Fix cutover exec-stack recursion and provider block handling - #263
Conversation
runCutoverCommand spawned coding-ethos-run children (agent-hooks verify, policy-lint --scope cutover, git-hook validate) with the parent's full environment, so they inherited CODING_ETHOS_EXEC_STACK and exited 96 (recursive coding-ethos executable invocation blocked), failing every make cutover-verify and cutover-install run. Scrub the exec-guard stack variable before spawning, matching the other sanctioned spawn paths in mcp/cerun.go, gitwrap git_env.go, and agenthooks settings.go. Also scope the managed-lint target assertion in main_test.go to the argv after the -- separator: hook-managed sandboxes place go test TMPDIR under the repo, so temp paths in --bundle/--ethos-root flags legitimately contain the parent directory name and made the broad substring check fail.
… shapes hookcli returned exit 0 for blocked codex and gemini agent-hook results whenever --json output was enabled (regression from 0a32d43), so cutover-verify's codex raw git probe reported allow even though the command was blocked. Blocked provider results now exit with the blocked exit code regardless of output mode. The codex probe validators also encoded remediation shapes that never matched the live compiled bundle: stronger policies such as git.checkout_protected_branch win over git.wrapper_required, and the wrapper refusal path carries no cerun template. Probe validation is now split into shape-specific checks (strict wrapper+cerun for plain git, git.* block for protected-branch switch, wrapper refusal for raw-path/bash-c/python-subprocess, hard block for tamper).
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughSummary by CodeRabbit
WalkthroughRefactors Codex block-probe validation in agenthooks into scenario-specific validators, updates hookcli to always return a fixed blocked exit code, adds matching e2e fixture exit-code expectations, filters exec-guard stack env vars in cutover verification's child process environment, and scopes a lint test's substring assertion to extracted targets. ChangesCodex probe validation and blocked exit code consistency
Cutover Verify Exec-Guard Env Isolation
Lint Test Target-Scope Assertion Fix
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CLI as hookcli.runWithIO
participant Result as HookResult
participant Test as main_internal_test.go / e2e fixtures
CLI->>Result: check result.Blocked()
Result-->>CLI: true
CLI->>CLI: optionally printBlocked (if not --json)
CLI-->>Test: return blockedExitCode
Test->>Test: assert status/wantExit == blockedExitCode
Suggested reviewers: Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="[linter] gci: create analyzer: finding local modules for Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors Codex hook probe validation to use more specific validation helpers, simplifies hook CLI exit code logic to consistently return a blocked exit code, and updates associated tests. Additionally, it fixes a false positive in the managed lint tests by only inspecting targets after the "--" separator, and scrubs the execguard.EnvStack environment variable during cutover verification to prevent recursive self-blocking. There are no review comments, so no further feedback is provided.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
1 participant
Summary
This branch fixes two related runtime cutover failures in the hook/toolchain path:
CODING_ETHOS_EXEC_STACKbefore sanctioned cutover child process execution so verification children do not trip recursive executable invocation protection.Impact
make cutover-verifyand cutover install paths should no longer fail because child commands inherit the parent exec guard stack, and raw provider block probes should no longer report an allowed command when the policy result is blocked.Validation
git diff --check origin/main...HEADmake buildNotes
The local checkout still has unstaged
go.work.sumdrift from Go workspace checksum updates. The branch commits and remote comparison do not include module metadata changes, so that file was left out of this PR.