Repository navigation
fix(settings): restore git -c and git switch force guards - #3
Merged
Merged
Conversation
git -c key=value can override config to route around the other rules, and git switch --discard-changes / -f destroy uncommitted work the same way the already-denied checkout, restore and clean do. These were dropped on the mistaken belief that git -c* also blocked git switch -c. Verified it does not: the earlier block came from the old blanket git switch* entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An automated security review flagged two deny-list entries dropped in #2. Both flags are valid.
What was wrong
Bash(git -c*)andBash(git switch --discard-changes*)/Bash(git switch -f*)were removed in #2 on the belief thatgit -c*was also blockinggit switch -c <branch>, which the agent needs for normal branch creation.That diagnosis was wrong. The block came from the old blanket
Bash(git switch*)entry onmain, which briefly came back into effect when a--delete-branchcheckout swapped the working tree back tomain. Verified by restoring the entries and running both commands:git switch mainandgit switch -c probe-delete-meeach succeed withBash(git -c*)in place.What this restores
Bash(git -c*)—git -c key=value <cmd>can override config to route around the other rules.Bash(git switch --discard-changes*),Bash(git switch -f*),Bash(git switch --force*)— these destroy uncommitted work exactly as the already-deniedcheckout,restore, andcleando.Deny list goes from 33 to 37 entries. Nothing else changes.