Description
When exarch verify --json runs against an archive whose verification result is FAIL (e.g. contains a bare symlink caught by security checks), the command prints TWO separate top-level JSON objects to stdout back-to-back: a success envelope containing the report (with data.status == "FAIL"), immediately followed by a second error envelope ("Archive verification failed"). Exit code is 1 in this case, regardless of whether --strict is passed. This breaks any consumer doing a plain json.loads(stdout) (or equivalent single-document parse) since the output is not valid as a single JSON document. Found and independently reproduced twice while writing an agent-skill document (skills/exarch-cli/SKILL.md) intended to teach AI agents to script against this CLI's --json mode.
Reproduction Steps
- Build a tar archive containing a bare symlink entry that trips security validation.
- Run
exarch verify archive.tar --check-integrity --check-security --json (with or without --strict).
- Inspect stdout.
Expected Behavior
A single top-level JSON object per invocation, consistent with every other command's --json contract (envelope shape {operation, status, data | error}), so scripted/agent consumers can rely on one json.loads() call.
Actual Behavior
Two concatenated top-level JSON objects are written to stdout: first a success envelope with the FAIL report in data, then a separate error envelope. A naive single-document JSON parse fails or silently only picks up the first object depending on the parser.
Environment
- Version: 0.5.1
- OS: macOS
- Archive format: tar
- Binding: CLI (
--json)
Logs / Evidence
Reproduced independently by both a live-testing pass and an implementation-critique pass during skills/exarch-cli/SKILL.md development. The skill doc has been updated with an explicit warning callout so agents following it don't assume single-object output for verify FAIL results.
Description
When
exarch verify --jsonruns against an archive whose verification result is FAIL (e.g. contains a bare symlink caught by security checks), the command prints TWO separate top-level JSON objects to stdout back-to-back: a success envelope containing the report (withdata.status == "FAIL"), immediately followed by a second error envelope ("Archive verification failed"). Exit code is 1 in this case, regardless of whether--strictis passed. This breaks any consumer doing a plainjson.loads(stdout)(or equivalent single-document parse) since the output is not valid as a single JSON document. Found and independently reproduced twice while writing an agent-skill document (skills/exarch-cli/SKILL.md) intended to teach AI agents to script against this CLI's--jsonmode.Reproduction Steps
exarch verify archive.tar --check-integrity --check-security --json(with or without--strict).Expected Behavior
A single top-level JSON object per invocation, consistent with every other command's
--jsoncontract (envelope shape{operation, status, data | error}), so scripted/agent consumers can rely on onejson.loads()call.Actual Behavior
Two concatenated top-level JSON objects are written to stdout: first a success envelope with the FAIL report in
data, then a separate error envelope. A naive single-document JSON parse fails or silently only picks up the first object depending on the parser.Environment
--json)Logs / Evidence
Reproduced independently by both a live-testing pass and an implementation-critique pass during
skills/exarch-cli/SKILL.mddevelopment. The skill doc has been updated with an explicit warning callout so agents following it don't assume single-object output forverifyFAIL results.