Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

fix(hooks): fail closed on crash in the remaining blocking hook rows

Open Beginner friendly
  • Is something wrong?
#8,799 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github, node.js, shell
Domain
devtools, security

Research direction

Start by reading the hook rows for worktree-add-containment, pr-body-linkage, pr-linkage-mcp, test-weaken, and run-python-hook, along with the exec-bash.mjs header and #8569. Update each listed blocking row so crashes, missing bash, node start failures, timeouts, and Git Bash crashes block the call; the issue leaves the mechanism to the deferred-hardening review. Done when every listed failure mode denies the tool call.

Written by the indexing model from the issue text.

Description

priority: low status: confirmed

Refs: #8569, #8282

Outcome

Every blocking hook row whose crash should deny the tool call fails closed: a bash crash, missing bash, a node start failure, the 60 s timeout, or a Git Bash crash read as exit 0 blocks the call instead of allowing it.

Current behavior

#8569 (PR #8674) adds an opt-in --fail-closed flag to exec-bash.mjs, passed only by the guardrails guard rows. These blocking rows in other plugins do not pass it, so a crash in any of the cases above allows the call (GitHub Security & Cost review of #8674 at e8309efd4b, 2026-10-21):

  • source-control: worktree-add-containment, pr-body-linkage, pr-linkage-mcp
  • testing: test-weaken
  • disk-hygiene: run-python-hook

Desired behavior

Each row above fails closed on every failure mode listed in Outcome. Claude Code's hook onFailure: "block" setting (v2.1.295+, https://code.claude.com/docs/en/hooks) covers all of them, including the cases --fail-closed cannot see (missing bash, node start failure, timeout).

Out of scope

  • Non-blocking rows (formatters, linters), whose fail-open is deliberate (exec-bash.mjs header).
  • The guardrails rows, covered by #8569.

Notes

Severity low; queued for the #8282 deferred-hardening review (2026-11-18) unless the owner wants it sooner. Which mechanism (onFailure: "block" per row vs --fail-closed) is a design choice for that review.

Dominant language
Shell
Stars
22
Forks
2
Avg merge
7h 57m
Merged PRs (30d)
938

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from melodic-software/claude-code-plugins

All issues in melodic-software/claude-code-plugins

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.