aaef4f06bd
Addresses the second CodeRabbit pass on #1006. `-w`/`-p` parse at group and top level as well as command level, all landing in `_global_overrides`, so reading the command-level params dropped the scope from `honcho session -w ws2 view ...`. The hint now reads the effective overrides via a new `get_flag_overrides()`, which deliberately excludes environment and config values since those resolve the same way on the next run. Also shell-quotes the hint's identifiers with `shlex.join`. Note this is hardening rather than a live injection fix: the API constrains IDs to `^[a-zA-Z0-9_-]+$`, so an ID carrying a space or metacharacter fails the fetch before any hint is printed. `validate_resource_id` is looser than the server though, so quoting is the cheaper invariant to hold locally. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| conftest.py | ||
| test_commands.py | ||
| test_common.py | ||
| test_config.py | ||
| test_oauth.py | ||
| test_output.py | ||
| test_validation.py | ||