[M3gA-Mind]

Summary

run_linter's eslint branch passed the model-supplied path to npx eslint --format compact <path>. It refused absolute paths and .., but not values that start with -. So path: "--output-file=pwned.txt" reached eslint as an option and could write a file, or change eslint's behavior in other ways, from a tool meant only for linting. #80 closed the same hole for read_diff's base.

The eslint branch now refuses a path that starts with - (path must be a path, not an option), the same way read_diff refuses an option-shaped base. No real lint target needs a leading -.

Related issue

None.

API or behavior changes

run_linter with linter: "eslint" and a path starting with - now returns an error and does not run eslint. Every other path behaves as before.

Validation

Commands actually run, with their outcome:

• cargo fmt --all -- --check: rustfmt --edition 2024 on the touched files only.
• N/A: cargo clippy --all-targets --all-features -- -D warnings was left to CI.
• N/A: cargo build --all-targets --all-features was left to CI.
• N/A: cargo test --all-features was left to CI. Only the eslint_rejects* tests ran locally, with npx taken off PATH so the pre-fix run could not start a real eslint:
  • eslint_rejects_an_option_shaped_path before the fix failed: the path passed validation and the tool tried to spawn npx (Err: No such file or directory). After the fix it passed, along with the existing absolute-path and traversal tests.

Tests

filesystem/run_linter/mod_tests.rs::eslint_rejects_an_option_shaped_path sends --output-file=pwned.txt as the path. The test expects an error that names the option, and expects pwned.txt not to exist.

Documentation

Not needed.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[tinysweeper]

Tiny Sweeper review

Reviewed head: 3b92304115ccef1594cfa8d768beae1b26be6db1

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 2 of 2 files.
Pull request purpose (title): fix(run_linter): ref…

Diagnostics and supporting details

Full summary

Pull request purpose (title): fix(run_linter): refuse an option-shaped eslint path. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	1	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

• Added — Reject option-shaped eslint path: A `path` value beginning with `-` is rejected before reaching `npx eslint`, closing an avenue where a value like `--output-file=pwned.txt` could have been interpreted as an eslint option and written a file. Other lint targets behave as before. (crates/tinytools-std/src/filesystem/run_linter/mod.rs impl Tool for RunLinterTool {)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The guard sits after the absolute/`..` rejection and before `cmd.args`, so the value never reaches `npx`; no defect found in the two changed files.
• Lane summary: The change guards the eslint branch against option-shaped `path` values and adds a test asserting the guard fires on `--output-file=pwned.txt`; the check sits after the existing absolute/`..` rejection and before `cmd.args`, so the value never reaches npx. I found no defect in the two changed files. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The defence is correctly placed on the only branch where `path` is used as an argument to a subprocess sink, and the test covers the stated failure path; no security defect introduced.
• Lane summary: The change adds a guard rejecting a `path` starting with `-` before it reaches `npx eslint`, plus a test asserting the refusal and that no file is written. The guard sits on the only branch where `path` is used as an argument, the input is model-supplied and the sink is a subprocess, so the defence is correctly placed and the test covers the stated failure path; I found no security defect introduced here. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The new test would fail if the guard were removed, since the substituted real path clears the earlier checks and the only remaining refusal is the new option guard.
• Lane summary: The change adds a guard rejecting option-shaped `path` values before they reach eslint, and the new test `eslint_rejects_an_option_shaped_path` would fail if the branch were removed (it substitutes a real path, which clears the earlier absolute/`..` check, so the only remaining refusal is the new one). Nothing else in the diff asserts behaviour that isn't pinned. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: No sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description matches the diff: it names the eslint path check, the new error message, the behavior change, and the new test; no discrepancies or repository-rule violations found.
• Lane summary: The description accurately matches the diff: it names the eslint path check, the new error message, the behavior change, and the new test, and its claims line up with the code and test shown. No discrepancies or repository-rule violations found. _The code index is behind this pull request (indexed at `28ea0933b938`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000390
• Tokens: 136791 input · 2410 output · 21504 cached · 115 embedding
• Updated: 2026-10-22T23:04:30Z

Head	State	Pass summary
3b92304115cc	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T23:04:30Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ebfafeda-0669-41e3-a763-612269a79376

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0004