Skip to content

Feat/copilot cli skill parity rebased#68

Merged
josealekhine merged 2 commits intomainfrom
feat/copilot-cli-skill-parity-rebased
Apr 14, 2026
Merged

Feat/copilot cli skill parity rebased#68
josealekhine merged 2 commits intomainfrom
feat/copilot-cli-skill-parity-rebased

Conversation

@josealekhine
Copy link
Copy Markdown
Member

Closes: #63

Combines two in-flight workstreams into one commit.

Docstring namespace sweep (parallel agent)

Follow-up to the CLI namespace cleanup in 78fbdf7. Updates
doc comments, blog posts, recipes, and the regenerated site to
reflect current command names (e.g. ctx pausectx hook pause,
ctx resumectx hook resume, ctx messagectx hook message).
Also refreshes the Copilot CLI integration skills added in
edaac81 (PR #63) to match the new namespace.

Scope: ~450 files across docs/, site/, internal/cli, internal/write,
internal/config, .github/, integration skill templates, and .claude/
skill SKILL.md files.

Git push regex hardening (this session)

The block-dangerous-command hook's MidGitPush regex only matched
git push mid-command after ;, &&, or ||. This session
accidentally bypassed it with git -C <path> push — the permissions
deny list Bash(git push *) only matches prefix git push, so
git -C <path> push also slipped through.

Replace MidGitPush with a broader GitPush that covers:

  • Bare git push at command start
  • All separator and subshell entry points (;, &&, ||, |, &,
      (, $(, backtick, newline)
  • Env-var and command-wrapper prefixes (GIT_DIR=/x git push,
      time git push, nice git push)
  • Any flag shape between git and push (-C path, -c key=val,
      --git-dir=/path, --no-pager, --bare, -p, -P)
  • Tail anchor that distinguishes subcommand from ref names
      (push-to-remote, push_branch) via [^a-zA-Z0-9._/-]|$

Documented trade-offs: accepted false positives on git log push
and git commit -m push (push as literal arg); known blind spots
for eval / sh -c quoting and shell aliases.

Adds internal/config/regex/cmd_test.go with 42 table-driven cases
covering all entry points, flag shapes, prefixes, negative cases
(other subcommands, ref-name continuations), and the accepted
false-positive classes.

Renames the Go symbol MidGitPushGitPush to accurately
reflect scope; keeps legacy variant string mid-git-push and text
key block.mid-git-push (user-facing message is already generic:
"git push requires explicit user approval").

Spec: specs/git-push-regex-hardening.md
Spec: specs/cli-namespace-cleanup.md
Signed-off-by: Jose Alekhinne jose@parlakisik.com

bilersan and others added 2 commits April 13, 2026 18:59
Port all 40 Claude skills to Copilot CLI format with proper YAML
frontmatter (tools array instead of allowed-tools string). Includes
lifecycle hook scripts (bash + PowerShell), agent instructions, and
hook configuration.

Contents:
- 40 skill SKILL.md files under integrations/copilot-cli/skills/
- 8 hook scripts (session-start/end, pre/post-tool-use × bash/ps1)
- INSTRUCTIONS.md agent bootstrap instructions
- ctx-hooks.json lifecycle hook configuration
- Updated embed.go to include integrations assets
- Parity spec document (specs/copilot-feature-parity-kit.md)

Signed-off-by: ersan bilik <ersanbilik@gmail.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: ersan bilik <ersanbilik@gmail.com>
Combines two in-flight workstreams into one commit.

## Docstring namespace sweep (parallel agent)

Follow-up to the CLI namespace cleanup in 78fbdf7. Updates
doc comments, blog posts, recipes, and the regenerated site to
reflect current command names (e.g. `ctx pause` → `ctx hook pause`,
`ctx resume` → `ctx hook resume`, `ctx message` → `ctx hook message`).
Also refreshes the Copilot CLI integration skills added in
edaac81 (PR #63) to match the new namespace.

Scope: ~450 files across docs/, site/, internal/cli, internal/write,
internal/config, .github/, integration skill templates, and .claude/
skill SKILL.md files.

## Git push regex hardening (this session)

The `block-dangerous-command` hook's `MidGitPush` regex only matched
`git push` mid-command after `;`, `&&`, or `||`. This session
accidentally bypassed it with `git -C <path> push` — the permissions
deny list `Bash(git push *)` only matches prefix `git push`, so
`git -C <path> push` also slipped through.

Replace `MidGitPush` with a broader `GitPush` that covers:

- Bare `git push` at command start
- All separator and subshell entry points (`;`, `&&`, `||`, `|`, `&`,
  `(`, `$(`, backtick, newline)
- Env-var and command-wrapper prefixes (`GIT_DIR=/x git push`,
  `time git push`, `nice git push`)
- Any flag shape between `git` and `push` (`-C path`, `-c key=val`,
  `--git-dir=/path`, `--no-pager`, `--bare`, `-p`, `-P`)
- Tail anchor that distinguishes subcommand from ref names
  (`push-to-remote`, `push_branch`) via `[^a-zA-Z0-9._/-]|$`

Documented trade-offs: accepted false positives on `git log push`
and `git commit -m push` (push as literal arg); known blind spots
for `eval` / `sh -c` quoting and shell aliases.

Adds `internal/config/regex/cmd_test.go` with 42 table-driven cases
covering all entry points, flag shapes, prefixes, negative cases
(other subcommands, ref-name continuations), and the accepted
false-positive classes.

Renames the Go symbol `MidGitPush` → `GitPush` to accurately
reflect scope; keeps legacy variant string `mid-git-push` and text
key `block.mid-git-push` (user-facing message is already generic:
"git push requires explicit user approval").

Spec: specs/git-push-regex-hardening.md
Spec: specs/cli-namespace-cleanup.md
Signed-off-by: Jose Alekhinne <jose@parlakisik.com>
@josealekhine josealekhine self-assigned this Apr 14, 2026
@josealekhine josealekhine requested a review from bilersan as a code owner April 14, 2026 08:22
@josealekhine josealekhine merged commit 7007bc1 into main Apr 14, 2026
11 of 12 checks passed
@josealekhine josealekhine deleted the feat/copilot-cli-skill-parity-rebased branch April 14, 2026 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants