bug(bash-format): shfmt -w deletes .sh files instead of formatting on Windows worktree

[kyle-sexton]

Lane: babysit (cycle 32, amendment-round 16).

Triggering example: worker dispatched to melodic-software/medley#1624 prepared and verified a fix for a real codex P2 finding (aggregate-stats.sh silently empties committed data/stats/*.json on a clean checkout) but could not commit it — every attempt to Write/Edit the .sh file in this Windows worktree triggered the bash-format hook's shfmt -w, which deleted the file instead of formatting it in place. The worker's Bash-tool fallback was itself blocked by block-hook-bypass.sh, leaving no path to land a shell-script edit on this machine at all.

Observed: shfmt -w <file> run by the bash-format PostToolUse hook deletes the target .sh file on this Windows/Git-Bash environment instead of formatting it.

Expected: the hook formats the file in place (or fails loudly / no-ops) — it must never delete source under any environment.

Category: bug (destructive — data loss on a source file; also an operational blocker: no shell-script fix can currently land via Claude Code on this machine while this hook is active).

Not filed as a self-observation paper-cut: this clears the DEFER-FORBIDDEN / destructive-finding bar (rule 3b class 1), so it's standalone per the intake throttle's carve-out rather than a sweep-issue line.

[kyle-sexton]

This was generated by AI during triage.

TL;DR

The data-loss report is credible and stays priority: high, but on this exact host I isolated all three mutating hooks that fire on a .sh edit — end-to-end, one at a time — plus a 60-iteration parallel race, against the real aggregate-stats.sh under medley's real config with a Windows backslash path, and none deleted or emptied the file. shfmt -w is empirically exonerated as a standalone deleter, so the filed single-cause attribution ("shfmt -w deletes the file") is very likely wrong, and fixing bash-format in isolation would not address the loss. The report says the deletion happened on every attempt (deterministic) — which points away from the intermittent race and toward a single always-firing hook or a Claude-Code-level Edit↔hook interaction — yet each always-firing hook tested clean in isolation. Root cause is unconfirmed; routing is needs-human pending the worker's transcript.

All repro used throwaway files outside any tracked repo. Host: melo-lap-001, Git-Bash MINGW64, shfmt v3.13.1, bash 5.3.9, jq 1.8.2, shellcheck 0.11.0, perl 5.42 (cygwin), typos-cli 1.44.0.

The three mutating hooks that fire on a .sh Write/Edit

CC runs every matching PostToolUse hook in parallel for one tool call, with no cross-hook locking (documented as a KNOWN RISK in typos-format.sh:35-43). On a .sh, three hooks each read-modify-write the same file:

• bash-format → shfmt --apply-ignore -w (extension-scoped to .sh/.bash)
• eol-normalizer → perl -pi (or a mktemp+cp -p+mv fallback when perl is absent) — extension-unscoped, fires on every write
• typos-format → typos --write-changes — extension-unscoped, fires on every write

Isolation results — each hook run alone, end-to-end, real file + medley config + backslash path

Hook / mechanism	Result
bash-format.sh full hook, real file mis-indented, Edit payload, backslash path	present, reformatted 4441→4439 B, exit 0
bash-format shfmt -w — POSIX / backslash / forward-slash paths; --apply-ignore	all present, formatted
bash-format shfmt — syntax-error file	exit 1, file untouched (no truncation)
bash-format shfmt — .editorconfig ignore=true + --apply-ignore	file skipped, untouched
eol-normalizer.sh full hook, CRLF→LF (perl path)	present, CR 3→0
eol-normalizer perl-absent mktemp+mv fallback, backslash $file	mktemp/cp/tr/mv all rc=0, original present, no orphan
typos-format.sh full hook, real file, backslash path	present (4439 B), no orphan
All three underlying writes concurrently, 60 iterations	LOST=0 EMPTIED=0, no orphans

Not one path deleted or emptied the file.

Gate + version-drift checks (both ruled out as explanations)

• Opt-in gate: medley's root .editorconfig has a real shell section [*.{sh,bash,zsh}], so shell_editorconfig_opt_in is true and shfmt genuinely executed on aggregate-stats.sh. The exoneration above is therefore empirical, not "shfmt never ran."
• Version drift: installed cache holds bash-format 0.4.1–0.6.0; the shfmt … -w line is byte-identical in the oldest (0.4.1) and unchanged since feat: make missing hook prerequisites skip visibly (10 plugins) #328. No version the worker could have run differs in the accused call.

Real file provenance

aggregate-stats.sh is not on medley main; it lives at .work/cicd-fleet-audit/scripts/aggregate-stats.sh on branch docs/cicd-fleet-audit (4439 B, LF, heavy jq). Its own codex P2 finding is that the script jq … >"$OUT/…json" truncates each output file before jq runs, so on a clean checkout with no input NDJSON it leaves the committed data/stats/*.json empty — a bug in the script's execution, distinct from the hook deleting the .sh source. Worth confirming the two weren't conflated (see below).

Residual hypotheses I could NOT clear (need loss-time state I cannot recreate)

1. Claude-Code Edit-tool ↔ content-mutating-hook interaction. Every successful Edit triggers shfmt, which reindents the file; a subsequent Edit whose old_string predates the reformat no longer matches. This is a real friction class between the Edit tool and formatter hooks; whether CC's write-reconcile can end in a lost/zeroed file on Windows is a harness question, not a plugin one, and I cannot drive it from a hook harness.
2. Conflation with the script's own data-loss. If the fix was verified by running aggregate-stats.sh (or its tests), the script's >-truncation emptied data/stats/*.json; confirm the reported "deleted file" was the .sh itself, 0 bytes vs truly absent.
3. Loss-time environment divergence — a hook timeout SIGKILL mid-write under heavy parallel spawn load (bash-format declares timeout: 15), or a tool/PATH state I can't reconstruct.

Recommendation

1. Do not autonomously "fix" bash-format. shfmt is proven safe here across every path form, the real file, and the full hook; its call is identical across all versions. A guard added there would not address the reported loss.
2. If systemic hardening is wanted regardless of the exact culprit (best-practice, low regret): give the mutating PostToolUse hooks a shared per-file advisory lock so they serialize instead of racing — the flock primitive already exists in the shared hook-utils.sh (hook::append_jsonl) — plus crash-safe mutation (verify the target exists and is non-empty after the step; restore from a same-run backup on loss; surface errors instead of 2>/dev/null-swallowing them). This lives in the lib/hook-utils.sh SSOT and touches bash-format + eol-normalizer + typos-format; flock's reliability on MSYS/Windows must be verified before relying on it.
3. Need from the worker / medley worktree at loss-time (discriminates the residuals; I cannot reconstruct it): was the .sh 0 bytes or truly absent? any orphan …aggregate-stats.sh.XXXXXX temp? which tool wrote last / any hook-timeout message? was the script executed during verification? was perl on PATH?

Routing

needs-human. Severity is real and stays high, but I disproved the filed root cause and could not reproduce the loss by any mechanism — each of the three always-firing mutating hooks is individually safe on the real file + config + Windows path, and even the documented parallel race does not delete or empty the file in 60 concurrent trials. The narrow open question — what actually removed the file, and which layer (a plugin hook vs. the Claude-Code Edit tool itself) — is answerable only from the worker's transcript / loss-time state, not from post-hoc reproduction.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Promote to agent-ready.

Small scoped bug with a bounded blast radius and enough specification for autonomous pickup. Removed needs-human, added agent-ready.

Re-open trigger: If implementation reveals an unresolved design fork or security policy decision.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave.

Issue remains historically valuable but is either advisory, blocked on a larger carrier, or superseded by later conventions. Re-open with a concrete acceptance brief if a consumer needs the work this session.

Title: bug(bash-format): shfmt -w deletes .sh files instead of formatting on Windows worktree