magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
2 min read

filter-without-input

An advisory by default: it explains, and blocks nothing, on a filter with no file, pipe or redirect, which reads a stdin nothing feeds.

What it catches

A filter with no file, pipe or redirect, which reads a stdin nothing feeds.

Why

A filter given no input reads stdin, and under an agent harness stdin is the harness's own: where the harness holds it open, nothing writes to it and nothing closes it, so the call waits past the tool timeout and goes on waiting in the background. Name the input: a file operand, a pipe into the command, or a <, << or <<< redirect on it or on a loop or block around it. It reads each tool's own flag grammar, so grep -e pat file, jq --arg k v . f and head -n 5 file are fed, and tr, tee and xargs fire whenever nothing feeds them, because their operands are never input. A recursive grep with no path passes: GNU grep, macOS's BSD grep and the ugrep a host may put behind grep all search the working directory then. What the guard cannot classify passes, because it refuses only what it can prove: an unknown flag, an unquoted expansion that may split into several words, jq -n, an awk program with a BEGIN block, a command inside a function body. ripgrep with no path passes for the same reason: it searches the working directory unless stdin is a pipe or a file, which a hook cannot see.

Default and override

By default this rule takes the decision advise. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"filter-without-input": "deny"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

advise [filter-without-input]: ...

magus describe rule filter-without-input prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. busy-wait: a loop that only sleeps between polls, holding a tool slot for its whole waitAn advisory by default: it explains, and blocks nothing, on a loop that only sleeps between polls, holding a tool slot for its whole wait. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillAn advisory by default: it explains, and blocks nothing, on the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill. capture-filter: a filter over a run capture or log, which cuts the failure block apartAn advisory by default: it explains, and blocks nothing, on a filter over a run capture or log, which cuts the failure block apart.
guardrulesfilter-without-inputadvise
Last updated (1a76274f)
Earlier changes on this page (2)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs: magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Advisor

One read-only check from the advice suite: it reads the changeset through magus and writes one titled section of findings. The same advisors run as a pull request comment in CI and inside magus diff --impact locally.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.