Skip to content

fix(cmd): expand file references in nullable string flags - #168

Closed
markstuart-oai wants to merge 1 commit into
mainfrom
markstuart/nullable-string-file-expansion
Closed

fix(cmd): expand file references in nullable string flags#168
markstuart-oai wants to merge 1 commit into
mainfrom
markstuart/nullable-string-file-expansion

Conversation

@markstuart-oai

Copy link
Copy Markdown
Contributor

Summary

Nullable string flags such as vector-stores update --name @file currently send the literal reference, while ordinary string flags expand it. Route nonnil *string values through the existing file expansion logic so explicit @file, @file:// and @data:// references behave consistently.

Nil remains JSON null. Unset values, escaped literals, missing-file errors, text/binary encoding, and untrusted-stdin provenance retain their existing behavior. Other pointer types are unchanged. SDK CODEOWNER review is required for this file-path/request-parsing change.

Validation

  • Demonstrated RED before the fix and GREEN afterward using the actual CLI against a synthetic localhost request capture, including nullable/ordinary/null/unset/escape controls and untrusted stdin with explicit overrides.
  • Passed focused nullable, embedding, and stdin-security tests; go test ./internal/...; go test ./... -run '^$'; go mod verify; and ./scripts/lint (build).
  • Passed focused race checks and go vet ./internal/requestflag ./pkg/cmd.
  • Windows cross-compilation passed (GOOS=windows GOARCH=amd64 go test -c); no native Windows runtime testing.
  • Trusted-main custom-code checker passed against the actual committed SHA before push: 495/1000 lines, with the generated snapshot verified.
  • Full LOCAL ./scripts/test NOT RUN: the pinned Steady tool cache is missing or linked, so the supported launcher cannot start the mock. Full hosted CI/mock results remain required; no hosted pass is claimed here.

@markstuart-oai
markstuart-oai requested a review from a team as a code owner September 8, 2026 05:58
Copilot AI lite review requested due to automatic review settings September 8, 2026 05:58
@markstuart-oai markstuart-oai added the autoimprove Scoped automated improvement label Sep 8, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 8, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-08T06:00:51.181744Z 5e20def PR opened
🔒 Security Review Completed 2026-09-08T06:02:50.083154Z 5e20def PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 094a4ab96e805e20def9b28d. Generated baselines verified.

5 existing customizations unchanged
  • pkg/cmd/adminorganizationcertificate.go
  • pkg/cmd/cmd.go
  • scripts/castiron/README.md
  • scripts/castiron/custom_code_report.py
  • scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34192725852 --repo openai/openai-cli \
  --name castiron-custom-code-34192725852-1 --dir /tmp/castiron-custom-code-34192725852-1
git apply --stat /tmp/castiron-custom-code-34192725852-1/custom-code.patch
cat /tmp/castiron-custom-code-34192725852-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 265cf6378ab2e6a27c17bc7c0b6a6cbe6dbd477b 5e20def9b28d790105aa9d9a1f6414d1e5165c98
python3 scripts/castiron/custom_code_report.py report \
  --base 265cf6378ab2e6a27c17bc7c0b6a6cbe6dbd477b \
  --head 5e20def9b28d790105aa9d9a1f6414d1e5165c98 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-5e20def9b28d
cat /tmp/castiron-custom-code-5e20def9b28d/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

It changes file-path/request-parsing behavior at a security boundary (explicitly requiring CODEOWNER review) and includes an end-to-end test that should be hardened for reliability.

Pull request overview

This PR fixes inconsistent “@file”-style expansion for nullable string CLI flags by ensuring non-nil *string values go through the same file-embedding logic as plain string flags, while preserving nil as JSON null.

Changes:

  • Update embedFilesValue to unwrap non-nil *string values before applying file-reference expansion.
  • Add focused unit coverage for embedFiles with nullable string pointers.
  • Add an end-to-end CLI test covering nullable vs ordinary string behavior, null/unset, escaping, missing-file errors, binary sniffing, and untrusted-stdin controls.
File summaries
File Description
pkg/cmd/flagoptions.go Unwraps non-nil *string to apply existing file embedding/expansion logic consistently.
pkg/cmd/nullablefile_test.go Adds unit + CLI end-to-end tests to validate nullable string file-reference expansion and related edge cases.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread pkg/cmd/nullablefile_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autoimprove Scoped automated improvement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants