[jbeckwith-oai]

Summary

• Match Bash by discarding Fish completion stderr instead of appending diagnostics to a fixed shared temporary file.
• Preserve existing completion output, registration, command behavior, and other shell integrations.
• Add real-Fish regression coverage for successful completion, malformed endpoint diagnostics, preexisting diagnostic files, and attacker-precreated symlinks.

Validation

• go test ./internal/autocomplete -count=1 with an actual Fish executable available.
• go test -race ./internal/autocomplete -count=1.
• ./scripts/lint and go vet ./....
• ./scripts/test -skip '^TestFilesCreateCLICancelClosesStalledFIFO$', including Windows test cross-compilation.
• go test -race -parallel 1 ./... -skip '^TestFilesCreateCLICancelClosesStalledFIFO$' -count=1.
• Linux and Windows CLI builds; Fish, Bash, and Zsh syntax checks; Fish, Bash, Zsh, and PowerShell completion generation.
• Completed a full-coverage security diff scan with zero findings.

The skipped FIFO cancellation test fails independently in unchanged baseline code on this macOS worktree. Unrestricted repository-wide race testing also exposes preexisting parallel-test races in internal/requestflag; the entire race suite passes when test parallelism is serialized.

[Copilot]

Pull request overview

This PR updates Fish shell completion integration to avoid persisting stderr diagnostics to a shared temp file (aligning behavior with Bash) and adds regression tests to ensure diagnostics are discarded while completion output/registration remains intact.

Changes:

• Update the Fish completion script to redirect __complete stderr to /dev/null rather than appending to /tmp/fish-debug.log.
• Add unit coverage to assert the generated Fish script discards diagnostics and does not reference the old debug log path.
• Add integration-style coverage (when fish is available) to ensure completion output is preserved and stderr diagnostics (including secrets) do not surface.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/autocomplete/shellscripts/fish_autocomplete.fish	Discard __complete stderr via 2>/dev/null instead of writing to a shared temp log.
internal/autocomplete/autocomplete_test.go	Add Fish completion generation + real-Fish regression tests around stderr/diagnostic handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[HAYDEN-OAI]

Reviewed exact head 831d44e: no introduced P1/P2 security findings. Independently verified the actual Fish 4 and Bash completion entrypoints against the built CLI, including successful completions, malformed-endpoint diagnostics with synthetic credentials, output redirection and pipelines, attacker-precreated files and symlinks, permissions and umasks, FIFO blocking, and concurrent shell sessions. Fish now discards diagnostics through /dev/null like Bash, removing the predictable shared diagnostic-file attack surface.