Skip to content

feat(gui): SpotHub is a CanonWindow workspace re-skinned to the canon palette. Principle VIII. - #6401

Merged
ten9876 merged 1 commit into
mainfrom
feat/spothub-canon-window
Oct 12, 2026
Merged

ten9876 merged 1 commit into
mainfrom
feat/spothub-canon-window

Conversation

@ten9876

@ten9876 ten9876 commented Oct 12, 2026

Copy link
Copy Markdown
Collaborator

Summary

Part of #6239. SpotHub (DxClusterDialog) moves from PersistentDialog to a CanonWindow workspace, following the recipe AetherGPS (#6364) and AetherMap (#6340) use:

  • Chrome: no title bar; the ambient ground, the canon header and the corner close button. Drag any empty area to move it, resize it from any edge, close it with Esc or Ctrl+W.
  • Kind: CanonWindow::Kind::Workspace, an independent top-level window with its own taskbar entry. It no longer follows View → Frameless Window, so the Settings → SpotHub… handler creates it directly instead of through showOrRaisePersistent(), which would set frameless mode on it.
  • Geometry: persists under its old key (DxClusterDialogGeometry), so saved positions carry over.
  • Size: minimum 360×600 (was 360×560) and first-open 760×680 (was 760×640), to make room for the header.

Look. It sits under the canon/spotHub theme scope, which maps the tokens the tabs' remaining per-widget sheets use (status colors, labels) onto the canon palette, plus one canon sheet:

  • the tab pages are a raised card; the selected tab is cyan with a cyan underline;
  • group boxes are nested cards with cyan titles;
  • fields, spin boxes and combos sit on control; the consoles and the spot list are nested, with a canon header row;
  • check boxes use the canon indicators;
  • each source's Connect / Start button is the filled cyan primary;
  • a checked toggle (Auto-Connect, Spots, Passive, Enabled/Disabled…) keeps SpotHub's green fill, now the color.toggle.success.* tokens instead of literals. The maintainer chose this over the canon aqua outline, because the fill is the only on/off signal on the Display tab's name-only toggles.

Cleanup. About 60 per-widget field, console, table, tab, checkbox and toggle sheets are replaced by that one sheet, and the remaining hex literals (swatch borders, the server and DXCC/Signal History labels) are tokens. kSpotHubToggle is gone.

Docs:

  • docs/user/docs/spothub.md describes the window (move, resize, close, taskbar, Frameless Window).
  • docs/style/* list SpotHub among the canon windows and its scope.
  • Stale screenshot, to recapture after merge: spothub.png shows the old window.

Constitution principle honored

Principle VIII (Evidence Over Assertion) covers the checks below. The visual direction is RFC #6226's; the checked-toggle color was the maintainer's call.

Test plan

  • Local build passes (Qt 6.12).
  • Full GUI on a scratch profile, opened via Settings → SpotHub… over the automation bridge, every tab grabbed: Cluster, WSJT-X, FreeDV, Spot List and Display draw the canon header, cards, cyan tabs and titles, canon fields and the corner ✕; checked toggles fill green. A clipped Freeze label (60 px fixed width) was fixed by tightening button padding, and re-grabbed.
  • The bridge's close closed the window and saved DxClusterDialogGeometry (570,237,760,680); reopening restored 760×680.
  • The static-check scripts (check_engine_boundary, gen_touchpoint_manifest --check, check_capability_records, check_command_plane) and check_a11y.py pass. The color-audit ratchet is 43 references and 40 setStyleSheet calls below main.
  • embed_screenshots.py --check and gen_reference.py --check pass.
  • Not exercised: live spot traffic (no cluster connected) and the live radio. No test covers this window, and this PR adds none.

Checklist

  • Commits are signed
  • No new flat-key AppSettings calls; the existing geometry key is reused
  • Code is clean-room
  • No meter UI touched
  • Documentation updated: docs/user/docs/spothub.md, docs/style/*; no CHANGELOG.md entry
  • Security-sensitive changes: n/a

🤖 Generated with Claude Code

… palette. Principle VIII.

Part of #6239. SpotHub (DxClusterDialog) moves from PersistentDialog to a
CanonWindow workspace, following AetherGPS and AetherMap:
- No title bar: the ambient ground, the canon header and the corner close
  button; it resizes from every edge and closes with Esc or Ctrl+W. It no
  longer follows View -> Frameless Window, so MainWindow creates it
  directly instead of through showOrRaisePersistent().
- Geometry persists under its old key (DxClusterDialogGeometry). Minimum
  360x600 and first-open 760x680, 40 px taller for the header.
- Look: the canon/spotHub theme scope plus one canon sheet. The tab pages
  are a raised card with cyan selected tabs, group boxes nested with cyan
  titles, fields on control, consoles and the spot list nested, canon
  check boxes. Connect / Start are the filled cyan primary; a checked
  toggle keeps the green fill (toggle success tokens).
- Per-widget field, console, table, tab and toggle sheets are gone in
  favor of that sheet; the remaining hex literals (swatch borders, label
  colors) are tokens.

Docs: the SpotHub page describes the window; docs/style lists SpotHub
among the canon windows and its scope.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@ten9876
ten9876 requested a review from a team as a code owner October 12, 2026 02:01
@ten9876 ten9876 self-assigned this Oct 12, 2026

@ten9876 ten9876 left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed head 78052c6e85e0d3d4c6deb6165c4fb3d4dac26a96. Approve with nits; no blockers. This implements the stated SpotHub canon migration under RFC #6226 and rollout #6239: workspace chrome, scoped palette, old geometry-key reuse, consolidated control styling and matching user documentation. No closing bug issue is linked, so this review evaluates the migration against its stated requirements. The maintainer-authored body explicitly chooses green checked toggles; that disclosed design decision is preserved.

Scope

File/group Change Claimed? Verdict
src/gui/DxClusterDialog.{h,cpp} CanonWindow workspace, header/resizer, same geometry key, disclosed size increases, canon sheet and primary-button properties Yes In scope
src/gui/MainWindow_Menus.cpp Direct lazy construction with QPointer and WA_DeleteOnClose; retain per-open FreeDV refresh and fresh-instance wiring Yes In scope
docs/style/{aethersdr-style-guide,dialog-patterns,theme-style-guide}.md Register SpotHub and its canon scope/workspace/persistence exceptions Yes In scope
docs/user/docs/spothub.md Document moving, resizing, closing, taskbar behavior and Frameless Window exception Yes In scope

Everything in the diff is explained by the migration. One signed commit, authored October 12 UTC, with no unrelated commits, engine/protocol changes, new settings keys, dependency changes, base-token edits or CHANGELOG entry. GitHub verifies the signature. The screenshot staleness is explicitly disclosed in the body.

Blockers

None.

Nits — non-blocking

  1. Two FreeDV fields still override the common canon field chrome. src/gui/DxClusterDialog.cpp:2375 and :2409: callsign and grid retain complete local QLineEdit sheets. Those take precedence over the body sheet, leaving raised-ground rectangular fields beside the rounded control-ground Station Msg field and overriding the common focus-border treatment. This is visible in the review-owned FreeDV grab. Keep their read-only text treatment while allowing the body sheet to own the field chrome:
    AetherSDR::ThemeManager::instance().applyStyleSheet(m_fdvCallsignEdit,
        "QLineEdit[readOnly=\"true\"] { color: {{color.text.label}}; }");

Use the corresponding replacement for the grid field:

    AetherSDR::ThemeManager::instance().applyStyleSheet(m_fdvGridEdit,
        "QLineEdit[readOnly=\"true\"] { color: {{color.text.label}}; }");
  1. Window integration coverage remains manual. src/gui/MainWindow_Menus.cpp:626 / src/gui/DxClusterDialog.cpp:561: the existing socket-free canon_window_test covers generic workspace keyboard, movement and persistence behavior, but no durable test constructs SpotHub through its menu and verifies repeated opening plus the old geometry key. The PR honestly discloses this, and independent bridge checks below passed. A focused, socket-free window-lifecycle test would preserve those guarantees; this migration does not require a synthetic feed peer.

Verification and attacks that held

  • Built AetherSDR at the exact head on Linux/Qt 6.12 in a scratch checkout, using shared core and -O2 -g1 -DNDEBUG. Built and ran the existing socket-free canon_window_test at the same head: 1/1 passed, including platform Close/Escape, hide-time persistence, workspace Return/Enter semantics and canon controls. No test is added or modified by this PR, so there is no new regression test to mutate.
  • Drove only the isolated offscreen instance pr-6401-head, explicit socket /tmp/aethersdr-pr6401-head, private settings and TX disabled. Connected exclusively to DEMO-0001; the bridge returned "model":"AetherSDR Demo", "serial":"DEMO-0001", "transmitting":false. Existing operator/author instances were left untouched, and the review instance is now closed.
  • Invoked Settings → SpotHub… twice: exactly one SpotHub window, initially {"h":680,"w":760,"x":360,"y":60}. Selected and grabbed all ten tabs, including FreeDV, Spot List and Display. Canon header/close button, selected cyan tab, source primaries, checkbox indicators and checked green toggles rendered; Freeze fit its button. Ground dragging moved the window. Resized to 900×760, closed and reopened it, then restarted the process: the geometry restored as {"h":760,"w":900,"x":445,"y":80} and the persisted old key contained 445,80,900,760. A separate restart seeded with Qt's legacy base64 geometry restored {"h":720,"w":850,"x":200,"y":180}.
  • Source audits checked deferred log callbacks/timers during teardown, source connection/default preservation, fresh-instance signal wiring, scoped QSS precedence, disabled/selected states and theme indicator refresh. The engine-boundary check has 0 strict blockers; touchpoint manifest, capability records, command plane, a11y, generated reference and screenshot embedding checks pass. The color ratchet reproduces −43 references / −40 stylesheet calls against the parent.

Limits: no live radio or spot traffic; native taskbar/compositor behavior, physical edge resizing and macOS/Windows GUI appearance were not exercised. The bridge cannot reach FramelessResizer's native-window event filter, so its edge-drag result was not counted as a resize test. The resizer installation and workspace flags were inspected. The optional code-review skill is unavailable; equivalent manual and parallel source audits were performed. Local captures/logs are under /tmp/pr6401-runtime/head/; the existing user screenshot remains the disclosed follow-up.

All required checks (build, check-windows, check-macos, Static checks) and docs CI passed at this head. Earliest head run creation was 2026-10-12T02:01:35Z; current main 82077256 was committed 2026-10-12T01:12:06Z, so these checks have no newer-main freshness gap at review time. Recommendation: approve with the two non-blocking nits; formal approval remains the operator/CODEOWNER's decision.

@ten9876 ten9876 removed their assignment Oct 12, 2026
@ten9876
ten9876 merged commit 40baf73 into main Oct 12, 2026
10 checks passed
@ten9876
ten9876 deleted the feat/spothub-canon-window branch October 12, 2026 02:22

@aethersdr-agent aethersdr-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issue fit

Yes. The PR tracks #6239 ("Part of #6239"), which has no SpotHub-specific child issue, so I reviewed against the tracking issue's rulings plus the PR's own stated intent. Every bullet in the commit message maps to a hunk and each one holds up: DxClusterDialog now derives CanonWindow with Kind::Workspace (src/gui/DxClusterDialog.h:84, src/gui/DxClusterDialog.cpp:546), geometry persists under the old key (:561), FramelessResizer::install(this) matches NetworkDiagnosticsDialog.cpp:340 and PskReporterMapDialog.cpp:469 exactly, and MainWindow creates it directly instead of through showOrRaisePersistent() so View → Frameless Window no longer reaches it (src/gui/MainWindow_Menus.cpp:626-640). The three style docs and the user page are updated consistently; I found no doc left describing SpotHub as a persistent/frameless-title-bar window.

One bookkeeping gap: #6239 says "Each item below is its own issue and its own PR" and "Items under Candidates are not approved scope until the maintainer picks them." SpotHub is not in the Picked list — the nearest entry is Candidates → Persistent tool dialogs, which is scoped to a base-token→color.canon.* migration, not a CanonWindow conversion, and docs/style/dialog-patterns.md:275 still reads "Use CanonWindow only for … the tool windows the maintainer has moved to it." Since the author is the maintainer (GOVERNANCE.md:82, @ten9876), this PR is the pick, so it is not a governance blocker — but please add the SpotHub row to #6239's Picked list so the tracking issue and the style docs don't disagree.

Scope

File / group What it changes Claimed by the body? Verdict
src/gui/DxClusterDialog.{h,cpp} PersistentDialog → CanonWindow workspace; one kSpotHubStyle sheet replaces ~30 per-widget sheets; remaining hexes → color.canon.* tokens Yes In scope
src/gui/MainWindow_Menus.cpp:621-648 Direct construction + WA_DeleteOnClose in place of showOrRaisePersistent() Yes ("MainWindow creates it directly") In scope
docs/style/{aethersdr-style-guide,dialog-patterns,theme-style-guide}.md SpotHub added to the canon-window, geometry-opt-in, Workspace-kind and canon/spotHub scope lists Yes ("docs/style lists SpotHub") In scope
docs/user/docs/spothub.md:27 New paragraph describing the chrome Yes In scope — wording matches the AetherGPS/AetherMap paragraphs verbatim

Nothing in the diff is unexplained: no CI/build/vendored churn, no new settings key (the geometry key is reused), no new public or protocol surface, no CHANGELOG.md entry. Removals are all stylesheet strings — I read every - line and the only deleted comments were the kSpotHubToggle block comment and the "green checked / red unchecked" note on the Display-tab toggles (which was already wrong: kSpotHubToggle had no red state). No guard, early return or confirmation was removed. No sibling implementation is left behind — SpotHub was the only DxClusterDialog surface, and grep finds no other reference to it outside MainWindow_Menus.cpp and a stale-comment mention in src/core/ThemeManager.cpp:1544.

Security audit (security-audit (CodeGuard)): no findings in this change. The canon sheet is a static constexpr literal, applyCanonSheet(bodyWidget(), …) (:570) takes no runtime data, and every dynamic sheet interpolates only QColor::name() (a normalised #rrggbb), so the hex→token rewrite opened no stylesheet-injection path. The CodeGuard list is not PR-scoped — 19 files were scanned against 7 changed, and MainWindow.cpp, RadioModel.*, tools/check_command_plane.py and the tests/ files are not in this diff; their CS-VLN-CMDI-*/CS-PII-IP/CS-INJ-* hits are the known lexical false positives (C++ &&/||, Markdown backticks in // comments, 224.0.0.1 as the WSJT-X multicast default at DxClusterDialog.cpp:1450-1451, box-drawing rules read as homoglyphs). The audit did raise one pre-existing, out-of-diff item for a separate issue: src/gui/RadioSetupDialog.cpp:2080,2119 writes the MCP bridge token to the clipboard on bridge-enable and on Rotate, not only from the Copy handler.

Blockers

None.

Nits (all non-blocking)

  • src/gui/DxClusterDialog.cpp:353-355 — the sheet has no QMenu background, so built-in context menus inherit background: transparent. The sheet opens with
    QWidget {
        color: {{color.canon.inkSoft}};
        background: transparent;
    }
    
    which cascades to every descendant of bodyWidget(). The window's own QMenu (:2620, ScopedChildWidget<QMenu> menuOwner(this)) is parented to this, so it escapes — but Qt's standard context menus for QLineEdit and QPlainTextEdit are created with the widget as parent, so right-clicking a console or any field lands a menu inside the sheeted subtree whose only matching background declaration is transparent (and a widget-chain sheet outruns the app stylesheet that normally makes menus opaque). The sheet this one cites as its model guards exactly this, src/gui/PskReporterMapDialog.cpp:208-211:
    QMenu,
    QComboBoxPrivateContainer {
        background: {{color.canon.raised}};
    }
    
    Reasoned from code, not reproduced — I cannot run the GUI. Drop-in, after the QLabel rule:
    QMenu,
    QComboBoxPrivateContainer {
        background: {{color.canon.raised}};
    }
    
  • src/gui/DxClusterDialog.cpp:2375 and :2409 — two fields keep base-token sheets, against the body's "Per-widget field, console, table, tab and toggle sheets are gone in favor of that sheet":
        AetherSDR::ThemeManager::instance().applyStyleSheet(m_fdvCallsignEdit, "QLineEdit { background: {{color.background.0}}; color: {{color.text.primary}}; border: 1px solid {{color.background.1}}; padding: 3px; }"
            "QLineEdit[readOnly=\"true\"] { color: {{color.text.label}}; }");
    They survive because they carry a read-only dimming rule the canon sheet lacks, so the FreeDV callsign and grid fields will read square-cornered and a different shade from every other field in the window. Add the state to kSpotHubStyle and delete both calls:
    QLineEdit[readOnly="true"] {
        color: {{color.canon.muted}};
    }
    
  • src/gui/DxClusterDialog.cpp:433-461 — the sheet's four QComboBox rule blocks are dead: SpotHub creates no combo box (grep QComboBox matches only the sheet). Harmless, but it also means the missing QComboBox::drop-down rule that NetworkDiagnosticsDialog.cpp:196 carries costs nothing here.
  • src/gui/DxClusterDialog.cpp:3075 — dxccTitle now mixes vocabularies: color: {{color.canon.cyan}} with border-top: 1px solid {{color.background.2}}. {{color.canon.line}} would finish the conversion.
  • src/gui/DxClusterDialog.cpp:1923 — the EiBi server label is still {{color.text.label}} while the POTA (:1774) and FreeDV (:2256) server labels moved to {{color.canon.muted}}.
  • No test accompanies the change. Correctly so, in my reading: this is window chrome and a stylesheet, with no deterministic socket-free seam, and tests/canon_window_test.cpp has no adoptee inventory that needs a row. Naming it so "no test" and "didn't check" don't look alike.

What I tried to break

  • Dangling pointer on the new WA_DeleteOnClose path. MainWindow_Menus.cpp:635 sets it on a hand-built dialog, but m_spotHubDialog is a QPointer<DxClusterDialog> (MainWindow.h:1666), the wasFresh guard re-reads it, and the whole re-wiring block is gated on wasFresh — so a destroyed window recreates and reconnects cleanly. This is also not new: showOrRaisePersistent() (MainWindow.h:2263-2270) already set WA_DeleteOnClose, and PersistentDialog::closeEvent() accepts the event, so close already destroyed the old dialog. No service dies with the window either — every spot client lives on MainWindow, unlike AetherModem's KISS server (MainWindow_DigitalModes.cpp:217-224), which is why that one deliberately avoids the attribute.
  • Geometry migration — the body's "saved geometry carries over" claim. PersistentDialog saved a base64 saveGeometry() blob; CanonWindow saves "x,y,w,h". CanonWindow::restoreGeometryFromSettings() (src/gui/CanonWindow.cpp:152-182) falls through to restoreGeometry(QByteArray::fromBase64(...)) when the value is not four comma-separated ints, so an existing DxClusterDialogGeometry is read once and rewritten on the next save. A window saved at the old 560-tall floor comes back clamped by expandedTo(minimumSize()) to the new 600. The claim holds. Both close paths flush: ✕ → close() and Esc/Ctrl+W → reject() both hide, and CanonWindow::hideEvent() saves and calls AppSettings::save().
  • Every token the sheet names. All 12 color.canon.* keys plus color.toggle.success.{background,border}.checked exist in both resources/themes/default-dark.json and default-light.json (and in ThemeSeedGenerated.cpp:82-96, 213-214); color.toggle.success.border.checked has precedent at GreenHeronApplet.cpp:62. canon/spotHub is not a defined scope in either theme — but neither are canon/aetherMap (PskReporterMapDialog.cpp:464) or canon/aetherGps (GpsLocationDialog.cpp:329), so resolution falls back to the canon scope, which is exactly what the comment at :556-558 relies on for the tabs' remaining color.text.*/color.accent sheets.
  • Contrast, dark theme, computed from the resolved values — all twelve pairs the sheet creates clear docs/a11y.md's 4.5:1: checked toggle ink on #006040 6.77, primary onAccent on cyan 12.71 (hover on aqua 15.18), cyan on control 10.47, unselected tab muted on raised 6.39, selected tab 12.43, console inkSoft on nested 11.61, disabled primary muted on control 5.39, field ink on control 14.01, table 15.50. I ran dark only; #6239 records the light canon values as AI-generated and not human-managed, with dark as the canon priority.
  • What the window loses by leaving the tracked list. m_persistentDialogs drives nothing but setFramelessMode() propagation (MainWindow.cpp:10305-10314) — no close-all, no shutdown flush — so dropping out of it costs only the thing the PR intends to drop, and matches AetherMap/AetherGPS.
  • Double-install and shortcut collisions. CanonWindow's constructor does not install FramelessResizer (so the explicit install at :569 is required, not doubled), and SpotHub declares no QShortcut/QKeySequence of its own, so CanonWindow's QKeySequence::Close collides with nothing. In Kind::Workspace, Return no longer auto-clicks the first button, which the cluster/RBN command line edits want.
  • CI: all 10 checks green on 78052c6, including check-windows (the -DENABLE_ASR=OFF lane), check-macos, build, Static checks and Build docs site. I also ran tools/audit_colours.py and tools/check_a11y.py against the head checkout: neither reports anything in DxClusterDialog.cpp.

Everything above is reasoned from the head checkout at the PR's commit; I have no build and cannot drive the GUI, so no claim here was reproduced at runtime.

Recommendation

Approve with nits. The conversion follows the AetherMap/AetherGPS pattern down to the line, the geometry-migration and token claims both check out, and the net effect is ~250 lines of per-widget stylesheet replaced by one sheet. The QMenu background omission is the one thing I'd fix before merge — it's two lines and the sibling sheet shows the exact shape — and folding the two FreeDV field sheets in would finish what the body claims. Next step: add the QMenu/QComboBoxPrivateContainer and QLineEdit[readOnly="true"] rules, then tick SpotHub into #6239's Picked list. Thanks for keeping the user-doc paragraph consistent with the other canon windows.


🤖 aethersdr-agent · cost: $15.9456 · model: claude-opus-5

@aethersdr-agent

Copy link
Copy Markdown
Contributor

Cisco CodeGuard — static analysis of this PR (235 finding(s))

  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in docs/architecture/aetherd-touchpoint-tags.json /tmp/aetherclaude/pr-6401/docs/architecture/aetherd-touchpoint-tags.json:10
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in docs/architecture/aetherd-touchpoint-tags.json /tmp/aetherclaude/pr-6401/docs/architecture/aetherd-touchpoint-tags.json:1151
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/core/backends/hl2/Hl2Discovery.h /tmp/aetherclaude/pr-6401/src/core/backends/hl2/Hl2Discovery.h:34
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/core/backends/hl2/Hl2Discovery.h /tmp/aetherclaude/pr-6401/src/core/backends/hl2/Hl2Discovery.h:37
  • [LOW] CS-PII-IP — PII detected: ip_address in src/gui/DxClusterDialog.cpp /tmp/aetherclaude/pr-6401/src/gui/DxClusterDialog.cpp:1450
  • [LOW] CS-PII-IP — PII detected: ip_address in src/gui/DxClusterDialog.cpp /tmp/aetherclaude/pr-6401/src/gui/DxClusterDialog.cpp:1451
  • [LOW] CS-PII-IP — PII detected: ip_address in src/gui/DxClusterDialog.cpp /tmp/aetherclaude/pr-6401/src/gui/DxClusterDialog.cpp:1451
  • [LOW] CS-PII-IP — PII detected: ip_address in src/gui/DxClusterDialog.cpp /tmp/aetherclaude/pr-6401/src/gui/DxClusterDialog.cpp:1494
  • [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:9770
  • [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:9882
  • [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:10004
  • [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:10005
  • [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:10006
  • [HIGH] CS-VLN-PATH-PROC — Vulnerability: CS-VLN-PATH-PROC in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:6294
  • [HIGH] CS-VLN-PATH-PROC — Vulnerability: CS-VLN-PATH-PROC in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:6373
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:527
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:568
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:571
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:593
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:602
  • [CRITICAL] CS-VLN-CMDI-AMP — Vulnerability: CS-VLN-CMDI-AMP in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:3673
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:600
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:1293
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:1817
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:1909
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:1986
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:2028
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:2063
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:2358
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:3615
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:3706
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:6236
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:8106
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:8180
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:8265
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:8446
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:8649
  • [CRITICAL] CS-VLN-CMDI-BACKTICK — Vulnerability: CS-VLN-CMDI-BACKTICK in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:9871
  • [LOW] CS-PII-IP — PII detected: ip_address in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:6986
  • [CRITICAL] CS-INJ-role_override — Prompt injection: role override attempt in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-6401/src/gui/MainWindow.cpp:11822

Automated static scan by Cisco DefenseClaw CodeGuard on the changed files. Advisory — some may be false positives; the review above verifies them.


🤖 aethersdr-agent · cost: $16.0983 · model: claude-opus-5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant