[rmcdaniel]

Summary

This is the second port group (#72): shell completion. It is a byte-for-byte port of the Symfony Console 7.4 completion that 2.x uses unchanged: DumpCompletionCommand, CompleteCommand, CompletionInput and the bash, zsh and fish outputs.

• completion [shell]:
  • Prints Symfony's completion script for bash, zsh or fish, chosen from the argument or $SHELL's basename, with {{ COMMAND_NAME }} (from basename(argv[0])) and {{ VERSION }} filled in.
  • An unknown or undetected shell is refused on stderr with exit 2. Unsafe executable basenames are refused before emitting shell code. --debug follows the private debug log through the validated file descriptor.
  • The three scripts are vendored from symfony/console 7.4.8 with its MIT licence (rust/src/completion/).
• _complete:
  • Reproduces CompletionInput: Symfony ArgvInput parsing with every token error suppressed, the relevant-token and previous-token rules for option names and values, argument binding, and getFirstArgument's skipping of option values.
  • Command lookup goes through the existing 2.x lookup, including abbreviations and aliases.
  • It answers the application's command list (with descriptions for zsh and fish), a found command's name expansion, option names (negatable options also as --no-x), and suggested values, in each shell's format.
  • -a/-S follow PHP truthiness and version_compare (exit 126). Setup errors exit 2 with no output, as in Symfony.
• Suggestion tables: 2.x has no input-dependent completers, so every suggested value is a fixed list. parity/update-completion.sh records them from the pinned 2.x CLI into src/completion.json: 91 application entries, and values for 81 commands, such as --output, help's command names and format, list's namespaces, completion's shells, and activity:fail's kinds.
• Review follow-up: build.rs now skips symlinks under schemas/ (the Rust CLI: port schema:list, schema:manifest, schema:show #92 review).

Intentional difference

Executable basenames must start with an ASCII letter or underscore and contain only ASCII letters, digits, dots, underscores and hyphens. Ordinary dw scripts stay byte-identical. Debug logs live in a private completion directory alongside the CLI config, replacing Symfony's shared temporary path. Unix opens use no-follow/nonblocking flags, directory/file handle verification, owner-only permissions and a single-link regular-file check. Windows opens the reparse point itself and refuses reparse/nonregular entries. completion --debug follows the validated descriptor. Unsafe log entries fail closed.

Evidence

• Rust 1.86: fmt, clippy -D warnings, 98 unit tests and 5 integration tests pass locally. New security tests exercise crafted-name sourcing, normal-name scripts, symlink/hard-link/FIFO/directory/shared log refusals, permissions and reading the same private log. Bash and Zsh ran locally; hosted CI installs and requires Bash, Zsh and Fish. Existing parser tests cover completion types, getFirstArgument, cursor validation, the scripts and basename.

• Parity: 53 new cases match 2.3.5 byte for byte. They cover:

  • the three scripts, $SHELL detection, an empty $SHELL, an unsupported shell, and quiet;
  • _complete in bash, zsh and fish for the command list, global and command option names, and help's command names;
  • ambiguous, unique and alias partial names;
  • option values: with =, with a prefix, as a separate token (with and without a prefix), with no suggestions, a short option, a flag, and a negatable name;
  • global options before the command;
  • list/help/completion arguments and formats, a second argument, after the last argument, after --, unknown commands, and a cursor on the first token;
  • every error path: API versions 0 and 0.9, the deprecated -S flag, a missing or unsupported shell, and a missing, zero, non-numeric or out-of-range current index, plus no tokens.

  Overall 308/312 match, 4 intentional, 0 unexpected.

The corrected build refuses unsafe executable names with exit 2 and emits zero script bytes. Unsafe-log regressions leave the sentinel unchanged. Fresh hosted checks are running.

Refs #72

[rmcdaniel]

Security source review at exact b65b61817735e695cec7af388b096f20e8523851: HOLD for two completion-boundary defects. Hosted checks are terminal and green, and the normal-name 308/312 parity result is credible. These findings are outside the current dw-name parity cases.

1. Generated shell code embeds the executable basename without validation or escaping.

   command_name() takes the raw basename of argv[0]; completion() replaces every {{ COMMAND_NAME }} with it. The three vendored scripts use that value in shell syntax and command positions, including function declarations, complete -F ... COMMAND, compdef ... COMMAND, and Fish function/complete forms. A Unix executable or symlink basename may contain whitespace, quotes, parentheses, braces, semicolons and newlines. A crafted local name can therefore turn dw completion <shell> output into commands that execute when the user follows the normal sourcing/eval workflow. For example, a basename shaped like dw() { :; }; <command>; _sf_x is inserted directly into the Bash function declaration.

   Preserve byte parity for the normal safe name, but fail closed or generate a separately sanitized function identifier plus correctly quoted command token for each shell. Add cases that invoke the exact built binary through crafted symlink names and source/parse the generated Bash, Zsh and Fish scripts in bounded scratch homes, proving no marker command runs. Include quotes, whitespace, newline, semicolon, command substitution and leading-dash names. Do not rely on the caller to pre-sanitize argv[0].

2. The Symfony-compatible debug log is a predictable symlink-following temp path.

   log_path() is temp_dir()/sf_<basename>.log. completion --debug does an exists() check followed by fs::write, and _complete uses OpenOptions::create(true).append(true); both follow links. A pre-created temp entry can redirect a privileged or different-user invocation into truncating/appending another writable file. The check/write path also has a TOCTOU window. The current log content is low sensitivity, but arbitrary file corruption is enough to hold this path.

   Use a user-private state/cache location or no-follow regular-file creation/opening with owner-only permissions and handle-based verification. Add a regression with a predicted-path symlink to a sentinel, plus a non-regular target, proving the sentinel is unchanged and the operation refuses safely. Keep completion --debug and _complete on the same safely resolved file.

The build.rs symlink skip is sound, the reference table is pinned to 2.3.5, and I found no additional blocker in the completion parser/update script. Keep the head fixed only for historical comparison; send the corrected exact head with fresh parity and terminal CI.

[rmcdaniel]

Security exact-head disposition: HOLD at 9d0a439912cedec62e83f6624270ea05c49cecc8.

The security direction remains appropriate: unsafe executable basenames are refused before shell text is emitted, and the debug log path is opened through the private state directory with no-follow/nonblocking and descriptor-based validation. However, the current exact head is not terminal green:

• Build run 41789190823, job 126438346535, passed all 98 unit tests but failed safe_executable_names_still_generate_working_shell_syntax at rust/tests/completion_security.rs:160;
• that Rust job failure also keeps the target-branch aggregate from passing;
• the assertion reports only safe completion script failed to source, so the hosted record does not identify the command name, shell, status, stdout, or stderr that failed.

I attempted a bounded counterfactual using the exact local 9d0a439 debug binary and the four safe names (dw, dw.exe, dw-cli, dw_2). All generated scripts sourced successfully under Bash 5.3, Zsh 5.9, and the exact hosted Fish 4.2.1. The disposable Fish container was removed and readback is empty. This means the hosted failure is currently unreproduced, not cleared.

Required next action: make the regression report the command name, shell, exit status, stdout, and stderr on failure; run it against all three required shells; then return a normally pushed exact head with terminal required checks. Preserve the current unsafe-name and private-log controls. No merge or release clearance is given for this head.

[rmcdaniel]

Security follow-through on the held CI failure is pushed normally as f3d3c9ee779d87e7f7cc96c279acf680688f8903 (parent 9d0a439912cedec62e83f6624270ea05c49cecc8).

This is test diagnostics only. On either safe-name generation or shell-source failure, the regression now records the command name, shell, exit status, stdout, and stderr. Product source, the unsafe-name refusal, private-log handling, completion templates, and the existing adversarial controls are byte-identical to the held head.

Focused local evidence:

• cargo fmt --check passed;
• cargo test --locked --test completion_security -- --nocapture passed 4/4 under native Bash/Zsh;
• before the push, the exact 9d0a439 binary's four safe-name scripts also sourced successfully under the hosted Fish 4.2.1 in a bounded disposable container; that container was removed and readback was empty.

Fresh exact-head hosted checks are running. The merge/release HOLD remains until they are terminal and the previously opaque shell-source failure is either absent or now specifically identified.

[rmcdaniel]

The instrumented exact-head rerun identified the failure precisely: command dw, shell zsh, exit 127. With the test's cleared environment, hosted Zsh found an inherited insecure completion directory, tried to prompt despite being non-interactive, aborted compinit, and therefore left compdef undefined. This is a test-harness portability failure, not a generated completion-script failure.

The focused correction is pushed normally as 5578f02077c2c397d1e55b81d0948d294f680100 (parent f3d3c9ee779d87e7f7cc96c279acf680688f8903): the Zsh syntax harness now runs compinit -D -i, which ignores unrelated insecure inherited completion entries and still defines compdef before sourcing the candidate script. The full command/shell/status/stdout/stderr diagnostics remain.

Product code, completion templates, unsafe-basename refusal, private debug-log handling, and all adversarial controls remain byte-identical to 9d0a439.

Focused local evidence at 5578f020:

• cargo fmt --check passed;
• cargo test --locked --test completion_security -- --nocapture passed 4/4;
• the earlier exact Fish 4.2.1 safe-name control remains applicable because no generated script changed.

Fresh exact-head hosted checks are running. HOLD remains until the required Bash/Zsh/Fish job and all other gates are terminal.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head review: MERGE GO for 5578f02077c2c397d1e55b81d0948d294f680100.

The security/product implementation remains byte-identical to reviewed 9d0a439: unsafe executable basenames are rejected before emitting shell text, and debug logging uses the private state path plus descriptor-based no-follow/nonblocking regular-file, ownership, mode, and link-count checks. The only later delta is rust/tests/completion_security.rs: actionable failure diagnostics and compinit -D -i so inherited insecure CI completion directories do not trigger a noninteractive prompt before the generated script is exercised.

Local exact-head cargo fmt --check and completion_security pass 4/4 with CARGO_BUILD_JOBS=2; the separate exact Fish 4.2.1 safe-name control also passed. Hosted exact-head checks are terminal success, including the Rust unit/parity lane, Bash/Zsh/Fish adversarial integration coverage, all five release dry-run binaries, CodeQL, Sonar, public boundary, and target-branch qualification.

This clears a normal merge of exactly this head. It does not authorize another release or change the already accepted CLI 2.3.6 artifacts; any head/base/tree change returns for review.

[rmcdaniel]

General merged the Security-cleared exact head 5578f02077c2c397d1e55b81d0948d294f680100 as a94189045cda232dd09698b918333bdc2a891016 after confirming the unchanged base and all 26 terminal-success checks. The draft was marked ready through the normal GitHub action immediately before merge. This is source integration only; accepted CLI 2.3.6 tags/assets and the stable 2.5.0 published-SDK requirement are unchanged. Next: one normal refresh of existing #94 onto this main, preserve its approved scope, rerun fresh qualification and return the immutable combined head for independent review. Keep #95/#96 frozen until that step; the existing hold on further feature work remains.