Skip to content

Match the account name as a whole word in /doc-review's scrub #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattmenefee merged 1 commit into from
Sep 16, 2026
Merged

Match the account name as a whole word in /doc-review's scrub #139

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions home/.claude/commands/doc-review.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -709,13 +709,13 @@ shell glob, and match `local-review*.md` rather than the exact name:

```bash
root="$(git rev-parse --show-toplevel)"
me="$(id -un)"
me="$(id -un | sed 's/[][\.*^$+?(){}|/]/\\&/g')"

# One pattern set, used by every pass, so the passes cannot drift apart.
paths='/users/|/home/|/tmp/|/var/folders/|/volumes/|/root/|-users-'
paths="$paths"'|[a-z]:\\users|\\wsl|\$\{?home|~[a-z_][a-z0-9_-]*/|\.(internal|local|corp|lan)'
hosts='(^|[^0-9.])(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.1)'
ident="$paths|$hosts|$me|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}"
ident="$paths|$hosts|(^|[^a-z0-9])$me([^a-z0-9]|$)|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}"
secrets='-----begin [a-z ]*private key-----'
secrets="$secrets"'|(api[_-]?key|secret|token|password|bearer)[[:space:]]*[:=]'
secrets="$secrets"'|[a-z][a-z0-9+.-]*://[^[:space:]/]+:[^[:space:]@]+@'
Expand Down Expand Up @@ -772,6 +772,14 @@ caught by the scan, then passes clean after a `~`-prefix rewrite while still nam
A remediation its own verifier certifies as safe is worse than none, because it ends the reviewer's
attention. `$me` is in the pattern set for exactly this reason.

Match the account name as a whole word, bounded by anything that is not a letter or digit. A bare
substring fires inside ordinary words — an account named `ann` blocks on "annual" and "planning" —
so the scrub stops clean posts, and a gate that routinely cries wolf teaches the reader to override
it. The boundary still catches every form that names the user: `/Users/<name>/`, dash-encoded
`-Users-<name>--repo`, `<name>@host` and the bare name in prose. The name is escaped before it
enters the pattern, since an account name can contain `.` or other characters `grep -E` would
otherwise read as syntax.

**Re-run `scan` after rewriting, and treat any remaining output as blocking.** The rewrite step is
performed by the same agent that is judging whether it worked, so without a second pass its belief
that the document is clean is never tested against the document as it now stands. A detect-and-fix
Expand Down