[MakerFlyFly]

Summary

• stack-review residue-command selects git grep -E but emits non-capturing groups that the tested ERE engines reject. Use ordinary groups so the command returns matches or a normal no-match result, while keeping leading-hyphen tokens protected from option parsing.
• Compile each variant once and reject common patterns that Python recognises as matching the empty string before emitting JSON. Document POSIX ERE, digit classes and --variant=-x, with the remaining dialect and backreference limits.
• Add real-Git and CLI rejection regressions and regenerate the packaged source with check-family-plugins.py --fix.

Type of change

• Python package
• Skill guidance — residue classification subdocument

Test plan

Validation is for commit 0979b20ce95b23e2595df82c949554f713e6b3e3 against 17abc4c8c6137f466b60bf698dd2684618e32358:

• Regression evidence: five real-Git cases fail before the grouping fix; six rejection cases fail before the empty-match precheck. Both sets pass with the change on Linux and Windows.
• Linux package tests: 758 passed, 15 subtests passed; Windows test_findings.py: 30 passed.
• Actual CLI processes on both platforms verify exit 1, an offending-variant diagnostic and empty stdout for rejected inputs; valid inputs still emit the command JSON.
• Package ruff, format and mypy checks; prek run --all-files --skip workspace-pytest; range-selected workspace tests; normal commit hooks; whole-tree lychee; packaged-source consistency and git diff --check pass.
• Six existing Step 3 structural-finding cases: 6/6 full JSON comparisons pass after answering the runner-generated prompts. This is a self-eval smoke test, not independent cross-model evidence.
• Magpie pre-first-PR checklist: five categories pass, zero blocking items. Fork CI for the reviewed change is green.

RFC-AI-0004 compliance

No network access, privileged operations or configuration is added. Tests use synthetic data and isolate temporary repositories from contributor Git configuration. The guidance states the supported spelling and the limits of the precheck.

Linked issues

Fixes #2008

Notes for reviewers

The Python precheck is deliberately limited. A POSIX character-class pattern such as [[:digit:]]* can still pass it despite matching empty strings in Git; Python-style \d and numeric backreferences also remain problematic. The help and residue guidance describe these limits. CLI parameters and the successful JSON structure are unchanged; common empty-matching variants are now rejected.

Suggested additional label: capability:fix; the repository has already assigned its component labels automatically.

Generative AI disclosure

AI-assisted with Codex (GPT-6), including code, tests, reproduction and drafting. The contributor has completed human review of the final changes. Both commits carry Generated-by: trailers.

[potiuk]

Thanks: git grep -E really does reject (?:…), the fix is right, and the real-Git tests are a good guard. I pushed one small fixup so you do not need another round: 58386ecb silences Python's FutureWarning for POSIX classes such as [[:digit:]] around the precheck's re.compile in stack_review/cli.py and its packaged copy, and adds a test in test_findings.py, because the docs now allow those classes.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.