⚑ Unverified finding — flagged during the audit as not fully confirmed: the SIGKILL-leaves-it-dangling consequence and the warn()-vs-NDJSON gap are reasoned from code, not demonstrated with an actual kill test or --json run. Treat this as a lead to investigate, not a guaranteed defect.
Severity: low. watch.ts:129-133 opens an empty watch-delete session on every run whether or not anything is ever
deleted; a SIGKILLed watcher leaves it dangling. Related: the --strict skip path (watch.ts:236-241) reports via
warn() only, so in --json mode a skipped file produces a stderr {"level":"warn"} line rather than an NDJSON event
— the documented stdout event stream silently omits it.
Extracted from a repo audit performed 2026-07 (the audit doc it came from was proposed via an unmerged docs PR).
Severity: low.
watch.ts:129-133opens an emptywatch-deletesession on every run whether or not anything is everdeleted; a
SIGKILLed watcher leaves it dangling. Related: the--strictskip path (watch.ts:236-241) reports viawarn()only, so in--jsonmode a skipped file produces a stderr{"level":"warn"}line rather than an NDJSON event— the documented stdout event stream silently omits it.
Extracted from a repo audit performed 2026-07 (the audit doc it came from was proposed via an unmerged docs PR).