[Desperado]

Long or compacted conversations can bury a rejected approach even when the shared transcript retains its evidence. Add /handoff reject <approach> | <evidence> to keep an explicit user decision visible to the next backend. For example, a note that increasing the reconnect timeout failed at both 5s and 60s accompanies the next turn after switching providers.

The checkpoint is included in every CLI handoff, including native resumes with no missing transcript entries, and in built-in provider system prompts. It survives compaction and session save/resume. /handoff lists entries; /handoff forget <number> removes a rejection, and /clear resets the checkpoint. Removed notes remain superseded by the current list.

Security: notes use existing retained-transcript redaction, are capped at 12 KiB, and are identified as user-supplied data. Input recall keeps only /handoff, avoiding retention of raw pasted evidence. Notes make no additional model request and do not inspect credentials or provider-private state.

This first version requires explicit user decisions. Failures are not automatically classified, and model compliance is not enforced. docs/HANDOFF.md describes a controlled live backend comparison; that evaluation has not yet been run.

Validation:

• Regression coverage for failed turns, compaction, save/restart, native resume, local/connected prompts, note validation/removal, redaction, and input recall.
• Full coverage-enabled suite: go test -coverprofile=<local-file> -covermode=atomic ./...
• Offline evaluation fixture: go run ./eval/handoff selfcheck (baseline and timeout-only workaround fail; reference fix passes visible and hidden checks).
• go vet ./...
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run
• Release-style build with -ldflags='-s -w -X main.Version=dev' (artifact under .context).
• Diff review and secret scan: no outstanding findings.

Refreshed against main and fixed module imports. The controlled live backend comparison remains pending; this PR stays draft.

QualityMax follow-up: close the evaluation output reader when mirroring fails, so a closed stdout pipe cannot block a long backend turn. Defer restoration of stdout and the working directory and cleanup of the timeout watcher/timer if a backend panics. Regression tests cover both failures and pass with the race detector. The harness executes runs serially; its stdout capture is limited to the standalone evaluation process. Diff artifacts contain the generated fixture repository, not a user's working repository.

Remaining advisory candidates were checked: future parallel execution is outside this serial harness, and --out deliberately selects the user's artifact directory. Run paths beneath it use validated backend/arm enums and nonnegative integer padding/repeat values; the live plan requires --yes. No untrusted path segment was found in the reported deletion path.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: model judgment; findings have not been reproduced

Re-review: Open the QualityMax check and select Re-review after it completes.

Files eligible: 18 · Files reviewed: 18 · Files with findings: 1 · Findings: 2 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 18, reviewed 18 · MODEL-ONLY findings are advisory · batches reviewed 4 of 4 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 30, reviewed 30 · hybrid · served qwen3.7-plus
Overall review evidence	non-blocking findings remain
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Advisory MODEL-ONLY candidates (2)

These model judgments do not block this PR and are not posted inline. Check reachable callers and existing protections, and reproduce a concrete failure before treating a candidate as a defect. A second model's confirmation or a model-reviewed patch does not reproduce a failure.

location	candidate	served model
eval/handoff/run.go:256	The `run` command accepts an `--out` flag that is used to construct paths for `os.RemoveAll` and `os.WriteFile` without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory.	gemini-3.1-flash-lite
eval/handoff/run.go:295	The `teeStdout` function and `runOne` method mutate global process state (`os.Stdout` and `os.Chdir`). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future.	gemini-3.1-flash-lite

Change diagram — Flow

flowchart TD
    subgraph "handoff-eval"
        A[main] --> B{Command}
        B -->|selfcheck| C[selfCheck]
        B -->|run| D[runCommand]
        B -->|summarize| E[summarizeCommand]
        C --> F[newRepo]
        C --> G[goTest]
        C --> H[setTimeout]
        C --> I[scoreRepo]
        D --> J[plan]
        D --> K[runOne]
        K --> L[fakeBackend]
        L --> M[Run]
    end

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: GROUNDED deterministic scanner evidence · MODEL-ONLY advisory model judgment · MODEL-REVIEWED patch model judgment, not reproduction.

QualityMax project results are available in the configured project.

_{Receipt · commit 6c2ea0160cce98a584302b2105999eb8f9a0c117 · run 2026-10-17T10:39:49+00:00 · model served gemini-3.1-flash-lite · model requested gemini-3.1-flash-lite · model review recorded — 18767 model output tokens · model source not recorded · re-review 2 · proof counts {'MODEL-ONLY': 2}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	⚠️ Unavailable — no completed model review · unavailable · 18 eligible / 15 reviewed · Diff analysis incomplete after 3 of 4 bounded review batches: batch 1 returned malformed review evidence after bounded retry. The evaluation tool in eval/handoff/run.go performs manual resource management for global state (stdout redirection and working directory) without using defer. If an error or panic occurs during execution, the process may be left with a corrupted stdout stream and an incorrect working directory, leading to resource leaks and potential failures in subsequent operations. The PR introduces a robust handoff mechanism for tracking rejected approaches, including proper state management, input validation, and redaction of sensitive data. The implementation correctly handles persistence, history compaction, and backend switching, with comprehensive test coverage for both the agent logic and the REPL command interface. The PR introduces a new /handoff command and associated logic to track backend switches and manage rejected approaches. The implementation correctly integrates with the existing REPL loop, command handling, and input redaction mechanisms, with appropriate updates to help text and test coverage.
🔍 SAST	completed · 30 eligible / 30 reviewed · claude-haiku-4-5-20251001
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5557394607 and overview #6002650534 confirmed
🧪 Repo Tests	✅ 1506/1506 passed (go)
🤖 AI Tests	⚠️ 51/56 passed

_{Powered by QualityMax — AI-Powered Test Automation}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

Completed 4 bounded review batches covering the full eligible diff. The PR introduces a robust evaluation harness for testing coding agents, including a fixture-based repository setup, timeout monitoring, and scoring logic. The implementation correctly uses temporary directories for isolation, includes comprehensive tests for the evaluation logic, and properly handles CLI arguments and MCP server mode. The evaluation runner introduces a global state mutation by swapping os.Stdout to capture output, which is not thread-safe and can cause data corruption if concurrent operations occur. Additionally, the teeStdout implementation lacks robust error handling for the pipe and goroutine lifecycle, potentially leaking file descriptors or causing deadlocks if the process exits prematurely. The PR introduces a robust handoff mechanism for AI agents, allowing users to record and manage rejected approaches. The implementation includes proper validation, state management, and test coverage for edge cases like session restoration, credential redaction, and context window constraints. No actionable defects were identified. The PR introduces a new /handoff command and associated logic to track backend switches and redact sensitive evidence from history. The implementation correctly uses strings.Fields for command parsing, maintains consistency with existing command handling, and includes necessary updates to the TUI and tests.

🟡 Finding 1: logic

File: eval/handoff/run.go:445 | Severity: warning

What: The teeStdout function modifies the global os.Stdout variable. This is not thread-safe and affects the entire process, potentially causing interleaved or lost output if other parts of the application attempt to write to stdout concurrently.

Fix: Avoid global state mutation. Pass an io.Writer to functions that need to log output, or use a structured logging framework that supports multiple outputs without hijacking standard streams.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in eval/handoff/run.go at line 445: The 'teeStdout' function modifies the global 'os.Stdout' variable. This is not thread-safe and affects the entire process, potentially causing interleaved or lost output if other parts of the application attempt to write to stdout concurrently."

🟡 Finding 2: logic

File: eval/handoff/run.go:456 | Severity: warning

What: The teeStdout goroutine does not handle potential errors from io.Copy and relies on a channel close to signal completion. If io.Copy fails or hangs, the cleanup function will block indefinitely on <-done.

Fix: Add a timeout or context to the cleanup function and ensure the goroutine handles errors gracefully.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in eval/handoff/run.go at line 456: The 'teeStdout' goroutine does not handle potential errors from 'io.Copy' and relies on a channel close to signal completion. If 'io.Copy' fails or hangs, the cleanup function will block indefinitely on '<-done'."

🔵 Finding 3: security

File: eval/handoff/run.go:235 | Severity: info

What: The runOne function uses os.WriteFile with 0o600 permissions for handoff-prompt.txt and transcript.jsonl, which is appropriate, but diff.patch is written with 0o644. If the repository contains sensitive information, this might be overly permissive.

Fix: Restrict permissions on generated artifacts to 0o600 if they contain sensitive session data.

Fix with your LLM agent

<your-llm-agent> "Fix the security issue in eval/handoff/run.go at line 235: The 'runOne' function uses 'os.WriteFile' with '0o600' permissions for 'handoff-prompt.txt' and 'transcript.jsonl', which is appropriate, but 'diff.patch' is written with '0o644'. If the repository contains sensitive information, this might be overly permissive."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- logic in eval/handoff/run.go:445: The 'teeStdout' function modifies the global 'os.Stdout' variable. This is not thread-safe and affects the entire process, potentially causing interleaved or lost output if other parts of the application attempt to write to stdout concurrently.\n- logic in eval/handoff/run.go:456: The 'teeStdout' goroutine does not handle potential errors from 'io.Copy' and relies on a channel close to signal completion. If 'io.Copy' fails or hangs, the cleanup function will block indefinitely on '<-done'.\n- security in eval/handoff/run.go:235: The 'runOne' function uses 'os.WriteFile' with '0o600' permissions for 'handoff-prompt.txt' and 'transcript.jsonl', which is appropriate, but 'diff.patch' is written with '0o644'. If the repository contains sensitive information, this might be overly permissive."

Change diagram — Flow

graph TD
    A[main] -->|run| B[runCommand]
    B --> C[plan]
    C --> D[runOne]
    D --> E[agent.Run]
    E -->|modifies| F[Repository]
    F --> G[scoreRepo]
    G --> H[git diff]
    G --> I[go test]
    I --> J[Result]

Loading

---

💡 Skills that might have caught this earlier: sast-triage-qm. React 👍 on this comment if the review helped, 👎 if it missed something real or hallucinated. Or use qmax skill-feedback <skill> --good|--bad "<note>" for details. Feeds the skill-postmortem-qm review queue.

_{Analyzed commit ad63b2c6 with gemini-3.1-flash-lite (18 files, 62287 tokens) | Customize review preferences}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 66.45963% with 270 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
eval/handoff/run.go	53.58%	110 Missing and 26 partials ⚠️
eval/handoff/fixture.go	68.42%	21 Missing and 21 partials ⚠️
eval/handoff/summarize.go	71.71%	17 Missing and 11 partials ⚠️
eval/handoff/seed.go	52.17%	22 Missing ⚠️
eval/handoff/main.go	0.00%	21 Missing ⚠️
internal/agent/handoff.go	87.61%	8 Missing and 5 partials ⚠️
internal/repl/repl.go	76.92%	5 Missing and 1 partial ⚠️
internal/agent/conversation.go	92.59%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

Diff analysis incomplete after 3 of 4 bounded review batches: batch 1 returned malformed review evidence after bounded retry. The evaluation tool in eval/handoff/run.go performs manual resource management for global state (stdout redirection and working directory) without using defer. If an error or panic occurs during execution, the process may be left with a corrupted stdout stream and an incorrect working directory, leading to resource leaks and potential failures in subsequent operations. The PR introduces a robust handoff mechanism for tracking rejected approaches, including proper state management, input validation, and redaction of sensitive data. The implementation correctly handles persistence, history compaction, and backend switching, with comprehensive test coverage for both the agent logic and the REPL command interface. The PR introduces a new /handoff command and associated logic to track backend switches and manage rejected approaches. The implementation correctly integrates with the existing REPL loop, command handling, and input redaction mechanisms, with appropriate updates to help text and test coverage.

🟡 Finding 1: logic

File: eval/handoff/run.go:265 | Severity: warning

What: The runOne function manually manages os.Stdout redirection and os.Chdir without defer. If a.RunCLI or other operations panic or return early, the stdout pipe remains open (causing a goroutine leak) and the process working directory is not restored.

Fix: Use defer to ensure restoreStdout() and os.Chdir(previous) are called regardless of how the function exits.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in eval/handoff/run.go at line 265: The 'runOne' function manually manages 'os.Stdout' redirection and 'os.Chdir' without 'defer'. If 'a.RunCLI' or other operations panic or return early, the stdout pipe remains open (causing a goroutine leak) and the process working directory is not restored."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- logic in eval/handoff/run.go:265: The 'runOne' function manually manages 'os.Stdout' redirection and 'os.Chdir' without 'defer'. If 'a.RunCLI' or other operations panic or return early, the stdout pipe remains open (causing a goroutine leak) and the process working directory is not restored."

_{Analyzed commit c4525884 with gemini-3.1-flash-lite (15 files, 57215 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

Completed 4 bounded review batches covering the full eligible diff. The PR introduces a new evaluation tool for coding agents with robust test coverage, including self-checks and state-restoration tests. The implementation uses safe practices for subprocess execution, file system operations, and state management (e.g., using t.Cleanup and defer for cleanup). No actionable defects were identified. The evaluation tool uses user-controlled input for file system operations without validation, creating a path traversal risk. Additionally, the tool relies on global state mutation for stdout redirection and working directory changes, which is fragile and prevents future parallelization. The PR introduces a robust handoff mechanism for agent conversations, allowing users to record rejected approaches that persist across backend switches and session restarts. The implementation includes proper redaction of sensitive data, efficient binary search for message truncation, and clear UX for suggesting rejections. The code is well-tested, and the logic for state management and digest-based synchronization is sound. The PR introduces a new /handoff command for managing rejected approaches across backend switches, including appropriate redaction logic for sensitive evidence and integration into the REPL loop. The implementation correctly handles command parsing, state management, and history redaction, with comprehensive tests covering both valid and malformed inputs.

🟡 Finding 1: security

File: eval/handoff/run.go:256 | Severity: warning

What: The run command accepts an --out flag that is used to construct paths for os.RemoveAll and os.WriteFile without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory.

Fix: Validate that the output directory is within an expected base path or sanitize the path to prevent traversal (e.g., using filepath.Clean and checking for '..').

Fix with your LLM agent

<your-llm-agent> "Fix the security issue in eval/handoff/run.go at line 256: The 'run' command accepts an '--out' flag that is used to construct paths for 'os.RemoveAll' and 'os.WriteFile' without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory."

🟡 Finding 2: logic

File: eval/handoff/run.go:295 | Severity: warning

What: The teeStdout function and runOne method mutate global process state (os.Stdout and os.Chdir). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future.

Fix: Avoid global state mutation. For stdout, consider passing a logger or writer interface to the agent instead of swapping the global stdout. For directory changes, use a temporary directory and pass the path explicitly to functions that need it.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in eval/handoff/run.go at line 295: The 'teeStdout' function and 'runOne' method mutate global process state ('os.Stdout' and 'os.Chdir'). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- security in eval/handoff/run.go:256: The 'run' command accepts an '--out' flag that is used to construct paths for 'os.RemoveAll' and 'os.WriteFile' without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory.\n- logic in eval/handoff/run.go:295: The 'teeStdout' function and 'runOne' method mutate global process state ('os.Stdout' and 'os.Chdir'). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future."

Change diagram — Flow

flowchart TD
    subgraph "handoff-eval"
        A[main] --> B{Command}
        B -->|selfcheck| C[selfCheck]
        B -->|run| D[runCommand]
        B -->|summarize| E[summarizeCommand]
        C --> F[newRepo]
        C --> G[goTest]
        C --> H[setTimeout]
        C --> I[scoreRepo]
        D --> J[plan]
        D --> K[runOne]
        K --> L[fakeBackend]
        L --> M[Run]
    end

Loading

_{Analyzed commit 6c2ea016 with gemini-3.1-flash-lite (18 files, 65293 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

Completed 4 bounded review batches covering the full eligible diff. The PR introduces a new evaluation tool for coding agents with robust test coverage, including self-checks and state-restoration tests. The implementation uses safe practices for subprocess execution, file system operations, and state management (e.g., using t.Cleanup and defer for cleanup). No actionable defects were identified. The evaluation tool uses user-controlled input for file system operations without validation, creating a path traversal risk. Additionally, the tool relies on global state mutation for stdout redirection and working directory changes, which is fragile and prevents future parallelization. The PR introduces a robust handoff mechanism for agent conversations, allowing users to record rejected approaches that persist across backend switches and session restarts. The implementation includes proper redaction of sensitive data, efficient binary search for message truncation, and clear UX for suggesting rejections. The code is well-tested, and the logic for state management and digest-based synchronization is sound. The PR introduces a new /handoff command for managing rejected approaches across backend switches, including appropriate redaction logic for sensitive evidence and integration into the REPL loop. The implementation correctly handles command parsing, state management, and history redaction, with comprehensive tests covering both valid and malformed inputs.

🟡 Finding 1: security

File: eval/handoff/run.go:256 | Severity: warning

What: The run command accepts an --out flag that is used to construct paths for os.RemoveAll and os.WriteFile without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory.

Fix: Validate that the output directory is within an expected base path or sanitize the path to prevent traversal (e.g., using filepath.Clean and checking for '..').

Fix with your LLM agent

<your-llm-agent> "Fix the security issue in eval/handoff/run.go at line 256: The 'run' command accepts an '--out' flag that is used to construct paths for 'os.RemoveAll' and 'os.WriteFile' without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory."

🟡 Finding 2: logic

File: eval/handoff/run.go:295 | Severity: warning

What: The teeStdout function and runOne method mutate global process state (os.Stdout and os.Chdir). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future.

Fix: Avoid global state mutation. For stdout, consider passing a logger or writer interface to the agent instead of swapping the global stdout. For directory changes, use a temporary directory and pass the path explicitly to functions that need it.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in eval/handoff/run.go at line 295: The 'teeStdout' function and 'runOne' method mutate global process state ('os.Stdout' and 'os.Chdir'). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- security in eval/handoff/run.go:256: The 'run' command accepts an '--out' flag that is used to construct paths for 'os.RemoveAll' and 'os.WriteFile' without validation. An attacker or a misconfigured environment could cause arbitrary file deletion or writing outside the intended directory.\n- logic in eval/handoff/run.go:295: The 'teeStdout' function and 'runOne' method mutate global process state ('os.Stdout' and 'os.Chdir'). While currently sequential, this design is inherently non-thread-safe and prevents the tool from being parallelized in the future."

Change diagram — Flow

flowchart TD
    subgraph "handoff-eval"
        A[main] --> B{Command}
        B -->|selfcheck| C[selfCheck]
        B -->|run| D[runCommand]
        B -->|summarize| E[summarizeCommand]
        C --> F[newRepo]
        C --> G[goTest]
        C --> H[setTimeout]
        C --> I[scoreRepo]
        D --> J[plan]
        D --> K[runOne]
        K --> L[fakeBackend]
        L --> M[Run]
    end

Loading

_{Analyzed commit 6c2ea016 with gemini-3.1-flash-lite (18 files, 65293 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.