verb.go: attach WithReason at policy_denied + scope_unresolved sites #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-17T22:35:04Z - https://github.com/coilysiren/cli-guard/issues/72
Follow-up to coilysiren/cli-guard#60 / coilysiren/coily#168.
Two
exitcode.New(...)sites inverb/verb.goare still missing.WithReason(...)chains, which forces consumers (coily) to keep a fallback why-line map alongside the constructor:verb/verb.go:145andverb/verb.go:151-policy_deniedfrom the shell-metacharacter gate.verb/verb.go:160-scope_unresolvedwhen buildBaseRecord cannot resolve a commit scope.Both kinds are high-frequency denials with well-known invariant-shaped reason strings. Today coily carries those reason strings in
cmd/coily/denial_reason.goand looks them up by kind inemitErrorEnvelopeas a fallback aftererrors.As(err, &exitcode.Reasoner). Once these sites chain.WithReason(...), the coily-side map can disappear entirely.Fix - Add
.WithReason(...)to the three sites with the reason strings currently stored in coily's denial_reason.go:policy_denied: "policy gate caught a shell metacharacter in argv; the gate exists because some downstream verbs (tailscale ssh, aws ssm send-command) ship argv into a remote shell, and a per-tool toggle can't tell those verbs apart from the safe ones. Workarounds for the high-volume cases: --body 'markdown' -> --body-file /tmp/body.md (gh native); --change-batch '{...}' -> --change-batch file:///tmp/batch.json (aws native); --jq '...' -> external pipe (coily ops gh api X | jq '...') or coily-side --jq-file /tmp/q.jq"scope_unresolved: "every audit row binds to a real commit scope; --commit-scope is the explicit hand-off when cwd cannot resolve one"After it lands - bump coily's cli-guard ref, delete
cmd/coily/denial_reason.go+ its test, drop the fallback branch inemitErrorEnvelope.