From 8c2dc842e64345efc9250da74f1b1be0f4692879 Mon Sep 17 00:00:00 2001 From: Dave Date: Mon, 24 Aug 2026 10:16:37 -0400 Subject: [PATCH] Pin audit sink writes against ambient WhatIfPreference Add-Content/New-Item in Write-PersonaAuditRecord honour ShouldProcess, so an ambient $WhatIfPreference left set in the caller's session (e.g. from dot-sourcing a prior -WhatIf run) silently turned the audit write into a no-op, even though the sink itself never opts into ShouldProcess. The audit log is supposed to be unconditional under -WhatIf, so both calls now pin -WhatIf:$false -Confirm:$false. Co-Authored-By: Claude Sonnet 5 --- src/Audit/Write-PersonaAuditRecord.ps1 | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/Audit/Write-PersonaAuditRecord.ps1 b/src/Audit/Write-PersonaAuditRecord.ps1 index cf06407..5624a48 100644 --- a/src/Audit/Write-PersonaAuditRecord.ps1 +++ b/src/Audit/Write-PersonaAuditRecord.ps1 @@ -69,12 +69,20 @@ function Write-PersonaAuditRecord { $directory = Split-Path -Parent $Path if ($directory -and -not (Test-Path -LiteralPath $directory)) { - $null = New-Item -ItemType Directory -Path $directory -Force + $null = New-Item -ItemType Directory -Path $directory -Force -WhatIf:$false -Confirm:$false } # Append, one record per line. UTF-8 without BOM so the file is # machine-readable by any NDJSON consumer. - Add-Content -LiteralPath $Path -Value $line -Encoding utf8NoBOM -ErrorAction Stop + # + # -WhatIf:$false / -Confirm:$false pin this call regardless of any + # ambient $WhatIfPreference in the caller's session (e.g. left set by + # dot-sourcing an earlier -WhatIf run). Add-Content honours + # ShouldProcess, and this sink is not optional under -WhatIf - the + # audit trail is what makes preview mode auditable at all, so it must + # write unconditionally, independent of anything the caller's scope + # happens to have set. + Add-Content -LiteralPath $Path -Value $line -Encoding utf8NoBOM -ErrorAction Stop -WhatIf:$false -Confirm:$false } catch { if ($null -ne $State -and $State.FileSinkFailed) { return }