fix: zsh glob safety — setopt guards + find for shell glob patterns

New zsh-safe test from main catches unsafe for-in globs and ls/grep with
glob args. Fix ship/SKILL.md.tmpl (for-in → find) and gstack-submit
(add setopt +o nomatch guards for ls with glob patterns).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Garry Tan 2026-03-27 00:42:10 -06:00
parent 5a5b575c97
commit 51171f3233
No known key found for this signature in database
GPG Key ID: C1F69E85C74EFE1D
4 changed files with 6 additions and 2 deletions

View File

@ -366,6 +366,7 @@ eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)"
3. Read existing design docs for context: 3. Read existing design docs for context:
```bash ```bash
setopt +o nomatch 2>/dev/null || true # zsh compat
ls -t ~/.gstack/projects/$SLUG/*-design-*.md 2>/dev/null | head -5 ls -t ~/.gstack/projects/$SLUG/*-design-*.md 2>/dev/null | head -5
``` ```
If design docs exist, read the most recent one. This gives you the "what was planned" narrative. If design docs exist, read the most recent one. This gives you the "what was planned" narrative.
@ -490,6 +491,7 @@ Use AskUserQuestion:
```bash ```bash
PROJECT_DIR=$(git rev-parse --show-toplevel | sed 's|/|-|g; s|^-||') PROJECT_DIR=$(git rev-parse --show-toplevel | sed 's|/|-|g; s|^-||')
echo "Looking for transcripts in: ~/.claude/projects/-$PROJECT_DIR/" echo "Looking for transcripts in: ~/.claude/projects/-$PROJECT_DIR/"
setopt +o nomatch 2>/dev/null || true # zsh compat
ls ~/.claude/projects/-$PROJECT_DIR/*.jsonl 2>/dev/null | tail -10 ls ~/.claude/projects/-$PROJECT_DIR/*.jsonl 2>/dev/null | tail -10
``` ```

View File

@ -46,6 +46,7 @@ You help gstack users submit their projects to the gstack.gg showcase gallery. Y
3. Read existing design docs for context: 3. Read existing design docs for context:
```bash ```bash
setopt +o nomatch 2>/dev/null || true # zsh compat
ls -t ~/.gstack/projects/$SLUG/*-design-*.md 2>/dev/null | head -5 ls -t ~/.gstack/projects/$SLUG/*-design-*.md 2>/dev/null | head -5
``` ```
If design docs exist, read the most recent one. This gives you the "what was planned" narrative. If design docs exist, read the most recent one. This gives you the "what was planned" narrative.
@ -170,6 +171,7 @@ Use AskUserQuestion:
```bash ```bash
PROJECT_DIR=$(git rev-parse --show-toplevel | sed 's|/|-|g; s|^-||') PROJECT_DIR=$(git rev-parse --show-toplevel | sed 's|/|-|g; s|^-||')
echo "Looking for transcripts in: ~/.claude/projects/-$PROJECT_DIR/" echo "Looking for transcripts in: ~/.claude/projects/-$PROJECT_DIR/"
setopt +o nomatch 2>/dev/null || true # zsh compat
ls ~/.claude/projects/-$PROJECT_DIR/*.jsonl 2>/dev/null | tail -10 ls ~/.claude/projects/-$PROJECT_DIR/*.jsonl 2>/dev/null | tail -10
``` ```

View File

@ -1809,7 +1809,7 @@ If the user chooses A or B:
```bash ```bash
REPO_SLUG=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)") REPO_SLUG=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)")
BRANCH=$(git branch --show-current 2>/dev/null) BRANCH=$(git branch --show-current 2>/dev/null)
for img in /tmp/gstack-pr-screenshots/*.png; do for img in $(find /tmp/gstack-pr-screenshots -name '*.png' 2>/dev/null); do
VIEWPORT=$(basename "$img" .png) VIEWPORT=$(basename "$img" .png)
URL=$(~/.claude/skills/gstack/bin/gstack-screenshot-upload "$img" \ URL=$(~/.claude/skills/gstack/bin/gstack-screenshot-upload "$img" \
--repo-slug "$REPO_SLUG" --branch "$BRANCH" --viewport "$VIEWPORT") --repo-slug "$REPO_SLUG" --branch "$BRANCH" --viewport "$VIEWPORT")

View File

@ -551,7 +551,7 @@ If the user chooses A or B:
```bash ```bash
REPO_SLUG=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)") REPO_SLUG=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)")
BRANCH=$(git branch --show-current 2>/dev/null) BRANCH=$(git branch --show-current 2>/dev/null)
for img in /tmp/gstack-pr-screenshots/*.png; do for img in $(find /tmp/gstack-pr-screenshots -name '*.png' 2>/dev/null); do
VIEWPORT=$(basename "$img" .png) VIEWPORT=$(basename "$img" .png)
URL=$(~/.claude/skills/gstack/bin/gstack-screenshot-upload "$img" \ URL=$(~/.claude/skills/gstack/bin/gstack-screenshot-upload "$img" \
--repo-slug "$REPO_SLUG" --branch "$BRANCH" --viewport "$VIEWPORT") --repo-slug "$REPO_SLUG" --branch "$BRANCH" --viewport "$VIEWPORT")