Summary
audit-comment-residue's default-target router parses git status --porcelain with awk '{print $NF}'. Any path containing a space is split on that space, so the reconstructed path is wrong and the file is dropped from the target list. Git's porcelain quoting for such paths is also not stripped, which corrupts the path a second way.
The failure is silent and actively misleading: the run reports files=0 and prints the reassuring note no code targets, so the caller concludes the tree is clean when a real Tier 1 finding is present.
Observed in code-tidying@0.13.2, current at dff0942.
Where
plugins/code-tidying/skills/audit-comment-residue/scripts/detect.sh L105:
done < <(git status --porcelain 2>/dev/null | awk '{print $NF}')Reproduction
In a git repo, an untracked file named my helper.sh:
#!/usr/bin/env bash
# as you asked, retry three times before giving up
retry=3
Porcelain emits the path quoted:
The awk parse yields a mangled fragment, keeping the trailing quote and dropping everything before the space:
Default-target run, which should find the residue:
Summary total: files=0 T1=0 T2=0 T3=0
Note: no code targets — pass code file paths or edit some tracked code files
Control, same file passed explicitly:
Finding shape: conversational-antecedent
Finding line: 2
Finding excerpt: # as you asked, retry three times before giving up
Summary total: files=1 T1=1 T2=0 T3=0
The finding exists. Only the default-target path misses it.
Why this one matters more than a typical parse bug
A false negative in an audit tool is worse than an error. An error prompts a retry; a confident files=0 plus no code targets ends the investigation. The caller has no signal that anything was skipped.
Suggested fix
The sibling audit-noise already solves exactly this, in plugins/docs-hygiene/skills/audit-noise/scripts/detect.sh: it slices the path with ${line:3} instead of splitting on whitespace, takes the right-hand side of a -> rename, and strips the surrounding quotes git adds. Porting that block gives a proven in-repo fix rather than a new one, and closes the rename case at the same time (a renamed file currently resolves to the old path under awk '{print $NF}' only by accident of field order).
Worth a regression fixture with a space in the filename, since a plain-path fixture passes either implementation.
Summary
audit-comment-residue's default-target router parsesgit status --porcelainwithawk '{print $NF}'. Any path containing a space is split on that space, so the reconstructed path is wrong and the file is dropped from the target list. Git's porcelain quoting for such paths is also not stripped, which corrupts the path a second way.The failure is silent and actively misleading: the run reports
files=0and prints the reassuring noteno code targets, so the caller concludes the tree is clean when a real Tier 1 finding is present.Observed in
code-tidying@0.13.2, current atdff0942.Where
plugins/code-tidying/skills/audit-comment-residue/scripts/detect.shL105:Reproduction
In a git repo, an untracked file named
my helper.sh:Porcelain emits the path quoted:
The
awkparse yields a mangled fragment, keeping the trailing quote and dropping everything before the space:Default-target run, which should find the residue:
Control, same file passed explicitly:
The finding exists. Only the default-target path misses it.
Why this one matters more than a typical parse bug
A false negative in an audit tool is worse than an error. An error prompts a retry; a confident
files=0plusno code targetsends the investigation. The caller has no signal that anything was skipped.Suggested fix
The sibling
audit-noisealready solves exactly this, inplugins/docs-hygiene/skills/audit-noise/scripts/detect.sh: it slices the path with${line:3}instead of splitting on whitespace, takes the right-hand side of a->rename, and strips the surrounding quotes git adds. Porting that block gives a proven in-repo fix rather than a new one, and closes the rename case at the same time (a renamed file currently resolves to the old path underawk '{print $NF}'only by accident of field order).Worth a regression fixture with a space in the filename, since a plain-path fixture passes either implementation.