From 31d6606067f15eed3121686d1f46f477f3928beb Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Thu, 10 Sep 2026 04:00:24 +0000 Subject: [PATCH] docs(xce-test-cli-ux): verify source's interaction with the confirmation gate (task 4.3) Live-cluster validation, no source changes: independently reproduced (implementer + reviewer, separate deploys) that a destructive command inside a sourced file, run within an otherwise-interactive session, still prompts for confirmation with wording identical to a directly-typed invocation, is skipped once the session toggle is set, and that decline does not trip set -e's abort-on-failure (Req 13.7). Structurally confirmed the gate has no code path capable of distinguishing a sourced line from a typed one. Bumps bug-1797's occurrence count (recurred via the source call path, confirmed pre-existing, not new). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_019jaMf9QEwpugH2W9KAuc7f --- .kiro/specs/xce-test-cli-ux/tasks.md | 3 ++- .wolf/buglog.json | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.kiro/specs/xce-test-cli-ux/tasks.md b/.kiro/specs/xce-test-cli-ux/tasks.md index d487cf65..2fd08df3 100644 --- a/.kiro/specs/xce-test-cli-ux/tasks.md +++ b/.kiro/specs/xce-test-cli-ux/tasks.md @@ -165,11 +165,12 @@ - _Depends: 3.3, 1.7_ - _Done (requirements 9.1-9.9 MET): run twice independently (implementer + reviewer), each against separately-deployed live single-node clusters (one with a real worker), for all five destructive commands (jobkill, shutdown, qctrl -i/-c, hostctrl -c, upgradeconfig). Default prompt + decline reports ": not run (declined)" on stderr only, never "failed" (AC1/AC2/AC8). A real SIGINT delivered while blocked inside the prompt's read produces the IDENTICAL "not run (declined)" text for all five (AC9) -- concretely contrasted against task 4.1's own finding that Ctrl-C on an ordinary (non-destructive) command instead reports ": Interrupted system call" as a failure, proving AC9's exception to Requirement 1.3 is real, not assumed. `--yes` and non-interactive (piped, non-tty) input both skip the prompt and proceed straight to the RPC for all five (AC3/AC4), including full real round trips for jobkill (a real submitted job actually signaled) and upgradeconfig (the real generated cluster.bin actually resubmitted, 3 times, safely idempotent) and, via two disposable throwaway controllers, shutdown itself (actually terminated for real to prove the bypass path executes all the way, not just "reached the RPC call"). The session toggle `set -y`/`set +y` (AC6/AC7) works for all five once issued from the top-level context (`set` is registered only in `top_commands[]`, not `client_commands[]`/`worker_commands[]`/`scheduler_commands[]` -- a cosmetic UX gap, not a Requirement 9 defect, confirmed by both runs). AC5's exact enumeration verified live both ways: `qctrl -a`/`-o`, `hostctrl -o`, and worker-context `jstart` never prompt; `qctrl -i`/`-c` and `hostctrl -c` do. No defect found in the confirmation gate itself. Two genuine but pre-existing, out-of-boundary defects were found along the way and logged rather than fixed: bug-1796 (cmd_qctrl/cmd_hostctrl/cmd_jobkill's RPC-error perror() calls print stale/misleading errno text, root-caused and reproduced independently by the reviewer, confirmed unrelated to the interrupt adapter or confirmation gate) and bug-1797 (cmd_qctrl leaks its strdup'd queue name on the RPC-error return path, ASAN-confirmed). No source files were changed; both sets of deploys were fully cleaned up._ -- [ ] 4.3 Verify source's interaction with the confirmation gate +- [x] 4.3 Verify source's interaction with the confirmation gate - Confirm a destructive command inside a sourced file, run within an otherwise-interactive session, still prompts for confirmation unless the session toggle is set, proving the gate's interactive check is based on the top-level session rather than on whether the current line came from a file - Observable completion: a live end-to-end run sources a file containing a destructive command from an interactive session and observes the prompt appear, then observes it skipped once the toggle is set - _Requirements: 13.7_ - _Depends: 2.4, 3.3, 1.7_ + - _Done (requirement 13.7 MET): run twice independently (implementer + reviewer), each against separately-deployed live single-node controllers, sourcing a script file containing a destructive `qctrl -i` line from an otherwise-interactive session. With the confirmation toggle at its default, the prompt appeared on stderr with wording byte-identical to a directly-typed invocation of the same command, and decline reported "qctrl: not run (declined)" -- proving the gate fires for a sourced-file line exactly as it would for a typed one. After `set -y` (issued at the top-level context), re-sourcing the same file produced zero prompt text, and `set +y` afterward restored prompting for a directly-typed invocation, confirming no lingering session-state confusion. The reviewer additionally confirmed this structurally, not just behaviorally: `confirm_destructive()`'s only gating checks are `confirm_is_skip_set()` and `!xcetest_is_interactive()` (a read-only accessor over `g_interactive`, set once at startup from `isatty(STDIN_FILENO)` and never reassigned), and the only per-source-invocation state that exists (`g_source_depth`, used solely for cycle detection) has zero references anywhere near the gate -- there is no code path capable of distinguishing a sourced line from a typed one for this decision. Also verified the bonus interaction flagged by task 3.3's Implementation Note: with `set -e` active, a sourced file's declined destructive line does NOT trip abort-on-failure (a subsequent `echo` line in the same file still ran), confirming decline's `return 0` per `confirm.h`'s contract. No defect found. The already-logged bug-1797 (`cmd_qctrl`'s RPC-error-path queue-name leak) recurred via the `source` call path in both runs -- confirmed to be the identical pre-existing leak, not a new one; occurrence count bumped in buglog.json. No source files were changed; both deploys were fully cleaned up._ - [ ] 4.4 Verify process-level help, tab completion, and consolidated help content end-to-end - Confirm the help/version flags and in-session help behavior from 1.6 and 3.5, and the tab-completion behavior from 2.3, hold together in the full built client, not just in isolation diff --git a/.wolf/buglog.json b/.wolf/buglog.json index ceb4e9fe..2f6bbb3d 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -21640,8 +21640,8 @@ "related_bugs": [ "bug-1796" ], - "occurrences": 1, - "last_seen": "2026-09-09T22:00:00Z" + "occurrences": 3, + "last_seen": "2026-09-09T23:30:00Z" } ] }