chore(inbox): park two hook fail-open fixes from .emacs.d

1 files changed, 38 insertions, 0 deletions

diff --git a/working/hook-fail-open/pre-commit.diff b/working/hook-fail-open/pre-commit.diff
new file mode 100644
index 0000000..26b3d7e
--- /dev/null
+++ b/working/hook-fail-open/pre-commit.diff
@@ -0,0 +1,38 @@
+--- languages/elisp/githooks/pre-commit	2026-07-23 20:37:08.136094097 -0500
++++ working/hook-fail-open/pre-commit	2026-07-24 09:02:54.812347251 -0500
+@@ -18,8 +18,17 @@
+ SECRET_PATTERNS_CS='(AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9_-]{20,}|-----BEGIN (RSA|DSA|EC|OPENSSH|PGP)( PRIVATE)?( KEY| KEY BLOCK)?-----)'
+ SECRET_PATTERNS_CI='(api[_-]?key|api[_-]?secret|auth[_-]?token|secret[_-]?key|bearer[_-]?token|access[_-]?token|password)[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"']{16,}["'"'"']'
+ 
+-added_lines="$(git diff --cached -U0 --diff-filter=AM \
+-  | grep '^+' | grep -v '^+++' || true)"
++# Read the diff on its own so a git failure is distinguishable from "grep
++# matched nothing".  Both end in a non-zero status, but only one of them means
++# there is nothing to scan; piping them together and swallowing the result with
++# `|| true` made a broken git look like a clean commit.
++if ! staged_diff="$(git diff --cached -U0 --diff-filter=AM)"; then
++  echo "pre-commit: cannot read the staged diff — refusing to skip the secret scan" >&2
++  exit 1
++fi
++
++# The greps keep their `|| true`: exiting 1 on no match is their normal result.
++added_lines="$(printf '%s\n' "$staged_diff" | grep '^+' | grep -v '^+++' || true)"
+ 
+ cs_hits="$(printf '%s\n' "$added_lines" | grep -nE  "$SECRET_PATTERNS_CS" || true)"
+ ci_hits="$(printf '%s\n' "$added_lines" | grep -niE "$SECRET_PATTERNS_CI" || true)"
+@@ -37,7 +46,14 @@
+ fi
+ 
+ # --- 2. Paren check on staged .el files ---
+-staged_el="$(git diff --cached --name-only --diff-filter=AM | grep '\.el$' || true)"
++# Same split as the secret scan above: a git failure must not read as "no .el
++# files staged", which would skip the paren check silently.
++if ! staged_names="$(git diff --cached --name-only --diff-filter=AM)"; then
++  echo "pre-commit: cannot read the staged file list — refusing to skip the paren check" >&2
++  exit 1
++fi
++
++staged_el="$(printf '%s\n' "$staged_names" | grep '\.el$' || true)"
+ 
+ if [ -n "$staged_el" ]; then
+   paren_fail=""