cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [spec-alignment] `audit list` and `audit show` have no `--format` option — machine-readable output impossible for security automation #6713

New issue

Open

opened 2026-04-09 23:47:26 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 23:47:26 +00:00

Owner

Bug Report: [spec-alignment] — `audit` commands missing `--format` option

Severity Assessment

Impact: Audit log data cannot be consumed by security automation tools, CI pipelines, or SIEM integrations — the only output format is Rich console output, which is not parseable
Likelihood: High — any security tooling or scripted audit review is affected
Priority: Medium

Location

File: src/cleveragents/cli/commands/audit.py
Function: list_entries, show_entry, count_entries
Lines: 36–114, 158–164

Description

Every other major CLI command group in the codebase supports --format (json/yaml/plain/table/rich). The audit command is unique in having no --format option on any of its subcommands:

# audit.py lines 36-70 — list_entries signature
@app.command(name="list")
def list_entries(
    plan: ... = None,
    project: ... = None,
    event_type: ... = None,
    since: ... = None,
    limit: ... = 50,
    # ← NO --format option
) -> None:

# audit.py lines 83-99 — show_entry signature  
@app.command(name="show")
def show_entry(
    audit_id: ...,
    # ← NO --format option
) -> None:

All output is rendered using console.print() (Rich), making it impossible to:

Pipe audit entries to jq for filtering
Export audit logs to JSON for SIEM ingestion
Use agents audit list --format json in CI/CD pipelines
Programmatically verify audit entries in integration tests

The spec (SEC7) describes the audit log as a security feature — security-relevant features are precisely where machine-readable output is most critical.

Evidence

# src/cleveragents/cli/commands/audit.py  lines 36-80
@app.command(name="list")
def list_entries(
    plan: Annotated[str | None, typer.Option(...)],
    project: Annotated[str | None, typer.Option(...)],
    event_type: Annotated[str | None, typer.Option(...)],
    since: Annotated[str | None, typer.Option(...)],
    limit: Annotated[int, typer.Option(...)] = 50,
    # ← NO fmt parameter
) -> None:
    console = get_console()
    with _get_audit_service() as service:
        entries = service.list_entries(...)
    ...
    for entry in entries:
        _print_entry_summary(entry)    # ← Rich-only output

Compare to session list (session.py lines 264–342) which has --format and calls format_output() for JSON/YAML.

Expected Behavior

agents audit list, agents audit show, and agents audit count should all support --format json|yaml|plain|table|rich matching the CLI-wide convention.

Actual Behavior

Only Rich console output is available. Running agents audit list | jq would parse Rich ANSI escape codes, not valid JSON.

Suggested Fix

Add --format / -f to all audit subcommands following the pattern established in session.py:

@app.command(name="list")
def list_entries(
    ...,
    fmt: Annotated[
        str,
        typer.Option("--format", "-f", help="Output format: json, yaml, plain, table, or rich"),
    ] = "rich",
) -> None:
    ...
    entries = service.list_entries(...)
    if fmt != "rich":
        data = [entry.as_dict() for entry in entries]
        typer.echo(format_output(data, fmt))
        return
    # existing Rich output

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: [spec-alignment] — `audit` commands missing `--format` option ### Severity Assessment - **Impact**: Audit log data cannot be consumed by security automation tools, CI pipelines, or SIEM integrations — the only output format is Rich console output, which is not parseable - **Likelihood**: High — any security tooling or scripted audit review is affected - **Priority**: Medium ### Location - **File**: `src/cleveragents/cli/commands/audit.py` - **Function**: `list_entries`, `show_entry`, `count_entries` - **Lines**: 36–114, 158–164 ### Description Every other major CLI command group in the codebase supports `--format` (json/yaml/plain/table/rich). The `audit` command is unique in having **no `--format` option** on any of its subcommands: ```python # audit.py lines 36-70 — list_entries signature @app.command(name="list") def list_entries( plan: ... = None, project: ... = None, event_type: ... = None, since: ... = None, limit: ... = 50, # ← NO --format option ) -> None: ``` ```python # audit.py lines 83-99 — show_entry signature @app.command(name="show") def show_entry( audit_id: ..., # ← NO --format option ) -> None: ``` All output is rendered using `console.print()` (Rich), making it impossible to: 1. Pipe audit entries to `jq` for filtering 2. Export audit logs to JSON for SIEM ingestion 3. Use `agents audit list --format json` in CI/CD pipelines 4. Programmatically verify audit entries in integration tests The spec (SEC7) describes the audit log as a security feature — security-relevant features are precisely where machine-readable output is most critical. ### Evidence ```python # src/cleveragents/cli/commands/audit.py lines 36-80 @app.command(name="list") def list_entries( plan: Annotated[str | None, typer.Option(...)], project: Annotated[str | None, typer.Option(...)], event_type: Annotated[str | None, typer.Option(...)], since: Annotated[str | None, typer.Option(...)], limit: Annotated[int, typer.Option(...)] = 50, # ← NO fmt parameter ) -> None: console = get_console() with _get_audit_service() as service: entries = service.list_entries(...) ... for entry in entries: _print_entry_summary(entry) # ← Rich-only output ``` Compare to `session list` (session.py lines 264–342) which has `--format` and calls `format_output()` for JSON/YAML. ### Expected Behavior `agents audit list`, `agents audit show`, and `agents audit count` should all support `--format json|yaml|plain|table|rich` matching the CLI-wide convention. ### Actual Behavior Only Rich console output is available. Running `agents audit list | jq` would parse Rich ANSI escape codes, not valid JSON. ### Suggested Fix Add `--format` / `-f` to all audit subcommands following the pattern established in `session.py`: ```python @app.command(name="list") def list_entries( ..., fmt: Annotated[ str, typer.Option("--format", "-f", help="Output format: json, yaml, plain, table, or rich"), ] = "rich", ) -> None: ... entries = service.list_entries(...) if fmt != "rich": data = [entry.as_dict() for entry in entries] typer.echo(format_output(data, fmt)) return # existing Rich output ``` ### Category `spec-alignment` ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added the

labels

2026-04-10 00:06:10 +00:00

HAL9000 added this to the v3.2.0 milestone

2026-04-10 00:10:26 +00:00

HAL9000 referenced this issue

2026-04-10 00:14:06 +00:00

[AUTO-ARCH] Architecture Status (Cycle 21) #6727

HAL9000 added

and removed

labels

2026-04-14 07:20:01 +00:00

HAL9000 commented

2026-04-14 07:20:01 +00:00

Author

Owner

✅ Verified — Spec alignment bug: audit commands missing --format option. MoSCoW: Should-have. Priority: High.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Spec alignment bug: audit commands missing --format option. MoSCoW: Should-have. Priority: High. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-15 23:33:31 +00:00

[AUTO-INF-8] Harden dependency security posture for cleveragents-core #9889