fix(cloud): review round 2 — bounded output, degraded-identity reporting, absolute binary, doc/field cleanup

[sourcehawk]

Description

Towards #44

Addresses a round of verified Copilot review findings on the read-only cloud-context MCP. Six independent fixes: the harness no longer risks unbounded memory on a large CLI response, a degraded session now names which pinned identity is broken, the provider CLI is pinned to an absolute path so a later PATH change cannot redirect it, and the output-result doc and an unused field are corrected to match what the code actually does. One commit per finding.

Changes

• Bound the harness output during the run. execCLI captured stdout/stderr through bytes.Buffer and truncated only after the process returned, so a very large response could buffer in full before being capped. It now captures through a limitedWriter that retains at most limit bytes each and flags overflow, so the cap is effective while the process runs. All existing guarantees hold: no shell, explicit minimal env, closed stdin, Truncated on overflow, stderr captured and capped, non-zero exit as a normal CLIResult, real start/exec failure as a Go error.
• Report the pinned identity on a degraded probe. cloud.Probe fell back to an empty AssumedIdentity when the provider could not resolve one, so session_status could not say which pinned credential was degraded. It now falls back to the expected identity.
• Keep the pinned identity when provider construction fails. ProbeSource returned a construction-error status (missing gcloud/aws) without the identity, so preflight and connections reported a degraded source with no identity to fix. It now carries src.AssumedIdentity through.
• Resolve the provider CLI to an absolute path. exec.LookPath returns a relative path (flagged with exec.ErrDot) when PATH has relative entries. Both providers' New() now pass the result through filepath.Abs, so a later subprocess env/PATH change cannot reinterpret the binary.
• Correct the CLIResult doc. It claimed output was shaped/redacted; run_cli returns the raw CLI stdout/stderr, only truncated. The doc now says so.
• Drop the unused Command.Redact field. It was advertised in the allowlist schema and documented as marking output for secret-scrubbing, but nothing read it before returning run_cli output. No shipped default_commands.json sets it.

Testing

make test-go is green and race-clean across the whole module; make lint reports 0 issues. Each fix landed test-first: a shell-free large-output cap assertion for the harness, degraded- and valid-path identity-fallback assertions for cloud.Probe, a construction-failure identity assertion for ProbeSource, and an absolute-path assertion under a relative PATH for both providers. No frontend/ changes.

🤖 Generated with Claude Code