Fix gated sync regex false positive and expose redacted matches

Merged
UN
1d ago
+464-17

Fixes #160. Gated sync rejected the public pm-web issue 218 because a JavaScript regex literal looked like a host path. Recognizable regex source now imports through ordinary and atomic gated modes, while quoted host roots and slash-separated paths remain findings before writes. Reports identify the item, field, starting offset of the hashed match, and a strictly redacted excerpt.

The review fixes preserve quoted text through escapes and earlier regexes, distinguish decoded field content from serialized TOON tracker lines, and retain whole JSON-string handling. Ambiguous quote contexts stay refused. Entropy-assignment offsets now point to the captured secret value; home-username offsets exclude the consumed delimiter. Explicit diff scanning also has regression coverage in a real tracker outside Git.

Review-round behavioral revert proofs: restoring only isBareRootRegex fails the quoted-path regression (1/1); restoring only scanLineForRuleHits fails the secret and home-offset regressions (2/2). Independently disabling original quote-state preservation, tracker serialization context, and slash interpretation handling each fails its regression (1/1 each). All fixes were restored: six expected assertion failures across five experiments. Tests import source directly and use real temporary trackers.

Validation on the merged package version 2026.10.21, with isolated HOME and disabled global/system Git configuration:

  • npm run release:check: 989/989 tests passed; zero failures, cancellations or skips.
  • bun run release:check: 989/989 tests passed; zero failures, cancellations or skips.
  • Both gates independently cover all 16 authored modules at exact 100/100/100/100: lines/statements 11169/11169, functions 305/305, branches 3603/3603. Thresholds and source inventory are unchanged. Source/test/config hashes match before and after each run.
  • Linked pm tests: 2/2 commands passed (21 tests). bun test --timeout 600000 test/gate-inputs.test.ts: 18/18 passed.
  • Typecheck/build, documentation, lint, zero duplication, privacy, zero production vulnerabilities, package dry-run, canonical changelog and publish-attestation checks passed. Strict pm health and validation passed with no history drift. The repository does not commit dist; the build was refreshed.

Tracker: pm-github-xhtp, retained in progress and unclaimed for orchestrator verification. Existing history remains append-only; test receipts are in comments because tracker test-result persistence is disabled.