From 9a776f84ab12bed1aa4bfad088fa74c92e724def Mon Sep 17 00:00:00 2001 From: CleverThis Date: Mon, 15 Jun 2026 00:58:36 -0400 Subject: [PATCH] fix(cli): address reviewer issues in project switch command - Narrow except Exception to NotFoundError in switch() to avoid masking unrelated errors when the project lookup fails - Fix shell injection risk in _write_active_project: use single-quoted export with embedded single-quote escaping instead of double-quoted f-string which would allow shell metacharacters in project names to execute arbitrary commands when the file is sourced - Pass command= keyword to format_output in switch non-rich path so the JSON/YAML envelope includes the originating command name per spec ISSUES CLOSED: #8675 --- src/cleveragents/cli/commands/project.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/cleveragents/cli/commands/project.py b/src/cleveragents/cli/commands/project.py index b8c6f7418..82a6d08fd 100644 --- a/src/cleveragents/cli/commands/project.py +++ b/src/cleveragents/cli/commands/project.py @@ -1040,7 +1040,7 @@ def switch( # Validate project exists try: proj = svc.get_project(project) - except Exception as exc: + except NotFoundError as exc: err_console.print(f"[red]Project not found:[/red] {project}") raise typer.Exit(1) from exc @@ -1086,7 +1086,7 @@ def switch( "description": proj.description, "updated_at": datetime.now(tz=UTC).isoformat(), } - console.print(format_output(data, output_format)) + console.print(format_output(data, output_format, command="project switch")) def _write_active_project(namespaced_name: str) -> None: @@ -1100,8 +1100,9 @@ def _write_active_project(namespaced_name: str) -> None: home = Path.home() / ".cleveragents" home.mkdir(parents=True, exist_ok=True) helper_path = home / "active-project.sh" + safe_name = namespaced_name.replace("'", "'\\''") helper_path.write_text( - f'export CLEVERAGENTS_PROJECT="{namespaced_name}"\n', encoding="utf-8" + f"export CLEVERAGENTS_PROJECT='{safe_name}'\n", encoding="utf-8" ) # Also update the in-memory environment for the current process and any