fix(hooks): merge_guard hardening — bound ReDoS prefixes + output-side process-sub (#1001, #1002)

[michael-wojcik]

Summary

Hardens the merge_guard PreToolUse(Bash) security control by closing two pre-existing defects surfaced during the #933 / PR #1000 review. Both are scoped, INV-D2-aware fixes with non-vacuous regression proofs.

What landed

F1 — bound O(n²) backtracking in global-flag prefixes (#1001) · 45c406cf

• The pre-existing unbounded (?:\S+\s+)* in _GH_GLOBAL_FLAGS / _GIT_GLOBAL_FLAGS (shared/merge_guard_common.py) and the two inline httpie copies (merge_guard_pre.py) walk across shell separators and never self-terminate → O(n²) on a many-anchor witness. Bounded to (?:\S+\s+){0,32} via a new _MAX_GLOBAL_FLAG_TOKENS constant. Empirically linear on both independently-quadratic call sites (is_dangerous_command + detect_command_operation_type).
• Fixed in the SHARED module to preserve the merge_guard_pre: compound-detector false-positives 2>&1 + classification asymmetry + single-use token forces re-approval on retries #720 pre/post classifier centralization.

F2 — catch output-side process-substitution under-block (#1002) · 1d921b4c

• _has_process_substitution_to_shell matched only input-side bash <(...), missing the output-side … > >(bash) form. For the echo/printf carriers (the only true stdout vectors), echo "<danger>" > >(bash) was a real under-block. Added an output-side arm, kept pre-local (post has no execution-gating strip surface — no merge_guard_pre: compound-detector false-positives 2>&1 + classification asymmetry + single-use token forces re-approval on retries #720 asymmetry).
• INV-D2 monotonically safe by construction (the guard is a strip-SKIP condition; widening only adds detection). Over-block bounded to shell targets (tee/cat/2> excluded).

Tests · be4de4ae (#1001 perf), 247c4d22 (#1002 output-side)

• New test_merge_guard_perf.py: scaling-ratio + generous absolute ceiling on both quadratic paths + the httpie copy.
• New test_merge_guard_output_side_process_sub.py: 39 cases (output-side positives with dangerous payloads, stderr/non-shell/plain-file exclusions, input-side parity).
• Bidirectional counter-test-by-revert proves every guarantee is coupled to the fix (removal-revert for the under-block positive; distinct broaden-mutations for each over-block exclusion).
• Full suite: 9290 passed, 0 failures, 0 errors.

Version · d9ed2379 — PATCH bump to 4.4.34 (hardening, not a new user-facing capability).

Why

merge_guard is a security control governed by INV-D2: never weaken detection of a real executing destructive op; over-block is acceptable, under-block is a hole. F2 closes a real under-block; F1 removes a DoS without changing the match set within the realistic envelope.

Known residual (documented, accepted)

F1's {0,32} bound carries a narrow, threat-model-justified residual under-block: a command with >32 valid global tokens (e.g. git -c k=v × 17 = 34 tokens, push --force) executes yet is missed. Accepted as a documented tradeoff vs the O(n²) DoS under the operator/LLM-authored threat model (not adversarial network input; self-padding to evade one's own guard is self-defeating). _MAX_GLOBAL_FLAG_TOKENS is raisable to 64 (still O(1)) if deemed material.

Closes #1001
Closes #1002