The pre-commit name guard decodes one JSON escape layer per run of backslashes and never re-reads its own output, so a backslash spelled as the unicode escape of U+005C (or as %5C) decodes to a literal backslash that is not read again as an escape: a banned name hidden one layer behind such a backslash (the escaped backslash followed by u0075 and the rest of the name) commits, while scanner.DecodedViews reads it through its second layer (maxJSONDecodeLayers is 3). The carrier is a hand-crafted file, since no mainstream encoder writes a backslash that way; the hook comments claim the guard reads what the scanner's redactors read, which overclaims by exactly this case. Both hook copies (.githooks/pre-commit and internal/core/ahoy/defaults/pre-commit) carry the decode.

The pre-commit name guard decodes one JSON escape layer per run of backslashes and never re-reads its own output, so a backslash spelled as the unicode escape of U+005C (or as %5C) decodes to a literal backslash that is not read again as an escape: a banned name hidden one layer behind such a backslash (the escaped backslash followed by u0075 and the rest of the name) commits, while scanner.DecodedViews reads it through its second layer (maxJSONDecodeLayers is 3). The carrier is a hand-crafted file, since no mainstream encoder writes a backslash that way; the hook comments claim the guard reads what the scanner's redactors read, which overclaims by exactly this case. Both hook copies (.githooks/pre-commit and internal/core/ahoy/defaults/pre-commit) carry the decode.

Grounds

• pursued: a name behind one or two escape-spelled backslashes (unicode escape of U+005C, or %5C) is refused by both guard copies while clean escaped text commits; a staged spelling DecodedViews reads that the hook passes, or a decode_layers below maxJSONDecodeLayers, would show it wrong