From 9f7844ad6c389aab1a016ada09226ef60319c104 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Sat, 31 Oct 2026 17:16:25 +0100 Subject: [PATCH] fix(democracy): ignore heavy commands inside quotes and heredocs in the block hook Co-Authored-By: Claude Opus 5.5 (1M context) --- skills/democracy/scripts/watch.py | 10 +++++++++- tests/test_watch.py | 18 ++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/skills/democracy/scripts/watch.py b/skills/democracy/scripts/watch.py index 1a4a227..e62243d 100755 --- a/skills/democracy/scripts/watch.py +++ b/skills/democracy/scripts/watch.py @@ -208,9 +208,17 @@ def cmd_watch(cfg: dict) -> int: return 0 +HEREDOC = re.compile(r"<<-?\s*(['\"]?)(\w+)\1[^\n]*\n.*?\n\s*\2(?=\s|\)|$)", re.DOTALL) +QUOTED = re.compile(r"'[^']*'|\"(?:\\.|[^\"\\])*\"") + + +def executable_text(command: str) -> str: + return QUOTED.sub("''", HEREDOC.sub("", command)) + + def cmd_block(cfg: dict) -> int: payload = json.load(sys.stdin) - command = (payload.get("tool_input") or {}).get("command", "") + command = executable_text((payload.get("tool_input") or {}).get("command", "")) stage = read_json(STATE).get("stage", "ok") if stage not in ("stop", "critical"): return 0 diff --git a/tests/test_watch.py b/tests/test_watch.py index d300106..1cacc33 100644 --- a/tests/test_watch.py +++ b/tests/test_watch.py @@ -105,6 +105,24 @@ class TestWatchCommands(unittest.TestCase): self._stage("warn") self.assertEqual(self._run("block", stdin=self._bash("make compose-deploy")).returncode, 0) + def test_block_ignores_heavy_words_inside_quotes_and_heredocs(self): + self.cfg["heavy_commands"] = [r"\bmake\s+(-C\s+\S+\s+)?(compose-deploy|test|swarm-\S+)(\s|$)"] + self._write_config() + self._stage("stop") + message = "$(cat <<'EOF'\nfix: run \"make test\" and make swarm-zombie\nEOF\n)" + for command in ( + 'git commit --no-verify -m "fix: passes the vars to make swarm-zombie app=x"', + "grep -n 'make test' Makefile", + f'git commit --no-verify -m "{message}"', + ): + self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 0, command) + for command in ( + "make -C x swarm-zombie app=y", + "env FOO=1 make swarm-zombie", + 'make compose-deploy apps="web-app-x"', + ): + self.assertEqual(self._run("block", stdin=self._bash(command)).returncode, 2, command) + def test_admit_keeps_the_stop_floor(self): self.cfg["thresholds_gb"] = {"warn": 0, "stop": 0, "critical": 0} self._write_config()