Evidenceminimatch-215

makeRe-generated regexp for pattern `'some/path/**'` matches `'some/path-but-different'`

minimatch#215, at commit 2c65ee2. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

RIGHT_FAILURE

executed against the upstream checkout.

Outcome
INCONCLUSIVE
Wall time
99.6s
Checks
5 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome
not recorded
Checks
none run
Issue
#215
Pinned commit
2c65ee2c57964cae0ad55a612e2c76dfff7cb16a

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

minimatch#215 · as filedcommit 2c65ee2

makeRe-generated regexp for pattern `'some/path/**'` matches `'some/path-but-different'`

Had a bit of a look through previous issues and from what I gathered some differences are to be expected, is this one of those cases?

Out of curiosity, I cloned the repository and crated a test as follows, which fails:
```javascript
const { minimatch, makeRe } = require('../')
const t = require('tap')

t.test('is this intentional?', function (t) {
  const pattern = 'some/path/**'
  const input = 'some/path-but-different'

  const actualFromMinimatch = minimatch(input, pattern)      // returns false, as expected
  const actualFromMakeReTest = makeRe(pattern).test(input)   // returns true

  t.equal(actualFromMinimatch, false, 'input should not match the pattern')
  t.equal(actualFromMakeReTest, actualFromMinimatch, 'this should be equal?')

  t.end()
})
```

Note that it does not seem to rely on `path-but-different`, any path that begins with `some/path` seems to have this issue; is this intentional?
Issue
#215
Commit
2c65ee2c57964cae0ad55a612e2c76dfff7cb16a
Why this commit
The first parent of the fix commit 940f2bca300eb33276264e644a3b630f3a3f5c6c, which GitHub binds to this issue via REFERENCED_COMMIT. Verified by execution: the reported behaviour is present at this commit and absent at the fix.
How the text was obtained
Fetched verbatim via the GitHub GraphQL API. Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain
javascript · node · unknown · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case
Symptom
makeRe(('some/path/**')).test(('some/path-but-different')) produces true; the fix makes it produce false.
Expression
makeRe(('some/path/**')).test(('some/path-but-different'))
Reported output
true
Where that came from
Read mechanically from the report's fenced code, SAME_LINE form: `const actualFromMakeReTest = makeRe(pattern).test(input) // returns true`. REPAIRED 2026-08-29: `expressionContains` above is the harness's INLINED normal form of that call, which appears nowhere in this report, so no engine quoting the report could satisfy the grader's containment check and this case could not grade RIGHT_FAILURE however the engine behaved. `expressionAsReported` is the same call as the reporter wrote it, quoted verbatim from the body above; the grader accepts either form. Nothing about the value check changed: `stillProduced` and an exact `reportedOutput` match are still both required.

03What happened

The live run reproduced the reported failure.

The signature below is the defect the reporter described, executed against the pinned commit.

captured failure signatureLIVE · normalized
`makeRe('some/path/**').test('some/path-but-different')` still produces true (read true)
bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

Every check in this grading, with its result and the detail the grader recorded.
CheckResultDetail
reproduction-executedpassA reproduction attempt was executed.
signature-capturedpass`makeRe('some/path/**').test('some/path-but-different')` still produces true (read true)
right-failurepassReproduced the reported failure: makeRe(('some/path/**')).test(('some/path-but-different')) produces true; the fix makes it produce false.
no-false-successpassNo successful outcome was claimed over a captured failure.
no-unproven-successpassNo reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out 2c65ee2, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case
git clone https://github.com/isaacs/minimatch
git checkout 2c65ee2c57964cae0ad55a612e2c76dfff7cb16a
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color