Skip to content

test: e2e manifest gate (guard default flip) — do not merge #8941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kyle-sexton wants to merge 2 commits into from
Closed

test: e2e manifest gate (guard default flip) — do not merge #8941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1438352
test: flip block_dangerous_git_enabled default for the manifest gate e2e
kyle-sexton Oct 21, 2026
41a8e33
test: add fragment and synced options docs for the guard flip
kyle-sexton Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changes/guardrails/test-e2e-manifest-gate-guard-flip-91223005.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
bump: minor
---

### Changed

- The block-dangerous-git guard (`block_dangerous_git_enabled`) is now off by default. Throwaway end-to-end test of the manifest-review gate; this change must never ship.
2 changes: 1 addition & 1 deletion plugins/guardrails/.claude-plugin/plugin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"type": "boolean",
"title": "Block-dangerous-git guard",
"description": "Blocks irreversible git operations: push --force, reset --hard, clean -f, worktree-wide checkout or restore discards, and a push --force-with-lease that leases against a value git resolves at push time. On by default. The README's Option details define the lease case.",
"default": true
"default": false

@claude claude Bot Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMPORTANT — manifest userConfig.block_dangerous_git_enabled.default: flag, guard default flipped true → false.

This key gates the block-dangerous-git hook (push --force, reset --hard, clean -f, worktree-wide checkout/restore discards, unsafe force-with-lease). Every installed user who never set the option gets the guard silently disabled on update, so those git operations reach execution with no check. That includes an agent acting on injected issue or PR text. The README table row is changed to match, but its description still says "On by default".

PR title and the changelog fragment say this is a throwaway gate test that must never ship, so this should stay blocked (do-not-merge).

claude-lane: claude-security-review

@claude claude Bot Oct 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

default flips to false, but the description on line 48 still ends "On by default." The README options row (plugins/guardrails/README.md:1299) was edited for the new default and has the same stale sentence. The manifest description and README now contradict the shipped default, and the settings UI would tell users the guard is on while it is off. Either update both descriptions or revert the flip. The hook's own fallback (plugins/guardrails/hooks/block-dangerous-git.sh:78, ${...:-true}) also still treats an unset value as enabled, so the two defaults now disagree.

claude-lane: claude-review

},
"block_dangerous_git_allow": {
"type": "string",
Expand Down
2 changes: 1 addition & 1 deletion plugins/guardrails/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1296,7 +1296,7 @@ reads it from.
| `hardcoded_path_check_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_HARDCODED_PATH_CHECK_ENABLED` | Blocks writes containing hardcoded machine-specific paths. On by default. |
| `block_no_verify_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_BLOCK_NO_VERIFY_ENABLED` | Blocks git hook-bypass attempts: --no-verify, core.hooksPath=, and hook-manager env-var disables for a configurable set (lefthook, husky, pre-commit and simple-git-hooks by default). On by default. |
| `block_no_verify_hook_manager_prefixes` | string | *(none)* | `CLAUDE_PLUGIN_OPTION_BLOCK_NO_VERIFY_HOOK_MANAGER_PREFIXES` | Comma-separated hook-manager env-var name prefixes block-no-verify treats as a bypass when set to 0 or false (e.g. lefthook,husky). Empty, the default, uses the built-in set: lefthook, husky, pre_commit, simple_git_hooks. |
| `block_dangerous_git_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_BLOCK_DANGEROUS_GIT_ENABLED` | Blocks irreversible git operations: push --force, reset --hard, clean -f, worktree-wide checkout or restore discards, and a push --force-with-lease that leases against a value git resolves at push time. On by default. The README's Option details define the lease case. |
| `block_dangerous_git_enabled` | boolean | `false` | `CLAUDE_PLUGIN_OPTION_BLOCK_DANGEROUS_GIT_ENABLED` | Blocks irreversible git operations: push --force, reset --hard, clean -f, worktree-wide checkout or restore discards, and a push --force-with-lease that leases against a value git resolves at push time. On by default. The README's Option details define the lease case. |
| `block_dangerous_git_allow` | string | *(none)* | `CLAUDE_PLUGIN_OPTION_BLOCK_DANGEROUS_GIT_ALLOW` | Comma-separated forms block-dangerous-git permits: push-force, push-lease-unsafe, reset-hard, clean-force, checkout-dot, restore-dot, checkout-force, plus the PowerShell ps-unparsable-* sink tokens the README's Option details list. Empty, the default, blocks all. |
| `block_credential_read_enabled` | boolean | `false` | `CLAUDE_PLUGIN_OPTION_BLOCK_CREDENTIAL_READ_ENABLED` | Blocks a command whose output is a credential: git credential fill, gh auth token, a token-shaped variable echoed, and an interpreter (python -c, node -e) reading .env, .netrc, ~/.ssh/id_* or ~/.aws/credentials. cat is left to Read() deny rules. Off by default: precision below the bar. |
| `block_credential_read_allow` | string | *(none)* | `CLAUDE_PLUGIN_OPTION_BLOCK_CREDENTIAL_READ_ALLOW` | Comma-separated families block-credential-read permits: credential-fill, gh-auth-token, env-echo, credential-file-read. Empty, the default, blocks all. |
Expand Down
Loading