[HackingGate]

Version bump.

Ships #513: Bash, WebFetch and WebSearch calls reach uphold hook through a compiled-in [[hook]] table with the new publishes = false, and the new running-user-email source with its hook-only no-running-user-email fallback refuses the running user's own address in their arguments, withheld from refusals and evidence. The Kani job is back on ubuntu-latest.

https://claude.ai/code/session_01EycJ7monkqAU8KKjL7Qp3L

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b07de66-5025-43c2-8320-e299ab339fd3

Commits

Reviewing files that changed from the base of the PR and between 9b29530 and 32a2843.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 3

• Cargo.toml
• README.md
• hooks/lefthook.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[uphold-review]

uphold-review

Every line this pull request changes only moves a version number or a commit id, so only uphold's rules ran, and they judge any dependency pins among them.

Rule output · this repository's policy at 9b29530

$ uphold scan
policy checks passed

$ uphold check
reconciled 19 enforcement claims:
  explicit-unknown <- catalog-tests  enforced by a hook installed here at manual, pre-commit
  single-authoritative-source <- catalog-reference-current  enforced by a hook installed here at manual, pre-commit
  make-illegal-states-unrepresentable <- catalog-validate  enforced by a hook installed here at manual, pre-commit
  single-authoritative-source <- catalog-tests  enforced by a hook installed here at manual, pre-commit
  explicit-unknown <- no-stale-hook-pins  enforced by uphold guard at manual
  single-authoritative-source <- no-stale-hook-pins  enforced by uphold guard at manual
  complete-mediation <- prevent-ai-author  enforced by uphold guard at commit-msg
  fail-safe-defaults <- prevent-public-push  enforced by uphold guard at pre-push
  observability <- removed-function-named  enforced by uphold guard at commit-msg
  least-privilege <- workflow-declares-permissions  enforced by uphold scan
  minimize-attack-surface <- workflow-declares-permissions  enforced by uphold scan
  compromise-recording <- no-local-merge  enforced by uphold guard at pre-merge-commit
  compromise-recording <- no-merge-commit  enforced by uphold guard at pre-commit
  data-minimization <- no-private-repo-names  enforced by uphold guard at commit-msg
  data-minimization <- no-running-os-identity-metadata  enforced by uphold scan
  chestertons-fence <- removed-function-named  enforced by uphold guard at commit-msg
  deprecation-discipline <- no-stale-hook-pins  enforced by uphold guard at manual
  reproducible-derived-state <- catalog-reference-current  enforced by a hook installed here at manual, pre-commit
  reproducible-derived-state <- review-current  enforced by a hook installed here at manual, pre-commit
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-validate: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-ai-author: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-public-push: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-local-merge: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-merge-commit: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-private-repo-names: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-running-os-identity-metadata: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  review-current: unmeasured [not_requested] — no behavioral probe requested
  note  lefthook.yml runs the binary
  note  lefthook.yml defines 20 command(s)
  note  every principle the base at /tmp/uphold-gate/base enforced is still enforced here, at the same seams
adopted 10 record(s) for design rulings ([decide]):
  explicit-unknown
  parameterize-do-not-enumerate
  enforcement-needs-a-trigger
  psychological-acceptability
  single-authoritative-source
  mechanism-policy-separation
  least-power
  complete-mediation
  fail-safe-defaults
  economy-of-mechanism
  order  fail-safe-defaults over psychological-acceptability: A scope the shim cannot evaluate refuses by default, and `unresolved = "run"` is the named way out.
  order  explicit-unknown over psychological-acceptability: A seam that stands down says so on stderr; it never reports what it did not read as a pass.
  order  psychological-acceptability over complete-mediation: A hook that refuses routine work has its matcher deleted, and then it mediates nothing.
  order  least-power over parameterize-do-not-enumerate: `[stop] run` takes argv and no shell; a command that needs a pipeline names a script.

• Full review: tick to review the whole pull request again at its current head

---

_{Reviewed with uphold 1.47.1 by uphold-review 0.12.4 · 32a2843 · claude-haiku-5-5 · 18 s · $0.00 list¹}

Footnotes

1. What this session cost uphold-review's operator, as the platform reports it: public list rates in whole cents, so under half a cent reads $0.00; billed spend might be lower. Source: How list cost is measured. ↩

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.12%. Comparing base (9b29530) to head (32a2843).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #514      +/-   ##
==========================================
- Coverage   95.14%   95.12%   -0.03%     
==========================================
  Files          58       58              
  Lines       29296    29296              
==========================================
- Hits        27874    27868       -6     
- Misses       1422     1428       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.