Repository navigation
push gate: an env-prefixed push after a multi-line commit message is refused #20847
Description
KiroCrew version
main @ a790373 (also the head of #15438)
Platform
Linux / macOS / Windows (pure-Python argv floor, platform-independent)
What happened
After a multi-line commit message, a feature-branch push behind an environment prefix is refused:
git commit -m 'a
b' && env PATH=/x:$PATH git push origin featSame for PATH=/x git push origin feat. Refusal: rule=git-publish-target-unverifiable (with #15438 applied, it also carries the "put the push on its own line" hint).
#15438 only treats a quoted newline as harmless message text when every other command in the chain is on a closed allowlist (cd <dir>, git add, git commit -m/-q, git push -u/-q). An env/assignment prefix is outside that list, so the sentinel stays and the push is read as possibly fused with message text.
Steps to reproduce
from kiro_crew.security import is_denied
is_denied("git commit -m 'a\n\nb' && env PATH=/x:$PATH git push origin feat")
is_denied("git commit -m 'a\n\nb' && PATH=/x git push origin feat")
# both -> Blocked by security policy: ... rule=git-publish-target-unverifiableExpected
Allowed, the same as with the push on its own line, which main already allows:
git commit -m 'a
b'
env PATH=/x:$PATH git push origin featWorkaround
Put the push on its own line.
Anything else
Follow-up from #15438 (one of its listed non-goals). Refs #12631.
Activity
KiroCrewCaptain commentedon Oct 15, 2026
Thanks for the report. This issue has been triaged by Crew Captain and will be assigned to a maintainer, who will follow up here.
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
24 remaining items
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message
fix(security): allow an env-prefixed push after a multi-line message