Skip to content

fix(fleet): detector-findings producers share two latent defects in their own copies of esc() and repo-root resolution #3203

Description

@kyle-sexton

Context

Both defects were identified by #3180 (now closed as superseded — see its closing comment). #3202 fixes them in docs-hygiene:audit-noise only. Each producer carries its own copy of the affected code, so the same defects are live in the siblings.

Known producers with an emit-findings.sh:

Defect 1 — esc() is not idempotent

function esc(s) { gsub(/\|/, "\\|", s); return s }

A pipe the source already escaped gets double-escaped: a \| ba \\| b. GFM reads that as a literal backslash followed by a live delimiter, so the row splits and the fix action misreads it — a well-formed-looking row with the wrong cells.

Confirmed reproducible, and this repo writes literal \| in its own markdown tables, so it is reachable rather than theoretical:

$ echo 'a \| b' | awk '{ s=$0; gsub(/\|/, "\\|", s); print s }'
a \\| b

The fix applied in #3202 parks already-escaped pipes on a sentinel and restores them single-escaped.

Defect 2 — repo-root resolution has three spellings

git rev-parse --show-toplevel can answer with a different path spelling than the one the caller used to reach the same directory. #3180 reports the concrete case on Git Bash: git answers C:/Users/u/AppData/Local/Temp/t/repo while the caller is at /tmp/t/repo.

Consequences differ per producer and should be checked individually rather than assumed:

#3180's fix derives the primary anchor from the caller's own pwd minus git's reported prefix.

What to do

  • Confirm each defect against each sibling producer individually — do not assume the shape is identical.
  • Fix esc() idempotency wherever it reproduces, with a regression test asserting an already-escaped pipe survives single-escaped and the row still parses to the right cell count.
  • Fix repo-root resolution wherever it reproduces, and state which failure mode that producer had.
  • Consider whether esc() and the repo-root resolution should become shared code rather than three copies — three copies is why one fix did not reach the others.

Related

Metadata

Metadata

Assignees

Labels

agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions