then only git CLI is used) where the [P1] Shell indirection bypasses pre-bash commit, push, staging, and security gates #161 git-level enforcement backstop is silently unwired for BOTH hosts after removing ONE plugin. The single-plugin fail-open was an accepted 'our OWN staleness' trade; dual-host widens it to a cross-plugin dep
Recommendation:
The pre-commit/pre-push shim embeds the last-writing plugin's absolute enforcer path and is fail-open when it is missing. Make the shim resolve either installed plugin's enforcer, or fail closed, so removing the BETA ca-codex does not silently unwire the git-level backstop for both hosts.
Acceptance criteria:
Uninstalling one of two installed plugins leaves the git-level enforcement wired to the survivor, or the commit is blocked, not passed.
Resolved as accept-risk (see PR). The clean fix is not safely achievable — ca and ca-codex have separate, independently-versioned plugin cache roots, so the surviving plugin's enforcer path can't be derived at shim-write time, and a runtime filesystem search inside the git shell shim (Git-Bash included) would be a fragile git-level backstop, not worth it for a LOW finding. Documented the residual in-code instead. Revisit if/when Codex's cache layout is stable and documented. Keeping open for your call on the acceptance.
Dual-host git-hook shims fail open when one plugin is uninstalled
Severity: low | Confidence: 0.75 | Group: githook-shim-crossplugin
Where:
core/pysrc/_githooks.py:122-137core/pysrc/_githooks.py:297-372core/pysrc/session-start.py:570-576Evidence / impact:
E="{enforcer}"from_enforcer_path()= this vendored copy's dir), and the shim is deliberately fail-open when that file is missing:[ -f "$E" ] || exit 0. With ca and ca-codex both installed against one repo, every alternation of host rewrites both shims (plus the .git/codearbiter-hooksdRecommendation:
The pre-commit/pre-push shim embeds the last-writing plugin's absolute enforcer path and is fail-open when it is missing. Make the shim resolve either installed plugin's enforcer, or fail closed, so removing the BETA ca-codex does not silently unwire the git-level backstop for both hosts.
Acceptance criteria: