Development record
With CDPATH exported in the hook's environment, the new CDPATH block (iss-2610111600031244) blocks every bare `cd name`, on the line and inside every script the guard reads (`bash build.sh` whose build.sh runs `cd sub` blocks as script-unread), including where only one directory can match; and the message never says the CDPATH came from the environment, so a person whose line never mentions CDPATH is told to edit a third-party script's cd. Found by the Fable review of lane G, 2026-10-11 (cdSearchesCDPATH: if !set { return rc.files.cdpath != "" }).
issueresolvedminoriss-2610111749083184
With CDPATH exported in the hook's environment, the new CDPATH block (iss-2610111600031244) blocks every bare cd name, on the line and inside every script the guard reads (bash build.sh whose build.sh runs cd sub blocks as script-unread), including where only one directory can match; and the message never says the CDPATH came from the environment, so a person whose line never mentions CDPATH is told to edit a third-party script's cd. Found by the Fable review of lane G, 2026-10-11 (cdSearchesCDPATH: if !set { return rc.files.cdpath != "" }).
Frontmatter
| id | iss-2610111749083184 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610111749083184-guard-cdpath-block-reach-and-message.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610111600031244The guard's script reader resolves a different file than bash runs in three ways: after `cd` it keeps the logical path (so `cd -P link && bash ../s.sh` judges the file beside the link while bash runs the one beside its target), it ignores `CDPATH`, and `source` of a bare name ignores a `PATH` prefix on the same command. Each lets a planted script carrying a bundled blocker run with exit 0.