Repository navigation
Match the Guard's Model Alias Boundaries Regardless of Case - #3525
Conversation
The alias inside a workflow script's model value was matched ignoring case while its boundaries excluded only lowercase letters, so a value such as `fableX` or `Xfable` matched `fable` and was denied. Both boundaries now exclude any ASCII letter or digit, and a test covers the uppercase-adjacent values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
A recorded local strict-review pass covers head |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
There was a problem hiding this comment.
🟢 Approval recommended
No unresolved review issues remain, and the changes have complete regression coverage.
No open issues 🎉
What changed in this PR
This pull request fixes case-insensitive model-alias boundary matching in the Claude Code model-tier guard, preventing aliases from matching within longer ASCII alphanumeric model names.
Changes:
- Expands alias boundaries to exclude uppercase and lowercase letters, plus digits.
- Adds regression tests for mixed-case blocked model IDs.
- Adds coverage for valid names containing the alias as part of a longer value.
| File | Description |
|---|---|
host-setup/agent-safety/claude/test_model_tier_guard.py |
Adds tests for mixed-case denial and alphanumeric containment boundaries. |
host-setup/agent-safety/claude/model-tier-guard.py |
Updates model-alias boundary matching to exclude all ASCII letters and digits. |
Review effort: Lite
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3525 +/- ##
========================================
Coverage 81.56% 81.56%
========================================
Files 26 26
Lines 8970 8970
========================================
Hits 7316 7316
Misses 1654 1654
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…ain (#3521) ## Summary This promotes three changes to `main`: - [#3516](#3516) maps model tiers in one config, `spec/model-tiers.json`, carries the "Model Tiers" rule into the skills that dispatch, and adds a guard that refuses a highest-tier dispatch the maintainer did not allow. - [#3518](#3518) has the agent-safety installer's hooks share one registration helper. - [#3520](#3520) has those hooks share one registration-check loop. It also carries the fixes for this promotion's own review findings, each landed on `develop` first: - [#3522](#3522) requires a non-empty model name per tier and names both edits a model release makes. - [#3523](#3523) states what the highest-tier allowance covers and where the guard stops. - [#3524](#3524) rejects a tier sharing the maintainer-only model and states the allowance as conduct. - [#3525](#3525) matches the guard's alias boundaries regardless of case. - [#3526](#3526) mirrors the guard's CI self-tests in the local runbook. - [#3527](#3527) rejects a repeated tier name and names every hook the installer registers. Closes #3517 Closes #3519 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Summary
This answers a fourth-round review finding on the promotion pull request #3521. The model-tier guard's
names_model()matched the blocked alias inside a workflow script's model value ignoring case, but its boundaries excluded only lowercase letters. SofableXorXfablematchedfable, and a workflow naming either was denied. Both boundaries now exclude any ASCII letter or digit.The tests now deny a mixed-case
claude-Fable-5-1, which holds the case-insensitive half of the match. They also allowfableX,Xfable, andFABLEX, each of which the old boundary denied.🤖 Generated with Claude Code