Conversation
…#509) Dispatchers run in the user's INTERACTIVE shell, where aliases are live and expand at parse time. A user alias on a coreutil silently hijacks any pipeline using it. Found live, not hypothetically. This machine has: tr='track-activity report' so every `... | tr -d ' '` in lib/ ran `track-activity report -d ' '` and its output landed in the variable instead of the count. Visible in `teach deploy --dry-run` against a real course repo: Would deploy Monthly Terminal Report (2026-08): ================================== files: where "675" belonged. The same alias also corrupted the uncommitted-file count added in v7.17.0 - I found it because my own new line was garbled, then traced it and discovered the pre-existing file_count line had the identical bug. 101 pipeline sites across 34 files. All now use `command tr`, which bypasses aliases and functions and is identical when no alias exists. Verified in the affected repo: bare tr: [Monthly Terminal Report (2026-08):\n===...] command tr: [1] Note: 1 uncommitted file(s) are NOT included below. Would deploy 675 files: tests/test-alias-shadowing.zsh guards it three ways: no bare `| tr` remains in lib/*.zsh, `command tr` survives a planted hostile alias, and a NEGATIVE control confirms the bare form really is hijacked - so if the environment ever stops reproducing it, the test says so instead of going vacuously green. Not changed: `grep` is also aliased here, but to `grep --color=auto --exclude-dir={...}`, which is behaviourally compatible. Only `tr` was destructive. Full suite 83 passed / 2 failed - both (e2e-em-dispatcher, test-atlas-contract) reproduce on unmodified dev and are green in CI. Co-authored-by: Test User <test@example.com>
Patch release for the alias-shadowing fix (#509). A user alias on a coreutil could hijack shipped pipelines: dispatchers run in the interactive shell where aliases expand at parse time, so on a machine with tr='track-activity report' every '| tr -d' in lib/ ran that instead. teach deploy --dry-run printed 'Would deploy Monthly Terminal Report (2026-08):' where 'Would deploy 675 files:' belonged. 101 sites now use 'command tr'. Both changelogs cut [7.17.1] with identical bodies; parity test green. docs/index.md updated by hand again - release.sh still does not touch it (both the What's New banner and the footer), which is worth folding into the script. Man-page guard 12/12, mkdocs --strict exit 0, no stale 7.17.0 refs outside changelogs. Full suite 81 passed / 1 failed / 3 timeout - the failure and timeouts are the known local-only set (e2e-em-dispatcher, test-atlas-contract and friends), all green in CI. Co-authored-by: Test User <test@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patch release: fixes a critical
tr-alias-shadowing bug where an interactive shell'stralias silently hijacked every| trpipeline in shippedlib/*.zshcode (107 sites, 34 files), corrupting output in commands liketeach deploy --dry-run. Fixed viacommand trat every call site (#509), release-cut in #510.Commits
bc2b366bbfix: usecommand trso a user alias cannot hijack shipped pipelines8955482d9chore(release): v7.17.1Test plan