[yannelli]

Summary

Random file sampling (shuf --random-source=/dev/urandom) landed on apply-patch.mjs and codex-tests.mjs. Both had real bugs.

Production: extractPatch only kept the first *** Begin Patch … *** End Patch span. A Bash command with two apply_patch heredocs scanned the first file and ignored the rest, so a long comment in the second patch would not be denied. parseApplyPatch also kept attaching + lines after *** End Patch to the last file, so trailing junk could be treated as file content.

Test: the multi-file “reason names the violating file” check printed FAIL but never incremented the suite failure count, so that assertion could not fail CI.

Rebased onto main after the main-only branch flow, so Conventional PR no longer treats this as a dev → main release PR.

Behavior

• Every Begin/End Patch span in a shell command is extracted and scanned.
• parseApplyPatch closes the current file on *** Begin Patch / *** End Patch, so + lines after the terminator are ignored.
• The violating-file assertion now uses the shared ok/bad counters.

Checks

Ran locally after the rebase:

node scripts/check.mjs
node --test test/*.test.mjs
env -u HOME -u USERPROFILE -u XDG_CONFIG_HOME node plugins/concise/test/run-tests.mjs
node scripts/coverage.mjs "$NODE_V8_COVERAGE"

scripts/check.mjs reported valid syntax/JSON/versions. node --test passed 193/193. Plugin tests: 1811 passed, 0 failed. Line coverage 100.00% (5854/5854). check-pr.mjs accepts this title against main.

Migration

None.