[rig-tasks] Add 10 rig samples — 2026-08-11 - #404

[/codebase-design] Shell injection risk: revision and filePath are interpolated directly into execSync command strings without sanitisation — a caller-supplied revision like $(rm -rf .) would execute arbitrary commands.

import { spawnSync } from "node:child_process";
const result = spawnSync("git", ["show", `${revision}:${filePath}`], { encoding: "utf8" });
const fileContent = result.stdout ?? "";

[/codebase-design] The same shell injection concern applies to git log — revision and filePath are still interpolated unquoted. Consistently use spawnSync for both calls, as suggested on line 11.

[/codebase-design] schemaTitle: undefined in early-return paths conflicts with the output schema s.optional(s.string) which expects the field to be absent (or null), not undefined. Return null or omit the key to match the schema contract — some JSON serialisers will silently drop undefined, others may fail validation.

return { valid: false, errors: ["Invalid JSON in schema file"], checkedFields: 0, schemaTitle: null };

[/codebase-design] The frontmatter regex /^--- ? ([\s\S]*?) ? ---/ doesn't require the closing --- to be at the start of a line (^), so it could match a --- in the middle of a line. Add the m flag and anchor the closing delimiter:

const match = content.match(/^---
?
([\s\S]*?)
?
^---/m);

Otherwise a document with --- foo --- in its body could produce a false frontmatter match.

[/codebase-design] The agent is asked to call parseLogLine once per log line, which could mean thousands of tool calls for a real access log. This will exceed maxTurns (default 10) and produce incomplete results without any guidance.

[/codebase-design] maxDepth is updated with if (depth > maxDepth) maxDepth = depth before recursing, so it always lags one level behind. Move the update after the recursive call, or simply Math.max at each level:

walk(child, depth + 1);
if (depth > maxDepth) maxDepth = depth;

As written, maxDepth will always equal one less than the true maximum depth.

[/codebase-design] The regex /const\s+(\w+)\s*=\s*async\s*(?:\([^)]*\)|[^=]+)\s*=>/g is brittle for multiline arrow functions and will silently miss async methods (async methodName()) in classes. Since this is a sample, the limitation should at minimum be documented in a comment so readers don't copy it expecting complete coverage.

[/codebase-design] branchDiffAgent uses git diff --stat HEAD~1..HEAD which will fail on a repository with a single commit (no HEAD~1). The || git diff --stat HEAD fallback still won't produce stats since HEAD with no parent means an empty diff. Consider git diff --stat $(git rev-parse --verify HEAD~1 2>/dev/null || git hash-object -t tree /dev/null) HEAD or document this limitation.

[/codebase-design] The object-spread regex /\{[^}]*\.\.\./g counts characters between { and ... but [^}]* is greedy and stops at the first }, so spread patterns inside nested objects (e.g. { a: { ...x }, b: 1 }) will match on the outer { and the wrong .... Consider a simpler /\.\.\.[a-zA-Z_$]/g count as a more robust proxy for spread occurrences in the file, noting the inherent approximation.