Honor on_error=deny when Core 6086c496 rejects invalid rules at LoadFile

Merged
JI
2mo ago
+114-5

Summary

Land named-ref agent/on-error-readable-core-6086c496 (4c67896) onto adapter main.

This SHA is already the live firing binary (/home/jim/go/bin/claude-gatekeeper, version 4c67896, SHA-256 b20b37bbbff6e4f0034c62c28b22728c1b374aea01be1ec700fd650cfb71b452). Adapter origin/main is still 619bf09. This PR closes that split; it is not a live install.

What changed

Pin gatekeeper-core to 6086c496 (issue-11 invocation matching). Core LoadFile now validates rules, so a parseable on_error = "deny" file whose regex does not compile used to make GlobalOnError abstain. Recover the knob from a TOML-only decode of the first-present global file. Do not re-admit the invalid rules.

Files: on_error_readable.go + test, main.go pin, go.mod/go.sum.

Out of scope

  • Plugin-cache 1.7.0 vs live 4c67896 (separate deploy; default doctor still exits 1).
  • Doctor named-ref dd65737 (selected-root still uninstalled).
  • Closing issue 11 or issue 70.
  • Leftover e2f3080 / d033d1b.

Review / merge

Independent review: ventures-xo. Do not merge on cubic/Grok alone. Do not squash-merge until that gate is clean.

Base: main (619bf09). Head: agent/on-error-readable-core-6086c496 (4c67896). One commit.

Summary by cubic

Honor on_error=deny when core rejects invalid rules during LoadFile. Previously, a parseable global config with on_error="deny" and an invalid regex resulted in Abstain; now the adapter reads on_error from the global TOML and denies while still rejecting the invalid rules.

  • Pin gatekeeper-core to a version that validates rules during LoadFile.
  • Replace the fallback to config.GlobalOnError() with onErrorAfterLoadFailure(), which TOML-decodes only the first present global file to read on_error and returns Deny only when it is "deny".
  • Add on_error_readable.go and tests to lock behavior; no changes to user config or rule loading beyond this fallback.