docs(scripts): stop overstating what the process-substitution gap readmits by kyle-sexton · Pull Request #2085 · melodic-software/claude-code-plugins

kyle-sexton · 2026-08-09T15:10:23Z

A one-comment correction to scripts/shell-portability-tokens.txt:245, which #2064 merged before
this fix landed. Comment-only — no token, no behavior, no test changes.

What is wrong on main

The sed command-gap comment claims [<>]$[^)]*$ "readmits exactly that shape and nothing else".
It does readmit a process substitution, but [^)]* is not recursive, so a process substitution
whose body itself contains one — sed -f <(diff <(a) <(b)) -i "$f" — stops the gap at the INNER
) and goes unreported.

An ERE cannot balance parentheses; catching that shape needs real parsing, which this grep-level
tripwire does not attempt. So the residual is a false NEGATIVE on a rare shape, which is the
direction this gate already accepts everywhere else. The defect is the comment asserting a
completeness the regex does not have — a reader trusting it would not think to check.

Provenance

Found by the fresh-context verifier on #2064 while auditing the very fix that introduced the
sentence. #2064 merged with the overstatement still in place; this carries the correction forward.

Prose asserting more than the artifact does has been a recurring defect class on this sweep — it
drew CHALLENGE on context-guard twice and appeared again as disk-hygiene's R1 — so it is worth
correcting rather than leaving as a harmless-looking comment.

The gap class excludes `(` and `)` alongside the separators, but the comment claimed only separators. Record the exclusion, the converse catch it buys, and the process-substitution blind spot it costs — a tradeoff the date/stat/mktemp tokens already carry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…call Narrowing the sed command gap to stop at a bare paren also stopped it at a process substitution, which is not a command of its own -- the shell folds it into the word it touches. `sed -f <(gen) -i "$f"` therefore went undetected where the pre-narrowing gap caught it. Readmit exactly that shape; a `)` closing a real subshell still ends the gap, so the converse catch it bought is kept. The `--in-place` unit block was building its local token from the pre-narrowing pattern, so none of its assertions could tell old behavior from new. Point it at the shipped pattern and give both sed tokens separator- and process-substitution-scoping cases, including two backed by the real token list so a hand-copied pattern cannot drift unnoticed again. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…dmits `[^)]*` cannot balance parens, so a nested process substitution still stops the gap at the inner `)`. The comment claimed the alternative readmits that shape "and nothing else"; record the residual false negative instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cursor · 2026-08-09T15:10:26Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba8ed8fad7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Keeps this branch's corrected comment — the process-substitution readmission is not recursive, so a nested one still goes unreported — and takes main's removal of the obsolete standalone `sed -Ei` token, which the cluster token now covers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

claude · 2026-08-09T15:30:11Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

claude · 2026-08-09T15:30:13Z

Claude encountered an error after 0s —— View job

I'll analyze this and get back to you.

github-actions · 2026-08-09T15:30:22Z

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31321166754
Failure class: rate-limit
Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":418,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

The check is red on purpose. It certifies that a security pass ran, and this one did not complete, so it cannot report success. Where this check is required, merging is blocked until a review actually finishes.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

github-actions · 2026-08-09T15:30:25Z

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31321166752
Failure class: rate-limit
Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":383,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).

kyle-sexton · 2026-08-09T16:42:51Z

Filed the quoted-command-word gap as #2091 so it survives this PR's resolution — it is a real coverage limit in the gate's design (an ERE cannot see through shell quote removal), just not one this comment-only change introduced or touched. The thread here is resolved on that basis.

kyle-sexton and others added 9 commits August 7, 2026 08:28

Merge remote-tracking branch 'origin/main' into fix/ci-scripts-strand…

2cc40ba

…ed-findings

Merge remote-tracking branch 'origin/main' into fix/ci-scripts-strand…

0e7f9cc

…ed-findings

Merge remote-tracking branch 'origin/main' into fix/ci-scripts-strand…

9523ab5

…ed-findings

Merge remote-tracking branch 'origin/main' into fix/ci-scripts-strand…

16f87dd

…ed-findings

Merge remote-tracking branch 'origin/main' into fix/ci-scripts-strand…

ae96c76

…ed-findings

chatgpt-codex-connector Bot reviewed Aug 9, 2026

View reviewed changes

Comment thread scripts/shell-portability-tokens.txt

github-actions Bot deleted a comment from claude Bot Aug 9, 2026

kyle-sexton mentioned this pull request Aug 9, 2026

shell-portability gate misses a quoted sed command word: "sed" -i and s"e"d -ni pass unflagged #2091

Closed

kyle-sexton merged commit 40bb023 into main Aug 9, 2026
32 of 33 checks passed

kyle-sexton deleted the fix/ci-scripts-stranded-findings branch August 9, 2026 16:44

kyle-sexton mentioned this pull request Aug 9, 2026

Triage the remaining stranded P2 review findings from the post-merge sweep #1938

Closed

3 tasks

Navigation Menu

Uh oh!

docs(scripts): stop overstating what the process-substitution gap readmits - #2085

docs(scripts): stop overstating what the process-substitution gap readmits#2085
kyle-sexton merged 10 commits into
mainfrom
fix/ci-scripts-stranded-findings

kyle-sexton commented Aug 9, 2026

Uh oh!

cursor Bot commented Aug 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

claude Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

kyle-sexton commented Aug 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kyle-sexton commented Aug 9, 2026

What is wrong on main

Provenance

Related

Uh oh!

cursor Bot commented Aug 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

kyle-sexton commented Aug 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

claude Bot commented Aug 9, 2026 •

edited

Loading

claude Bot commented Aug 9, 2026 •

edited

Loading