Skip to content

Address Copilot review feedback from PR #16 - #24

Open
ndenny wants to merge 1 commit into
developfrom
fix/copilot-review-pr16
Open

Address Copilot review feedback from PR #16#24
ndenny wants to merge 1 commit into
developfrom
fix/copilot-review-pr16

Conversation

@ndenny

@ndenny ndenny commented Sep 1, 2026

Copy link
Copy Markdown
Member

Resolves the Copilot review comments on #16 (the v0.0.1 release candidate) so that PR can go into main clean.

Fixed

# Concern Fix
skills/skills.go:176 updateClaudeMD ignored os.ReadFile errors — an existing-but-unreadable CLAUDE.md was treated as empty and then overwritten, destroying its contents Only os.IsNotExist is treated as empty; any other read error is returned
oauth/authcode.go:240 Reflected-XSS hardening had no test coverage Added three tests for the auth callback handler. The two escaping tests were verified to fail when html.EscapeString is removed
skills/skills.go:78 resolveTarget had no tests Added table-driven tests: no flag, each target, and every mutually-exclusive combination
cli/request_test.go:75 TestAuthHookFailure depended on global state left by earlier tests Pins rsh-profile to default. It also needed a non-nil configs map — Copilot spotted one of the two causes; both are fixed, and the test now passes standalone
README.md ×2, skills/skills.go:208, 3× skills/embed/*.md Docs claimed create commands read JSON from stdin only, which contradicts cli.GetBody (and the README's own CLI Shorthand section immediately below) Reworded to "stdin or CLI Shorthand arguments". Heredoc stdin is still the recommended form for agents, and the accurate "there is no --body/--data/-d flag" statement is kept
README.md:12 Installation and Manual installation were both ## Manual installation, MacOS, Windows and Linux demoted to ### under Installation
skills/embed/setup-api-monitor.md:92 Validation gate said "monitor ID" but the API-monitor skill schedules a <call-id> Changed to "call ID". The browser and MCP skills correctly use <monitor-id> and are unchanged

Not fixed — the premise is incorrect

main.go:13 — Copilot claimed the goreleaser -X main.commit / main.date / main.builtBy ldflags "will cause release builds to fail with 'cannot set -X main.commit' errors".

The Go linker silently ignores -X for symbols that don't exist; it is not an error. Verified two ways:

  • go build -ldflags "-X main.commit=abc123 -X main.nonexistent=foo" . exits 0.
  • Every release since these ldflags were added has built successfully, most recently v0.1.0-beta-1.

The flags are dead config rather than a build break. Left alone here — rewriting five .goreleaser/*.yaml files to strip no-ops immediately before the first formal release is risk without benefit. Worth a follow-up to either drop them or wire commit/date into --version, which versionExtraInfo already exists to serve.

Verification

go build ./..., go vet ./... and go test ./... all pass. (gofmt -l flags five files — bulk/commands.go, bulk/metadata.go, cli/api.go, cli/autoconfig.go, cli/param.go — all pre-existing and untouched here.)

🤖 Generated with Claude Code

Docs:
- README/skills no longer claim create commands read JSON from stdin
  *only* — cli.GetBody also accepts CLI Shorthand args. Heredoc stdin is
  still the recommended form, and the "no --body/--data/-d" fact stands.
- README: demote Manual installation / MacOS / Windows / Linux to
  subheadings under Installation so the hierarchy reads correctly.
- setup-api-monitor.md: the scheduled target is the call ID, not the
  "monitor ID", matching the rest of that skill.

Code:
- skills: updateClaudeMD no longer swallows os.ReadFile errors. An
  unreadable-but-present CLAUDE.md was treated as empty and then
  overwritten, destroying its contents.

Tests:
- oauth: cover the reflected-XSS hardening in the auth callback handler.
  Both new escaping tests fail if html.EscapeString is removed.
- skills: table-driven tests for resolveTarget (no flag, each flag, and
  every mutually-exclusive combination).
- cli: TestAuthHookFailure was order-dependent — it needs a non-nil
  configs map and rsh-profile set, or it panics before reaching the auth
  hook. It now runs standalone.
- cli: typo in TestLoadCache comment.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 1, 2026 14:32

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses prior automated review feedback from PR #16 by hardening file-update error handling, adding targeted test coverage for OAuth callback XSS escaping and skills target resolution, stabilizing a CLI request test that depended on global state, and correcting documentation to reflect actual input handling.

Changes:

  • Prevent CLAUDE.md overwrites when os.ReadFile fails for reasons other than non-existence.
  • Add/extend unit tests for resolveTarget and the OAuth auth callback handler (escaping + code passthrough).
  • Update docs (README + embedded skill docs) to reflect “stdin or CLI shorthand” request bodies and fix heading/wording issues.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
skills/skills.go Returns non-IsNotExist read errors from updateClaudeMD; updates generated agent guide wording about input sources.
skills/skills_test.go Adds table-driven tests covering resolveTarget flag combinations and errors.
skills/embed/setup-mcp-monitor.md Updates skill doc to reflect stdin or CLI shorthand input (preferring heredoc stdin).
skills/embed/setup-browser-monitor.md Same stdin/shorthand doc correction for browser monitor skill.
skills/embed/setup-api-monitor.md Same stdin/shorthand doc correction; fixes validation gate wording (“call ID”).
README.md Fixes heading levels and clarifies stdin vs CLI shorthand for create/update bodies.
oauth/authcode_test.go Adds tests validating auth callback HTML escapes attacker-controlled query params and still passes the code through.
cli/request_test.go Stabilizes TestAuthHookFailure by initializing configs and setting rsh-profile.
cli/cli_test.go Fixes a spelling typo in a comment.
Suppressed comments (1)

oauth/authcode_test.go:71

  • Close the response body returned by httptest's recorder here as well; keeping the close pattern consistent across the file helps prevent future leaks when this helper grows.
	body, err := io.ReadAll(w.Result().Body)
	assert.NoError(t, err)

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread cli/request_test.go
Comment on lines +74 to +81
// This test must not depend on what earlier tests left behind: `configs` is
// nil until initConfig runs, and an empty rsh-profile makes MakeRequest
// panic with "invalid profile" before it ever reaches the auth hook.
if configs == nil {
configs = apiConfigs{}
}
viper.Set("rsh-profile", "default")

Comment thread oauth/authcode_test.go
Comment on lines +35 to +36
body, err := io.ReadAll(w.Result().Body)
assert.NoError(t, err)
Comment thread skills/skills_test.go
Comment on lines +72 to +76
if c.wantErr != "" {
assert.EqualError(t, err, c.wantErr)
assert.Empty(t, target)
return
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants