Development record
launch --dry-run hard-fails on a local_username false positive: the scan matches the maintainer's short username against the documented '--dev' CLI flag text, so the release preview reports 5 hard fails on a clean tree. The matcher needs a word-boundary/flag-context exemption.
issueresolvedmajoriss-236
launch --dry-run hard-fails on a local_username false positive: the scan matches the maintainer's short username against the documented '--dev' CLI flag text, so the release preview reports 5 hard fails on a clean tree. The matcher needs a word-boundary/flag-context exemption.
Evidence
- 2026-09-23, autonomous run A: the same false positive fires in CI on the CI machine's account name. The forge's hosted Linux and macOS machines run as the account
runner, so the payload scan in thecheckjob read that word as the local username wherever it stood as an ordinary noun: #684 failed its secret and PII scan on both operating systems (hard fail 2) because commands/implement.md and theimplementhelp text used it. Reproduced locally with HOME set to a directory of that name (red on the old tree, green once the text said "in CI" instead). Every lane of the run then carried a rule never to write the bare word in commands/, agents/ or CLI help. The exemption this record asks for would retire that rule.
Grounds
- pursued: a generic account name identifies no person, so the payload and the redactors stop reporting its bare word while every home path and login shape is still caught; a leaked home path or login of a generic name that the scan no longer reports would show it wrong
Frontmatter
| id | iss-236 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-236-launch-dry-run-hard-fails-on-a-local.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-305abcd lint privacy-hygiene hard-fails on ordinary committed content because hasAbsHomePath lacks the leading-boundary predicate its scanner twin has
- iss-2608291444328326The launch payload's `local_username` identity rule takes the username from the last segment of HOME and hard-fails every case-insensitive occurrence of it in the payload. On a machine whose account name is an ordinary word that is also product vocabulary (an account named with the same three-letter word as the `ahoy install` track-latest flag and the "-shim" install mode it names, which appears in commands/ahoy.md, commands/update.md, commands/launch.md and docs/reference/cli/commands.md), `TestPayloadTreeImplementationsResolveIdentically` and `TestRenderPayloadLeavesSourceTreeUnversioned` fail on a pristine main (9 hard-fail findings at e6efe28f), and with them `make preflight` and the pre-push hook, so the v0.6.8 release branch could not be pushed from that machine until HOME was pointed at a symlink alias of the real home directory for the push. CI, which runs under a different account name, passes.