`--exclude` does not trim whitespace, so space-separated entries are silently not excluded

[alaminfirdows]

Bug Report

• Yes, I reviewed the contribution guidelines.
• Yes, more specifically, I reviewed the guidelines on how to write clear bug reports.

Describe the current, buggy behavior

Both wp core verify-checksums and wp plugin verify-checksums split the --exclude argument with explode( ',', $exclude ) and never trim the resulting values. Because the later comparison is strict, any entry with a leading or trailing space (for example after a comma) never matches and is silently not excluded.

This is easy to hit, since writing a comma-separated list with spaces ("a, b, c") is a common habit. There is no warning that an exclude entry matched nothing, so the failure is invisible.

Affected code:

// Core — src/Checksum_Core_Command.php
$this->exclude_files = explode( ',', $exclude ); // "a, b" => ['a', ' b']

// Plugin — src/Checksum_Plugin_Command.php
$exclude_list = explode( ',', $exclude );        // "a, b" => ['a', ' b']

Both are matched later with strict comparison, so ' b' !== 'b':

in_array( $value, $exclude_list, true );

Describe how other contributors can replicate this bug

• Run plugin verify-checksums with a space after a comma in --exclude
• Compare against the same command without the space
• Note that the spaced entry is not skipped

# With a space — only "ai" is skipped, "plugin-check" is still verified
wp plugin verify-checksums --all --exclude="ai, plugin-check,paritypress"
# Success: Verified 5 of 10 plugins (5 skipped).

# Without the space (control) — "plugin-check" is correctly skipped
wp plugin verify-checksums --all --exclude="ai,plugin-check,paritypress"
# Success: Verified 4 of 10 plugins (6 skipped).

The only difference between the two runs is the single space before plugin-check, yet the skip count changes from 6 to 5.

The same applies to core verify-checksums:

echo "<?php" > wp-includes/zz-a.php
echo "<?php" > wp-includes/zz-b.php
wp core verify-checksums --exclude="wp-includes/zz-a.php, wp-includes/zz-b.php"
# Warning: File should not exist: wp-includes/zz-b.php   <- 2nd entry (leading space) not excluded

Describe what you would expect as the correct outcome

Whitespace around comma-separated --exclude entries should be ignored, so "a, b" and "a,b" behave identically and every listed entry is excluded.

Let us know what environment you are running this on

OS:	Darwin 24.6.0 arm64
Shell:	/bin/zsh
PHP binary:	/opt/homebrew/bin/php
PHP version:	8.5.7
PHP memory limit:	128M
MySQL version:	mysql Ver 9.6.0 for macos15.7 on arm64 (Homebrew)
WP-CLI version:	2.13.0-alpha
WordPress version: 7.0

Provide a possible solution

Trim each value after splitting, in both commands:

// Core — src/Checksum_Core_Command.php
$this->exclude_files = array_map( 'trim', explode( ',', $exclude ) );

// Plugin — src/Checksum_Plugin_Command.php
$exclude_list = array_map( 'trim', explode( ',', $exclude ) );

Provide additional context/Screenshots

• Affects both core verify-checksums and plugin verify-checksums, since both parse --exclude the same way.
• The failure is silent — no warning is emitted when an exclude entry matches nothing — which makes it easy to miss in scripts.
• Reproduced live against WP-CLI 2.13.0-alpha.