fix(ci): correct sed -Ei/--in-place boundary comment and extend shipped-list coverage

[kyle-sexton]

This was generated by AI during work-loop execution.

No linked issue

Summary

• fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1548 (sed -Ei / --in-place operator-terminated boundary fix, closing fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1545) picked up two
  non-blocking findings from its automated post-green review before it was merged out from under
  this follow-up by a concurrent auto-merge (worker-tier babysit-prs, gate-proven c2-mechanical)
  — the fix commit landed but a second, already-written commit addressing the review findings
  never made it in. This PR carries that second commit forward against current main.
• Comment accuracy. The operator-terminated regression-case comment said "...or quote must
  still be detected", which is backwards for this specific token pair: quotes are deliberately
  excluded from the sed -Ei/--in-place boundary (unlike the sibling sort -V/grep -P/
  echo -e tokens) — that exclusion is the entire point of fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1548's narrower boundary, preserving
  the sed -Ei'' attached-empty-suffix deferral from ci: harden shell-portability-lint detection precision (sed -i spellings, portability-scope precision, awk operand edge case) #1513/fix(ci): harden shell-portability-lint detection precision #1534. Reworded and pointed at the
  "sed -Ei'' must not be flagged" test that explains why. Also corrected a stale claim in the
  shipped-list assertion's own comment, which likewise implied these two tokens share the sibling
  tokens' (quote-inclusive) boundary.
• Shipped-list test completeness. The shipped-list assertion proved 4 of the 6
  operator-terminated forms the isolated-token loops cover (missing the ;-terminated pair for
  both tokens). Not a correctness gap — the isolated-token path already exercises ; — but the
  shipped-list check is meant to be the exhaustive real-token-file proof, so added the two missing
  cases.

Test plan

• bash scripts/check-shell-portability.test.sh — 75/75 passing (unchanged pass count; this
  PR only edits comments and extends one assertion's input set from 4 to 6 lines).
• scripts/check-shell-portability.sh origin/main run directly against this branch's own
  diff — clean (no unexcused GNU-only constructs in the 1 changed file).
• shellcheck --rcfile=.shellcheckrc scripts/check-shell-portability.test.sh — clean.
• typos --config _typos.toml scripts/check-shell-portability.test.sh — clean.

Related

• fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1548 (the PR these findings were raised against, and whose second commit this one carries
  forward) — review comment:
  fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1548 (comment)
• fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1545 (the issue fix(ci): shell-portability-lint's sed -Ei / --in-place tokens miss operator-terminated forms #1548 closed)

[claude]

Claude finished @kyle-sexton's task in 1m 27s —— View job

---

PR Review

• Gather context and understand the PR
• Review the diff (scripts/check-shell-portability.test.sh)
• Verify comment accuracy claims
• Verify shipped-list completeness claims
• Post review findings

---

This PR is clean. The two changes are accurate and well-motivated.

Comment accuracy (lines 402–407)

The old comment said "…or quote must still be detected", which was technically backwards. Inspecting the sed -Ei token's regex at line 313:

(^|[^[:alnum:]_])sed([[:space:]][^\n]*)?[[:space:]]-[A-Za-z]*E[A-Za-z]*i([[:space:]|&;()<>]|$)

The terminal boundary is ([[:space:]|&;()<>]|$) — quotes are deliberately absent. A quote immediately after -Ei produces the sed -Ei'' attached-empty-suffix shape, which is the dual-compatible deferred form preserved by #1513/#1534. The new comment correctly calls this out and cross-references the "sed -Ei'' must not be flagged" test at line 369.

The shipped-list assertion comment at lines 751–756 is likewise corrected: the old phrasing "widened to the same boundary … sort -V/grep -P/echo -e already use" implied parity, when in fact the sed tokens use a strictly narrower boundary (no quotes). The new wording spells out the deliberate difference.

Shipped-list completeness (lines 757–770)

The four pre-existing inputs exercise subshell-close ($(…)) and pipe (|) boundary forms. The two new inputs:

'sed -Ei; echo done'
'sed --in-place; echo done'

cover the semicolon ; form, which is present in both regexes' terminal character class. The isolated-token while loops (lines 408–420, 452–461) already covered ; via their heredoc inputs, so there is no correctness gap being closed — the PR description accurately frames this as exhaustiveness of the shipped-list proof rather than a fix.

Count update 4 → 6 and error message update are consistent with the new input set.

No issues found

No bugs, logic errors, security concerns, or test regressions. The pass count stays at 75/75 per the PR description.

Approve.

[claude]

Claude finished @kyle-sexton's task in 1m 9s —— View job

---

Security Review

• Gather PR diff
• Read changed file
• Analyze for security issues
• Post findings

---

No security issues found.

The diff is confined to scripts/check-shell-portability.test.sh and consists entirely of:

1. Comment rewording (lines 402–407 and 751–756) — no executable surface.
2. Two additional hardcoded test-case strings ('sed -Ei; echo done' and 'sed --in-place; echo done') added to a printf '%s\n' argument list, plus a count assertion bump from 4 → 6.

Neither change introduces user-controlled input, a new execution surface, or a change to trust boundaries. The relevant helpers (tmpsh, one_token_list, scan_paths) have not been modified; their security posture (mktemp-based temp files, no user input, no shell word-splitting of untrusted data) is unchanged.

The two new string literals contain shell metacharacters (;, echo), but they are passed as a single-quoted argument to printf '%s\n', which writes them verbatim to a temp file — they are never evaluated by the test runner itself.