[thesmartshadow]

cli.json command names are normalized during package discovery, but were
not constrained to command identifiers before being incorporated into binary
output names.

Validate command names while reading package metadata, before installer
selection or dependency processing. Keep the same validation at the Go build
and binary download sinks so direct callers cannot reintroduce filesystem path
control.

Remove a pre-existing Go build output entry before invoking go build. This
prevents package contents from supplying a symlink at the expected output
location.

Add regressions for malformed local and remote metadata, the binary download
path, and the Go installation path.

Tests: go test ./...

[Copilot]

🟡 Changes recommended

Address the ASCII validation issue and add coverage for pre-existing output symlink cleanup.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR validates package command names before deriving executable paths and removes pre-existing Go build outputs to mitigate path-control and symlink risks.

Changes:

• Adds centralized command-name validation.
• Applies validation during metadata loading, Go builds, and binary downloads.
• Adds malformed-metadata and output-path regressions.
• Removes existing Go build outputs before compilation.

Review findings:

• pkg/tools/util.go:19 (moderate, 1 vote): validate raw values against ASCII ranges before lowercasing.
• pkg/packages/golang.go:84 (nit, 3 votes): add a regression covering removal of a pre-existing output symlink.

File summaries

File	Summary
pkg/tools/util.go	Defines command-name normalization and validation.
pkg/packages/golang.go	Validates Go commands and removes existing outputs.
pkg/packages/golang_test.go	Tests malformed Go command names.
pkg/commands/subcommands.go	Validates metadata and binary output paths.
pkg/commands/subcommands_test.go	Tests malformed local, remote, and binary metadata.

Review details

Suppressed comments (1)

pkg/tools/util.go:20

• The validation runs after Unicode lowercasing, so non-ASCII characters with an ASCII lowercase mapping (for example U+212A, the Kelvin sign) pass this supposedly ASCII identifier grammar and can collide with a distinct normalized name. Match the raw value against the ASCII ranges first, then lowercase it.

	normalized := strings.ToLower(name)
	if !commandNamePattern.MatchString(normalized) {

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.