Codebase review findings (September 2026)

[retr0h]

Tracking issue for the September 2026 review of the osapi Go codebase (controller, providers, cmd/config, SDK/agent/job, and a cross-area pass).

Security

Eight security findings (four critical) are tracked as private draft security advisories on this repository, visible to maintainers only until fixes ship. Fix those first.

Quick fixes

• CLI exits 0 when a remote command fails unless --stdout or --stderr is set #494
• Agent, NATS server and all-in-one start panic when the metrics server cannot be created #495

Larger changes, one PR each

• Agent command execution has no timeout or cancellation #496
• Agent lifecycle state and cached facts are read and written without synchronization #497
• File deploy writes are not atomic and never apply mode, owner or group on redeploy #498
• Provider errors lose their type between agent and controller; handlers match on error text #499
• Audit log records who and where but not what, and has no job ID #500

Medium

• Broadcast timeouts are reported as ordinary failures #501
• Node status returns zero values when a provider read fails #502
• osapi help and osapi completion fail when no config file exists #503
• Shutdown cleanup has no timeout and can hang on an unreachable telemetry collector #504
• Pending-target hint uses a package-level variable shared across concurrent requests #505
• Ping leaks a goroutine on every timeout #506
• Agent stays Pending forever if its first enrollment request fails to publish #507

Low

• Low-severity cleanup from the codebase review #508

Checked and clean

Package layering matches the architecture docs, API domains are structurally consistent, RBAC checks are applied consistently, the public SDK API is solid, and trace context propagates end to end.