refactor(machine-specific-paths): source shared machine-path pattern bodies

[kyle-sexton]

The action's per-OS regex bodies were a hand-synced copy of the same bodies carried by the guardrails plugin (claude-code-plugins) and medley's tools/shared/path-detection. The bodies now live in machine-path-patterns.sh — the standards-managed materialization added by melodic-software/standards#172 — and the driver keeps only its own wrapping (PATH_BOUNDARY prefix, git-grep execution). Byte-identical to the canonical, so the first sync reconciles as a no-op. Positive and negative smoke verified (planted C:/Users violation detected; clean tree passes).

Closes #138

Related

• feat(distribution): add path-detection component with shared machine-path regex bodies standards#172 (canonical component + manifest)
• Source the standards-managed machine-path pattern bodies in the guardrails path-detection lib claude-code-plugins#301, melodic-software/medley#1566 (sibling consumer refactors)

🤖 Generated with Claude Code

https://claude.ai/code/session_01S3Gt4Q3aggmM2Gb72aRmkr

[claude]

Claude finished @kyle-sexton's task in 1m 38s —— View job

---

Review

This is a clean, low-risk refactor. The mechanics are solid and there's no functional regression. A few things worth noting:

---

Pattern fidelity — verified byte-identical

All 5 regex bodies transferred without alteration:

Old variable	New variable	Match
WIN_USER_BODY	HPP_WIN_USER_BODY	✓
MACOS_USER_BODY	HPP_MACOS_USER_BODY	✓
LINUX_USER_BODY	HPP_LINUX_USER_BODY	✓
WIN_REPO_BODY	HPP_WIN_REPO_BODY	✓
ESCAPED_WIN_REPO_BODY	HPP_ESCAPED_WIN_REPO_BODY	✓

---

Sourcing mechanics

The source line uses ${BASH_SOURCE[0]%/*} to construct the library path, which is the right idiom here. Under set -euo pipefail (line 9), a missing or unreadable machine-path-patterns.sh causes an immediate hard exit — exactly the fail-closed behaviour you want. No extra guard needed.

One edge case to be aware of: if the script is ever invoked as a bare name with no path separator in BASH_SOURCE[0] (e.g. bash check-machine-specific-paths.sh from within the action directory), %/* leaves the string unchanged and the resolved path becomes check-machine-specific-paths.sh/machine-path-patterns.sh, which will fail. This can't happen through GitHub Actions' normal invocation (scripts are always called with absolute paths), so it's not a blocking issue — just something to keep in mind if the script is ever tested locally.

---

Library file structure

machine-path-patterns.sh correctly follows the define-only library contract:

• No shebang (sourced, not executed directly) — correct
• No set -e / set -u — correct (must not alter the caller's shell state)
• No I/O, no env reads, no exit calls — correct
• HPP_ namespace prefix avoids collision with caller variables

---

ShellCheck annotations

Both files carry the right directives:

• # shellcheck shell=bash on the library (no shebang to infer from) — correct
• # shellcheck disable=SC2034 at file scope in the library (all variables are "unused" here by design) — correct
• # shellcheck source=machine-path-patterns.sh in the driver (enables SC to resolve the HPP_* names) — correct
• # shellcheck disable=SC1003 scoped to the escaped-repo body only — carried over correctly from the original

---

Security

No new attack surface. The path passed to source is derived from the script's own location (BASH_SOURCE[0]), not from any user-controlled or environment input. The patterns are unchanged, so detection coverage is identical.

---

Overall: Approved from a correctness and security standpoint. The refactor is straightforward and the implementation matches the stated intent.