release-train: develop -> staging - #442
Conversation
* fix(install): match a quoted fish path, spaces included rc_lists_dir field-split fish_add_path arguments on whitespace. Since #434 started writing fish_add_path "$PREFIX", a prefix containing spaces became two fields, matched neither, and the installer appended a SECOND block directly beneath an existing line naming the same directory -- while reporting that it had added a PATH entry that was already there. The read path now parses quotes like the ownership reader further up the file already does: a quoted argument is one path, spaces included, while an unquoted line still splits so several bare paths on one line keep working. Single quotes are handled too, which the old code also missed. Verified in both directions: the two new harness cases fail against the current installer (29 passed / 2 failed) and pass with this change (31 passed / 0 failed). Found by Bugbot on the develop->staging promotion (cli#438). * fix(install): take the FIRST fish_add_path, not the last A greedy /^.*fish_add_path/ strips through the LAST occurrence on the line, so an inline comment mentioning fish_add_path left the comment text as the path and missed the real argument -- reintroducing the exact bug this branch fixes. index() takes the first occurrence instead. Also restores the leading-whitespace strip that the greedy regex used to consume: without it substr() left ' "/path"', so the quote check saw a space and fell back to field-splitting, breaking the spaced-path fix. Caught by re-running the whole case set rather than only the new one. Bugbot, cli#439. * fix(install): take the FIRST fish_add_path, not the last A greedy /^.*fish_add_path/ strips through the LAST occurrence on the line, so an inline comment mentioning fish_add_path left the comment text as the path and missed the real argument -- reintroducing the exact bug this branch fixes. index() takes the first occurrence instead. Also restores the leading-whitespace strip that the greedy regex used to consume: without it substr() left ' "/path"', so the quote check saw a space and fell back to field-splitting, breaking the spaced-path fix. Caught by re-running the whole case set rather than only the new one. Bugbot, cli#439. * fix(install): tokenise the fish argument list properly Replaces three rounds of patching with one quote-aware tokenizer, because each patch fixed its own case and broke or missed another: * greedy .* strip lost the real argument to an inline comment * index() alone dropped the leading space, so the quote check failed and spaced paths regressed * taking only the first quoted argument missed the prefix when fish_add_path lists several directories The loop now walks the argument list: quoted tokens are one path (spaces included), bare tokens split on whitespace, flags are skipped, and a trailing # comment ends parsing. 18 direct variants and 33 harness cases green. Bugbot, cli#439. * fix(install): tokenise the fish argument list properly Replaces three rounds of patching with one quote-aware tokenizer, because each patch fixed its own case and broke or missed another: * greedy .* strip lost the real argument to an inline comment * index() alone dropped the leading space, so the quote check failed and spaced paths regressed * taking only the first quoted argument missed the prefix when fish_add_path lists several directories The loop now walks the argument list: quoted tokens are one path (spaces included), bare tokens split on whitespace, flags are skipped, and a trailing # comment ends parsing. 18 direct variants and 33 harness cases green. Bugbot, cli#439.
Records a redacted gitleaks baseline at the repo root so the full-history dispatch scan runs clean, and wires the code-quality caller to consume it via the gitleaks-baseline input. Part of tracebloc/backend#1303. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
bugbot run |
|
👋 Heads-up — Code review queue is at 37 / 30 Above the WIP limit. The team convention is to review existing PRs before opening new work. Open PRs currently in Code review (oldest first):
Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.) |
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
1 issue from previous review remains unresolved.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit be16f6f. Configure here.
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit be16f6f. Configure here.

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Low Risk
Changes are mostly installer awk parsing and CI/docs; installer behavior improves idempotency for fish users with no auth or data-path impact.
Overview
Develop → staging promotion bundling installer fixes, CI secret-scan baseline, and contributor template updates.
The
install.shrc_lists_dirlogic for fishfish_add_pathno longer field-splits quoted paths. It tokenises arguments from the firstfish_add_pathon the line, honours single/double quotes (including paths with spaces), skips flags, stops at trailing comments, and walks multiple directory arguments—fixing false “not listed” detection that duplicated PATH blocks (cli#439).install-verify.shadds cases 16–18 for spaced prefixes, inline comments mentioningfish_add_path, and a second quoted path on one line.CI passes
gitleaks-baseline: .gitleaks-baseline.jsoninto the shared code-quality workflow so one known generic-api-key finding ininternal/submit/submit_test.go(IdempotencyKeytest fixture) does not fail the gate.The pull request template expands guidance: cross-repo issue examples, Breaking change type, test plan / screenshots / deployment notes sections, and checklist items for docs, security reviewers, expand-then-contract rollouts, and local Go/style checks.
Reviewed by Cursor Bugbot for commit be16f6f. Bugbot is set up for automated code reviews on this repo. Configure here.