fix: harden PR #310 — log chown errors, path validation, Trivy precision by bussyjd · Pull Request #311 · ObolNetwork/obol-stack

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd · 2026-04-07T05:43:35Z

Summary

Post-merge review of #310 + logging uniformity cleanup.

Commit 1: Harden PR #310

Silent chown failures (medium): fixVolumeOwnership() swallowed errors with _ = cmd.Run(). Now uses u.Warnf through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership), uniform with the rest of the codebase.
Path traversal guard (low): filepath.Rel could produce ../ paths if hostPath isn't under DataDir. Now rejects explicitly.
Trivy scan precision (low): Security scan used :latest tag instead of exact build SHA. Now uses ${{ github.sha }} tag.
Broken CI outputs (low): Matrix outputs both pointed at the same step. Removed (unused downstream).
Ollama restart warning (low): Only restarts if already active, warns before doing so.

Commit 2: Migrate fmt.Print* → ui.UI

Routes all CLI output through the ui.UI layer instead of raw fmt calls. This closes the Phase 1C gap documented in docs/plans/cli-agent-readiness.md — ensures all output respects --verbose, --quiet, and future --output json mode.

sell.go: 77 calls migrated
network.go: 28 calls migrated
model.go: 17 calls migrated

Zero fmt.Print* output calls remain in CLI commands.

Related: #312 (future slog introduction for operational logging)

Test plan

go build ./... passes
go test ./cmd/obol/ passes
go test ./internal/openclaw/ passes
CI validates workflow syntax

… Trivy precision Address review findings from #310 merge: - fixVolumeOwnership: thread *ui.UI through the full call chain (ensureWallet → GenerateWallet → provisionKeystoreToVolume → fixVolumeOwnership) so chown failures surface via u.Warnf, uniform with the rest of the codebase (zero log.Printf in openclaw package) - fixVolumeOwnership: reject paths outside DataDir (../ traversal guard) to prevent docker exec targeting unexpected node paths - docker-publish-x402: remove broken matrix outputs (both pointed to last-finishing job), scan by SHA tag instead of :latest for deterministic Trivy results matching the exact build - obolup.sh: warn before restarting Ollama service, only restart if already active to avoid disrupting running inference

Route all CLI output through the ui.UI layer instead of raw fmt calls. This ensures all output respects --verbose, --quiet, and future --output json mode (Phase 1C of cli-agent-readiness plan). - sell.go: 77 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - network.go: 28 fmt.Print* calls → u.Infof/Warnf/Successf/Printf - model.go: 17 fmt.Print* calls → u.Infof/Warnf/Successf/Printf Thread u *ui.UI into standalone helpers that previously used fmt directly: removePricingRoute, runInferenceGateway, registerSponsored, registerDirectViaSigner, registerDirectWithKey.

bussyjd force-pushed the fix/pr310-review-fixes branch from 2b8b245 to 71f140fCompare April 7, 2026 05:50

bussyjd force-pushed the fix/pr310-review-fixes branch from 71f140f to 3ada2abCompare April 7, 2026 05:59

bussyjd requested a review from OisinKyne April 7, 2026 06:23

OisinKyne approved these changes Apr 7, 2026
View reviewed changes

OisinKyne merged commit 792abf4 into mainApr 7, 2026
6 checks passed

OisinKyne deleted the fix/pr310-review-fixes branch April 7, 2026 13:40

This was referenced Apr 7, 2026
Replace fmt output with UI abstraction layer throughout codebase #314
Closed
Wallet and RPC integration and e2e tests #216
Closed