feat: Add terminal profile support for tmux session management#8
feat: Add terminal profile support for tmux session management#8jellydn wants to merge 10 commits into
Conversation
…velopment, testing, and error handling
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @jellydn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the AI review workflow by introducing support for running AI review commands within Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
jellydn
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new 'terminal profile' feature, allowing AI review commands to be executed within a tmux session for better management. A high-severity command injection vulnerability has been identified in the new terminalProfile.ts module, where the function for building the tmux command does not properly escape all its inputs, creating a risk of arbitrary code execution. Additionally, there's an opportunity for refactoring to improve the consistency of string sanitization for tmux names.
| export function buildTmuxCommand(sessionName: string, windowName: string, command: string): string { | ||
| const escapedCommand = command.replace(/'/g, `'\\''`) | ||
| return `tmux new-session -A -s ${sessionName} -n ${windowName} -d && tmux send-keys -t ${sessionName}:${windowName} '${escapedCommand}' Enter && tmux attach -t ${sessionName}` | ||
| } |
There was a problem hiding this comment.
The buildTmuxCommand function is vulnerable to command injection. It constructs a shell command by directly interpolating the sessionName and windowName parameters into the command string without proper shell escaping. While the calling code in src/commands.ts currently provides sanitized input, the function itself is inherently insecure. If this utility function is reused in the future with unsanitized input (e.g., a raw user-provided string), it could allow an attacker to execute arbitrary commands. For example, a sessionName like foo; reboot would result in the reboot command being executed. To ensure security, utility functions should be robust and not rely on the caller for sanitization.
export function buildTmuxCommand(sessionName: string, windowName: string, command: string): string {
const escapedCommand = command.replace(/'/g, `'\''`);
// To prevent command injection, arguments to shell commands must be escaped.
const safeSessionName = sessionName.replace(/'/g, `'\''`);
const safeWindowName = windowName.replace(/'/g, `'\''`);
return `tmux new-session -A -s '${safeSessionName}' -n '${safeWindowName}' -d && tmux send-keys -t ${safeSessionName}:${safeWindowName} '${escapedCommand}' Enter && tmux attach -t '${safeSessionName}'`;
}| if (terminalProfile === 'tmux') { | ||
| const workspaceName = workspace.workspaceFolders?.[0]?.name ?? 'workspace' | ||
| const sessionName = getSessionName(workspaceName) | ||
| const windowName = `${templateName ?? 'review'}-${aiTool ?? 'ai'}`.toLowerCase().replace(/[^a-z0-9-]/g, '-') |
There was a problem hiding this comment.
The sanitization logic for windowName is inconsistent with the more robust logic used for sessionName in getSessionName (in src/terminalProfile.ts). This could result in poorly formatted tmux window names, for example with multiple or trailing hyphens.
To improve consistency and code reuse, I recommend extracting the sanitization logic into a new exported utility function in src/terminalProfile.ts and using it for both the session name and the window name.
Recommendation:
- In
src/terminalProfile.ts, create a new exported function likesanitizeForTmuxwith the logic fromgetSessionName. - Update
getSessionNameto use this new function. - In this file (
src/commands.ts), importsanitizeForTmuxand use it to sanitize thewindowName.
For example, this line could be changed to:
const windowName = sanitizeForTmux(`${templateName ?? 'review'}-${aiTool ?? 'ai'}`);1 participant
What
Add terminal profile support for running AI reviews within terminal multiplexers (tmux). Users can now configure their preferred terminal session manager, and all AI reviews will run within grouped sessions per workspace.
Why
Running AI reviews in individual VSCode terminals makes it difficult to manage multiple concurrent reviews. Terminal multiplexers like tmux provide:
How
seal-code.terminalProfileconfig setting (default|tmux)terminalProfile.tsmodule with session/window managementUser Stories Completed
Test Plan