fix(#2247): compare managed content below sentinel as text

[fullsend-ai-coder]

Summary

Fix false-positive shim drift detection in reconcile-repos.sh that caused bogus update PRs (e.g., PR #2101) which stripped the sentinel and --- lines from deployed shims.

Changes

• Replace managed_content_b64() with managed_content_text() in the comparison logic. The new function extracts content below the sentinel line (excluding the sentinel itself) and returns plain text instead of base64. This prevents false-positive drift when one side has the sentinel/--- prefix and the other doesn't.
• Add regression test (test 5) that reproduces the exact scenario: template without sentinel vs remote shim with sentinel and matching managed content — must not be flagged as stale.

Root cause

When the .fullsend repo template predated the sentinel addition but deployed shims already included the sentinel (e.g., from a scaffold deploy), the old managed_content_b64() function included the sentinel line in the extracted content on the remote side but returned the full template (without sentinel) on the expected side. This structural mismatch triggered a "stale" detection even though the actual managed content was identical.

Testing

• All 7 reconcile-repos tests pass (including new regression test)
• Secret scan clean
• make lint could not run due to sandbox network restrictions; post-script handles this authoritatively

---

Closes #2247

Post-script verification

• Branch is not main/master (agent/2247-fix-reconcile-comparison)
• Secret scan passed (gitleaks — 8f8848417b246a8e2a84a39cb9d0a40290411589..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:27 PM UTC · Completed 8:40 PM UTC

Commit: 94c5aa6 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Low

• [dead code] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:84 — The extract_managed_content function no longer has any callers after this PR. Its only caller was managed_content_b64, which is replaced by managed_content_text using inline awk. The function definition and its comment (lines 81–89) remain in the file but are unreachable.
  Remediation: Remove the extract_managed_content function (lines 81–89) to avoid confusion.

• [edge-case] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:158 — When the sentinel is the very last line of the file (no content below it), the awk script finds the sentinel and sets found=1 but prints nothing. The below variable is therefore empty, and the function falls through to the else branch, returning the entire decoded content including the sentinel and any --- prefix. Meanwhile the template side (which may lack the sentinel) would return its full raw content. This causes a comparison mismatch and a false-positive stale detection for this edge case. In practice this scenario does not occur — deployed shims always have managed content below the sentinel — so the risk is theoretical.

• [comment-formatting] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:150 — Double spaces after periods in comments (lines 150, 156, 414). The rest of the file consistently uses single space between sentences.
  Remediation: Change double spaces to single spaces: comparison. The (line 150), template). Trailing (line 156), drift. Text (line 414).

---

Labels: PR fixes a bug in the scaffold enrollment reconciliation script (shell scripts under internal/scaffold/)

Previous run

Review

Findings

Low

• [dead code] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:84 — The extract_managed_content function no longer has any callers after this PR. It was previously called only by managed_content_b64, which is replaced by managed_content_text using inline awk.
  Remediation: Remove the function and its comment block (lines 81–89).

• [edge-case] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:158 — When the sentinel is the very last line (no content below it), managed_content_text falls through to the else branch and returns the entire decoded content including the sentinel. The old function handled this differently (returned just the sentinel line, base64-encoded). In practice this scenario does not occur — shims always have content below the sentinel.

• [comment-formatting] internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:147 — Double spaces after periods in the new comments (lines 147, 152, 412). The rest of the file consistently uses single space between sentences.
  Remediation: Change double spaces after periods to single spaces.

---

Labels: PR fixes a bug in the scaffold enrollment reconciliation script

[ralphbean]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:47 PM UTC · Completed 1:59 PM UTC

Commit: 94c5aa6 · View workflow run →

[fullsend-ai-review]

Note: The following inline comments could not be posted on the diff (GitHub returned 422) and are included here instead:

• internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh (file-level): Line 84 · [low] dead code

The extract_managed_content function no longer has any callers after this PR. Its only caller was managed_content_b64, which is replaced by managed_content_text using inline awk. The function definition and its comment (lines 81-89) remain in the file but are unreachable.

Suggested fix: Remove the extract_managed_content function (lines 81-89) to avoid confusion.

• internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:158: [low] edge-case

When the sentinel is the very last line of the file (no content below it), the awk script finds the sentinel and sets found=1 but prints nothing. The below variable is therefore empty, and the function falls through to the else branch, returning the entire decoded content including the sentinel and any --- prefix. Meanwhile the template side (which may lack the sentinel) would return its full raw content. This causes a comparison mismatch and a false-positive stale detection for this edge case. In practice this scenario does not occur — deployed shims always have managed content below the sentinel — so the risk is theoretical.

• internal/scaffold/fullsend-repo/scripts/reconcile-repos.sh:150: [low] comment-formatting

Double spaces after periods in comments (lines 150, 156, 414). The rest of the file consistently uses single space between sentences.

Suggested fix: Change double spaces to single spaces: 'comparison. The' (line 150), 'template). Trailing' (line 156), 'drift. Text' (line 414)