security: add pre-commit hook that rejects staged files containing merge-conflict markers #39
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Source: background security review on coilysiren/agent-guard during a stash-pop conflict that surfaced raw merge-conflict markers (
<<<<<<<,=======,>>>>>>>) inside.claude/lockdown-deny.shuntil coily lockdown regenerated the file.Finding (MEDIUM, Agent/Subprocess Permission Bypass): A conflicted security-config file is risky to commit. Conflict markers are not valid shell, so a script-style file like
lockdown-deny.shwould silently break at the next invocation. The current case resolved cleanly because the file is auto-generated, but the class of bug stands.Suggested fix: Add a pre-commit hook (or extend an existing one in
coilysiren/agentic-os/scripts/) that fails on staged files containing conflict markers. One-liner shape:Wire it into the cross-repo pre-commit suite alongside
catalog-doc-size,documentation-layout, etc. Catches conflict markers in any tracked file, not just.claude/.Why agentic-os, not consumer repos: the existing pre-commit suite rolls out from
coilysiren/agentic-osto every catalog repo, so the fix lands once and propagates.