@haus-tech/haus-workflow 5.6.0 → 5.6.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [5.6.1](https://github.com/WeAreHausTech/haus-workflow/compare/v5.6.0...v5.6.1) (2026-09-16)
+
+### Bug Fixes
+
+- **security:** allow gh pr merge and read-only gh verbs, deny the --admin bypass ([#562](https://github.com/WeAreHausTech/haus-workflow/issues/562)) ([00a8c95](https://github.com/WeAreHausTech/haus-workflow/commit/00a8c95dbc49dea5863d15b9812f038dfde036bb)), closes [#545](https://github.com/WeAreHausTech/haus-workflow/issues/545)
+
 ## [5.6.0](https://github.com/WeAreHausTech/haus-workflow/compare/v5.5.0...v5.6.0) (2026-09-13)
 
 ### Bug Fixes

package/dist/cli.js

@@ -3383,8 +3383,42 @@ var ALLOWED_SUBCOMMANDS = [
   "workspace worktree list",
   "workspace worktree doctor"
 ];
+var ALLOWED_COMMANDS = [
+  // Merging the PR is the last step of the house loop, and where a deploy builds `main`'s
+  // SHA it is a precondition of deploying at all. The auto mode classifier blocked it
+  // mid-run with no rule available to pre-authorize it (#545). Its dangerous form —
+  // `--admin`, the only way past branch protection and required reviews — is deny-tier in
+  // `DENY_COMMANDS` and caught in any spelling by the runtime guard, which outranks this
+  // rule. The repo's own branch protection stays the review gate.
+  "gh pr merge",
+  // Read-only verbs. `gh` is absent from Claude Code's built-in read-only command set
+  // (`ls`, `cat`, `grep`, read-only `git`, …), so each of these otherwise costs a
+  // classifier round-trip mid-run — on `gh run watch`, once per CI wait. Nothing under
+  // these prefixes writes, so there is no dangerous form left to gate.
+  "gh pr view",
+  "gh pr list",
+  "gh pr diff",
+  "gh pr checks",
+  "gh run list",
+  "gh run view",
+  "gh run watch",
+  "gh issue view",
+  "gh issue list",
+  "gh repo view",
+  "gh label list",
+  // Prints who you are authenticated as; `gh auth token`, which prints the credential
+  // itself, is a different leaf and stays out.
+  "gh auth status",
+  "gh search prs",
+  "gh search issues"
+];
 function buildAllowRules() {
-  return [...new Set(ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`))];
+  return [
+    .../* @__PURE__ */ new Set([
+      ...ALLOWED_SUBCOMMANDS.map((sub) => `Bash(haus ${sub}:*)`),
+      ...ALLOWED_COMMANDS.map((command) => `Bash(${command}:*)`)
+    ])
+  ];
 }
 
 // src/install/settings-merge.ts
@@ -3722,6 +3756,9 @@ var DENY_COMMANDS = [
   // Skipping the hooks is a NEVER rule in WORKFLOW.md and was missing from every tier.
   "git commit --no-verify",
   "git push --no-verify",
+  // `gh pr merge` is allow-tier so an unattended run can land its own PR; this is the
+  // one form that merges past branch protection and required reviews (#545, ADR-0126).
+  "gh pr merge --admin",
   ...RUNTIME_ONLY_DENY_COMMANDS,
   "npm publish",
   // Classic v1 syntax alongside the Berry `yarn npm publish` form.
@@ -11868,6 +11905,32 @@ function isPackagePublish(words) {
   if (RUN_SCRIPT_VERBS.some((verb) => hasWord(words, verb))) return false;
   return !words.some((word) => word === "--dry-run" || word === "--dry-run=true");
 }
+var GH_TEXT_FLAGS = /* @__PURE__ */ new Set([
+  "-b",
+  "--body",
+  "-F",
+  "--body-file",
+  "-t",
+  "--subject",
+  "-R",
+  "--repo"
+]);
+var ADMIN_MERGE_FLAGS = /* @__PURE__ */ new Set(["--admin", "--admin=true", "--admin=1"]);
+function isProtectionBypassMerge(words) {
+  if (commandName(words) !== "gh") return false;
+  const args = [];
+  for (let i = 1; i < words.length; i += 1) {
+    const word = words[i];
+    if (GH_TEXT_FLAGS.has(word)) {
+      i += 1;
+      continue;
+    }
+    args.push(word);
+  }
+  const operands = args.filter((word) => !word.startsWith("-")).map((word) => word.toLowerCase());
+  if (operands[0] !== "pr" || operands[1] !== "merge") return false;
+  return args.some((word) => ADMIN_MERGE_FLAGS.has(word.toLowerCase()));
+}
 var PRIVILEGE_ESCALATORS = /* @__PURE__ */ new Set(["sudo", "doas", "pkexec"]);
 function isPrivilegeEscalation(words) {
   return PRIVILEGE_ESCALATORS.has(commandName(words));
@@ -11887,7 +11950,8 @@ var SEGMENT_MATCHERS = [
   { name: "a force push", matches: isForcePush },
   { name: "a commit or push that skips the hooks", matches: isHookBypass },
   { name: "a recursive permission change", matches: isRecursiveChmod },
-  { name: "a package publish", matches: isPackagePublish }
+  { name: "a package publish", matches: isPackagePublish },
+  { name: "a merge that bypasses branch protection", matches: isProtectionBypassMerge }
 ];
 function matchDangerousCommandShape(command) {
   for (const segment of parseShellSegments(command)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "5.6.0",
+  "version": "5.6.1",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {