From 7ed761fb31ee199cf3f995effbe1fccc16c73f33 Mon Sep 17 00:00:00 2001
From: acrogenesis <adrian.rangel@gmail.com>
Date: Sat, 29 Aug 2026 16:08:41 -0600
Subject: [PATCH] Stop the heredoc check writing its own exemption

The failure advice printed a ready-to-paste annotation with the scan's
verdict already filled in, so the shortest way past the check was to copy
back what it had just concluded. That is worst exactly where the scan is
weakest: a path it cannot follow through a variable reads as an ordinary
value, and the annotation it offers for that case is paths=none.

Print the annotation with the path list left blank and say why the author
has to fill it in. The scan's own reading stays in the report above it, so
nothing diagnostic is lost.
---
 test/shell.d/privileged-heredoc-test.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/test/shell.d/privileged-heredoc-test.sh b/test/shell.d/privileged-heredoc-test.sh
index c62d3f45..ce274260 100755
--- a/test/shell.d/privileged-heredoc-test.sh
+++ b/test/shell.d/privileged-heredoc-test.sh
@@ -613,7 +613,11 @@ scan_file() {
       1. quote the delimiter (<<'$delim') so nothing expands at install time;
       2. hardcode an absolute root-owned path instead of expanding one;
       3. if the expansion is genuinely required, declare it above the heredoc:
-         # omarchy:heredoc-expands paths=$shown_paths -- <why this is safe>")
+           # omarchy:heredoc-expands paths=<expansions used as paths, or none> -- <why this is safe>
+         Decide that list yourself. The scan's own reading of it is above, and
+         where the scan is most likely wrong is exactly here -- a path it could
+         not follow reads as an ordinary value -- so pasting its verdict back
+         signs off on the case worth checking by hand.")
         continue
       fi
 
@@ -623,9 +627,9 @@ scan_file() {
     Every expansion used as a path outside a root-owned prefix has to be named,
     so adding one to an already-annotated heredoc trips this check again instead
     of inheriting the old exemption.
-    Fix: drop the path expansion (hardcode an absolute root-owned path), or
-    correct the declaration:
-      # omarchy:heredoc-expands paths=$shown_paths -- <why root using this path is safe>")
+    Fix: drop the path expansion (hardcode an absolute root-owned path), or name
+    every path-shaped expansion in the declaration and say why root using it is
+    safe.")
       fi
     done
   done