fix(git-http): log access-hook denial detail to stdout #161

2026-06-02T23:13:39-04:00

didericis-claude commented

2026-06-02 23:13:39 -04:00

Summary

When the access-hook returned non-zero, git-http piped its stderr into the 403 body sent back to the agent's git client but never logged it locally. Operators saw "GET /repo.git/info/refs?... 403 -" in docker logs with no explanation and had to shell into the sidecar to re-run the hook by hand.

This change routes the hook's stderr/stdout through the existing log_message channel before sending the 403:

One log line per output line so the default request-log format stays readable.
If the hook exits non-zero with no output, the log line still includes the exit code.
Wire format / 403 body to the client is unchanged.

Why now

Surfaced today while diagnosing a failed clone from inside a claude-dev bottle. Docker showed only 403 -; the actual cause (ssh: connect to host gitea.dideric.is port 30009: Connection refused from the access-hook's upstream fetch) was only visible after manually invoking /etc/git-gate/access-hook inside the sidecar.

Test plan

pytest tests/unit/test_git_http_backend.py — 8/8 pass, including two new tests
- test_access_hook_denial_is_logged_to_stdout — stderr message appears on stdout and in 403 body
- test_access_hook_denial_without_output_logs_exit_code — empty-output denials still log the exit code
Full unit suite (excluding pre-existing unrelated test_smolmachines_pty_resize stdin failure): 867 pass

🤖 Generated with Claude Code

## Summary When the access-hook returned non-zero, git-http piped its stderr into the 403 body sent back to the agent's git client but never logged it locally. Operators saw `"GET /repo.git/info/refs?... 403 -"` in `docker logs` with no explanation and had to shell into the sidecar to re-run the hook by hand. This change routes the hook's stderr/stdout through the existing `log_message` channel before sending the 403: - One log line per output line so the default request-log format stays readable. - If the hook exits non-zero with no output, the log line still includes the exit code. - Wire format / 403 body to the client is unchanged. ## Why now Surfaced today while diagnosing a failed clone from inside a claude-dev bottle. Docker showed only `403 -`; the actual cause (`ssh: connect to host gitea.dideric.is port 30009: Connection refused` from the access-hook's upstream fetch) was only visible after manually invoking `/etc/git-gate/access-hook` inside the sidecar. ## Test plan - [x] `pytest tests/unit/test_git_http_backend.py` — 8/8 pass, including two new tests - `test_access_hook_denial_is_logged_to_stdout` — stderr message appears on stdout *and* in 403 body - `test_access_hook_denial_without_output_logs_exit_code` — empty-output denials still log the exit code - [x] Full unit suite (excluding pre-existing unrelated `test_smolmachines_pty_resize` stdin failure): 867 pass 🤖 Generated with [Claude Code](https://claude.com/claude-code)

didericis approved these changes 2026-06-02 23:29:30 -04:00

didericis added 1 commit 2026-06-02 23:29:43 -04:00

fix(git-http): log access-hook denial detail to stdout

test / unit (pull_request) Successful in 33s

Details

test / integration (pull_request) Successful in 39s

Details

test / unit (push) Successful in 43s

Details

test / integration (push) Successful in 59s

Details

f427d35e72

Previously when the access-hook returned non-zero, git-http would pipe
the hook's stderr into the 403 body sent back to the agent's git
client but never log it locally, so docker logs just showed
`"GET ... 403 -"` with no explanation. Operators had to shell into
the sidecar and re-run the hook by hand to find out why a clone was
being refused (e.g. upstream SSH unreachable, missing credentials).

Route the hook's stderr/stdout through the existing log_message
channel before sending the 403, one log line per output line so the
default request-log format stays readable. When the hook exits
non-zero with no output, log the exit code so the line is still
informative.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

didericis force-pushed fix-git-http-log-403-detail from b5b694acb8 to f427d35e72

2026-06-02 23:29:43 -04:00

Compare

didericis merged commit f427d35e72 into main

2026-06-02 23:41:59 -04:00

didericis deleted branch fix-git-http-log-403-detail

2026-06-02 23:42:00 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#161