crewforth 3.1.0-rc.7 → 3.1.0-rc.8

package/CHANGELOG.md

@@ -343,6 +343,12 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Fixed
 
+- **On some Windows machines every commit was stopped: "PRIVATE-PATH SCANNER: … could not run".** The look for a
+  machine-private string used `grep -iF`, and Git Bash's grep 3.0 aborts for it (exit 134): in the C locale with
+  Git for Windows 2.53, under a Turkish locale with 2.55 (measured on one machine of each). The commit hook sets
+  the C locale, so on the first kind every look aborted, and the hook rightly stopped the commit. A private term
+  is now escaped and matched with `-iE`, which aborted in none of the 15 pairs of `LANG` and `LC_ALL` measured on
+  either machine. A term is still a literal: `.`, `\`, `[`, `(`, `+`, `|` and the rest match only themselves.
 - **Critical work with a verify command was refused every time where the Agent tool has no `run_in_background`.**
   The gate asked for the field to be `false`. Where background tasks are off the tool has no such field (measured on
   Claude Code 2.1.296: the call arrives with description, prompt, subagent_type and model, and runs in the

package/kit/eval/smoke-test.sh

@@ -10102,8 +10102,10 @@ printf 'acme-internal-host\n' > "$_TH/r/.private-terms.txt"
 _thbad=""
 _th_hook "$_TH/r" pre-commit ""; { [ "$_thr" = 1 ] && grep -q 'PRIVATE-PATH SCANNER: a staged line contains' "$_TH/out"; } \
   || _thbad="$_thbad [FIXTURE: with a working grep the private string is not reported: rc=$_thr]"
-_th_hook "$_TH/r" pre-commit "" "$_TH/bin"; { [ "$_thr" = 1 ] && grep -q 'could not run' "$_TH/out"; } \
-  || _thbad="$_thbad [grep aborting for -iF: rc=$_thr, want 1 and 'could not run' — $(sed -n 1p "$_TH/out" | cut -c1-120)]"
+# A grep that aborts for -iF changes nothing: the look for a private string does not use it (measured on two
+# Windows machines: Git Bash's grep 3.0 aborts for -iF in the C locale on one and under tr_TR on the other).
+_th_hook "$_TH/r" pre-commit "" "$_TH/bin"; { [ "$_thr" = 1 ] && grep -q 'PRIVATE-PATH SCANNER: a staged line contains' "$_TH/out" && ! grep -q 'could not run' "$_TH/out"; } \
+  || _thbad="$_thbad [grep aborting for -iF: rc=$_thr, want 1 and the private string reported — $(sed -n 1p "$_TH/out" | cut -c1-120)]"
 # the same for a scan by pattern: an abort is not "this pattern does not compile"
 mkdir -p "$_TH/bin2"
 printf '#!/bin/sh\ncase " $* " in *" -qiE "*) kill -ABRT $$ ;; esac\nexec "%s" "$@"\n' "$_thg" > "$_TH/bin2/grep"; chmod +x "$_TH/bin2/grep"
@@ -10112,6 +10114,41 @@ _th_hook "$_TH/e" pre-commit "" "$_TH/bin2"; { [ "$_thr" = 1 ] && grep -q 'TRACE
   || _thbad="$_thbad [pre-commit, grep aborting for -iE: rc=$_thr, want 1 and 'could not run' — $(sed -n 1p "$_TH/out" | cut -c1-120)]"
 _th_hook "$_TH/e" commit-msg "" "$_TH/bin2" msg.txt; { [ "$_thr" = 1 ] && grep -q 'could not run' "$_TH/out"; } \
   || _thbad="$_thbad [commit-msg, grep aborting for -iE: rc=$_thr, want 1 and 'could not run' — $(sed -n 1p "$_TH/out" | cut -c1-120)]"
+# ...and the look for a private string, which is a scan by pattern now: an abort stops the commit and says so
+_th_hook "$_TH/r" pre-commit "" "$_TH/bin2"; { [ "$_thr" = 1 ] && grep -q 'PRIVATE-PATH SCANNER: the look for a machine-private string could not run' "$_TH/out"; } \
+  || _thbad="$_thbad [the private-string look, grep aborting for -iE: rc=$_thr, want 1 and 'could not run' — $(grep -m1 PRIVATE "$_TH/out" | cut -c1-120)]"
+# A term is a literal, whatever it holds: each is found as written and in another case, and none of its characters
+# works as a pattern (the line on the right is what it would match if one did).
+_thl=0
+while IFS= read -r _tl; do [ -z "$_tl" ] && continue
+  _tt="${_tl%% @@ *}"; _tr="${_tl#* @@ }"; _th1="${_tr%% @@ *}"; _th0="${_tr#* @@ }"; _thl=$((_thl+1))
+  _th_repo "$_TH/l"; printf '%s\n' "$_tt" > "$_TH/l/.private-terms.txt"
+  ( cd "$_TH/l" && printf 'x %s y\n' "$_th1" > n.md && git add n.md ) >/dev/null 2>&1
+  _th_hook "$_TH/l" pre-commit ""; { [ "$_thr" = 1 ] && grep -q 'a staged line contains' "$_TH/out"; } || _thbad="$_thbad [the term $_tt is not found in: $_th1 (rc=$_thr)]"
+  ( cd "$_TH/l" && printf 'x %s y\n' "$_th0" > n.md && git add n.md ) >/dev/null 2>&1
+  _th_hook "$_TH/l" pre-commit ""; [ "$_thr" = 0 ] || _thbad="$_thbad [the term $_tt is read as a pattern: it matched $_th0 (rc=$_thr, $(sed -n 1p "$_TH/out" | cut -c1-80))]"
+done <<'TL'
+acme.internal @@ ACME.Internal @@ acmeXinternal
+C:\Users\ada.l @@ c:\users\ADA.L @@ C:Usersada.l
+build[7] @@ BUILD[7] @@ build7
+a+b(c) @@ A+B(C) @@ aab(c)
+host|other @@ HOST|OTHER @@ host
+cost$ ^x* @@ COST$ ^X* @@ cost ^
+q{2}? @@ Q{2}? @@ qq
+TL
+[ "$_thl" = 7 ] || _thbad="$_thbad [FIXTURE: the literal-term table has $_thl rows, not 7]"
+# No hook looks for anything with -iF: a code line of a gate that calls grep with both flags is the defect itself.
+_thf="$(for _f in "$HOOKS"/*.sh "$HOOKS/pre-commit" "$HOOKS/commit-msg"; do grep -nE '^[^#]*(grep[[:space:]][^|;#]*-[A-Za-z]*(i[A-Za-z]*F|F[A-Za-z]*i)|_crew_(scan|any)[^#]*[[:space:]](iF|Fi)([[:space:]]|$))' "$_f" 2>/dev/null | sed "s#^#${_f##*/}:#"; done)"
+[ -z "$_thf" ] || _thbad="$_thbad [a hook calls grep with -i and -F together: $(printf '%s' "$_thf" | head -2 | cut -c1-140)]"
+# ...and the look itself names the C locale on the call (3 calls: _crew_scan in both git hooks, _crew_any): under
+# tr_TR `grep -iE` answers "no match" for i against I without aborting, so a look left to the session's locale
+# would miss a term in capitals, silently.
+_thc="$(grep -cE '^[[:space:]]*LC_ALL=C grep -q' "$HOOKS/pre-commit" "$HOOKS/commit-msg" | tr '\n' ' ')"
+_thu="$(grep -nE '^[[:space:]]*grep -q("\$1"|\$3) -- ' "$HOOKS/pre-commit" "$HOOKS/commit-msg" | head -2)"
+case "$_thc" in *"pre-commit:2 "*"commit-msg:1 "*) ;; *) _thbad="$_thbad [the first look does not name the C locale on the call: $_thc]" ;; esac
+[ -z "$_thu" ] || _thbad="$_thbad [a first look runs in whatever locale is exported: $(printf '%s' "$_thu" | cut -c1-120)]"
+printf 'x() { grep -qiF -- "$a" "$b"; }\n_crew_scan iF "$t" "$f"\n# grep -iF in a comment\n' > "$_TH/pin.sh"
+[ "$(grep -cE '^[^#]*(grep[[:space:]][^|;#]*-[A-Za-z]*(i[A-Za-z]*F|F[A-Za-z]*i)|_crew_(scan|any)[^#]*[[:space:]](iF|Fi)([[:space:]]|$))' "$_TH/pin.sh")" = 2 ] || _thbad="$_thbad [FIXTURE: the -iF pin does not see the two lines it is for]"
 # and for the diff itself: the grep that picks the added lines aborting must not leave an empty file to scan
 mkdir -p "$_TH/bin3"
 printf '#!/bin/sh\n[ "$1" = -E ] && [ "$2" = "^\\+" ] && kill -ABRT $$\nexec "%s" "$@"\n' "$_thg" > "$_TH/bin3/grep"; chmod +x "$_TH/bin3/grep"
@@ -10124,7 +10161,7 @@ _th_hook "$_TH/b" pre-commit ""; { [ "$_thr" = 0 ] && grep -q 'is not a valid re
   || _thbad="$_thbad [pre-commit with a pattern that does not compile: rc=$_thr, want 0 and the warning]"
 _th_hook "$_TH/b" commit-msg "" "" msg.txt; { [ "$_thr" = 0 ] && grep -q 'is not a valid regular expression' "$_TH/out"; } \
   || _thbad="$_thbad [commit-msg with a pattern that does not compile: rc=$_thr, want 0 and the warning]"
-[ -z "$_thbad" ] && pass "a scan that could not run stops the commit: with grep aborting for -iF (what Git Bash's grep does under a Turkish locale) or for -iE, or while the added lines are collected, pre-commit and commit-msg exit 1 and say so; a pattern that does not compile still only warns, in both" \
+[ -z "$_thbad" ] && pass "a scan that could not run stops the commit: with grep aborting for -iE (the scan by pattern and the look for a private string), or while the added lines are collected, pre-commit and commit-msg exit 1 and say so; a pattern that does not compile still only warns, in both; a grep that aborts for -iF changes nothing, since no hook calls it (pinned, with a twin the pin sees); the first look names the C locale on the call, in both git hooks; a private term is a literal: 7 terms with . \\ [ ] + ( ) | \$ ^ * { } ? are found as written, in another case, and match nothing else" \
                  || fail "a scan that could not run:$_thbad"
 
 # The command shown in the approval prompt is cut to 300 bytes a line and goes into JSON. `cut -c` did it: GNU cut
@@ -10207,7 +10244,7 @@ else
   ( cd "$_TH/n" && printf 'see ŞİRKET-GİZLİ\n' > n.md && git add n.md ) >/dev/null 2>&1
   _th_hook "$_TH/n" pre-commit "$_th"; _thna="$_thr"
   # required where this platform's grep folds such a letter under the locale at all (GNU grep does, BSD grep does not)
-  if ( printf 'ŞİRKET\n' | LC_ALL=$_th grep -qiF 'şirket' ) >/dev/null 2>&1; then
+  if ( printf 'ŞİRKET\n' | LC_ALL=$_th grep -qiE 'şirket' ) >/dev/null 2>&1; then
     [ "$_thna" = 1 ] || _thbad="$_thbad [pre-commit, a private string of non-ASCII letters in another case: rc=$_thna, want 1 (this grep folds them under $_th)]"
   fi
   [ -z "$_thbad" ] && pass "under $_th the git hooks stop what they stop under C: a vendor name in another case in an added line and in the message, a staged key that holds an I, a private string in another case; an ordinary line and message pass (a private string of non-ASCII letters in another case: exit $_thna, 1 = caught by the second look)" \

package/kit/hooks/commit-msg

@@ -36,7 +36,9 @@ export LC_ALL=C
 # the first look finds nothing and the match ignores case: in the C locale such a letter has no other case.
 _crew_scan(){  # $1 = grep's flags after -q (iE, E, iF) · $2 = pattern · $3 = file
   local r=0
-  grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$?
+  # The first look is in the C locale, SAID ON THE CALL and not left to the export at the top of the file: under
+  # tr_TR `grep -iE` does not abort, it answers "no match" for i against I (measured in Git Bash), which is silent.
+  LC_ALL=C grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$?
   if [ "$r" = 1 ] && [ -n "$_CREW_LOCALE" ]; then
     case "$1" in *i*) case "$2" in *[!$'\t'\ -~]*) r=0; LC_ALL="$_CREW_LOCALE" grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$? ;; esac ;; esac
   fi

package/kit/hooks/pre-commit

@@ -37,7 +37,9 @@ export LC_ALL=C
 # the first look finds nothing and the match ignores case: in the C locale such a letter has no other case.
 _crew_scan(){  # $1 = grep's flags after -q (iE, E, iF) · $2 = pattern · $3 = file
   local r=0
-  grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$?
+  # The first look is in the C locale, SAID ON THE CALL and not left to the export at the top of the file: under
+  # tr_TR `grep -iE` does not abort, it answers "no match" for i against I (measured in Git Bash), which is silent.
+  LC_ALL=C grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$?
   if [ "$r" = 1 ] && [ -n "$_CREW_LOCALE" ]; then
     case "$1" in *i*) case "$2" in *[!$'\t'\ -~]*) r=0; LC_ALL="$_CREW_LOCALE" grep -q"$1" -- "$2" "$3" 2>/dev/null || r=$? ;; esac ;; esac
   fi
@@ -352,18 +354,32 @@ done < <({ _floor_diff --cached; [ "${CREW_SCAN_UNSTAGED:-0}" = 1 ] && _floor_di
 # escapes to top level): 8 mismatches, in BOTH directions — three clean messages newly rejected and two real
 # secrets newly passed. Also checked structurally: no pattern in either shipped blocklist carries a bare
 # top-level `|` (every one is inside a group) and none uses a back-reference, so joining cannot reshape them.
-_crew_any(){   # $1 = pattern list  $2 = corpus  $3 = grep flags  $4 = 1 for newline-joined fixed strings
+# A LITERAL TERM IS LOOKED FOR AS A PATTERN, NEVER WITH `grep -iF`. Measured on two Windows machines, both GNU grep
+# 3.0 in Git Bash, and they fail in opposite places:
+#     Git for Windows 2.53 (msys bash 5.2)    grep -iF aborts (exit 134) when the locale in effect is C or POSIX
+#     Git for Windows 2.55 (cygwin bash 5.3)  grep -iF aborts (exit 134) when the locale in effect is tr_TR
+# This file sets the C locale (above), so on the first of them every look for a private string aborted and every
+# commit was stopped; with no locale set, the second one aborted for a Turkish user. No locale is safe for both.
+# On both, -iE and -i did not abort in any of 15 pairs of LANG and LC_ALL. So the term is escaped and matched with
+# -iE: _crew_lit puts a backslash before each character that means something in a pattern.
+_crew_lit(){  # $1 = a literal string -> _CL, the pattern that matches exactly it
+  local s="$1" c; _CL=""
+  while [ -n "$s" ]; do
+    c="${s:0:1}"; s="${s:1}"
+    case "$c" in '\'|.|'['|']'|'^'|'$'|'*'|+|'?'|'('|')'|'{'|'}'|'|') _CL="$_CL\\$c" ;; *) _CL="$_CL$c" ;; esac
+  done
+}
+_crew_any(){   # $1 = pattern list  $2 = corpus  $3 = grep flags  $4 = 1 when the list holds literal terms, not patterns
   local pat alt="" sep="|" na=0 r=0
-  [ "$4" = 1 ] && sep="
-"
   while IFS= read -r pat || [ -n "$pat" ]; do
     pat="${pat%$'\r'}"
     case "$pat" in ''|\#*) continue;; esac
-    alt="${alt:+$alt$sep}$pat"
     case "$pat" in *[!$'\t'\ -~]*) na=1 ;; esac
+    if [ "$4" = 1 ]; then _crew_lit "$pat"; pat="$_CL"; fi
+    alt="${alt:+$alt$sep}$pat"
   done < "$1"
   [ -n "$alt" ] || return 1
-  grep -q$3 -- "$alt" "$2" 2>/dev/null || r=$?
+  LC_ALL=C grep -q$3 -- "$alt" "$2" 2>/dev/null || r=$?
   # Nothing found, but a pattern holds a letter outside ASCII and the match ignores case: the per-pattern loop looks
   # again under the session's own locale (_crew_scan), so send the caller there.
   if [ "$r" = 1 ] && [ "$na" = 1 ] && [ -n "$_CREW_LOCALE" ]; then case "$3" in *i*) return 4 ;; esac; fi
@@ -472,21 +488,21 @@ PAL="";  [ -n "$GITROOT" ] && [ -f "$GITROOT/.private-allowlist.txt" ] && PAL="$
   fi
   [ -n "$PTF" ] && sed -e 's/[[:space:]]*$//' -e '/^#/d' -e '/^$/d' "$PTF"
 } > "$PTERM_F" 2>/dev/null || true
-if _crew_any "$PTERM_F" "$SECRET_F" iF 1; then _dec=0; else _dec=$?; fi
+if _crew_any "$PTERM_F" "$SECRET_F" iE 1; then _dec=0; else _dec=$?; fi
 if [ -s "$PTERM_F" ] && [ -s "$SECRET_F" ] && [ "$_dec" != 1 ]; then
   while IFS= read -r term || [ -n "$term" ]; do
     term="${term%$'\r'}"
     [ -n "$term" ] || continue
     if [ -n "$PAL" ] && grep -qxF -- "$term" "$PAL"; then continue; fi
-    _gr=0; _crew_scan iF "$term" "$SECRET_F" || _gr=$?
+    _crew_lit "$term"; _gr=0; _crew_scan iE "$_CL" "$SECRET_F" || _gr=$?
     if [ "$_gr" = 0 ]; then
       # The term is echoed back deliberately: unlike a secret, the author has to see WHICH private string to
       # replace, and it is already sitting in their own working tree.
       echo "PRIVATE-PATH SCANNER: a staged line contains a machine-private string -> '$term' (§4.3)"
       HIT=1
     elif [ "$_gr" -ge 2 ]; then
-      # This loop used to read every exit status but 0 as "no match": under a Turkish locale in Git Bash grep -iF
-      # aborted (134) for each term and the commit went through with both private strings in it (measured).
+      # This loop used to read every exit status but 0 as "no match": where grep aborted (134) for each term the
+      # commit went through with both private strings in it (measured).
       echo "PRIVATE-PATH SCANNER: the look for a machine-private string could not run, so the staged lines are not known to be clean and the commit is stopped (§4.3)."
       HIT=1
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.1.0-rc.7",
+  "version": "3.1.0-rc.8",
   "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"
@@ -44,6 +44,7 @@
     "git-hooks"
   ],
   "author": "Barış Yerlikaya",
+  "homepage": "https://crewforth.com/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Crewforth/crewforth.git"