UNRELEASED DEVELOPMENT SNAPSHOT · READ-ONLY EXCERPT
hooks/shared/secret-scan-block/run.sh
This is the cited technical source at local revision 275a354, inspected on 22 September 2026. It differs from the public release. This reference publishes only the cited sections, not an installable release or the development branch.
Line numbers refer to the complete recorded file. Uncited lines are omitted. Full-file SHA-256: 05094fb9eec7ddcd2f6dc623d526bffe1b831fa4105f5493282fb42ed3e644cc.
1
#!/usr/bin/env bash2
# secret-scan-block — Lintel JUSTIFIED-BLOCK hook3
# Blocks git commit/push if Tier 1 secret pattern in staged content.5
# NOT `set -e` (issue I1 / claude-code #60490): under -e an upstream grep/tr6
# returning non-zero would exit this script BEFORE the blocking `exit 2`, and7
# Claude Code treats any non-2 exit as NON-blocking — the secret commits through.8
# Explicit exits only (0 = allow, 2 = block); -u/pipefail kept for correctness.9
set -uo pipefail11
source "$(dirname "${BASH_SOURCE[0]}")/../_input.sh"12
CMD="$(hook_input command "${1:-}")"13
[ -z "$CMD" ] && exit 015
# Match against a FLATTENED copy: a line-continuation newline between `git` and16
# the subcommand defeats a line-oriented grep (silent fail-open), and a newline… omitted uncited lines …
24
# Unified audit writer (hooks/shared/<name>/ → repo-root → bin/). Idempotent source.25
command -v audit_log >/dev/null 2>&1 || source "$(dirname "${BASH_SOURCE[0]}")/../../../bin/_audit.sh"26
# Shared detection patterns (defined once). Block hook → strict `tier1` (high-confidence only).27
source "$(dirname "${BASH_SOURCE[0]}")/../_patterns.sh"29
# Fire on any git commit/push, however the command is phrased: `git commit`,30
# `git -C path commit`, `/usr/bin/git push`, `true && git commit`, `cd x && git31
# commit -am`. The old `^git` anchor was trivially bypassed (security battletest32
# K2). Word-boundary match on both `git` and the subcommand.33
if ! printf '%s' "$CMD_FLAT" | grep -qE '(^|[^A-Za-z0-9_-])git([[:space:]]|$).*\b(commit|push)\b'; then34
exit 035
fi37
# Override path — checked BEFORE everything else so an explicit override always38
# audits (battletest H8: the override branch sat after the matcher and an inline39
# `LINTEL_OVERRIDE_SECRET=1 git commit` left no record). Honor either the hook's40
# own env OR the token in the command string the operator typed.41
# Honor the override via the hook's env OR a LEADING env-assignment on the42
# command (`LINTEL_OVERRIDE_SECRET=1 [VAR=v ...] git commit …`) — NEVER the token43
# appearing inside a quoted arg / -m message (review P0: that re-opened a44
# forgeable fail-open). The anchored prefix is what the operator actually types.45
if [ "${LINTEL_OVERRIDE_SECRET:-}" = "1" ] || printf '%s' "$CMD_FLAT" | grep -qE '^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*LINTEL_OVERRIDE_SECRET=1([[:space:]]|=|$)'; then46
reason="${LINTEL_OVERRIDE_REASON:-no-reason-given}"47
audit_log "hooks" "secret_scan_block" "hook=secret-scan-block" "tier=OVERRIDDEN" "override=true" "reason=$reason" "blocked=false"