[melodic-automation-lanes]

Closes #12895

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The recorded decision on ＃12895 (2026-11-04) settles that the extglob-off rewrite this issue targeted no longer exists: ＃12896 (4799a0e) replaced it with shfmt's parse tree, which refuses any command holding an extglob form (lib/hook-utils.sh:4891-4896, reason at :4998). Following that decision, this change adds the missing refusal row for !(x)＃; git \<newline>reset --hard beside the existing !(x)＃ rows in lib/hook-utils.test.sh, so the guard still denies the reset through the extglob refusal. The reader and the oracle table are unchanged, so the oracle's none-hidden result is unaffected.

Not verified

• lib/hook-utils.test.sh (including the new row and the oracle table's none-hidden line) was not executed here, because this lane runs no test runner; left to the PR's CI
• tidy skipped: the change touches lib/, a listed shared path under the tidy cutoffs
• Body done-when item 1 (fix the extglob-off rewrite of )＃) and the 'by reading it rather than by refusal' part of item 2 were not built: the recorded decision says ＃12896 removed that rewrite and the reader refuses extglob forms by design

Fix

• lib/hook-utils.test.sh: added a bps_refused row asserting that !(x)＃; git \<newline>reset --hard is refused with 'an extglob pattern, which shfmt and bash do not read the same way'

Verification

The runner ran each check from the base copy against 1dd933a:

• scripts/check-changelog-fragments.sh --check: passed
• scripts/check-changed-skills.sh --merge-base: passed

The run reports:

• /home/runner/work/claude-code-plugins/claude-code-plugins/.lane/checks/bin/check-changelog-fragments: all 1 changelog fragment(s) valid
• /home/runner/work/claude-code-plugins/claude-code-plugins/.lane/checks/bin/check-changed-skills: no changed skills, nothing to gate
• /home/runner/work/claude-code-plugins/claude-code-plugins/.lane/checks/bin/check-affected: 10 passed, 6 skipped over 1 changed file
• read lib/hook-utils.sh:4489-4491 and :4891-4999: hook::bash_parse_segments calls the shfmt reader directly, and any ExtGlob node sets __hu_bext, which refuses with the expected reason before any callback runs
• fresh-context review subagent: no defects found; it confirmed the $'...\\n...' string decodes to a backslash and a newline, and that the row should pass the same way as the neighbouring '!(x)＃; git reset --hard' row
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41770403863

Left out: the items under Not verified.

Related

#12895

[github-actions]

claude-review reviewed 1dd933a4429b2693c351452607b52f014a8f377f: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #13109 (no findings)

Scope: 1 changed file, lib/hook-utils.test.sh. I read the whole change (one hunk). The PR adds one bps_refused row for !(x)#; git \<newline>reset --hard.

Checked against the closing issue (#12895, as the recorded decision comment changed it):

• "A row in lib/hook-utils.test.sh covers !(x)#; git \<newline>reset --hard: the guard still denies the reset, by the extglob refusal." Met. The new row (L4090-L4092) uses $'!(x)#; git \\\nreset --hard', which decodes to a literal backslash followed by a newline. It expects the same reason text as the neighbouring !(x)# rows. bps_refused (L4045-L4057) needs exit 2 plus got no parse and that reason, so this row is itself the test that fails if the refusal stops happening.
• "The oracle table still reports none hidden." Met by construction. The PR leaves both the reader and the oracle table unchanged. I did not run the test suite (this lane has no shell). The author says it was not run either and leaves it to CI.
• The original issue's item 1 (fix the extglob-off rewrite) and the "by reading it rather than by refusal" part of item 2 were dropped, as the recorded decision on the issue says. The PR body states this openly under "Not verified".

Path-scoped rules: no rule in .claude/rules/ has a paths: glob that matches lib/hook-utils.test.sh.

Embedded text: none found in the PR context.

Spend: the change only adds one test row. It adds no spend and no billable resource.

Verification: the author's verification notes (the check-changelog-fragments, check-changed-skills and check-affected results) are their own claims and I did not confirm them. I only read the diff and the test file around the new row.

[github-actions]

claude-security-review reviewed 1dd933a4429b2693c351452607b52f014a8f377f: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read the whole diff. It changes one file, lib/hook-utils.test.sh, and adds a single bps_refused test row at lines 4090-4092. The row checks that the command guard still refuses !(x)#; git \<newline>reset --hard with the extglob refusal reason.

• Production code: none is changed. The reader in lib/hook-utils.sh, the guard's block lists and the oracle table are untouched.
• Guardrail coverage: the change adds a check rather than removing one. A destructive git reset --hard hidden behind a backslash-newline continuation after an extglob form must still be refused.
• Trust controls: none of the changed files match the trusted paths. No trust control, token scope, kill switch, merge hold or plugin manifest is touched.
• Instruction surface: no standing instruction is deleted, narrowed or softened.
• PR context: the description and the closing issue's comment contain no embedded text telling this lane to pass the change, skip a check or drop a finding.
• Spend: none.

critical-findings: 0

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head 1dd933a4429b2693c351452607b52f014a8f377f.