From a6bd481e61a6f0435b0dc8f6c3b454c39e0959e9 Mon Sep 17 00:00:00 2001
From: Dave Morin <dave@morin.com>
Date: Fri, 8 May 2026 00:59:09 -0700
Subject: [PATCH 1/3] fix(hooks): replace unsafe eval with declare in
 check-config.sh

The load_env_vars function used eval to assign .env values, which
executes command substitutions in backtick-containing comments.
Replace eval with declare and strip inline comments before assignment.

Fixes #361
---
 hooks/scripts/check-config.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hooks/scripts/check-config.sh b/hooks/scripts/check-config.sh
index bc57dd5..3f28b03 100755
--- a/hooks/scripts/check-config.sh
+++ b/hooks/scripts/check-config.sh
@@ -33,8 +33,11 @@ load_env_vars() {
       [[ -z "$key" ]] && continue
       key=$(echo "$key" | xargs)
       value=$(echo "$value" | xargs | sed 's/^["'\''"]//;s/["'\''"]$//')
+      # Strip inline comments (# preceded by whitespace) to prevent
+      # command substitution in backtick-containing comments
+      value="${value%%[[:space:]]#*}"
       if [[ -n "$key" && -n "$value" ]]; then
-        eval "ENV_${key}=\"${value}\""
+        declare "ENV_${key}=${value}"
       fi
     done < "$file"
   fi

From 7506cbd5426c7c88876aff5e04b9441995b4dcff Mon Sep 17 00:00:00 2001
From: Trevin Chow <trevin@trevinchow.com>
Date: Sat, 16 May 2026 23:35:19 -0700
Subject: [PATCH 2/3] fix(hooks): scope ENV_* to global (declare -g) so caller
 sees values

---
 hooks/scripts/check-config.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hooks/scripts/check-config.sh b/hooks/scripts/check-config.sh
index 3f28b03..c5a8f09 100755
--- a/hooks/scripts/check-config.sh
+++ b/hooks/scripts/check-config.sh
@@ -37,7 +37,7 @@ load_env_vars() {
       # command substitution in backtick-containing comments
       value="${value%%[[:space:]]#*}"
       if [[ -n "$key" && -n "$value" ]]; then
-        declare "ENV_${key}=${value}"
+        declare -g "ENV_${key}=${value}"
       fi
     done < "$file"
   fi

From 46cf2328aad83094f0b4d13afc2778ebb90168fa Mon Sep 17 00:00:00 2001
From: Trevin Chow <trevin@trevinchow.com>
Date: Sat, 16 May 2026 23:49:44 -0700
Subject: [PATCH 3/3] fix(hooks): use printf -v for bash 3.2 compat (declare -g
 is 4.2+)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

macOS ships /bin/bash 3.2 and the script uses #!/bin/bash with
set -euo pipefail, so declare -g would abort the SessionStart hook
with "invalid option" on every Mac. printf -v writes via assignment
semantics (global from inside a function on 3.2+) — same scope
outcome, broader compatibility.
---
 hooks/scripts/check-config.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hooks/scripts/check-config.sh b/hooks/scripts/check-config.sh
index c5a8f09..bb20a6e 100755
--- a/hooks/scripts/check-config.sh
+++ b/hooks/scripts/check-config.sh
@@ -37,7 +37,9 @@ load_env_vars() {
       # command substitution in backtick-containing comments
       value="${value%%[[:space:]]#*}"
       if [[ -n "$key" && -n "$value" ]]; then
-        declare -g "ENV_${key}=${value}"
+        # printf -v writes via assignment semantics (global from inside a
+        # function), works on macOS's /bin/bash 3.2 — `declare -g` is 4.2+.
+        printf -v "ENV_${key}" '%s' "$value"
       fi
     done < "$file"
   fi