NOTE
Agent-authored. Written by Claude Code (Claude Fable 5.1) on Jon's behalf, posted from Jon's account. Claims carrying a
file:linecitation were read in the tree; anything unverified is marked inline.
What
diff now refuses more than two file operands, the way GNU diff does:
$ diff a b c
diff: extra operand 'c'
diff: Try 'diff --help' for more information.
$ echo $?
2Before, packages/just-bash/src/commands/diff/diff.ts checked only for fewer than two operands and then destructured the first two (const [f1, f2] = files), so any further operands were silently dropped.
Why
An agent working in a just-bash sandbox ran diff doc@*.md doc.md to find what changed between a document's saved versions and the current one. The glob expanded to four files; diff compared the first two, which happened to be identical, printed nothing, and the agent reported "no change". Real diff would have stopped it with the error above. We hit this in two of three trials of the same question.
Change
diff.ts: after the missing-operand check, return the GNU message and exit status 2 when more than two operands are present. Wording follows the existingsplit,lnandjoinmessages in this repo (extra operand '<file>').diff.test.ts: two tests, one with three explicit operands and one with a glob that expands past two.- Changeset: patch.
Verification
pnpm --filter just-bash test:run src/commands/diff/: 6 files, 95 tests pass.biome checkon the changed files: clean.pnpm dev:execwithdiff a b cprints the message above with exit code 2.
🤖 Generated with Claude Code
Activity
3
auto-maintain[bot]10d ago🤖 auto-maintain review
Automated, advisory triage for @JonathanBocanegra's PR. Facts below are read from the GitHub API.
| Check | Result |
|---|---|
| Author's merged PRs (this repo) | 0 — ⚠️ first-time contributor |
| Account established | ✅ (age 3913d · 0 followers · 11 public repos) |
| Commits signed/verified | ⚠️ 0/1 |
| Changeset included | ✅ (.changeset/diff-extra-operand.md) |
Review panel: 🟢 low highest severity
just-bash maintainer code review: 🟢 low
The extra-operand validation is correct, precedes filesystem access, preserves option handling, and is covered by explicit and glob-expansion tests.
General code review: 🟢 low
No actionable issues found; the change correctly rejects extra operands and covers explicit and glob-expanded cases.
Adversarial security: 🟢 low
No actionable security issues found in the complete diff.
Adversarial security (second opinion): 🟢 low
Three-file change adding a GNU-compatible 'extra operand' guard to the diff builtin; no security-relevant surface (no network, process execution, env, FS writes, or dependency/CI changes), the guard is correctly placed after the missing-operand check, the interpolated filename only reaches stderr as the existing error paths already do, and no in-repo caller passes more than two diff operands.
Standard Bash and host portability: 🟢 low
No Standard Bash or host-portability issues found.
Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.
@JonathanBocanegra is attempting to deploy a commit to the Vercel Labs Team on Vercel.
A member of the Team first needs to authorize it.