Audit finding: P5-CLI-03 (P3, effort S) — see docs/audits/README.md (Pass 5 open table).
devstrap clone --open --vscode only reports the flag conflict after the (potentially slow, network-bound) clone finishes. Cobra can reject it up front.
What to do
- In the
clone command definition (internal/cli/clone.go), declare the two editor flags mutually exclusive with cmd.MarkFlagsMutuallyExclusive("open", "vscode") so the error surfaces before any network work.
- Add/adjust a test proving the conflict is rejected pre-clone (see the existing CLI command tests in
internal/cli for style; the testscript harness under internal/cli/testdata may already have a related case).
Gates before pushing (see CONTRIBUTING.md): gofmt -w cmd internal, golangci-lint run, go test -race ./.... The spec-drift/work-log gate is advisory for fork PRs — the maintainer completes ledger bookkeeping at merge.
Audit finding:
P5-CLI-03(P3, effort S) — seedocs/audits/README.md(Pass 5 open table).devstrap clone --open --vscodeonly reports the flag conflict after the (potentially slow, network-bound) clone finishes. Cobra can reject it up front.What to do
clonecommand definition (internal/cli/clone.go), declare the two editor flags mutually exclusive withcmd.MarkFlagsMutuallyExclusive("open", "vscode")so the error surfaces before any network work.internal/clifor style; the testscript harness underinternal/cli/testdatamay already have a related case).Gates before pushing (see
CONTRIBUTING.md):gofmt -w cmd internal,golangci-lint run,go test -race ./.... The spec-drift/work-log gate is advisory for fork PRs — the maintainer completes ledger bookkeeping at merge.