guard-shared-stash.sh has the same split_segments() backslash fail-open that #11131 closed in the bash checkout guard

[yinlianghui-tw]

Filed by the domain:devx @ objectui execution PM seat (objectui#5748, PM session session_019b5UBNMtTzKbVtZZGvFuxe) as the cross-repo sibling of objectui#6042, per the follow-up duty that the accepting seat files the other repo's card.

Surfaced while porting the guard-main-checkout-bash.sh fix family (#11131 + #11133 + #11234, PR #11278) into objectui (objectui#5789 / PR objectui#6046). It was correctly not folded into that port — a verbatim port must not touch other hooks.

The observation

.claude/hooks/guard-shared-stash.sh's split_segments() has no backslash branch.

Outside quotes, a backslash escapes the next character, so an escaped backslash-doublequote opens no quoted region at all. Without that branch the pass reads the doublequote as opening a region that never closes, goes inert for every separator behind it, and collapses the whole command into one segment whose head word is the harmless one — leaving the real command behind the separator to be read as a mere argument of echo.

This is exactly the shape #11131 closed in guard-main-checkout-bash.sh. tokenize() already had the branch; split_segments() did not. The same asymmetry exists here.

Measured

Measured in objectui's copy (ad0f5f11f), fed as the PreToolUse payload shape ({cwd, tool_name:"Bash", tool_input:{command}}):

command	verdict
git stash	blocked — control: the guard works
echo backslash-doublequote, then ;, then git stash	ALLOWED — the hole

The control is load-bearing: without it, "ALLOWED" could mean the harness never reached the guard rather than that the guard let it past.

⚠️ What is measured and what is inferred, stated separately. The reading above was taken against objectui's copy. The dev's report states the defect is present in both repos' copies, on the strength of the two files being declared case-for-case identical in this region. This repo's copy has not been independently probed — that is the first thing whoever takes this card should do, rather than trusting the parity declaration. If it does not reproduce here, that is itself a finding: it would mean the two copies have diverged where they are declared not to have.

Scope — only one of the two upstream fixes has an analogue

• The [finding] guard-main-checkout-bash.sh: an unquoted backslash still makes tokenize() and split_segments() disagree, and a real sed -i into the shared checkout is allowed through #11131 backslash half applies.
• The [finding] guard-main-checkout-bash.sh: a heredoc introducer NAMED inside a comment makes strip_heredocs() swallow the real commands after it #11133 comment-heredoc half does NOT — guard-shared-stash.sh has no strip_heredocs() pass to carry that defect. Do not port it looking for a place to put it.

Why this is worth a card rather than a note

guard-shared-stash.sh is the enforcement behind the ⛔ Never git stash Prime Directive. That rule exists because refs/stash lives in the common .git directory, so every worktree of a repo shares one LIFO stack: two agents stashing in their own worktrees push and pop the same stack, pop reports success, and the only symptom is another agent's files turning up in your git status — after which a git add -A merges their work into your PR. It has already cost two parallel agents their in-flight changes (objectui#3430).

So a fail-open here does not merely admit a discouraged command. It admits the one command whose failure mode silently corrupts a different agent's work, with a success message. The rule outranks the hook, so this is a backstop gap rather than a live breach — but the backstop exists precisely for the agent who does not know the rule.

Suggested fix

Port the split_segments() backslash branch from guard-main-checkout-bash.sh (as landed in #11278) into guard-shared-stash.sh, and add the matching cases to .claude/hooks/guard-shared-stash.selftest.sh — that file's own instruction is to re-run the selftest on any change to the hook.

Keep the two repos' copies in step: fix both with the same patch shape, or the declared parity contract is broken by the fix itself.

⚠️ .claude/** is a governed surface — draft PR, human merge.

Filed unassigned; domain:* and grading are the triage seat's to set.

Refs: #11131 · #11133 · #11234 · PR #11278 · objectui#6042 (sibling) · objectui#5789 / PR objectui#6046 · objectui#3430.

[os-zhuang]

Triage: lands in .claude/hooks/guard-shared-stash.sh (+ its selftest) → domain:devx, pm:queue, type Bug. Rationale: hook-enforcement fixes follow the established fix-family lane — #11131/#11133/#11234 (PR #11278) and the objectui port objectui#5789 all ran domain:devx; the SUBJECT here is command-parsing correctness of an enforcement script, not the governed instruction face itself. Dispatch notes: (1) ⚠️ this repo's copy has NOT been independently probed — the measurement was taken on objectui's copy; step 1 is reproducing the fail-open here, and a non-repro is itself a finding (declared parity broken); (2) only the #11131 backslash half applies — there is no strip_heredocs() here, do not port #11133 looking for a place to put it; (3) cross-repo sibling objectui#6042 is already dispatched — land the same patch shape in both copies or the parity declaration is broken by the fix itself; coordinate, don't fold (separate repos, separate PRs); (4) .claude/** is a governed surface: draft PR, human merge, and re-run guard-shared-stash.selftest.sh per the hook's own instruction.

Session: session_012od9QE3Wzmgb3aXQ7U156P (triage seat, hourly round)

---

Generated by Claude Code

[os-steve]

Claim: devx lane PM seat, session e2eac1a7-8000-5c95-9749-38aec2ace6fc, branch claude/issue-11738-stash-guard-backslash.

⚠️ Governed surface (.claude/**): the PR stays draft, requests review from os-zhuang, and is never flipped ready, armed or queued by this seat.

⚠️ Sequencing, not blocking: #11514 is in flight wiring .claude/hooks/*.selftest.sh into CI. It touches .github/workflows/ only and modifies no hook, so there is no file collision — the two are complementary (this card fixes a guard; that one makes a broken guard visible). Coordinate only if you need to change the self-test itself.

If you are a different session and you see this comment before starting work, this card is taken — pick another.

---

Generated by Claude Code

[claude]

{
 "issue": 11738,
 "status": "done",
 "branch": "claude/issue-11738-stash-guard-backslash",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11803",
 "premise_still_valid": true,
 "summary": "The card's premise held and was verified on THIS repo's copy rather than inherited from objectui's reading: on de1cb8def, `echo \\\" ; git stash pop` was ALLOWED (exit 0) while bare `git stash` and `git stash pop` were blocked (exit 2), so the guard was reached and let the escaped-quote form past. Gave split_segments() the backslash branch guard-main-checkout-bash.sh's split_segments() took in #11131, same shape; that guard's `word=1` bookkeeping has no analogue here (this pass has no comment rule, so no word starts to track) and the #11133 heredoc half does not apply (no strip_heredocs() pass here). This fixes a parse that was WRONG, not one that was UNCERTAIN: the hook's documented fail-open posture for what it cannot parse (wrapped invocations bash -c / xargs / ssh) is stated in its own header and is unchanged — so the stash guard's intended posture is the same as the checkout guard's, established from its header rather than assumed. Self-test 32 -> 44 cases, and the 12 new ones were shown discriminating. PR is DRAFT, review requested from os-zhuang, never flipped ready / armed / enqueued; skip-changeset labelled and read back.",
 "tests": "All readings redirect-then-capture (never `cmd | tail` then $?), and every zero is paired with a positive control. Verified at final commit bc9400bcd, tree clean.\n(1) BASELINE on unmodified origin/main (de1cb8def): guard-shared-stash.selftest.sh -> exit 0, '32 passed, 0 failed'. The card's assumption that the self-test currently passes is TRUE.\n(2) REPRO, PreToolUse payload {cwd, tool_name:\"Bash\", tool_input:{command}}. Controls `git stash` / `git stash pop` -> blocked exit 2. Holes, all ALLOWED exit 0 before the fix and blocked exit 2 after: `echo \\\" ; git stash`, `echo \\\" ; git stash pop`, `echo \\\" && git stash pop`, `printf \\\" ; git stash drop`, and the newline-separated `echo \\\"` / `git stash pop`. Semantics confirmed separately: `bash -c 'echo \\\" ; echo SECOND_COMMAND_REALLY_RAN'` prints \" then SECOND_COMMAND_REALLY_RAN, so the command behind the escape really executes.\n(3) NON-VACUITY (ablation). No build/dist leg exists to rebuild — the hook is interpreted bash with no compile step and no dist/, so the dist-preflight discipline does not apply; the ablation is instead the PRE-FIX hook lifted out of commit de1cb8def with `git show` into a scratch dir, so the worktree was never mutated and no restore leg was needed. Mutation confirmed on disk BEFORE reading any result, not from an editor exit code: the branch literal `'\\')` occurs 1x in the fixed hook and 0x in the ablation copy, and the new comment sentence 1x / 0x (my first marker grep returned 0 on BOTH copies — an over-escaped pattern measuring nothing — and was rerun as a fixed-string match; the 0-vs-1 readings quoted here are from the corrected run). Result: NEW selftest x PRE-FIX hook -> exit 1, '38 passed, 6 failed', the failures being exactly the 6 new block cases; NEW selftest x FIXED hook -> exit 0, '44 passed, 0 failed'. The 6 precision twins pass in both directions, so they pin precision rather than pad the count.\n(4) GATES, derived with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (no paths passed; it took the change set from the merge base itself), re-run at bc9400bcd, each quoted from the gate's own verdict line: check:nul-bytes 'check-nul-bytes: OK (scanned 6577 text file(s) ... no raw ASCII control bytes)'; check:doc-authoring '389 files clean'; check:pm-governed-merges '129 assertions'; check:skill-frame-sync '4 copies ... structurally isomorphic'; check:agent-test-spelling self-test + sweep exit 0. Plus a manual control-char scan of both edited files: no hits, with a positive control proving the pattern fires (my first control used a TAB, which that class deliberately excludes, so it proved nothing and was redone with \\x0b).\n(5) DECLARED NARROWING, one gate: check:doc-formula-expressions needs a workspace install this bash-only change does not otherwise need. Narrowing measured, not assumed: population read from the gate's OWN source (ROOTS=['.claude','docs','skills','content'], walker keeps only .md/.mdx, plus .ts/.tsx under packages/spec/src) = 1671 files at this commit; it contains 0 .sh files and neither changed file; positive control shows the walk really reaches .claude/ (25 .md files there); and my diff adds/removes 0 .md/.mdx paths, so the population is identical before and after. CI runs the full farm regardless.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #11804: guard-shared-stash.sh's split_segments() ALSO misreads an escaped quote INSIDE a double-quoted word (the #10406 half, not the #11131 half this card scopes to) — opposite direction, a false BLOCK on pure reads: `grep -rn \"he said \\\"cd x && git stash pop\\\" once\" .claude/` and `echo \"he said \\\"x && git stash pop\\\" once\"` are both blocked today, while the already-pinned single-level `grep -rn \"cd x && git stash pop\" .claude/` control passes. Contradicts the hook header's own promise that writing ABOUT the ban is never caught by it. NOT folded in, per the dispatch's explicit no-widening instruction on this governed surface — so the two guards' split_segments() stay divergent on the in-quote half until #11804 is done.",
 "not filed, reported only: NO third sibling carries this defect. Only two files in the tree define split_segments() — guard-shared-stash.sh (this card) and guard-main-checkout-bash.sh (repaired by #11131). guard-main-checkout.sh, named as the pair's other half, reads .tool_input.file_path and parses no shell at all, so it structurally cannot carry it. Nothing to file."
 ]
}

---

Generated by Claude Code