UAT: `agents config list <PATTERN>` includes false positive keys when pattern is a glob (e.g. `plan.*` matches `sandbox.checkpoint.max-per-plan`) #1839

New issue

Open

opened 2026-04-02 23:56:50 +00:00 by freemo · 1 comment

freemo commented

2026-04-02 23:56:50 +00:00

Owner

Metadata

Branch: fix/config-list-glob-pattern-false-positives
Commit Message: fix(cli): anchor config list pattern matching to prevent glob false positives via re.search
Milestone: v3.6.0
Parent Epic: #936

Description

The agents config list command accepts an optional pattern argument to filter configuration keys. The spec describes this as a "Glob or regex filter for key names (e.g. plan.*)". However, the implementation compiles the pattern as a regex and uses re.search() which matches the pattern anywhere in the key name, not just at the start.

Expected behavior: When running agents config list "plan.*", only keys that start with plan. should be returned (e.g., plan.concurrency, plan.budget.per-plan, etc.).

Actual behavior: sandbox.checkpoint.max-per-plan is also included in the results because the regex plan.* matches the substring "plan" in "max-per-plan".

Steps to reproduce:

agents config list "plan.*"

Actual output includes:

sandbox.checkpoint.max-per-plan  50  default

Expected output: Only keys starting with plan. should appear.

Root cause: In src/cleveragents/cli/commands/config.py, lines 496–500:

if (
    key_re is not None
    and not key_re.search(key)
    and (pattern is None or not fnmatch.fnmatch(key, pattern))
):
    continue

The condition uses OR logic: a key is included if it matches EITHER the regex OR the fnmatch. Since plan.* as a regex matches any key containing "plan." (including sandbox.checkpoint.max-per-plan), the regex match is too broad.

The correct behavior should be to use fnmatch for glob patterns (which correctly handles plan.* as "starts with plan.") and only fall back to regex when the pattern is explicitly a regex. Alternatively, the regex should be anchored with ^ to match from the start of the key.

Impact: Users cannot reliably filter config keys by subtree prefix using glob patterns, which is the primary documented use case for the pattern argument.

Subtasks

Investigate the pattern-matching logic in src/cleveragents/cli/commands/config.py (lines 496–500)
Fix the filter logic to use fnmatch.fnmatch() as the primary glob matcher (correctly anchored)
Ensure regex patterns are anchored with ^ when compiled, or use re.fullmatch() instead of re.search()
Remove the OR logic that allows either regex or fnmatch to independently pass a key through
Tests (Behave): Add scenario for agents config list "plan.*" verifying no false positives from substring matches
Tests (Behave): Add scenario confirming plan.* does NOT match sandbox.checkpoint.max-per-plan
Tests (Robot): Add integration test for glob pattern filtering correctness
Verify coverage >= 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
agents config list "plan.*" returns only keys whose names start with plan. and does not include false positives such as sandbox.checkpoint.max-per-plan.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-uat-tester

## Metadata - **Branch**: `fix/config-list-glob-pattern-false-positives` - **Commit Message**: `fix(cli): anchor config list pattern matching to prevent glob false positives via re.search` - **Milestone**: v3.6.0 - **Parent Epic**: #936 ## Description The `agents config list` command accepts an optional pattern argument to filter configuration keys. The spec describes this as a "Glob or regex filter for key names (e.g. `plan.*`)". However, the implementation compiles the pattern as a regex and uses `re.search()` which matches the pattern anywhere in the key name, not just at the start. **Expected behavior:** When running `agents config list "plan.*"`, only keys that start with `plan.` should be returned (e.g., `plan.concurrency`, `plan.budget.per-plan`, etc.). **Actual behavior:** `sandbox.checkpoint.max-per-plan` is also included in the results because the regex `plan.*` matches the substring `"plan"` in `"max-per-plan"`. **Steps to reproduce:** ```bash agents config list "plan.*" ``` **Actual output includes:** ``` sandbox.checkpoint.max-per-plan 50 default ``` **Expected output:** Only keys starting with `plan.` should appear. **Root cause:** In `src/cleveragents/cli/commands/config.py`, lines 496–500: ```python if ( key_re is not None and not key_re.search(key) and (pattern is None or not fnmatch.fnmatch(key, pattern)) ): continue ``` The condition uses `OR` logic: a key is included if it matches EITHER the regex OR the fnmatch. Since `plan.*` as a regex matches any key containing `"plan."` (including `sandbox.checkpoint.max-per-plan`), the regex match is too broad. The correct behavior should be to use `fnmatch` for glob patterns (which correctly handles `plan.*` as "starts with plan.") and only fall back to regex when the pattern is explicitly a regex. Alternatively, the regex should be anchored with `^` to match from the start of the key. **Impact:** Users cannot reliably filter config keys by subtree prefix using glob patterns, which is the primary documented use case for the pattern argument. ## Subtasks - [ ] Investigate the pattern-matching logic in `src/cleveragents/cli/commands/config.py` (lines 496–500) - [ ] Fix the filter logic to use `fnmatch.fnmatch()` as the primary glob matcher (correctly anchored) - [ ] Ensure regex patterns are anchored with `^` when compiled, or use `re.fullmatch()` instead of `re.search()` - [ ] Remove the OR logic that allows either regex or fnmatch to independently pass a key through - [ ] Tests (Behave): Add scenario for `agents config list "plan.*"` verifying no false positives from substring matches - [ ] Tests (Behave): Add scenario confirming `plan.*` does NOT match `sandbox.checkpoint.max-per-plan` - [ ] Tests (Robot): Add integration test for glob pattern filtering correctness - [ ] Verify coverage >= 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - `agents config list "plan.*"` returns only keys whose names start with `plan.` and does not include false positives such as `sandbox.checkpoint.max-per-plan`. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97%. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-uat-tester

freemo added this to the v3.6.0 milestone

2026-04-02 23:57:17 +00:00

freemo referenced this issue

2026-04-02 23:58:16 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 461 — v3.7.0 #1850

freemo added a new dependency

2026-04-03 00:00:43 +00:00

#936 Epic: Output Rendering Pipeline Integration — Wire Commands to OutputSession Framework

freemo commented

2026-04-03 00:04:58 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: MoSCoW/Should Have — bug or error handling improvement.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: MoSCoW/Should Have — bug or error handling improvement. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo referenced this issue

2026-04-03 00:08:26 +00:00

[UAT-SUPERVISOR] Progress Report — Cycle 471 — v3.7.0 #1891