cc-discipline 2.13.5 → 2.13.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cc-discipline",
3
- "version": "2.13.5",
3
+ "version": "2.13.6",
4
4
  "description": "Discipline framework for Claude Code — rules, hooks, and agents that keep AI on track",
5
5
  "bin": {
6
6
  "cc-discipline": "bin/cli.js"
@@ -98,7 +98,28 @@ if echo "$CMD_SCAN" | grep -qE 'git\s+branch\s+-D\s'; then
98
98
  fi
99
99
 
100
100
  # git push --force / -f (to main/master)
101
- if echo "$CMD_SCAN" | grep -qE 'git\s+push\s+.*(-f|--force)' && echo "$CMD_SCAN" | grep -qE '(main|master)'; then
101
+ #
102
+ # Both the flag test and the branch test are scoped to the push command itself
103
+ # and anchored on both sides. Three defects found 2026-09-02, all from the old
104
+ # one-line form:
105
+ # 1. `-f` had no word boundary, so it matched inside `--format`, `--file` and
106
+ # `--follow`.
107
+ # 2. `.*` was unbounded, so a match anywhere later in a compound command
108
+ # counted — pushing to main on the same line as `git log --format=%h` was
109
+ # blocked as a force-push.
110
+ # 3. `--force` had no boundary either, so it matched inside
111
+ # `--force-with-lease` — the guard blocked the very remedy it recommends.
112
+ # `-[a-zA-Z]*f[a-zA-Z]*` still catches clustered short flags (-fu, -uf, -ufv);
113
+ # `--format` cannot match it because a letter class cannot consume the second
114
+ # dash. `[^;&|]*` keeps the scan inside one command, which is also what fixes
115
+ # the branch test — moving it inside the segment stops `... origin dev && echo
116
+ # main` from counting. The branch test itself stays deliberately UNanchored:
117
+ # anchoring it would let `refs/heads/main` through, and a miss here costs the
118
+ # user's history while a false positive costs one turn.
119
+ PUSH_SEG=$(printf '%s' "$CMD_SCAN" | sed -n 's/.*\(git[[:space:]]\{1,\}push[^;&|]*\).*/\1/p')
120
+ if [ -n "$PUSH_SEG" ] \
121
+ && printf '%s' "$PUSH_SEG" | grep -qE '(^|[[:space:]])(-[a-zA-Z]*f[a-zA-Z]*|--force)([[:space:]]|$)' \
122
+ && printf '%s' "$PUSH_SEG" | grep -qE '(main|master)'; then
102
123
  BLOCKED="git push --force to main/master (rewrites shared history)"
103
124
  SUGGESTION="git push --force-with-lease"
104
125
  fi