fix(claude-config): guard --input against missing value in fix-plugin-drift.sh

[kyle-sexton]

Closes #3430

Summary

A bare --input as the final argument to fix-plugin-drift.sh dereferenced $2 under set -u, crashing with exit 1 instead of the documented usage error.

Fix

Guard the --input option-argument read: when no value follows, print a usage message to stderr and exit 2, matching the script's other argument-validation errors.

Verification

• bash plugins/claude-config/skills/audit/scripts/fix-plugin-drift.sh --input now exits 2 with Missing value for --input on stderr.
• Added a regression case (case-8) to fix-plugin-drift.test.sh.
• Ran scripts/affected-tests.sh --run: all 4 selected suites passed.

Related

N/A

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T06:18:56.554039Z	b6638ed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 28s —— View job

---

Security review: no findings

• Gather context (PR diff, changed files)
• Check skip gate
• Review changed files for security-relevant surface
• Report findings

Skip gate applied: this PR has no security-relevant surface. The change (fix-plugin-drift.sh#L54-L58) adds a bounds check on $# before dereferencing $2 for --input, turning a set -u unbound-variable crash into a clean exit 2 usage error. It doesn't touch injection surfaces, auth/access control, secrets/tokens, or GitHub Actions configuration — it's local CLI argument-parsing hardening only. The accompanying test addition (fix-plugin-drift.test.sh case-8) is a straightforward regression check for the new path.

No security issues found.

[github-actions]

Last security-reviewed head: b6638ed8f77a080daae6ff9649ebb5421f4c99ad. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 1m 5s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md, skill instructions)
• Review changed files for correctness/maintainability
• Post findings

Summary: Reviewed both changed files against origin/main...HEAD.

fix-plugin-drift.sh (lines 54–61): the guard is correct. Inside the --input) case, $1 is still unshifted, so $# counts --input plus any remaining args — $# -lt 2 is true exactly when no value follows, correctly distinguishing a bare --input from --input <path>. It matches the script's existing error convention (message to stderr, exit 2), same as the Unknown arg and missing-settings-file paths elsewhere in the script. --input is the only option in this parser that consumes a value (git grep for shift 2 in this file confirms it's the only occurrence), so this closes the only set -u exposure of this kind — no other option-argument reads need the same guard.

fix-plugin-drift.test.sh (case-8, lines 243–251): the regression test correctly asserts exit code 2 and the stderr message, following the same CASE_NUM/assert_exit/assert_contains pattern as the surrounding cases.

No correctness, maintainability, or test-coverage issues found. The PR body's verification steps (manual repro, affected-tests run) are author-claimed; I did not independently re-run them in this lane, but static review of the added guard and test is sufficient to confirm the fix is correct and complete.

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 25s —— View job

---

Code review skipped

• Gather context (PR diff, CLAUDE.md, skill instructions)
• Check skip gate
• Report result

Skip gate applied: this PR is already merged, not open. Per /review:code-review's skip gate ("PR is closed or not open"), no review is performed and nothing further is posted.

For reference, this PR was already reviewed twice while open (security review: no findings; code review: no correctness/maintainability issues found — see prior comments above).