[ndbroadbent]

Syntax check. A script with a typo got all the way through the review dialog, the PIN and the touch, then failed on the rack once the process had booted. run and exec now have the local Ruby parse a .rb script first and refuse one with a syntax error, before anyone is asked anything:

Error: bad.rb has a syntax error, according to ruby 3.4.1:
bad.rb:3: syntax errors found (SyntaxError)
  2 | puts (accounts.count
> 3 | puts 2
    |       ^ unexpected end-of-input, assuming it is closing the parent top level context
Nothing was sent. Fix the script, or if the rack's Ruby understands this syntax and yours doesn't, add --skip-syntax-check

• Nothing in the script runs, since nobody has reviewed it yet. It's ruby --disable=all -c -: -c only parses, including BEGIN blocks, and --disable=all ignores RUBYOPT. The script goes in on stdin as the exact bytes that will be sent, with any #! line blanked (Ruby takes switches from it, and hunts for a Ruby script past one naming another interpreter). TestCheckRunsNothingInTheScript covers these with a real Ruby, and fails if -c is removed.
• It can't get in the way when it has no answer. No ruby, a version manager shim with no version set, a timeout or a signal all leave the script unchecked. Only Ruby exiting with an error refuses it.
• --skip-syntax-check is for a local Ruby too old for the script's syntax. macOS's system Ruby 2.6 refuses def x = 1, for example, so the error names the Ruby that judged it.

--dry-run is hidden from --help and the docs, and still works. It was for developing the script review. A real run does the same checks before asking anyone anything, so a dry run first only had the person approve the same dialog twice, and that dialog's Run button runs nothing. internal/cli/AGENTS.md now says what it's for.

Tested: the new and affected CLI tests pass, and removing -c or the #! blanking makes them fail. Run for real against a gateway, a broken script is refused with no dialog, and run --help no longer lists --dry-run. The real-Ruby tests also run in CI, on Ruby 3.2.3, as well as on 3.4.7 locally.

Also bumps the version to v0.1.31. There are no gateway changes.

[deepsource-io]

DeepSource Code Review

We reviewed changes in d8d0fc2...368dc09 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Nov 4, 2026 5:52a.m.	Review ↗
Go		Nov 4, 2026 5:52a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.