chore(#153): extend Bash-write matcher beyond first-version coverage#155
Merged
atlas-apex merged 1 commit intoMay 3, 2026
Merged
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends
_lib-detect-bash-write.sh(introduced in #152 for #151) with the matcher families that Rex's review flagged as missing from the first-version coverage. AgDR-0011 already frames the matcher table as a living list extended on observation; this PR walks the list.cp,mv,rm,dd,install. Anchored at command-start.--help/--versionandgit rm/git mvare excluded sogit rm src.txtandcp --helpstay read-class.tar -x/tar --extract,curl -o/--output,wget -O/--output-document. Flag-gated sotar -t(list),curl <url>(bare fetch),wget --helpstay read-class.perl -eandphp -rkeyword-gated like the existing python/node/ruby matchers;go run,deno run/deno script.ts,bun run/bun script.tsmatched categorically as script runners.pathlib.Path().touch(),shutil.copy*,shutil.move,os.renameadded to thepython -cand python-heredoc keyword list.rubyandnode— previously only python's heredoc form was matched.cp/mvreturn the last positional arg;curl -o/--outputandwget -O/--output-documentreturn the file argument.go run/deno/bun/perl -e/php -r/tar -xreturn empty (caller gates categorically per AgDR-0011).Refactored the matcher into one
_bdw_match_<family>helper per family so future extensions land as additional helpers rather than additionalifbranches in one big function.Testing
bash .claude/hooks/tests/test_detect_bash_write.sh— 86/0 (was 32/0 before [Chore] Extend Bash-write matcher in _lib-detect-bash-write.sh beyond first-version coverage #153). Includes ≥3 negative-class counterexamples for every new family:tar -t,tar --list,tar -tzf,cp --help,cp --version,rm --help,mv --version,git rm,git mv,curl -s url,curl bare,wget --help,wget bare,deno fmt,deno test,go build,go version,perl -v,php --version.bash .claude/hooks/tests/test_require_active_ticket_bash.sh— 12/12 (regression check, unchanged)..claude/hooks/_lib-detect-bash-write.shand.claude/hooks/tests/test_detect_bash_write.sh.Glossary
_bdw_match_*helper.go run,deno,bunwhere the script body could write but isn't visible to the detector.python -c,node -e,perl -e, …) AND a write-related keyword (writeFile,open(…, "w"),unlink, …) before firing. Reduces false positives on read-only one-liners..claude/session/active-bootstrapmarker that lets/setup,/handover,/update,/split-portfoliowrite files without an active ticket. Orthogonal to this PR but the reason the matcher can be stricter without breaking first-run UX.