fix: security-audit probe searches the tree; CI pin and audit-doc follow-ups - #18
Merged
Conversation
…ee; v0.15.4 - security-audit: the auth/session file probe ran `rg` with no path. When the host supplies a non-terminal stdin, ripgrep searches stdin instead of the working tree: with an open pipe it blocks, with an empty one it reports "none matched" against a directory that contains a match. Passing `.` makes it search the tree in both shells regardless of stdin. Recorded as an unscored observation in docs/audits/2026-09-05-post-fix. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…pin revisions on main - validate.yml: @anthropic-ai/claude-code 2.1.258 -> 2.1.266 (current npm release) - SKILL_AUDITS.md: record audit revisions that already exist on main, since rebase-merge rewrites branch SHAs; content hashes survive either way Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
chrispezza
added a commit
that referenced
this pull request
Sep 9, 2026
The first publish of owned-skills-2026-09-05-post-fix recorded branch SHAs that the rebase-merges of #17 and product-dev#58 rewrote. This record pins every entity to revisions on main (plugins cb2e6fd, product-dev 469a06d), includes the code-tools 0.15.4 security-audit probe fix from #18 with its piped-stdin reproduction, and re-collects all evidence at that revision: 642/642 probes, 6/6 host validations, 8/8 tests. Ops accepted it (39 entities, 195 signals); publication.json references the superseded digest. Also untracks scripts/__pycache__, committed by mistake in 9742632, and ignores it going forward. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Found-work items from the 2026-09-05 skill-audit pass.
rgwithout a path. With a non-terminal stdin, ripgrep searches stdin: an open pipe blocks, an empty one reports "none matched" against a directory that has a match. Verified both ways in bash and zsh with a fixture; the probe now passes.. Released as code-tools 0.15.4.Verification
scripts/validate_plugins.py, the regression tests, andclaude plugin validatepass locally.Merge
Rebase, not squash: the code-tools release commit must survive for
/plugin-releasedelta derivation.🤖 Generated with Claude Code