fix: audit and remediate CLI reliability and security

[continued-agent]

Executive summary

Completed the CLI audit and the directly related Core/fetch audit on branch audit/cli-fixes, updating this existing PR. The audit found 18 confirmed issues: 0 CRITICAL, 11 MAJOR, and 7 MINOR. All safely fixable findings are applied in source code with regression coverage; no new public flag, output, or credential-storage format was introduced.

Issue counts by phase: Phase 0: 1; Phase 1: 6; Phase 2: 5; Phase 3: 2; Phase 4: 4; Phase 5: 0. Applied fixes: 18. Decision-required items: 3 policy/architecture items. Blocked checks: 2 environment-dependent lint/format commands.

Repository and CLI map

• Entry point and dispatch: extensions/cli/src/index.ts, Commander command modules under extensions/cli/src/commands/.
• TUI: Ink/React components under extensions/cli/src/ui/; standard/headless modes are selected in the index and command flow.
• Agent/streaming loop: extensions/cli/src/stream/streamChatResponse.ts and helpers; shared process/tool behavior also exists in core/.
• Providers/config: onboarding and config loading under extensions/cli/src/onboarding.ts and configLoader.ts; credentials stay in ~/.continue/.env and YAML references them.
• Tools: extensions/cli/src/tools/, including shell execution and permission checks.
• Terminal cleanup: CLI process-tree helper plus Core terminal state cancellation; serve shutdown handlers restore service state before exit.
• Coverage gaps: full interactive PTY signal/resize behavior across Windows/macOS/Linux, provider-selector terminal resize/cancel edge cases, and full subprocess-tree behavior on Windows remain limited by this Linux environment.

Issues table

ID	File:Line	Phase	Category	Severity	Reproduction scenario	Impact	Fix
CLI-001	extensions/cli/src/util/filePermissions.ts:8-13	1/3	Credential/session storage	MAJOR	Reuse an existing permissive ~/.continue file or directory	Other local users could read credentials, sessions, history, or logs	Applied: private directory/file modes and regression tests
CLI-002	extensions/cli/src/tools/runTerminalCommand.ts:260-333	1/4	Child-process lifecycle	MAJOR	Move/timeout/fail a Bash command during listener or job transitions	Orphaned commands, stale listeners, and unmanaged output	Applied: cleanup and managed termination paths
CLI-003	extensions/cli/src/util/clipboard.ts:90-95	4	Temporary-file cleanup	MINOR	Paste an image and interrupt/fail processing	Clipboard PNGs accumulated in the system temp directory	Applied: finally cleanup and tests
CLI-004	extensions/cli/README.md:42-69,145-163	5	Documentation drift	MINOR	Compare documented commands/startup behavior with implementation	Users followed unsupported or stale examples	Applied: docs aligned with actual behavior
CLI-005	extensions/cli/src/util/exponentialBackoff.ts:269-367	2/4	Streaming retry/cancellation	MAJOR	Abort during retry delay or fail after partial stream output	Delayed cancellation or duplicated assistant/tool output	Applied: abort-aware delay and no retry after yielded data
CLI-006	extensions/cli/src/tools/index.tsx:160-178	2/3	Tool-argument validation	MAJOR	Send malformed streamed tool JSON	Invalid model data reached preprocessing/execution	Applied: reject malformed/empty tool arguments
CLI-007	extensions/cli/src/tools/runTerminalCommand.ts:229-234	2	Argument validation	MINOR	Pass a non-finite or negative timeout	Invalid timeout behavior or unexpectedly long-running commands	Applied: validate before spawn
CLI-008	extensions/cli/src/commands/serve.ts:622-651	1/4	Signal cleanup	MAJOR	Send SIGINT/SIGTERM while cn serve is active	Races/double cleanup and unreliable exit behavior	Applied: deterministic serve shutdown
CLI-009	extensions/cli/src/commands/serve.ts:488-494	4	Promise/error handling	MAJOR	Fail an asynchronously processed serve message	Failure became an unobserved rejection or stale server state	Applied: observe, report, and update assistant state
CLI-010	extensions/cli/src/stream/streamChatResponse.ts:307-375, extensions/cli/src/tools/index.tsx:243-291	3	Sensitive logging/telemetry	MAJOR	Enable debug/telemetry while streaming or executing tools	Model/tool payloads could be written to logs or telemetry	Applied: metadata-only logging and tests
CLI-011	extensions/cli/src/services/ResourceMonitoringService.ts:51-69	4	Resource/listener lifecycle	MAJOR	Initialize the resource monitor repeatedly	Duplicate signal listeners and repeated cleanup work	Applied: idempotent listener registration and tests
CLI-012	extensions/cli/src/tools/runTerminalCommand.ts:208-215,353-367	4	Process-tree cleanup	MAJOR	Hit the CLI output cap while a shell child keeps stdout open	Shell exits but descendants keep pipes open, causing hangs/orphans	Applied: detached process groups and escalation helper
CLI-013	core/tools/implementations/runTerminalCommand.ts:171-224,410-450, core/util/processTree.ts:9-41	4	Core process-tree cleanup	MAJOR	Timeout or cancel a Core terminal command that spawned descendants	Descendants survived timeout/cancellation	Applied: POSIX process-group and Windows tree termination
CLI-014	packages/fetch/src/stream.ts:111-139	2	SSE stream termination	MAJOR	Server sends data after data: [DONE]	Post-completion tool/content data was processed	Applied: terminate generator at [DONE]; ping comments remain non-terminal
CLI-015	extensions/cli/src/configLoader.ts:127-135,570-580	1	Config path handling	MINOR	Run cn --config ~/config.yaml	Tilde path was treated as a literal relative filename	Applied: expand ~ before loading/persisting
CLI-016	packages/fetch/src/fetch.ts:13-25	3	Secret redaction	MAJOR	Set VERBOSE_FETCH=1 with an api-key header	API key appeared in request/curl debug output	Applied: case-insensitive api-key redaction and test
CLI-017	extensions/cli/src/version.ts:30-43,96-115	2	API response validation	MINOR	Update endpoint returns {"version":42}	Update check could fail in version comparison/error paths	Applied: validate semver-like response before use
CLI-018	extensions/cli/package-lock.json:5267-5275	0	Dependency reproducibility	MINOR	Run the CI-required npm ci in extensions/cli	Every CLI CI matrix job stopped before build/test because the lockfile resolved the overridden dependency to 2.1.4 while npm required 2.1.7	Applied: synchronized lockfile and verified clean install

All 18 statuses: Applied. No safely fixable finding remains deferred.

Applied fixes

The new remediation commits are:

• fc5df9441 — fix: terminate cli and core process trees
• 221a42a9c — fix: stop processing SSE data after done
• b3e9fa70d — fix: validate cli config and update responses
• 33199fc0c — test: avoid readonly process mock mutation
• c252a7c8c — fix: synchronize cli dependency lockfile

The source changes are covered by new or updated tests in CLI terminal/config/version tests, Core terminal timeout/cancellation tests, and fetch SSE/log-redaction tests. The before/after behavior is summarized in the issue table above; source code—not documentation only—was changed for every functional/security issue.

Verification

Passed:

• CLI npm test: 175 suites passed, 4 skipped; 1,842 tests passed, 7 skipped.
• CLI npm ci --ignore-scripts --no-audit --include=optional.
• CLI npm run lint: 0 errors; one pre-existing unused eslint-disable warning.
• CLI npm run build:tsc.
• Core npm run tsc:check.
• Core npm run vitest -- tools/implementations/runTerminalCommand.timeout.vitest.ts: 6 passed.
• Core npm test -- --runInBand util/processTerminalStates.test.ts: 26 passed.
• Fetch npm test -- --run src/stream.test.ts src/logRedaction.test.ts: 15 passed.
• Fetch npx tsc -p tsconfig.json --noEmit.
• Fetch npm run build.
• npm audit --omit=dev --audit-level=moderate: 0 vulnerabilities.
• Changed-file Prettier check and git diff --check.

The full CLI run emitted existing EventEmitter/listener warnings from shared fixtures and the Core Jest run emitted existing duplicate-mock/ts-jest/open-handle warnings, but the tests passed.

Decisions required / residual risks

• Credential encryption at rest would require a storage-format/product decision; no new format was introduced.
• Destructive-tool confirmation and workspace/symlink policy remain governed by existing permission and terminal-security architecture; this audit did not weaken them.
• A complete cross-platform PTY matrix is still needed for interactive SIGINT/SIGTERM, resize behavior, and Windows process-tree verification.
• The repository root npm run format:check could not run because the root workspace has no prettier binary; changed-file formatting passed using the CLI-local Prettier. Core package lint could not run because its local install lacks @typescript-eslint/parser; Core typecheck and targeted tests passed.
• The repository requires Node 20.20.1 while this environment runs Node 24.20.0.

Pull request

This is the existing single PR for the audit: #27, base main, head audit/cli-fixes. The branch is pushed and exactly one matching open PR exists. It was not merged.