From a22a1b174b7e634a8d3a34093ba7ca6dbe04717f Mon Sep 17 00:00:00 2001
From: AIOSAI <aipass.system@gmail.com>
Date: Sat, 16 May 2026 11:48:37 -0700
Subject: [PATCH] =?UTF-8?q?fix(security):=20broaden=20git=5Fgate=20subproc?=
 =?UTF-8?q?ess=20bypass=20detection=20=E2=80=94=20word-boundary=20matching?=
 =?UTF-8?q?=20catches=20os.system=20string-style,=20bare=20popen,=20and=20?=
 =?UTF-8?q?escaped-quote=20patterns=20(Issue=20#561)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .claude/hooks/git_gate.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.claude/hooks/git_gate.py b/.claude/hooks/git_gate.py
index afdb2bb8..d367291f 100755
--- a/.claude/hooks/git_gate.py
+++ b/.claude/hooks/git_gate.py
@@ -148,9 +148,9 @@ def main():
                 return
 
             # Subprocess bypass detection — scan raw command for git/gh inside
-            # subprocess.run/call/Popen/os.system patterns before stripping quotes.
-            if re.search(r"subprocess\.\w+|os\.system|os\.popen|Popen", cmd):
-                if re.search(r"['\"]git['\"]|['\"]gh['\"]", cmd):
+            # subprocess/os execution patterns before stripping quotes.
+            if re.search(r"subprocess\.\w+|os\.system|os\.popen|Popen|(?<!\w)popen\s*\(|(?<!\w)system\s*\(", cmd):
+                if re.search(r"\bgit\b|\bgh\b", cmd):
                     _block(GIT_REDIRECT)
 
             # Strip quoted strings before matching — text inside "..." or '...' is data