Add defensive input parsing & artifact validation to Core verbs#10
Closed
Gerrrt wants to merge 2 commits into
Closed
Add defensive input parsing & artifact validation to Core verbs#10Gerrrt wants to merge 2 commits into
Gerrrt wants to merge 2 commits into
Conversation
Backend / structural: - Derive the completion-coverage gate from the source verb set (minus an explicit allowlist of hooks/helpers) instead of a hardcoded list — it now fails when ANY first-party verb ships without a #compdef (the old list silently omitted update-check + opssh, which had no completion at all). - Add a hermetic render+validate gate for maint's scheduler artifacts (systemd unit/timer, launchd plist XML, cron line) — the one fan-out artifact class that previously had no gate. - Add behavioral regression tests for the zle-widget bare-box degradation, up's strict flag parsing, maint-log's input guard, and serve's -l flag. Terminal UX: - Guard the unconditionally-bound Ctrl-F/Ctrl-R widgets so a bare box gets a Core-voice warning instead of "command not found" (matching Alt-Z/fif/fbr). - Parse every argument to `up` and reject unknown/contradictory flags in Core's voice rather than silently falling through to a privileged update. - Validate maint-log's N argument (positive int or -f) instead of handing a bad value to `tail`. - Add the missing _update-check and _opssh completions. - Add an opt-in `serve -l/--local` flag to bind loopback only; all-interfaces (with its exposure warning) stays the default. Audit stays green: 133 pass / 1 skip / 0 fail. https://claude.ai/code/session_017AhYATFU6rXt3C1uHExNvt
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens Core's user-facing shell verbs with strict input parsing that rejects unknown options in Core's voice, adds graceful degradation for ZLE widgets when tools are absent, introduces hermetic maint scheduler artifact validation tests, and converts the completions regression gate from a hardcoded list to a derived one that auto-detects new verbs.
Changes:
- Adds strict flag parsing to
serve(new-l/--localflag for loopback binding),up(rejects unknown flags & mutually exclusive-y/-n), andmaint-log(validates numeric N) - Guards ZLE widgets (
Ctrl-F,Ctrl-R,Alt-Z) with_core_havechecks so they warn in Core's voice instead of leaking "command not found" on bare boxes - Adds hermetic scheduler artifact tests (systemd, launchd, cron) and a derived completions regression gate, plus new
_opsshand_update-checkcompletion files
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| zsh/update.zsh | Replaces single-arg check with full argument loop; rejects unknown flags (rc 2) and mutually exclusive -y/-n |
| zsh/maint.zsh | Adds emulate -L zsh and input guard to maint-log rejecting non-numeric/non-flag args |
| zsh/fzf.zsh | Adds _core_have/FD_BIN guards to _fzf_file_no_hidden (Ctrl-F) and _fzf_history_clean (Ctrl-R) |
| zsh/functions.zsh | Refactors serve with full flag parser, -l/--local loopback mode, updated help/core-help row |
| zsh/completions/_serve | Updates completion to include -l/--local flag alongside the port argument |
| zsh/completions/_update-check | New no-args completion for update-check |
| zsh/completions/_opssh | New no-args completion for opssh |
| scripts/test-core.sh | Adds tests for serve/up flag parsing, ZLE widget degradation, maint-log guard, scheduler artifacts, and derived completions gate |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…rb convention - zsh/fzf.zsh: the Ctrl-R guard comment said the Alt-Z guard is "below", but _fzf_zoxide_jump is defined above it — correct to "above". - zsh/update.zsh: up rejected bad flags with rc 2 (the bash gate-script convention), diverging from every interactive verb — including serve in this same PR — which returns rc 1 for usage errors. up is a verb, not a gate, so return 1; note the distinction in a comment. Tests updated accordingly. Audit stays green. https://claude.ai/code/session_017AhYATFU6rXt3C1uHExNvt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Hardens Core's user-facing verbs (
serve,up,maint-log) with strict flag parsing that rejects unknown options and invalid arguments in Core's voice (rc 2) before any privileged operations. Adds graceful degradation for ZLE widgets (Ctrl-F,Ctrl-R,Alt-Z) when fzf/fd are absent. Introduces hermetic validation of maint scheduler artifacts (systemd timer/service, launchd plist, cron line) to catch malformed schedules before they fan out to 9 repos. Converts the completions regression gate from a hardcoded verb list to a derived list that auto-detects new verbs, closing the gap that silently omittedupdate-checkandopssh.Is it actually Core?
Contract & checks
core.manifestupdated (added_opssh,_update-checkcompletions;maint-loginput guard)make auditpasses locally+x, zsh modules remain non-executableNotes
Key changes:
serveflag parsing: Now accepts-l/--localto bind loopback only (127.0.0.1) instead of all interfaces. Rejects unknown flags and validates port before python binds.upflag parsing: Parses all arguments (not just$1), rejects unknown flags/operands with rc 2, and refuses-yand-ntogether as mutually exclusive.maint-loginput guard: Rejects non-numeric N in Core's voice instead of handing totail.ZLE widget guards:
_fzf_file_no_hidden(Ctrl-F),_fzf_history_clean(Ctrl-R), and_fzf_zoxide_jump(Alt-Z) now warn in Core's voice and repaint when fzf/fd/zoxide are absent, preventing raw "command not found" leaks.Maint scheduler artifact validation: Hermetic tests that render and validate systemd timer/service, launchd plist (XML well-formedness + Hour/Minute), and cron line (5-field schedule) before they're deployed.
Completions regression gate: Derives the verb list from
zsh/*.zshfunctions (excluding private helpers via_prefix and an explicit allowlist), so new verbs without completions now fail the test instead of silently being omitted.New completions: Added
_opsshand_update-check(both take no arguments).All changes are backward-compatible;
-lis optional and defaults to the current all-interfaces behavior.https://claude.ai/code/session_017AhYATFU6rXt3C1uHExNvt