Repository navigation
Conversation
The shell-command-guard name was never published to npm, so the package moves to the shorter shell-guards with nothing to deprecate. Repository links follow the GitHub rename; GitHub redirects the old URLs.
shell-guards could tell whether a line runs `git commit`, but a caller that wanted to check the message still had to dig it out of the raw text with regexes, which miss `env`/`bash -c` wrappers and misread a heredoc that merely prints the words. The authorship-conventions hooks in bond did exactly that. The reader now keeps what it used to throw away: each here-document body is attached to the command it feeds, and each $(…) leaves an index to its source after its EXP marker. On top of that, `invocations(cmd, command)` lists every command a line certainly runs with its words as the shell passes them and its here-document or here-string stdin; a word that is one whole `$(cat <<'EOF' … EOF)` resolves to the body. `src/authorship.ts` builds the policy on it: `authoredMessages` reads commit `-m`/`-F -`/`--trailer` and `gh pr` title/body text, `branchNames` reads every way git creates or renames a branch, and `authorshipViolations` reports AI signatures, non-Conventional commit subjects and non-Conventional branch names. What the line does not show (an editor, an expansion) is not a violation; message files are read only through a caller-supplied `readFile`. deniedBy, runsCommand and commandSegments behave as before; the markers never leave the module. Verified: pnpm test (525 passed), pnpm typecheck, pnpm lint, publint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
invocations(cmd, command)lists every command a line certainly runs. For each one it gives the words as the shell passes them, with wrappers removed, and the stdin it reads from a here-document or here-string. A word that is one whole$(cat <<'EOF' … EOF)resolves to the here-document text.src/authorship.ts:authoredMessagesreads commit text from-m,-F -and--trailer, andgh prtitle, body and body-file text.branchNamescoverscheckout -b,switch -c,branch,branch -mandworktree add.aiSignatures,isConventionalCommit,isConventionalBranch,COMMIT_TYPESandBRANCH_TYPEShold the rules.authorshipViolationscombines all of the above. It ports the authorship-conventions logic from the bond plugin's hooks.$(…)leaves an index to its source.deniedBy,runsCommandandcommandSegmentsbehave as before (all 477 existing tests pass unchanged).Note: this branch is based on
docs/awesome-readme, so it also carries0c6a747 chore: rename package and repository to shell-guards. That commit was pushed after #3 merged and never reachedmain.Known gaps (found in review, not fixed here):
$'…'ANSI-C words are read as expansions, so a message spelled that way is not checked.git commitandgh pr …are read.git tag -m,git merge -mandgh issue commentare not.< file).Merge …andfixup! …subjects pass the Conventional Commit check.Test plan
pnpm test: 525 passedpnpm typecheck,pnpm lintand publint are clean/code-review high --fix: 10 findings, 5 fixed (signature glued to its flag, partial-msubject, prose false positive, unescaped custom types, README recipe that could fail open), 5 left as the gaps above