fix(cli): harden swarm commands found by max-quality review#318
Merged
Conversation
Deep review of the swarm CLI commands (open, watch, stats, prune, tag) surfaced correctness, safety, and injection issues. Fix them all with regression tests. - open: scoped resume now picks the most-recently-active match instead of the oldest (it reused stats' created-ascending ordering); add a guard so `open --current` errors out instead of resuming an unrelated session when no repo/branch/folder can be detected. - watch: count AttentionInterrupted sessions in their own bucket instead of silently tallying them as idle while listing them as interrupted. - stats: neutralize CSV/spreadsheet formula injection (CWE-1236) in repository/branch/host labels via csvSafe, and surface csv writer flush errors instead of swallowing them in a deferred Flush. - prune: enumerate all session IDs (including empty sessions) so config metadata for real-but-empty sessions is not treated as stale; refuse to --apply against an empty store, which would otherwise wipe every config entry. - tag: resolve an ID or unique prefix via the store (matches the other <id> commands and finds empty sessions the filtered list omits). - data: add Store.AllSessionIDs for existence checks that must include empty sessions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 524cf702-8922-4cfd-b23f-4069b734e09b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
devx-max-qualitydeep review of the recently merged swarm CLI commands (#317) surfaced correctness, safety, and injection issues that got lighter review than the git-status feature. This fixes all of them with regression tests. Every deterministic gate is green (build, vet, full test suite,-race, gofmt, gofumpt,mage deadcode,golangci-lint).Findings fixed
openupdated DESC(same as--last) and pick the newest match.openopen --currentwith no detectable repo/branch/folder left an empty scope filter that matched every session and resumed an unrelated one.watchAttentionInterruptedsessions were tallied as idle while simultaneously listed as interrupted.Interruptedbucket to the snapshot and count/print it.statsstats --csvwrote user-controlled repository/branch labels raw. A label starting with= + - @executes as a formula when opened in Excel/Sheets/LibreOffice (CWE-1236).csvSafeprefixes a'to formula-triggering values.prunepruneused the filtered session list, which drops empty sessions, so config metadata for real-but-empty sessions was treated as stale. An empty store would also wipe every config entry.Store.AllSessionIDs; refuse to--applyagainst an empty store.tagtagrequired an exact ID match (no prefix) and missed empty sessions.Store.ResolveIDPrefix, matching the other<id>commands.statswriteStatsCSVuseddefer cw.Flush(), swallowing any flush error.Flush()+cw.Error()check on the success path.Tests
Added regression tests:
TestRunOpen_ScopedResumePicksMostRecent,TestRunOpen_CurrentNoDetection,TestRunWatch_InterruptedNotIdle,TestRunStatsCSV_FormulaInjection,TestCsvSafe,TestRunPrune_EmptyStoreGuard,TestRunTag_ResolvesPrefix.Verification
go build ./...,go vet ./...: passgo test ./... -count=1: all packages passgo test -raceon changed packages: passgofmt -l ./gofumpt -l .: cleanmage deadcode: OK (10 known exclusions)golangci-lint run: 0 issues