Skip to content

fix: enforce required gstack across Claude Code and Copilot#2229

Open
time-attack wants to merge 6 commits into
garrytan:mainfrom
time-attack:required-team-enforcement
Open

fix: enforce required gstack across Claude Code and Copilot#2229
time-attack wants to merge 6 commits into
garrytan:mainfrom
time-attack:required-team-enforcement

Conversation

@time-attack

Copy link
Copy Markdown

A project could say gstack was required but Copilot could still open a skill when gstack was missing. The official main branch reproduces this today.

Now Claude Code and Copilot stop the skill and explain how to install gstack. When gstack is installed, the skill opens normally.

What changed

  • Replace the shell-specific check with one cross-platform check.
  • Handle Claude Code’s Skill name and Copilot’s lowercase skill name.
  • Return the denial format understood by both runners.
  • Stop safely when the installation or project directory cannot be checked.
  • Migrate projects away from the old shell-specific check.
  • Explain the behavior in plain English in the README.

Real-runner verification

Using Copilot CLI 1.0.70 with gstack deliberately absent:

  • Official main: the protected skill loaded and returned RUNNER_SKILL_EXECUTED.
  • This branch: the skill returned success: false, code: denied, and never executed.

Both CLI processes exited 0, so verification used the actual tool result and execution token rather than the process exit code.

Live repository gate

The identical probe failed on official main and passed with this branch:

  • miru-web: fail → pass
  • gbrain: fail → pass
  • zotero-arxiv-daily: fail → pass
  • plane: fail → pass
  • twenty: fail → pass

Secondary checks

  • Required-team tests: 33 passed, 0 failed
  • Shell syntax: passed
  • Diff check: passed
  • Windows-safe suite reached one unrelated browser terminal test failure. The exact test fails identically on official main and this branch: 18 passed, 1 failed.

No version or release files changed.

This directly supersedes #2217 with the combined fix and real-runner verification.

neallee2012 and others added 6 commits July 10, 2026 19:56
Generate one Node CommonJS enforcement hook, fail closed when project context or the global install cannot be verified, and cover cmd and PowerShell execution paths.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Catch project hook resolution and load failures in the cross-shell Node launcher, returning a sanitized structured denial instead of a module-loader error.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@trunk-io

trunk-io Bot commented Jul 10, 2026

Copy link
Copy Markdown

Merging to main in this repository is managed by Trunk.

  • To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants