golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(#3504): harden hook injection patterns and force-add guard (#3510)

Browse Source 
* test(#3504): add failing-first parity, fail-closed, and bypass suites

* fix(#3504): harden hook injection patterns and force-add guard

* test(#3504): stage the scanner lib dependency in shared-hooks fixture

* chore(#3504): backfill changeset pr number

* test(#3504): build parity samples from fragments for the ci scan

---------

Co-authored-by: sim <sim@local>
This commit is contained in:
Tom Boucher
2026-08-14 21:19:35 -04:00
committed by GitHub
parent e57918a648
commit 268ca7e32d
24 changed files with 659 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/nimble-jaguars-tumble.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Security
pr: 3510
---
**Hook security hardening — shared injection patterns + fail-closed force-add guard** — the prompt-injection pattern list is now one shared module used by both the write-guard and the read-scanner hooks, so the two surfaces can no longer silently drift apart; and the opt-in workflow guard's force-add block on agent branches now fails closed on internal error instead of silently allowing. (#3504)