guardrails: verify-cli-flag.sh grep here-string uses the shape this repo documents as deadlocking near 64KB, risking a hung PostToolUse hook

[kyle-sexton]

Context

Found by the repo-wide /code-tidying:batch-simplify sweep (62 groups / 986 files, branch claude/repo-code-tidying-batch-twhddw). The sweep's doctrine files latent defects instead of fixing them mid-sweep, because the fix changes observable behavior; this issue is that filing.

plugins/guardrails/lib/verification/verify-cli-flag.sh:157,159 — grep -E "$FLAG_PATTERN" <<<"$HELP_OUTPUT" uses the here-string shape the repo's own docs record as deadlocking when the payload is 65536-65663 bytes; a tool with ~64KB of --help could hang the cli-flag-verify PostToolUse hook.

Proposed work

• Pipe via printf '%s' | grep (the repo's documented safe form) instead of the here-string.

Acceptance criteria

• A 65600-byte help fixture passes through the verifier without hanging.

References

• plugins/guardrails/lib/verification/verify-cli-flag.sh:157

Filed by the /code-tidying:batch-simplify closeout (Phase 8).

[kyle-sexton]

Already fixed on main. plugins/guardrails/lib/verification/verify-cli-flag.sh streams help through printf '%s\n' "$HELP_OUTPUT" | grep (not a here-string), with a comment citing the 64KiB deadlock. Recorded in guardrails CHANGELOG 0.30.x.

This was generated by AI during work-loop.