Repository navigation
Elon gate: also gate gh create inside subshells and command substitution #252
Description
What: The Elon gate also checks gh issue|pr create run inside a subshell, command substitution or backticks.
Why: gh_create() only matches a bare gh word, so (gh issue create …), $(gh issue create …) and the backtick form create an Issue or PR with no Elon record and no block.
So what: Small fix for an implementation worker after #250 merges; independent review; Luke approves the merge.
Outcome
A wrapped gh issue|pr create is gated exactly like a bare one.
Evidence
- Installed AgentsMD 17.4.1 on bestia, hook run as the tests do (
bin/project-direction hook --host claude, PreToolUse Bash input), 2026-10-19:gh issue create --title x --body helloexits 2 (blocked);(gh issue create --title x --body hello)andecho $(gh issue create --title x --body hello)exit 0. - Found by the Muse Spark 1.3 round-2 review of PR fix: let gh create help through the Elon gate #250 (Elon gate: let gh issue|pr create --help through #247), noted as pre-existing and out of that Issue's scope; same class as the
newalias gap in Elon gate: also gate gh issue new and gh pr new #251.
Contribution to the Objective: the Elon record exists on every Issue and PR it is meant to cover.
Elon record
- Requirements and who asked: Luke's rule that every Issue and PR carries an Elon record, enforced by the hook; gap found during the 2026-10-19 review follow-up.
- Deleted: a general shell interpreter; only the wrapped forms that run
gh(subshell,$(...), backticks, and nesting of these) are in scope. - Bottleneck: word matching in
gh_create()and segment splitting inshell_segments(). - Checked myself: the three hook runs above.
Acceptance criteria
-
(gh issue create …),$(gh issue create …),`gh issue create …`andgh prequivalents are gated like the bare form, including the Elon gate: let gh issue|pr create --help through #247 help exemption. - Quoted text that merely contains
$(gh issue create …)as data (for example inside a single-quoted body) is not treated as a command. - Regression tests cover each form.
Non-goals
- Other gate changes; the
newalias is Elon gate: also gate gh issue new and gh pr new #251.
Blockers
Build on PR #250 (#247), which rewrote the segment parser; start after it merges.
Required proof
- Tests failing before and passing after; full suite; independent review on the exact head; version transition per repository policy.
Activity
lukemaj commentedon Oct 19, 2026
Two more word forms the gate does not recognize as a create, found by Grok in the PR #250 round-4 review (pre-existing on main ce17c3b): brace expansion
{gh,} issue create --title x --body helloand ANSI-C quotinggh $'issue' create --title x --body hello; both exit 0 at the hook while bash runs a real create. Same class as the subshell forms; include them in this Issue's acceptance.lukemaj commentedon Oct 19, 2026
More forms from the Muse round-4 review of PR #250 (pre-existing on main):
sh -c 'gh issue create …'and an$IFS-split create (no--help) also pass the gate (exit 0) while creating. Include them in this Issue's scope.lukemaj commentedon Oct 19, 2026
What: Implemented together in #257 at
6ea958a7439c25a388ee7161def506b3f1dfd8a8.Why: Raw fail-closed checks cover alias and wrapped/dynamic recognition gaps before body extraction can authorize a hidden create.
So what: Deterministic proof is complete; independent review remains pending, with no reviewers started, before Luke approves merge.
Proof and the Elon record are in the PR: 148 failing-before assertions; real Bash with fake-gh argv logs; 468 repository tests and 7 versionctl tests passed; doctor and release-check passed; version 17.4.3 prepared and pushed. The PR documents accepted data false positives and the separate-body-file workaround. Zsh execution is unverified because Zsh is absent on bestia. No merge, release, tag or install performed.
lukemaj commentedon Oct 19, 2026
What: Revised implementation is pushed in #257 at
50b82dc12676156c995b350b7207cc3a25d23c50.Why: Confident single wrappers now receive their own normal record check, and literal commit/echo/printf text remains data; dynamic or nested execution still fails closed.
So what: All deterministic proof passes; independent review is pending, with no reviewers started, before Luke approves merge.
473 repository tests and 7 versionctl tests pass on the exact head; doctor and release-check pass. Version remains the PR's one 17.4.3 transition. The PR body documents the remaining exact data false positives and Zsh execution gap. Observer was republished as an explicitly session-scoped report after a default-ledger failure, tracked at toolboxmd/agent-observer#140. No merge, release, tag or install.
Proof correction: the earlier claim of 148 copied-baseline failures was a runner setup error because the sibling Python module was omitted. The corrected runner copies both files from each exact revision: current selected regressions produce 143 genuine bypass failures against original main
15b1dd5(exit 0 instead of 2), and 124 genuine overblocking failures against prior PR head6ea958a(exit 2 instead of 0). Both corrected runs have zero errors and no import failures; their results supersede that earlier count.lukemaj commentedon Oct 19, 2026
Scope narrowed after the PR #257 round-1 review (coordinator decision, reversible): the gate parses and record-checks wrapped creates it can see (
$( ), backticks,( ),sh|bash|zsh -c '<literal>', heredoc or here-string text fed to a shell). Adversarial forms it cannot see from the command text (evalof variables, split variables /$IFS, brace expansion, functions, aliases, scripts written then run) become documented limits rather than blocks, because the raw-text blocking needed to catch them blocked ordinary Markdown PR bodies and read-only searches. Agents trip the gate by accident, not by evasion.