[BUG] security-guidance truncates diffs at embedded "diff --git " source text

Summary

parse_diff_into_files splits the entire diff on every occurrence of diff --git , including occurrences inside source lines. An ordinary string literal can therefore truncate the diff forwarded to security review.

Source audit and local reproduction at commit 3deb873687379f0c199a69fdaccc65f0865f7a29, Windows / Python 3.13. No Claude CLI/model version was exercised.

Reproduce

Run the following Python from the repository root. It creates a temporary Git repository; the generated source files are never executed.

import subprocess, sys, tempfile
from pathlib import Path
sys.dont_write_bytecode = True
sys.path.insert(0, str(Path.cwd() / "plugins/security-guidance/hooks"))
from gitutil import parse_diff_into_files

with tempfile.TemporaryDirectory() as tmp:
    repo = Path(tmp)
    def git(*args):
        return subprocess.check_output(
            ["git", "-c", "core.hooksPath=/dev/null", *args],
            cwd=repo).decode("utf-8")
    git("init", "-q")
    git("-c", "user.name=Audit", "-c", "user.email=audit@example.invalid",
        "commit", "--allow-empty", "-qm", "baseline")
    (repo / "embedded.py").write_text(
        'prefix = "diff --git "\nprint("AFTER_MARKER")\n', encoding="utf-8")
    (repo / "normal.py").write_text(
        'print("CONTROL_MARKER")\n', encoding="utf-8")
    git("add", ".")
    diff = git("diff", "--cached", "--no-color", "--no-ext-diff", "HEAD")
    parsed = dict(parse_diff_into_files(diff))
    print(repr(parsed["embedded.py"]))
    assert "AFTER_MARKER" in diff
    assert "AFTER_MARKER" not in parsed["embedded.py"]  # defect
    assert "CONTROL_MARKER" in parsed["normal.py"]
    git("-c", "user.name=Audit", "-c", "user.email=audit@example.invalid",
        "commit", "-qm", "fixture")
    committed = dict(parse_diff_into_files(
        git("show", "-p", "--no-color", "--no-ext-diff", "HEAD", "--")))
    assert "AFTER_MARKER" not in committed["embedded.py"]

Actual versus expected

Actual parsed embedded.py diff:

@@ -0,0 +1,2 @@
+prefix = "

The remainder of the string line and the following print("AFTER_MARKER") addition disappear. The subsequent real normal.py diff remains intact. Expected: both complete added lines survive parsing; only actual file-header lines delimit files.

Cause and security-review impact

gitutil.py uses diff_output.split("diff --git ") without restricting the delimiter to actual header lines. The single-shot reviewer builds its input from the parsed diff strings, so the omitted tail cannot be reviewed through that input. A contributor could intentionally place this marker before a change.

This is a demonstrated parser/input-coverage defect, not prompt injection, an end-to-end model false-negative result, RCE, or sandbox escape. The agentic reviewer still receives the file path and can read the complete file, so a universal agentic-review bypass is not established.

Duplicate check and related report

Targeted public issue/PR searches for parse_diff_into_files, embedded diff markers, and security-guidance diff parsing found no matching report. PR #76274 concerns downstream path normalization and does not change this split operation. Separate quoted-header defect: #101547.