feat(hooks): deny git checkout/restore that would discard uncommitted work

.gitapex/ssot.json

@@ -84,7 +84,7 @@
       "id": "bash-cli-write-and-install-guard",
       "kind": "script",
       "script": "hooks/check-bash-safety.sh",
-      "rule": "Delegates classification to hooks/gitapex_check_bash_safety.py, a token-based classifier (Python stdlib shlex, POSIX mode) that matches against bash's own dequoted, operator-segmented token stream -- closing the quote-splitting, ${IFS}/$IFS substitution, and variable/array/positional-parameter indirection bypass classes a prior raw-text regex substring scan was live-confirmed vulnerable to (issue #1326). Denies a Bash call matching a package/plugin-install verb (uv add/uv remove and apm install/apm uninstall stay allowed as declarative, visibly-mutating commands); denies gh issue/gh pr write subcommands and gh api writes (POST/PUT/PATCH/DELETE, a field flag, or 'mutation' in gh api graphql); on git push (including an obfuscated/indirected one that still resolves to git push), runs skills/outward-artifact-preflight/scripts/gitapex_scan_provenance.py against the outgoing commit range and warns (never blocks) if it flags something. Fails closed (denies) rather than allowing the call through when jq or python3 is missing from PATH, the payload or tool_input is not a JSON object, tool_name is present but not a string, tool_input.command is present but not a string, the classifier exits non-zero, or the classifier's own output is not a JSON object with a recognized decision. Disclosed residual (not closed by this classifier): verb-token-splitting that never places the tool/verb name as its own literal token anywhere, e.g. string-slice reconstruction (cmd=uvinstall; eval \"${cmd:0:2} ${cmd:2}\") or array-literal-assignment indirection (A=(uv); V=(install); \"${A[@]}\" \"${V[@]}\") -- see hooks/gitapex_check_bash_safety.py's own module docstring.",
+      "rule": "Delegates classification to hooks/gitapex_check_bash_safety.py, a token-based classifier (Python stdlib shlex, POSIX mode) that matches against bash's own dequoted, operator-segmented token stream -- closing the quote-splitting, ${IFS}/$IFS substitution, and variable/array/positional-parameter indirection bypass classes a prior raw-text regex substring scan was live-confirmed vulnerable to (issue #1326). Denies a Bash call matching a package/plugin-install verb (uv add/uv remove and apm install/apm uninstall stay allowed as declarative, visibly-mutating commands); denies gh issue/gh pr write subcommands and gh api writes (POST/PUT/PATCH/DELETE, a field flag, or 'mutation' in gh api graphql); on git push (including an obfuscated/indirected one that still resolves to git push), runs skills/outward-artifact-preflight/scripts/gitapex_scan_provenance.py against the outgoing commit range and warns (never blocks) if it flags something. Since issue #1375: the classifier also extracts every path a git checkout/git restore invocation could discard (git checkout -- PATH, git checkout ./.., git checkout with 2+ positionals and no --, or git restore PATH/--staged --worktree PATH, a case-sensitive enumerated restore flag vocabulary), denying outright (no live I/O) when a path token is dynamic and cannot be soundly resolved to a literal, when an otherwise-risky shape yields zero paths (e.g. bare 'git checkout --'), when a restore segment carries --pathspec-from-file/--pathspec-file-nul or an unrecognized flag, or when the classifier cannot soundly determine which working tree is at risk (a -C/--git-dir/--work-tree flag, a GIT_DIR=/GIT_WORK_TREE=/GIT_INDEX_FILE= assignment, or an earlier cd/pushd/popd -- literal, or dynamic and resolvable to one via a reassignment-biased reading -- in the same command); when paths are extracted, hooks/check-bash-safety.sh reads .cwd from the PreToolUse payload itself (not $CLAUDE_PROJECT_DIR) and denies if `git -C \"$cwd\" diff --quiet <HEAD-or-empty-tree> -- \"$path\"` reports any of them dirty. Fails closed (denies) rather than allowing the call through when jq or python3 is missing from PATH, the payload or tool_input is not a JSON object, tool_name is present but not a string, tool_input.command is present but not a string, the classifier exits non-zero, the classifier's own output is not a JSON object with a recognized decision, .cwd is missing/not a git working tree, or a checkout/restore path's own live git-diff check cannot be verified. Disclosed residual (not closed by this classifier): verb-token-splitting that never places the tool/verb name as its own literal token anywhere, e.g. string-slice reconstruction (cmd=uvinstall; eval \"${cmd:0:2} ${cmd:2}\") or array-literal-assignment indirection (A=(uv); V=(install); \"${A[@]}\" \"${V[@]}\") -- see hooks/gitapex_check_bash_safety.py's own module docstring. A bare 'git checkout SOMENAME' (single positional, not '.'/'..', no --) is a deliberate Non-goal: disambiguating a branch/ref name from a path needs a live ref-existence lookup this pure classifier does not perform.",
       "planes": ["pretooluse"],
       "local_exclusion": "PreToolUse-only: grades a Claude Code tool-call JSON payload arriving on stdin, which has no working-tree equivalent to reconstruct ahead of a push.",
       "trigger": "PreToolUse matcher Bash (hooks/hooks.json)",
@@ -101,7 +101,10 @@
         {"kind": "bash-pattern", "ref": "gh api -X|--method POST|PUT|PATCH|DELETE"},
         {"kind": "bash-pattern", "ref": "gh api -f|-F|--field|--raw-field"},
         {"kind": "bash-pattern", "ref": "gh api graphql ... mutation"},
-        {"kind": "bash-pattern", "ref": "git push"}
+        {"kind": "bash-pattern", "ref": "git push"},
+        {"kind": "bash-pattern", "ref": "git checkout -- PATH..."},
+        {"kind": "bash-pattern", "ref": "git checkout ."},
+        {"kind": "bash-pattern", "ref": "git restore [FLAGS] PATH..."}
       ]
     },
     {

hooks/check-bash-safety.sh

@@ -200,4 +200,82 @@ if [ "$is_git_push" = "true" ]; then
   fi
 fi
 
+# --- Finding 5: git checkout/restore gated on a live git-diff check (issue #1375) ---
+# `git checkout -- PATH` / `git restore PATH` / `git checkout .` can discard
+# uncommitted work on a tracked path with no warning at all. gitapex_check_bash_safety.py's
+# own classifier already extracted every candidate path such an invocation
+# could discard (its own "git checkout/restore path extraction" section),
+# soundly and with no live git call of its own. Unlike Finding 4's own
+# advisory provenance scan (surfaces candidates, does not decide -- warn,
+# not deny), "does git diff report a difference at this path" is a binary,
+# deterministic fact about repo state with no judgment-call axis, so a hit
+# here denies.
+checkout_restore_paths_count=$(printf '%s' "$classifier_output" | jq -r '.checkout_restore_paths | length // 0')
+if [ "$checkout_restore_paths_count" -gt 0 ]; then
+  # Read `.cwd` from the ORIGINAL tool-call payload, not
+  # `${CLAUDE_PROJECT_DIR:-$(pwd)}` the way Finding 4 above does -- a push
+  # is not cwd-relative, but a `git diff -- PATH` pathspec check is, and
+  # `.cwd` is Claude Code's own record of the Bash tool call's actual
+  # working directory (updated on every `cd` the session runs), not this
+  # hook runner's own. Replaying the near-miss's own exact command from a
+  # subdirectory must resolve the pathspec against the SAME tree bash
+  # itself would use.
+  cwd=$(printf '%s' "$input" | jq -r '.cwd // empty')
+  if [ -z "$cwd" ]; then
+    deny "Blocked by hooks/check-bash-safety.sh: this git checkout/restore command needs the PreToolUse payload's own .cwd field to check the right working tree against, but it was missing or empty. Failing closed."
+  fi
+  if ! git -C "$cwd" rev-parse --show-toplevel >/dev/null 2>&1; then
+    deny "Blocked by hooks/check-bash-safety.sh: '$cwd' is not inside a git working tree -- cannot verify this git checkout/restore command is safe. Failing closed."
+  fi
+  # A fresh repo with no commits yet has no HEAD to diff against
+  # (`git diff --quiet HEAD -- PATH` fails with "fatal: bad revision
+  # 'HEAD'", confirmed live, exit 128, not the "differs" exit 1) --
+  # compare against git's own well-known empty-tree object instead, so a
+  # genuinely clean fresh repo is not denied outright.
+  if git -C "$cwd" rev-parse --verify -q HEAD >/dev/null 2>&1; then
+    diff_base="HEAD"
+  else
+    diff_base="4b825dc642cb6eb9a060e54bf8d69288fbee4904"
+  fi
+  # Disclosed, accepted residual (round-3 independent review, issue #1375):
+  # a bare `git checkout -- PATH` / `git restore PATH` restores the
+  # WORKING TREE from the INDEX, not from HEAD -- so a path that was
+  # `git add`-ed with no further unstaged edit (worktree == index, but
+  # index != HEAD) is a genuine no-op checkout/restore, yet this check
+  # diffs against HEAD/the empty tree and denies it as if it would
+  # discard something. Confirmed live: stage a change with no further
+  # edit, then `git checkout -- PATH` changes nothing on disk, but this
+  # diff_base comparison still reports a difference. Deliberately left
+  # as-is rather than special-cased per flag combination (`--staged`
+  # alone already skips this check entirely below, since unstaging alone
+  # never discards file content) -- the failure direction is safe
+  # (over-denial only, matching every other explicit-source variant this
+  # check already treats the same conservative way; it never under-denies
+  # a real discard), and the existing deny message's `git checkout -m --`
+  # / `git add` remedies still resolve it as a false alarm the caller can
+  # work around.
+  # Fed via process substitution (`< <(...)`), not a pipe
+  # (`... | while read`) -- bash runs a pipe's right-hand side in a
+  # subshell, where `deny`'s own `exit 2` would only exit that subshell,
+  # letting this script fall through to its own `exit 0` past the loop
+  # instead of actually denying. Process substitution keeps the loop in
+  # THIS shell, so `exit 2` inside it really does exit the whole script.
+  while IFS= read -r encoded_path; do
+    [ -z "$encoded_path" ] && continue
+    # Each line is one base64-encoded path (issue #1375: a genuine JSON
+    # array from the classifier, base64-encoded here too) -- a path
+    # containing a newline or other shell-hazardous byte would otherwise
+    # split across `read` calls or corrupt this loop's own field
+    # splitting; base64 has neither.
+    path=$(printf '%s' "$encoded_path" | base64 -d)
+    diff_exit=0
+    git -C "$cwd" diff --quiet "$diff_base" -- "$path" || diff_exit=$?
+    if [ "$diff_exit" -eq 1 ]; then
+      deny "Blocked by hooks/check-bash-safety.sh: this git checkout/restore command would discard uncommitted changes at '$path'. Stash first (git stash push -- '$path') if this is not resolving a merge conflict; if it is, resolve and git add the path, or use git checkout -m -- '$path' to regenerate conflict markers instead of discarding them."
+    elif [ "$diff_exit" -ne 0 ]; then
+      deny "Blocked by hooks/check-bash-safety.sh: could not verify whether '$path' has uncommitted changes (git diff exited $diff_exit). Failing closed."
+    fi
+  done < <(printf '%s' "$classifier_output" | jq -r '.checkout_restore_paths[] | @base64')
+fi
+
 exit 0