[rig-tasks] Add 10 rig samples — 2026-08-07 - #365

[/diagnosing-bugs] Shell injection risk: filePath is interpolated directly into the shell command string without sanitization — paths containing shell metacharacters (spaces, $(), backticks) will be interpreted by the shell.

import { spawnSync } from "node:child_process";
const result = spawnSync("git", ["log", "--format=%ae", "--", filePath], { encoding: "utf-8" });
const output = result.stdout.trim();

[/diagnosing-bugs] False negative: otherContent.includes(sym) matches any substring, so a symbol like log will be considered "used" if any file contains logError, blogPost, etc. This produces incorrect dead-export results.

const usagePattern = new RegExp(`\\b${sym}\\b`);
if (usagePattern.test(otherContent)) { found = true; break; }

[/codebase-design] Schema/tool mismatch: the output schema declares scripts: s.record(s.object({ purpose, category, command })), but inferScriptPurpose only returns { purpose, category } — it never returns command. The LLM must hallucinate command from context, which is unreliable.

return { purpose, category, command } as const;

[/diagnosing-bugs] process.cwd() inside a tool handler always returns the CLI's working directory, not the git repository root. On any invocation where the repo root differs from CWD — or in future non-stdio transports — this heuristic will misclassify the main worktree as "linked".

// In the agent instructions: track whether the current block is the first one
// and pass an `isFirst` boolean to classifyWorktree.
const type: "main" | "linked" | "bare" = bare ? "bare" : isFirst ? "main" : "linked";

[/diagnosing-bugs] The typeof regex /\btypeof\s+\w+\s*[=!]==/g only matches === and !==, so it misses the common patterns typeof x == 'string' (double equals) and typeof x === 'string' with a string literal on the right (the == char class [=!] is followed by = but typeof x === "number" ends in three = signs — confirmed match). More critically, it won't match typeof x !== 'string' because !== ends in = not = after !=.

// Match: typeof x === ..., typeof x !== ..., typeof x == ..., typeof x != ...
const typeofCount = (content.match(/\btypeof\s+\w+\s*[!=]==?/g) ?? []).length;

[/diagnosing-bugs] Variable name s in the reduce callback shadows the imported s schema helper from "rig". TypeScript will not catch this because s inside the callback refers to the callback parameter, but it creates a confusing naming collision in a file that prominently uses s.* for schemas.

const totalKeys = Object.values(sections).reduce((sum, kvs) => sum + Object.keys(kvs).length, 0);

[/diagnosing-bugs] The inputsMatch regex is fragile: it requires workflow_dispatch: to be followed immediately by inputs: within a narrow look-ahead, and uses a fixed indentation depth of 4–8 spaces for inputPattern. Real-world workflow files often use 2-space indentation (GitHub's default), which will be silently missed, returning { inputs: {}, inputCount: 0 } for valid workflow files.

const inputPattern = /^\s{2,}(\w+):\s*\n((?:\s{3,}.+\n?)*)/gm;

[/codebase-design] analyzeColumn returns { min: undefined, max: undefined, mean: undefined } for non-numeric columns, but the output schema declares these as s.optional(s.number). In s.object, s.optional means the key may be absent — not that it may be undefined. Returning explicit undefined values may cause schema validation to fail depending on how the serializer handles them.

// Instead of: return { columnName, type, uniqueCount, min: undefined, ... }
return { columnName, type, uniqueCount };