golem15/msd-core
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(#260): enforce worktree absolute-path safety via PreToolUse hook

Browse Source 
Closes #260

Moves the step-0b absolute-path guard from prose instructions to a harness-enforced PreToolUse hook (gsd-worktree-path-guard.js). Hard-blocks Edit/Write/MultiEdit calls whose absolute path resolves outside the active worktree root.
This commit is contained in:
Tom Boucher
2026-06-01 10:56:06 -04:00
committed by GitHub
parent 4332e1a5dd
commit faf329ecb9
10 changed files with 632 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/INVENTORY-MANIFEST.json
View File

@@ -355,7 +355,8 @@
"gsd-statusline.js",
"gsd-update-banner.js",
"gsd-validate-commit.sh",
"gsd-workflow-guard.js"
"gsd-workflow-guard.js",
"gsd-worktree-path-guard.js"
]
}
}

3
docs/INVENTORY.md
View File

@@ -455,7 +455,7 @@ Full listing: `get-shit-done/bin/lib/*.cjs`.
---
## Hooks (13 shipped)
## Hooks (14 shipped)
Full listing: `hooks/`.
@@ -470,6 +470,7 @@ Full listing: `hooks/`.
| `gsd-workflow-guard.js` | `PreToolUse` | Detects file edits outside GSD workflow context (advisory, opt-in) |
| `gsd-read-guard.js` | `PreToolUse` | Advisory guard preventing Edit/Write on unread files |
| `gsd-read-injection-scanner.js` | `PostToolUse` | Scans tool Read results for prompt-injection patterns (v1.36+, PR #2201) |
| `gsd-worktree-path-guard.js` | `PreToolUse` | Hard-blocks Edit/Write/MultiEdit with absolute paths outside the worktree root (PR #579, #260) |
| `gsd-session-state.sh` | `PostToolUse` | Session-state tracking for shell-based runtimes |
| `gsd-validate-commit.sh` | `PostToolUse` | Commit validation for conventional-commit enforcement |
| `gsd-phase-boundary.sh` | `PostToolUse` | Phase-boundary detection for workflow transitions |