Skip to content

fix(lint): resolve static analysis baseline#769

Open
PierrunoYT wants to merge 2 commits into
Gitlawb:mainfrom
PierrunoYT:fix/issue-743-golangci-lint-baseline
Open

fix(lint): resolve static analysis baseline#769
PierrunoYT wants to merge 2 commits into
Gitlawb:mainfrom
PierrunoYT:fix/issue-743-golangci-lint-baseline

Conversation

@PierrunoYT

@PierrunoYT PierrunoYT commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Summary

  • resolve the existing unused, ineffassign, and staticcheck baseline
  • remove confirmed-dead helpers and simplify equivalent control flow
  • preserve established error text with targeted lint suppressions

Validation

  • go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 run --enable-only unused,ineffassign,staticcheck ./... (0 issues)
  • go vet ./...
  • go test ./...
  • go run ./cmd/zero-release build
  • go run ./cmd/zero-release smoke
  • go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...

Closes #743

Summary by CodeRabbit

  • Bug Fixes

    • Strengthened provider connectivity checks to consistently block unsafe private or loopback destinations unless explicitly permitted.
    • Refined tool-result card collapsing behavior for clearer transcript presentation.
    • Improved handling when disabling built-in MCP servers.
    • Preserved more accurate signal information when commands terminate unexpectedly.
  • Refactor

    • Simplified internal formatting, navigation, sandbox, update, and command-processing logic without changing expected workflows.

Copilot AI review requested due to automatic review settings July 20, 2026 10:02

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request resolves the repository’s existing unused, ineffassign, and staticcheck baseline by applying safe mechanical refactors, removing confirmed-dead helpers, and adding targeted lint suppressions where error-string text must remain stable for users.

Changes:

  • Simplifies boolean/control-flow expressions to address staticcheck quick-fix findings while preserving behavior.
  • Removes unused helpers and assignments flagged by unused/ineffassign.
  • Preserves established user-facing error text by adding targeted //nolint:staticcheck suppressions and by using non-nil contexts in tests/commands.

Reviewed changes

Copilot reviewed 38 out of 38 changed files in this pull request and generated no comments.

Show a summary per file
File Description
internal/usercommands/usercommands.go Simplifies rune validation logic for validCommandName.
internal/update/update.go Adds //nolint:staticcheck to preserve established Termux error text.
internal/update/apply.go Replaces OS if/else with switch to satisfy staticcheck quick-fix guidance.
internal/update/apply_test.go Mirrors apply.go OS switch structure to keep tests aligned and lint-clean.
internal/tui/transcript_selection.go Removes unused layout helper and consolidates viewport-start computation path.
internal/tui/streaming_fade.go Removes an unused helper for age-tick rescheduling.
internal/tui/specialist_card.go Simplifies switch for tool call summaries.
internal/tui/rendering.go Applies De Morgan simplification to collapse-footer gating logic.
internal/tui/provider_wizard_test.go Removes an ineffectual assignment while retaining the type assertion.
internal/tui/onboarding.go Converts stage checks to switch statements for readability and staticcheck fixes.
internal/tui/model.go Removes unused scrollableTranscriptView wrapper.
internal/tui/model_test.go Removes an ineffectual assignment while preserving call/type-check intent.
internal/tui/loop.go Replaces Sprintf+WriteString with Fprintf into a builder.
internal/tui/image_attach_test.go Uses Fprintf into a buffer to avoid intermediate allocations flagged by linters.
internal/tui/flush.go Simplifies negated boolean expression for “settled row” determination.
internal/tui/files_git_sweep_test.go Passes non-nil contexts (context.TODO()) to satisfy staticcheck.
internal/tui/command_center.go Simplifies credential-check boolean expression.
internal/specialist/exec.go Adjusts signal description extraction per staticcheck quick-fix guidance.
internal/sandbox/windows_network.go Adds //nolint:staticcheck to keep exported sentinel error text unchanged.
internal/sandbox/runner.go Removes unused sandbox helper functions flagged by unused.
internal/sandbox/landlock_other.go Adds //nolint:staticcheck to keep exported sentinel error text unchanged.
internal/sandbox/engine.go Simplifies backend capability boolean checks.
internal/sandbox/command_prefix.go Simplifies if/return into a single return expression.
internal/sandbox/adapters.go Applies De Morgan simplification to backend marker checks.
internal/repomap/prompt.go Uses Fprintf into a builder to avoid intermediate string formatting.
internal/provideronboarding/localruntime_test.go Simplifies slice nil/len checks using len(nil)==0 behavior.
internal/providerhealth/providerhealth.go Simplifies endpoint safety boolean checks while preserving semantics.
internal/lsp/navigate_test.go Passes non-nil contexts (context.TODO()) to satisfy staticcheck.
internal/imageinput/pdf_test.go Uses Fprintf into buffers to avoid intermediate allocations flagged by linters.
internal/dictation/transcriber_deepgram.go Adds //nolint:staticcheck to preserve established Deepgram error text.
internal/config/mcp_merge.go Simplifies merge logic boolean condition without semantic change.
internal/cli/usage.go Uses Fprintf into a builder for report formatting.
internal/cli/provider_detect.go Simplifies argument parsing switch to match staticcheck recommendations.
internal/cli/mcp_config.go Removes ineffectual assignments flagged by ineffassign.
internal/cli/agent_eval.go Uses variadic append to simplify list accumulation.
internal/agentinit/agentinit.go Uses Fprintf into a builder to avoid intermediate strings.
internal/agenteval/score.go Uses variadic append to simplify list accumulation.
internal/agent/profile_controller.go Simplifies boolean condition for escalation gating.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@PierrunoYT, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 03fabb2c-664f-4837-8402-de9235d81bf6

📥 Commits

Reviewing files that changed from the base of the PR and between c7bdd34 and d35fa39.

📒 Files selected for processing (9)
  • internal/sandbox/engine.go
  • internal/tui/export_test.go
  • internal/tui/model_test.go
  • internal/tui/provider_wizard_test.go
  • internal/tui/rendering.go
  • internal/tui/specialist_card.go
  • internal/tui/theme.go
  • internal/tui/transcript_selection.go
  • internal/update/update.go

Walkthrough

This PR resolves existing lint findings across agent, CLI, configuration, provider health, sandbox, TUI, and update code. It also replaces intermediate string formatting, removes unused helpers, simplifies equivalent control flow, and updates affected tests.

Changes

Lint baseline cleanup

Layer / File(s) Summary
Formatting and control-flow cleanup
internal/agent/*, internal/agenteval/*, internal/cli/*, internal/lsp/*, internal/imageinput/*, internal/repomap/*, internal/specialist/*, internal/usercommands/*
Staticcheck-driven changes simplify boolean expressions, switches, slice appends, builder writes, context usage, validation assertions, and signal descriptions.
Configuration, provider, and sandbox paths
internal/config/*, internal/providerhealth/*, internal/sandbox/*
MCP merge checks and provider blocking conditions are rewritten, exported error strings receive lint suppressions, and three unused sandbox helpers are removed.
TUI interaction and transcript paths
internal/tui/*
TUI navigation, rendering, transcript geometry, scrollback settlement, test state handling, and formatting code are refactored to address lint findings.
Platform update branching
internal/update/*
Update platform selection and its test use switch runtime.GOOS; unsupported-platform error handling receives a lint suppression.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

  • Gitlawb/zero#706: Removes the same unused sandbox helper functions in internal/sandbox/runner.go.
  • Gitlawb/zero#167: Also changes SSRF blocking conditions in internal/providerhealth/providerhealth.go.
  • Gitlawb/zero#158: Overlaps with the TUI flush and rendering paths updated here.

Suggested reviewers: copilot, vasanthdev2004

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR includes unrelated edits in files like profile_controller.go, providerhealth.go, and tui/rendering.go that are not in #743. Remove or split the unrelated edits so this PR only contains fixes for the #743 lint findings.
Docstring Coverage ⚠️ Warning Docstring coverage is 36.84% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and accurately describes the lint-baseline fix.
Linked Issues check ✅ Passed The changes address the listed unused, ineffassign, and staticcheck findings in #743.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 20, 2026

@jatmn jatmn left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found issues that need to be addressed before this is ready.

Findings

  • [P1] Preserve the id-invariant invalid-session recovery path
    internal/tools/exec_command.go:778
    Missing, nil, non-integer, and < 1 IDs now return distinct validation errors instead of UnknownExecSessionError. The agent’s repeated-failure guard keys its streak on the first 80 characters of the error, so a model can alternate malformed IDs (or transition from one to a guessed unknown ID) and reset the streak rather than receiving the recovery hint and six-failure halt. This reintroduces the probing/thrashing behavior fixed by the immediate base; keep every no-live-session input on the shared recovery error and restore coverage for the invalid forms.

…gci-lint-baseline

The three conflicts were all the same shape — this branch deleted some dead
helpers, main deleted a superset — so each resolves to main's side:

- internal/sandbox/runner.go: main moved seatbeltCompatibilityPermissionProfile
  and sandboxEnvironment into export_test.go and dropped
  existingBubblewrapMounts, which is what this branch had removed.
- internal/tui/model.go and transcript_selection.go: main removed
  scrollableTranscriptView and transcriptViewportStartForLayout outright.

Re-ran the pinned baseline against the merged tree and cleared the five findings
main introduced since the branch was cut:

- Three helpers main moved into internal/tui/export_test.go
  (scrollableTranscriptView, ensureAgeTickReschedule,
  transcriptViewportStartForLayout) are unused there too; removed, along with the
  now-unused bubbletea import.
- tuiTheme.onPerm has no callers; removed.
- A new QF1001 in transcript_selection.go, simplified the same way the branch
  simplified the earlier one.

internal/tools/ is byte-identical to main, so the id-invariant invalid-session
recovery path (Gitlawb#768) is untouched — see the review reply for the verification.
@PierrunoYT

Copy link
Copy Markdown
Contributor Author

Merged current main (d35fa39) — the PR is MERGEABLE again — and re-established the baseline against the merged tree.

[P1] Preserve the id-invariant invalid-session recovery path — I want to be precise here, because I think this one is an artifact of the stale branch rather than a change in the diff: this branch does not touch internal/tools/exec_command.go at all. Verified two ways after merging:

  • git diff upstream/main --stat -- internal/tools/ is empty — the merged tree is byte-identical to main in that package, so UnknownExecSessionError still handles the missing / nil / non-integer / < 1 cases through the one shared recovery error that fix(tools): give write_stdin's invalid-session errors the same recovery guidance (#749 follow-up) #768 introduced.
  • Its coverage runs green: TestWriteStdinReportsUnknownSession, TestWriteStdinRequiresPositiveSessionID, TestWriteStdinSchemaPinsSessionIDMinimum, and the rest of the internal/tools suite pass.

What produced the finding is the same thing that made GitHub report CONFLICTING: the head was 26 commits behind, so a base-to-head comparison shows main's newer work — including #768 — as if it were being removed. Nothing in the branch reverts it, and the merge does not either. Happy to be corrected if you were looking at something the diff still shows.

The three real conflicts were all one shape — this branch deleted some dead helpers, main deleted a superset — so each resolved to main's side:

  • internal/sandbox/runner.go: main moved seatbeltCompatibilityPermissionProfile and sandboxEnvironment into export_test.go and dropped existingBubblewrapMounts (exactly what this branch removed).
  • internal/tui/model.go, internal/tui/transcript_selection.go: main removed scrollableTranscriptView and transcriptViewportStartForLayout outright.

Baseline re-run, which was the point of the PR. The pinned linter reported 5 new findings on the merged tree that main introduced since the branch was cut; all are now fixed:

finding fix
unused: scrollableTranscriptView, ensureAgeTickReschedule, transcriptViewportStartForLayout in internal/tui/export_test.go main moved these into the test-seam file, where nothing calls them either — removed, along with the now-unused bubbletea import
unused: tuiTheme.onPerm (internal/tui/theme.go) no callers — removed
staticcheck QF1001 in internal/tui/transcript_selection.go:1363 simplified the same way the branch simplified the earlier occurrence

Result: 0 issues.

On the toolchain limitation in the PR body — it is worked around rather than accepted. go run …golangci-lint@v2.12.2 picks its own go1.25.12 toolchain and then refuses a Go 1.26.5 module ("the Go language version used to build golangci-lint is lower than the targeted Go version"). Forcing the build toolchain fixes it:

GOTOOLCHAIN=go1.26.5 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 \
  run --enable-only unused,ineffassign,staticcheck ./...
→ 0 issues.

That is worth folding into the repo's lint invocation, since the same mismatch will hit anyone whose default toolchain resolves below the module's Go version.

Validation (Windows host, Go 1.26.5): the lint command above reports 0 issues; go build ./..., go vet ./..., go test ./... -count=1 all pass; GOOS=linux|darwin builds plus vets of internal/tui and internal/sandbox are clean; gofmt clean on every changed file.

@jatmn — ready for another look, in particular the internal/tools verification above. I can't use the reviewer-request button on this repo, hence the mention.

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 25, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== HEAD / merge-base / internal-tools diff =='
git status --short
git rev-parse HEAD
git merge-base HEAD upstream/main
git diff --stat upstream/main...HEAD -- internal/tools || true
git diff --name-status upstream/main...HEAD

echo '== Changed Go-file outlines (focused candidates) =='
for file in \
  internal/specialist/exec.go \
  internal/providerhealth/providerhealth.go \
  internal/config/mcp_merge.go \
  internal/cli/mcp_config.go \
  internal/update/apply.go \
  internal/tui/rendering.go \
  internal/tools/exec_command.go
do
  if [ -f "$file" ]; then
    echo "-- $file"
    ast-grep outline "$file" --items all --type function,method --view compact || true
  fi
done

echo '== Focused diffs =='
git diff --unified=35 upstream/main...HEAD -- \
  internal/specialist/exec.go \
  internal/providerhealth/providerhealth.go \
  internal/config/mcp_merge.go \
  internal/cli/mcp_config.go \
  internal/update/apply.go \
  internal/tui/rendering.go \
  internal/tools/exec_command.go

Length of output: 1468


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Available refs =='
git branch -a
git show-ref --heads --remotes || true

echo '== PR `#769` metadata =='
gh pr view 769 --repo Gitlawb/zero \
  --json number,state,mergeable,baseRefName,baseRefOid,headRefName,headRefOid,url \
  --jq '{number,state,mergeable,baseRefName,baseRefOid,headRefName,headRefOid,url}'

base_oid="$(gh pr view 769 --repo Gitlawb/zero --json baseRefOid --jq .baseRefOid)"
head_oid="$(gh pr view 769 --repo Gitlawb/zero --json headRefOid --jq .headRefOid)"
echo "base=$base_oid"
echo "head=$head_oid"

if git cat-file -e "${base_oid}^{commit}" 2>/dev/null && git cat-file -e "${head_oid}^{commit}" 2>/dev/null; then
  range="${base_oid}...${head_oid}"
else
  echo 'PR base/head objects are not both available locally; showing GitHub file list instead.'
  gh pr view 769 --repo Gitlawb/zero --json files --jq '.files[] | [.path,.additions,.deletions] | `@tsv`'
  exit 0
fi

echo '== internal/tools change relative to PR base =='
git diff --stat "$range" -- internal/tools
git diff --name-status "$range" -- internal/tools

echo '== All changed files =='
git diff --name-status "$range"

echo '== Focused diffs =='
git diff --unified=35 "$range" -- \
  internal/specialist/exec.go \
  internal/providerhealth/providerhealth.go \
  internal/config/mcp_merge.go \
  internal/cli/mcp_config.go \
  internal/update/apply.go \
  internal/tui/rendering.go \
  internal/tools/exec_command.go

Length of output: 27370


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="a4a805a6c82c51cb255e909bd87ca183c8805cf2"
head="d35fa3921008a6e52cef8d35e5e6f266e4f79fb3"

echo '== Full changed-line summary =='
git diff --stat "$base...$head"

echo '== Merged-main cleanup diff and surrounding declarations =='
git diff --unified=45 "$base...$head" -- \
  internal/tui/export_test.go \
  internal/tui/theme.go \
  internal/tui/transcript_selection.go \
  internal/tui/model_test.go \
  internal/tui/provider_wizard_test.go \
  internal/tui/onboarding.go

echo '== References to removed test seams / onPerm (including tests) =='
rg -n -C 3 \
  '\b(scrollableTranscriptView|ensureAgeTickReschedule|transcriptViewportStartForLayout|onPerm)\b' \
  internal/tui || true

echo '== Context-sensitive changed functions and tests =='
for file in internal/tui/transcript_selection.go internal/tui/onboarding.go internal/tui/theme.go internal/tui/export_test.go; do
  echo "-- $file"
  ast-grep outline "$file" --items all --type function,method --view compact || true
done

echo '== All additions/removals excluding direct lint-only mechanical patterns =='
git diff --unified=12 "$base...$head" -- \
  ':!internal/agent/profile_controller.go' \
  ':!internal/agenteval/score.go' \
  ':!internal/agentinit/agentinit.go' \
  ':!internal/cli/agent_eval.go' \
  ':!internal/cli/provider_detect.go' \
  ':!internal/cli/usage.go' \
  ':!internal/imageinput/pdf_test.go' \
  ':!internal/lsp/navigate_test.go' \
  ':!internal/repomap/prompt.go' \
  ':!internal/sandbox/adapters.go' \
  ':!internal/sandbox/command_prefix.go' \
  ':!internal/sandbox/engine.go' \
  ':!internal/sandbox/landlock_other.go' \
  ':!internal/sandbox/runner.go' \
  ':!internal/sandbox/windows_network.go' \
  ':!internal/tui/command_center.go' \
  ':!internal/tui/files_git_sweep_test.go' \
  ':!internal/tui/flush.go' \
  ':!internal/tui/image_attach_test.go' \
  ':!internal/tui/loop.go' \
  ':!internal/tui/specialist_card.go' \
  ':!internal/update/apply_test.go' \
  ':!internal/update/update.go' \
  ':!internal/usercommands/usercommands.go'

Length of output: 65028


@PierrunoYT Re-reviewed the refreshed PR diff against its actual base (a4a805a…).

  • Confirmed: internal/tools has no changes in this PR, so the invalid-session recovery path remains inherited from main. My earlier P1 finding was stale-diff noise and does not apply.
  • Reviewed the remaining behavior-affecting changes, including MCP disable merging, provider-health SSRF guards, TUI permission/card logic, and update platform selection. The rewrites preserve the prior behavior.
  • Confirmed the removed TUI test seams and tuiTheme.onPerm have no remaining internal/tui references.

No new actionable findings from this review. I could not independently execute the Go validation commands in this sandbox, but the diff inspection aligns with your reported validation.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@PierrunoYT
PierrunoYT requested a review from jatmn July 25, 2026 14:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Resolve existing golangci-lint baseline (35 findings)

3 participants