chore: deslop shell command execution

[steipete]

Remove the unused runCommandRaw export and put its implementation directly in runCommand. All callers already use runCommand, so shell selection, quoting, deadlines, and returned results remain unchanged; this removes nine lines of forwarding code.

Repository-wide reference checking found no direct caller of the removed export. Existing execution tests (19 passed, 2 Windows-only skips), the full suite, typecheck, lint, formatting, build, and installed-package smoke checks passed on AWS Crabbox. Independent Codex review is clean through P2. There is no user-visible behavior change.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 22, 2026, 6:33 AM ET / 10:33 UTC.

ClawSweeper review

What this changes

Removes an unused shell-execution export and moves its unchanged implementation directly into the function used by callers.

Merge readiness

⛔ Blocked before merge - 2 items remain

This is a focused, behavior-preserving cleanup with no actionable correctness finding. Main and v0.8.1 still contain the redundant wrapper, so the contribution remains useful; supplied validation does not yet demonstrate the changed execution path outside tests.

Priority: P3
Reviewed head: a176e18c58244e4c46fdf3d4d6d29a79a6da387f

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and appears correct, but inspectable real execution evidence remains a merge gate.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: The body reports AWS Crabbox checks, but provides no observed after-change run through runCommand or fix validation; the inspected installed-package smoke exercises init/map. Execution tests are supplemental. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The body reports AWS Crabbox checks, but provides no observed after-change run through runCommand or fix validation; the inspected installed-package smoke exercises init/map. Execution tests are supplemental. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	Pinned introduced change: The complete introduced diff deletes nine forwarding/declaration lines in one file. The shell selection, arguments, options, and returned command result remain identical. Caller and contract inspection: Repository-wide references show no remaining runCommandRaw consumer. The production validation loop calls runCommand with a deadline and output bound; existing execution tests cover stdin, output trimming, bounds, and timeout behavior. Package metadata presents a CLI rather than a documented plugin API. Still distinct from main and release: Both fetched main and v0.8.1 retain runCommand forwarding to runCommandRaw; this exact cleanup is not already implemented in either inspected revision.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch runs configured validation commands after an attempted code fix. Its execution helper selects the platform shell and returns output, timing, and exit status used to assess the fix.

flowchart LR
  A[Code fix attempt] --> B[Configured validation commands]
  B --> C[Shell execution helper]
  C --> D[Platform shell]
  D --> E[Output and exit status]
  E --> F[Fix validation result]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The body reports AWS Crabbox checks, but provides no observed after-change run through runCommand or fix validation; the inspected installed-package smoke exercises init/map. Execution tests are supplemental. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Add after-change real shell-execution evidence before merge: terminal output or redacted logs are suitable, with a terminal screenshot or recording welcome. Remove credentials, private endpoints, IP addresses, and other private details. Updating the PR body should trigger review automatically; otherwise ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep one shell-execution entrypoint with the existing quoting, timeout, output, and result contracts intact.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a cleanup, and inspection found no introduced functional defect to reproduce.

Is this the best way to solve the issue?

Yes: placing the unchanged implementation in the existing caller-facing function is a narrow way to remove unused indirection.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 917bcf0f85c8.

Labels

Label changes:

• add P3: This removes unused forwarding code without changing observable behavior.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The body reports AWS Crabbox checks, but provides no observed after-change run through runCommand or fix validation; the inspected installed-package smoke exercises init/map. Execution tests are supplemental. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This removes unused forwarding code without changing observable behavior.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The body reports AWS Crabbox checks, but provides no observed after-change run through runCommand or fix validation; the inspected installed-package smoke exercises init/map. Execution tests are supplemental. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff deletes nine forwarding/declaration lines in one file. The shell selection, arguments, options, and returned command result remain identical. (src/exec.ts:26, a176e18c5824)
• Caller and contract inspection: Repository-wide references show no remaining runCommandRaw consumer. The production validation loop calls runCommand with a deadline and output bound; existing execution tests cover stdin, output trimming, bounds, and timeout behavior. Package metadata presents a CLI rather than a documented plugin API. (src/fix.ts:119, a176e18c5824)
• Still distinct from main and release: Both fetched main and v0.8.1 retain runCommand forwarding to runCommandRaw; this exact cleanup is not already implemented in either inspected revision. (src/exec.ts:26, 917bcf0f85c8)
• Validation claims and proof coverage: The complete supplied body reports execution tests, full checks, and installed-package smoke passing on AWS Crabbox. It supplies no execution transcript or linked artifact. The inspected package smoke exercises init and map, whereas the changed shell helper is used by fix validation. Live discussion contains only bot status comments and no additional proof or reviews. Tests were inspected but not executed during this read-only review. (scripts/package-smoke.mjs, a176e18c5824)
• Relevant merged history: Path history includes validation deadline work by Peter Steinberger and Windows shell/cleanup work by Sebastien Tardif. GitHub identifies steipete on the validation commit and SebTardif on the merged fix(exec): timeout Windows taskkill on the timeout path #195. Deeper pickaxe and blame inspection encountered unavailable historical objects, so no source-line introduction attribution is asserted. (src/exec.ts, f16b8467e1b5)
• Applicable repository policy: Read the full root AGENTS.md and applied its small-helper, focused-validation, and secret-handling guidance. No nested AGENTS.md or maintainer-notes directory was found; final status inspection showed a clean checkout. (AGENTS.md, a176e18c5824)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• SebTardif: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted after-change terminal output or logs showing the production shell-execution path and its returned result.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.