fix: catch C-quoted filenames in four probes, close a one-way parity test, and record the pipefail question

[claude]

No linked issue

Summary

The last five findings from an independent security review of #3460/#3468/#3469, plus the durable fix that should stop this class recurring. #3474 and #3475 closed the probe-shape and citation halves; this closes the filter half and writes the open question into the convention.

Four probes silently under-reported any filename git status --porcelain C-quotes — a plain space is enough to defeat grep '\.md$' and awk '{print $NF}'. Two correct forms already shipped in the same two plugins, so this is drift, not a missing idea.

Fix

F1 — under-reporting filters

Executed against a repo holding seven files per extension: plain, space, single quote, double quote, semicolon, pipe, and an embedded newline.

Site	Before	After	Caught
docs-hygiene:compress	grep '\.md$'	grep -E '\.md"?$'	4/7 → 7/7
docs-hygiene:audit-progressive-disclosure	grep '\.md$'	grep -E '\.md"?$'	4/7 → 7/7
docs-hygiene:audit-derivability	awk '/\.md$/'	awk '/\.md"?$/'	4/7 → 7/7
code-tidying:dissolve-comments	awk '{print $NF}'	-z NUL parse	4/7 → 7/7

dissolve-comments took the -z parse because the site already parses fields and its sibling audit-comment-residue ships that exact program. The .md sites took audit-noise's grep form, which keeps their leading token grep so the existing grant stays valid.

The residual is stated in the changelogs rather than hidden: under -z a newline-bearing name reaches the grep as two lines and renders as its tail; under the grep form a quoted record renders C-quoted.

F2 — a parity test that could not see an over-reporting preview

audit-comment-residue's parity loop only checked one direction: "detect.sh audited it but the preview missed it". Mutating the SKILL.md awk to drop its rename skip made the preview emit a phantom path while detect.sh audited five real ones — and the suite passed 53/53.

A reverse loop now asserts every previewed path is one detect.sh audited. The same mutation fails 1/54, naming the phantom; reverted, 54/54. The forward loop is byte-identical — no existing assertion was touched or weakened.

F3 — a failure token that collided with real data

claude-ops:observability rendered unknown both outside a repo and inside one whose toplevel directory is literally named unknown. The failure case now renders (git toplevel unavailable); a repo named unknown still renders unknown, now distinguishable.

F4 — labels asserting a state the probe did not establish

The brace group's : makes the outer || unreachable, which also masks failures inside the group — a filter-stage failure, and a guard/data double-invocation. Both render empty under a label reading empty = none.

Applied at six sites, not the three first reported: all five brace-group probes plus audit-derivability. Labels now read empty = none matched or the probe returned nothing. No plumbing was restructured — the label is the honest fix, and the plumbing change would be a worse trade.

repo-hygiene:clean and the ~25 unfiltered { git status || echo; } | head -N probes were left alone: no filter stage, no double invocation, so their empty = none is already true.

F5 — the durable fix

precompute-context.md gains a subsection recording that whether Claude Code runs ! injections under pipefail is undocumented — the skills page specifies working directory, stderr merging, timeout, output size and exit-code semantics, and names no shell options. It states that the brace group is correct under both settings while guard && pipeline || token is correct under only one, gives the mechanism for each direction, and names the brace group's own price: an internal failure renders empty, which is exactly why the label must carry it. The recheck trigger now covers shell options.

This is the part that stops the next author reintroducing the shape.

Verification

Pipefail matrix on the merged tree: seven touched probes × five states (healthy, at cap, no match, clean tree, outside a repo) × two shell settings = 70 cells, all exit 0. At-cap renders exactly the cap with no failure token; only the outside-a-repo cells render one. audit-derivability additionally re-proved at 25 dirty .md files: 20 paths under both settings, no spurious token.

scripts/affected-tests.sh --run                 real exit 0, 17/17 suites (not piped)
scripts/check-changed-skills.sh origin/main     8 skills, 0 failed
check-changelog-parity --check-order/-bump/     0 each; --check-preserved compared
  --check/--check-preserved                     306 headings across 4 changelogs
node scripts/validate-plugin-contracts.mjs      3061 files
markdownlint-cli2 (173 files, 4 plugins)        0 issues
typos                                           0; added lines carry 0 em dashes
shellcheck -S warning (both test scripts)       clean

Roster delta. Two derivations unrelated to the report's table — every git status --porcelain inside an injection (35 hits), and every injection carrying an extension-anchored filter — both return the same six filtered probes and no others. Delta: +1 (audit-derivability), 0 removed. The security report listed five and called three defective; the true set is six, four defective. A fourth pass over every injection with a text-filter stage found four more (tidy, rename-references, two detect.sh | grep '^(Summary' lines), all anchored on a line prefix rather than a filename, so none share the defect.

Stale-base recovery. This branch was cut before #3474 and #3475 merged and was rebuilt onto 02e1d8b0. One line collided: audit-derivability:15, where #3474 added the brace group and this change adds the filter. Both are now present on that line — committing either alone would have silently reverted the other. docs-hygiene and code-tidying versions were renumbered above what main now carries, since #3474 had already claimed the numbers first picked.

Grants. None widened, none broken. audit-progressive-disclosure is the only touched skill declaring allowed-tools; its leading token stays grep, so Bash(grep:*) still authorizes the rewritten command and no new binary entered the pipeline.

Related

Refs #3474, refs #3475, refs #3469, refs #3468, refs #3460. Closes the filter half of the same verification pass.

---

Generated by Claude Code