fix(config)!: stop loading the config file from the working directory

[pbeckham]

Closes kosli-dev/server#6778 and kosli-dev/server#6779.

The --config-file default fell back to the bare name kosli whenever $HOME/.kosli.yml was absent, and viper resolves that against the current working directory. A checkout could therefore ship kosli.yml and set any Kosli flag for a command run with a real API token. The default is now always the home config file, and a working-directory config is read only when named.

Why

Two confirmed vulnerabilities, both reachable by a developer or CI job running an ordinary Kosli command in an untrusted checkout with KOSLI_API_TOKEN set. A repository-controlled host or http-proxy sends Authorization: Bearer <real token> to a host of the repository's choosing. A repository-controlled kubeconfig on snapshot k8s runs a kubeconfig exec credential plugin, which is arbitrary command execution, and --dry-run does not prevent it. Exposure is widest where tokens live: a CI runner has no $HOME/.kosli.yml, the state that triggered the fallback.

What changed

getConfigFileFlagDefault no longer degrades to a relative name, so viper's search path is always the home directory. initialize skips the config read when no default path resolves, and kosli config fails clearly rather than writing into the working directory. The --config-file and kosli config help strings now say config is never read implicitly from the current directory, since the published reference is generated from them.

Behaviour is unchanged for --config-file, KOSLI_CONFIG_FILE, $HOME/.kosli.yml and KOSLI_* environment variables.

So the removal does not break a pipeline silently, an ignored working-directory config produces a warning naming the file and the fix. When to warn is the fiddly half: only while no home config was loaded, since nobody else lost behaviour and --config-file would replace a home config rather than restore one; only for a decodable regular file under 1 MB, since it is repository-controlled and read on every command run; and never for a flow template, told apart by trail being a mapping or artifacts a sequence, because both are CLI flags as well as template keys.

Verification

New WorkingDirConfigTestSuite in cmd/kosli/configWorkingDir_test.go, 14 cases. They pin that none of the six decodable extensions can set host from the working directory, the warning text across nine file shapes, the home-config load path in both .yml and .json form, and that a kosli.yml -> /dev/zero symlink is skipped rather than read unbounded.

Both reported scenarios were reproduced against a build of a5ecf036 and re-run against this branch: the bearer token now stops at the default host, and the kubeconfig credential plugin does not execute. The Test workflow gates this PR with make test_integration_full and golangci-lint.

Follow-up

Docs are on 6778-no-implicit-cwd-config in kosli-dev/docs, to merge with the release.

[claude]

Claude finished @pbeckham's task in 6m 11s —— View job

---

Review of 907e6717 + da5322af

• Static analysis
• Read the changed files at HEAD
• Verify the two new commits against viper 1.21's own source
• Post findings

Static analysis

Check	Result
go build ./...	clean
go vet ./...	clean
go mod tidy + git diff --exit-code go.mod go.sum	clean

go test needs approval in this environment, so the suite was not run. Everything below is read from the sources.

Verified against viper 1.21

Both new commits claim to reproduce viper's search rule, so I checked the rule rather than the claim.

file.go:75-92 — searchInPath iterates SupportedExts and returns on the first hit, no parse attempted:

for _, ext := range SupportedExts {
    if b, _ := exists(v.fs, filepath.Join(in, v.configName+"."+ext)); b {
        return filepath.Join(in, v.configName+"."+ext)
    }
}

file.go:95-104 — exists is !stat.IsDir(), and swallows every non-IsNotExist error into false because the caller discards it:

stat, err := fs.Stat(path)
if err == nil {
    return !stat.IsDir(), nil
}
if os.IsNotExist(err) { return false, nil }
return false, err

root.go:434-470 now mirrors all three branches exactly — continue on any stat error (broken symlink, ELOOP, EACCES), continue on a directory, return on everything the search would have stopped at. viper.go:304 confirms the order (json, toml, yaml, yml, properties, …) and encoding.go:166-181 confirms only json/toml/yaml/yml/dotenv/env have a decoder, so TestUndecodableWorkingDirConfigIsSilent rests on real behaviour and not on a coincidence. v.configType is never set, so the extensionless kosli fallback at file.go:85-89 stays unreachable and the name list is complete.

Also checked for test contamination: no tracked kosli.<ext> anywhere in the repo, and no t.Parallel() in cmd/kosli, so the t.Chdir calls are safe and no other suite starts emitting the warning.

Finding

kosli config cannot honour the remedy it is shown — root.go:422. config.go:68 rejects --config-file in its PreRunE, but the flag is inherited rather than shadowed, so shadowed is false and the full "pass --config-file kosli.yml" wording is printed. Following it gives cannot use --config-file with config command. Reachable on the likeliest path: the warning requires that no home config was loaded, which is exactly the state of a first-time kosli config run, and a checkout with a kosli.yml is the premise of the whole PR. Suggestion is inline, including the wording that stays true for snapshot k8s.

Not raising

• The 1 MB ceiling and the IsRegular guard both return silently, so a genuinely >1 MB config or a FIFO-backed one is dropped without a word. Both match what viper would have stopped at, and the old CLI hung on the FIFO, so there is no behaviour to migrate — deliberate, and the comments say so.
• Up to 12 os.Stat calls per command run in the working directory. Negligible next to a single HTTP request.

Good work

da5322af is the finding I raised, but the fix is better than what I suggested: splitting IsDir from IsRegular rather than folding them, with each branch's comment naming the viper line it mirrors, so the next reader can check the mirror instead of trusting it. 907e6717 retired a follow-up rather than adding one — stopping at the first existing name closed the extension-stripping mismatch as a side effect, which is the rare case of a fix shrinking the outstanding list.

The test suite has held up unusually well across nine rounds of review, and the reason is that each case pins why rather than what: TestNonRegularWorkingDirConfigIsNotParsed was quietly neutered by 907e6717 and the fix moved /dev/zero onto kosli.json with a comment explaining why the position is load-bearing, rather than leaving a green test guarding nothing. The 30-second FailNow harness turning a hang into a readable failure, and the stubHomeConfig helper making "no home config" the explicit precondition of every case, are both worth keeping as patterns.
· branch fix-no-implicit-cwd-config