Skip to content

fix(autofix): shell parser safety and check script fallback - #331

Merged
torn4dom4n merged 1 commit into
refactor-autofix-architecture-15113170007543883834from
refactor-autofix-architecture-15113170007543883834-69303809989503385
Nov 8, 2026
Merged

torn4dom4n merged 1 commit into
refactor-autofix-architecture-15113170007543883834from
refactor-autofix-architecture-15113170007543883834-69303809989503385

Conversation

@google-labs-jules

Copy link
Copy Markdown
Contributor

Addresses PR #327 review feedback:

  1. Shell parser safety: enhanced shell command splitting and word tokenization to inspect and detect background execution (&), output redirections (>, >>, 2>, 2>>, &>), process substitutions (<(), >()), command substitutions ($(), backticks), and malformed quotes/escapes. Commands containing these constructs fail closed and cannot be classified as "read-only", preventing them from being scheduled in check mode while allowing valid quoted arguments and escaped characters to work.
  2. Candidate fallback: refactored format check candidate selection to evaluate format:check first, selecting it only if verified as "read-only", and falling back to fmt:check if format:check is absent, write-capable, or unknown.
  3. Updated distribution bundles and added comprehensive unit and regression tests in tests/autofix-architecture.test.ts.

PR created automatically by Jules for task 69303809989503385 started by @torn4dom4n

- Prevent unsafe shell commands with redirections, backgrounding, or substitutions from being classified as read-only
- Fail closed on malformed quotes and incomplete command substitutions
- Fall back to fmt:check when format:check cannot be safely classified as read-only
- Regenerate dist/autofix.mjs bundle
- Add regression test coverage for shell safety and check script candidate fallback
@google-labs-jules

Copy link
Copy Markdown
Contributor Author

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@changeset-bot

changeset-bot Bot commented Nov 8, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 4149ad4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@torn4dom4n
torn4dom4n merged commit d14e2dd into refactor-autofix-architecture-15113170007543883834 Nov 8, 2026
18 checks passed
@torn4dom4n
torn4dom4n deleted the refactor-autofix-architecture-15113170007543883834-69303809989503385 branch November 8, 2026 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant