Found during the v1.2.0 UAT (2026-07-12), then immediately self-demonstrated: filing THIS issue via the gh CLI was blocked by the gate, because the issue body contains the trigger phrase as a quoted substring.
The PreToolUse gate blocks any Bash/PowerShell command whose text contains the substring "gh pr create" — including commands that merely quote or mention it (issue bodies, commit messages, echo statements). It fails closed, so there is no security impact; purely a false-positive ergonomics issue.
Fix direction: tokenize the command (shlex) and match gh + pr + create as leading argv tokens (respecting command separators like &&, ;, |), or at minimum anchor the match to word boundaries outside quoted strings. Low severity, backlog.
Workaround meanwhile: put text containing the phrase in a file and pass it via --body-file so the command line itself stays clean.
Found during the v1.2.0 UAT (2026-07-12), then immediately self-demonstrated: filing THIS issue via the gh CLI was blocked by the gate, because the issue body contains the trigger phrase as a quoted substring.
The PreToolUse gate blocks any Bash/PowerShell command whose text contains the substring "gh pr create" — including commands that merely quote or mention it (issue bodies, commit messages, echo statements). It fails closed, so there is no security impact; purely a false-positive ergonomics issue.
Fix direction: tokenize the command (shlex) and match gh + pr + create as leading argv tokens (respecting command separators like
&&,;,|), or at minimum anchor the match to word boundaries outside quoted strings. Low severity, backlog.Workaround meanwhile: put text containing the phrase in a file and pass it via --body-file so the command line itself stays clean.