fix(code-placeholders): reject shell arithmetic placeholders

[icecrasher321]

Summary

• Reject resolved shell placeholders inside $((...)), $[...], and ((...)) (including arithmetic for headers) before sandbox execution, where Bash recursively evaluates operand text.
• Track these explicit arithmetic frames and their nested substitutions in the shared placeholder compiler. Preserve literal shell text and analysis-only variable discovery.
• Scope: this is a defense-in-depth syntax guard, not a complete prohibition on evaluating bound data. let, numeric [[ ... ]] comparisons, array subscripts, integer assignments, and values assigned elsewhere before arithmetic evaluation remain outside this change. The demonstrated path uses environment values available to the shell author; no additional privilege boundary is crossed.

Type of Change

• Bug fix

Testing

• All 13 arithmetic rejection cases fail with the guard removed.
• Compiler, resolver, and Function execution tests: 316 passed on the staging base.
• bun run lint, bun run type-check, all 58 repository audits, docs-manifest check, and the staging-based block-registry check passed.
• Full repository test run on Node 24: app suite had 34,713 passes and one timeout in the existing executor/execution/executor.test.ts case "does not run a stale branch inside a loop"; all 18 other test tasks passed. The timeout also reproduces with this patch removed on clean staging.
• Local compiler-to-Bash reproduction verified before the fix and rejected after it; no hosted sandbox run.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 5, 2026 6:01pm UTC

[cubic-dev-ai]

All reported issues were addressed across 2 files

_{Fix all with cubic | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds validation to reject shell arithmetic placeholders.

The PR appears safe to merge within its stated explicit-arithmetic scope.

Summary

The PR rejects resolved shell placeholders in explicit arithmetic expansions and commands while retaining literal-text handling and analysis-only discovery.

• Adds compiler tests for arithmetic forms, nested substitutions, heredocs, and completed frames.
• The previously reported broader arithmetic evaluators remain outside this PR’s acknowledged scope.

_{Reviews (2) · Last reviewed commit: "fix(code-placeholders): reject shell ari..."}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}