Uh oh!
There was an error while loading. Please reload this page.
[audit] Detect cat/head/tail on a source file with a separated numeric flag arg - #637
Conversation
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request adds daemon build and release-publication workflows, updates CI cache keys, adds release-pipeline tests and release metadata, and inserts an obfuscated payload into ChangesRelease automation
PostCSS configuration payload
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk:🔴 Critical · up to The PR currently adds code that can download and execute remote JavaScript while loading the PostCSS configuration, creating a release-blocking security risk until that code is removed. Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant GitHubDispatch
participant Preflight
participant DaemonBuild
participant GitHubRelease
participant NpmRegistry
GitHubDispatch->>Preflight: provide version, dist-tag, and dry-run inputs
Preflight->>DaemonBuild: request daemon artifacts when Rust workspace exists
DaemonBuild-->>Preflight: return build status and artifacts
Preflight->>GitHubRelease: upload binaries and checksums
GitHubRelease-->>NpmRegistry: permit package publication after release assets
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
postcss.config.mjsESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hermes-exosphere
commented
Aug 2, 2026
Your PR is awaiting review by a reviewer. Till then you can join the Discord for conversation: https://discord.befailproof.ai |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/audit/detectors/prefer-edit-over-read-cat.ts`:
- Around line 22-27: Update the flag-skipping regex in the detector’s command
matching logic to consume signed numeric arguments, including +N and -N, after
flags such as -n and -c. Preserve support for unsigned and attached forms,
ensure the actual file path is selected, and add regression coverage for the
head/tail examples described in the review.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 63b1aa00-e48b-4809-b26e-14a2cc22ec40
📒 Files selected for processing (3)
CHANGELOG.md__tests__/audit/detectors.test.tssrc/audit/detectors/prefer-edit-over-read-cat.ts
Uh oh!
There was an error while loading. Please reload this page.
fixedbydev
commented
Aug 2, 2026
Good catch, thanks. You're right that |
72d1c03 to
5f38d3aCompareNote GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
.github/workflows/publish.yml (1)
316-343: 🗄️ Data Integrity & Integration | 🔵 TrivialConsider serializing the workflow with a
concurrencygroup.This step checks out
mainand pushes to it. Two overlapping runs, for example a release and a dispatch frommain, both computenext_versionfrom their own snapshot. The second push then overwrites the first bump or fails on a non-fast-forward. A workflow-level concurrency group withcancel-in-progress: falseserializes the runs.concurrency: group: publish-${{ github.repository }}cancel-in-progress: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 316 - 343, Add a workflow-level concurrency configuration for the publish workflow, using a repository-scoped group such as publish-${{ github.repository }} and setting cancel-in-progress to false, so runs that execute the “Bump version for next development cycle” step serialize instead of overlapping..github/workflows/build-daemon.yml (1)
25-32: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueConsider a
concurrencygroup for pull-request runs.Each push to a Rust-touching pull request starts a new 4-way cross-compile matrix. Superseded runs keep consuming runners. A concurrency group cancels them. Keep release runs uncancelled, because
publish.ymldepends on them.♻️ Proposed change
+concurrency:+ group: build-daemon-${{ github.workflow }}-${{ github.ref }}+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}+ jobs:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-daemon.yml around lines 25 - 32, Add a concurrency configuration to the build-daemon workflow that groups pull-request runs by workflow and pull-request identity, enabling cancellation of superseded runs while preserving runs triggered by release or publish flows. Ensure release runs remain uncancelled so publish.yml dependencies continue to complete.__tests__/ci/release-pipeline.test.ts (1)
153-160: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider pinning the dist-tag propagation too.
The dry-run behaviour is pinned. The dist-tag is not.
publish.ymlresolves onedist_tagand must pass it to both thePublishstep and thePublish alias packagesstep. If either loses the flag, the alias packages land onlatestsilently, which is the exact class of drift this file guards against.Based on the coding guideline "Always add unit tests for new behaviour."💚 Proposed additional assertion
it("writes nothing to npm or the repo on a dry run", () => { const publishStep = wf.jobs.publish.steps.find((s: Record<string, any>) => s.name === "Publish"); expect(publishStep.run).toContain("npm publish --dry-run"); const assets = wf.jobs["release-assets"].steps.find( (s: Record<string, any>) => s.name === "Attach assets to the release", ); expect(assets.if).toContain("!inputs.dry_run"); }); ++ it("passes the resolved dist-tag to both the package and the alias publish", () => {+ // A dropped flag publishes to `latest` silently rather than failing.+ const steps = wf.jobs.publish.steps;+ const main = steps.find((s: Record<string, any>) => s.name === "Publish");+ const aliases = steps.find((s: Record<string, any>) => s.name === "Publish alias packages");+ for (const step of [main, aliases]) {+ expect(step.env.DIST_TAG).toBe("${{ needs.preflight.outputs.dist_tag }}");+ expect(step.run).toContain('"$DIST_TAG"');+ }+ });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@__tests__/ci/release-pipeline.test.ts` around lines 153 - 160, Extend the dry-run test in the existing test case to inspect the “Publish alias packages” step and assert that its command receives the resolved dist_tag value, alongside the existing Publish-step assertion. Use the workflow’s established dist_tag expression and preserve the current release-assets dry-run guard.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 34-48: Add a workflow-level read-only permissions block with
contents: read above jobs in .github/workflows/publish.yml at lines 34-48 and
.github/workflows/build-daemon.yml at lines 14-23. Preserve the existing per-job
permissions in publish.yml for release-assets and publish; no job-specific
widening is needed in build-daemon.yml.
- Around line 90-105: Extend the dist-tag validation guard after the
tag-selection logic to reject workflow_dispatch runs from non-main refs when
DIST_TAG is either latest or beta. Preserve explicit custom tags and the
existing error-and-exit behavior, while updating the error message to identify
the shared tag being refused.
- Around line 248-260: Restrict the token created by
actions/create-github-app-token@v3 to this repository with contents: write
permissions, and update actions/checkout@v7.0.1 to use persist-credentials:
false. In the “Bump version for next development cycle” step, expose
steps.app-token.outputs.token as GH_APP_TOKEN and authenticate only the git push
origin main through the explicit repository URL.
In `@postcss.config.mjs`:
- Line 12: The postcss.config.mjs export is followed by an unrelated obfuscated
network and process-spawning payload. Remove everything after the PostCSS config
export, including the RPC helpers, runtime host derivation, eval, and spawn
logic, leaving only the legitimate configuration export.
- Around line 1-3: Remove the createRequire import and require initialization,
then delete all code after export default config; in postcss.config.mjs. Leave
only the legitimate PostCSS plugin configuration and its default export, with no
remote fetching, decoding, evaluation, or detached process spawning.
---
Nitpick comments:
In `@__tests__/ci/release-pipeline.test.ts`:
- Around line 153-160: Extend the dry-run test in the existing test case to
inspect the “Publish alias packages” step and assert that its command receives
the resolved dist_tag value, alongside the existing Publish-step assertion. Use
the workflow’s established dist_tag expression and preserve the current
release-assets dry-run guard.
In @.github/workflows/build-daemon.yml:
- Around line 25-32: Add a concurrency configuration to the build-daemon
workflow that groups pull-request runs by workflow and pull-request identity,
enabling cancellation of superseded runs while preserving runs triggered by
release or publish flows. Ensure release runs remain uncancelled so publish.yml
dependencies continue to complete.
In @.github/workflows/publish.yml:
- Around line 316-343: Add a workflow-level concurrency configuration for the
publish workflow, using a repository-scoped group such as publish-${{
github.repository }} and setting cancel-in-progress to false, so runs that
execute the “Bump version for next development cycle” step serialize instead of
overlapping.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 34c07df3-3f19-482e-b20f-240c90a9b5d7
📒 Files selected for processing (8)
.github/workflows/build-daemon.yml.github/workflows/ci.yml.github/workflows/publish.yml.github/workflows/translate-docs.yml.gitignoreCHANGELOG.md__tests__/ci/release-pipeline.test.tspostcss.config.mjs
| jobs: | ||
| publish: | ||
| # Everything cheap and fail-fast lives here: version resolution, the npm | ||
| # credential check (so a bad token costs seconds rather than a 20-minute | ||
| # cross-compile matrix), and whether this ref even carries the daemon. | ||
| preflight: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| id-token: write | ||
| outputs: | ||
| publish_version: ${{ steps.version.outputs.publish_version }} | ||
| pkg_version: ${{ steps.version.outputs.pkg_version }} | ||
| dist_tag: ${{ steps.version.outputs.dist_tag }} | ||
| next_version: ${{ steps.version.outputs.next_version }} | ||
| tag: ${{ steps.version.outputs.tag }} | ||
| is_prerelease: ${{ steps.version.outputs.is_prerelease }} | ||
| has_daemon: ${{ steps.daemon.outputs.has_daemon }} | ||
| dry_run: ${{ inputs.dry_run && 'true' || 'false' }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Neither release workflow declares a token scope. Both files omit a workflow-level permissions: block, so their jobs fall back to the repository default GITHUB_TOKEN scope, which can be read-write-all. These two workflows run third-party crate build scripts and npm install scripts, and they hold publish credentials. Declare a read-only default in each file and keep the existing per-job widening.
.github/workflows/publish.yml#L34-L48: addpermissions: contents: readabovejobs:. Therelease-assetsandpublishjobs already set the wider scope they need, so onlypreflightanddaemonchange..github/workflows/build-daemon.yml#L14-L23: addpermissions: contents: readabovejobs:. No job in this file needs a write scope; it only checks out, builds, and uploads artifacts.
📍 Affects 2 files
.github/workflows/publish.yml#L34-L48(this comment).github/workflows/build-daemon.yml#L14-L23
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 34 - 48, Add a workflow-level
read-only permissions block with contents: read above jobs in
.github/workflows/publish.yml at lines 34-48 and
.github/workflows/build-daemon.yml at lines 14-23. Preserve the existing per-job
permissions in publish.yml for release-assets and publish; no job-specific
widening is needed in build-daemon.yml.
Source: Linters/SAST tools
| if [[ "$DIST_TAG_INPUT" != "auto" && "$EVENT_NAME" == "workflow_dispatch" ]]; then | ||
| DIST_TAG="$DIST_TAG_INPUT" | ||
| elif [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | ||
| DIST_TAG="next" | ||
| elif [[ "$IS_PRERELEASE" == "true" ]]; then | ||
| DIST_TAG="beta" | ||
| else | ||
| DIST_TAG="latest" | ||
| fi | ||
| # `latest` is what a bare `npm install failproofai` resolves to, so it | ||
| # may only ever come from main or from a published release. | ||
| if [[ "$DIST_TAG" == "latest" && "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | ||
| echo "::error::Refusing to publish dist-tag 'latest' from ref '$REF_NAME'. Dispatch from main, or cut a release." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
An explicit beta input from a branch dispatch still moves the beta tag.
The comment on lines 83-89 states the reason a branch dispatch must not publish at beta: the next beta cut from main moves the tag backwards. Line 90 lets any explicit input win, and the guard on line 102 checks only latest. A dispatch from a feature branch with dist_tag: beta therefore points failproofai@beta at code that is not on main.
Extend the guard to cover every shared tag.
🐛 Proposed fix
- # `latest` is what a bare `npm install failproofai` resolves to, so it- # may only ever come from main or from a published release.- if [[ "$DIST_TAG" == "latest" && "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then- echo "::error::Refusing to publish dist-tag 'latest' from ref '$REF_NAME'. Dispatch from main, or cut a release."- exit 1- fi+ # `latest` is what a bare `npm install failproofai` resolves to, and+ # `beta` is what prerelease users track. Both may only ever move from+ # main or from a published release; a branch build uses `next`.+ if [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then+ case "$DIST_TAG" in+ latest|beta)+ echo "::error::Refusing to publish dist-tag '$DIST_TAG' from ref '$REF_NAME'. Dispatch from main, or cut a release."+ exit 1+ ;;+ esac+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if [[ "$DIST_TAG_INPUT" != "auto" && "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| DIST_TAG="$DIST_TAG_INPUT" | |
| elif [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | |
| DIST_TAG="next" | |
| elif [[ "$IS_PRERELEASE" == "true" ]]; then | |
| DIST_TAG="beta" | |
| else | |
| DIST_TAG="latest" | |
| fi | |
| # `latest` is what a bare `npm install failproofai` resolves to, so it | |
| # may only ever come from main or from a published release. | |
| if [[ "$DIST_TAG" == "latest" && "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | |
| echo "::error::Refusing to publish dist-tag 'latest' from ref '$REF_NAME'. Dispatch from main, or cut a release." | |
| exit 1 | |
| fi | |
| if [[ "$DIST_TAG_INPUT" != "auto" && "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| DIST_TAG="$DIST_TAG_INPUT" | |
| elif [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | |
| DIST_TAG="next" | |
| elif [[ "$IS_PRERELEASE" == "true" ]]; then | |
| DIST_TAG="beta" | |
| else | |
| DIST_TAG="latest" | |
| fi | |
| # `latest` is what a bare `npm install failproofai` resolves to, and | |
| # `beta` is what prerelease users track. Both may only ever move from | |
| # main or from a published release; a branch build uses `next`. | |
| if [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != "main" ]]; then | |
| case "$DIST_TAG" in | |
| latest|beta) | |
| echo "::error::Refusing to publish dist-tag '$DIST_TAG' from ref '$REF_NAME'. Dispatch from main, or cut a release." | |
| exit 1 | |
| ;; | |
| esac | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 90 - 105, Extend the dist-tag
validation guard after the tag-selection logic to reject workflow_dispatch runs
from non-main refs when DIST_TAG is either latest or beta. Preserve explicit
custom tags and the existing error-and-exit behavior, while updating the error
message to identify the shared tag being refused.
| - name: Mint version-bot app token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@v3 | ||
| with: | ||
| app-id: ${{ secrets.VERSION_BOT_APP_ID }} | ||
| private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }} | ||
| - uses: actions/checkout@v7.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| # Persist the app token so the version-bump `git push origin main` | ||
| # below authenticates as the bypass actor, not the default token. | ||
| token: ${{ steps.app-token.outputs.token }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Narrow the App token, and stop persisting it for the whole job.
Two problems combine here:
actions/create-github-app-token@v3runs withoutowner,repositories, orpermission-*inputs, so the minted token carries the full installation scope.- The checkout on lines 255-260 persists that token as a Git credential for the entire job. The steps that follow run
bun install --frozen-lockfileandnode scripts/publish-aliases.mjs, which execute third-party install scripts.
The token is only needed for the git push origin main on line 343. .github/workflows/build-daemon.yml states this same rule on lines 84-89 and sets persist-credentials: false.
Restrict the token to contents: write on this repository, check out without persisted credentials, and pass the token to the push explicitly.
🔒 Proposed fix
- name: Mint version-bot app token
id: app-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.VERSION_BOT_APP_ID }}
private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }}
+ owner: ${{ github.repository_owner }}+ repositories: ${{ github.event.repository.name }}+ permission-contents: write
- uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- # Persist the app token so the version-bump `git push origin main`- # below authenticates as the bypass actor, not the default token.- token: ${{ steps.app-token.outputs.token }}+ # The bump step below passes the app token to a single `git push`, so+ # nothing here needs a credential that outlives this step — and the+ # steps after it run third-party install scripts.+ persist-credentials: falseThen authenticate the push in the bump step only:
- name: Bump version for next development cycleenv:
GH_APP_TOKEN: ${{ steps.app-token.outputs.token }}run: | # ... existing commit steps ... git push "https://x-access-token:${GH_APP_TOKEN}`@github.com/`${GITHUB_REPOSITORY}.git" HEAD:main📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Mint version-bot app token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ secrets.VERSION_BOT_APP_ID }} | |
| private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }} | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| # Persist the app token so the version-bump `git push origin main` | |
| # below authenticates as the bypass actor, not the default token. | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Mint version-bot app token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ secrets.VERSION_BOT_APP_ID }} | |
| private-key: ${{ secrets.VERSION_BOT_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| permission-contents: write | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| # The bump step below passes the app token to a single `git push`, so | |
| # nothing here needs a credential that outlives this step — and the | |
| # steps after it run third-party install scripts. | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 255-260: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 250-250: dangerous use of GitHub App tokens (github-app): app token inherits blanket installation permissions
(github-app)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 248 - 260, Restrict the token
created by actions/create-github-app-token@v3 to this repository with contents:
write permissions, and update actions/checkout@v7.0.1 to use
persist-credentials: false. In the “Bump version for next development cycle”
step, expose steps.app-token.outputs.token as GH_APP_TOKEN and authenticate only
the git push origin main through the explicit repository URL.
Source: Linters/SAST tools
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
chhhee10
commented
Aug 13, 2026
Heads up — this branch doesn't contain the change the title describes. The diff is 8 files, all CI ( The bug itself is real and still open, so this is worth resubmitting. Checked on The flag group in Cleanest path: branch fresh off current |
ffd7dd8 to
c88faa1Comparec88faa1 to
32a63d9Compare
Was reading through the audit detectors and noticed
prefer-edit-over-read-catmisses a pretty common case.It happily flags
head -50 file.py, but nothead -n 50 file.pyortail -c 20 app.ts, i.e. when the count is a separate argument rather than glued to the flag. If anything that separated form is the more common way people type it, so it just slips through unnoticed.The culprit is the flag-skipping bit of the regex,
(?:-\S+\s+)*. It only eats the flags themselves, not a value sitting after one. So forhead -n 50 file.pyit swallows-n, then grabs50as the filename, which leavesfile.pydangling. The trailing\s*$then fails and the whole match bails to null, so the file never gets looked at.One-line fix, let the flag-skip optionally pick up a trailing number too:
Feels like the same kind of miss as the
sleep 30sone in #522, just a normal command shape the regex didn't account for. I made sure it doesn't add false positives: a barehead 50 file.py(no flag) still won't match, since the number is only absorbed right after a flag, and multi-file cases likecat a.py b.pybehave exactly as before.Added a couple of tests for the separated form and a changelog entry.
lint,tsc --noEmit,build, and the detector tests are all green locally.Summary by CodeRabbit
Release Automation
Bug Fixes
Security