# Go Code Review Findings (2026-02-09)

Scope: Go source and test code across the repository.

Verification run:
- `go vet ./...`
- `go test ./...`
- `go test -race ./...`

All commands passed.

## Findings

### 1) High: CIDR protection is fail-open on resolver errors

Files:
- `proxy/http.go:156`
- `proxy/http.go:52`

Details:
- `resolveAndCheckCIDR` returns `(false, nil)` when `LookupIPAddr` errors.
- `checkRequest` interprets that as "not blocked" and allows the request.
- This can skip CIDR protection when DNS resolution fails or is degraded.

Suggested fix:
- Make CIDR enforcement fail-closed for resolver errors.
- Option A: treat any resolver error as blocked.
- Option B: block when `err != nil && len(addrs) == 0`, while still checking any returned addresses.

### 2) Medium: `allow` accepts malformed `allow-http` entries

Files:
- `cmd/allow.go:24`
- `proxy/api.go:63`
- `proxy/allowlist.go:52`
- `proxy/allowlist.go:75`

Details:
- CLI/API accept entries without enforcing `domain:port-pattern`.
- Parser leaves `Port=""` if `:` is missing.
- Empty port pattern does not match non-empty runtime ports, so rule never applies.
- User can see `+ allowed ...` and `+ saved ...` for a non-functional entry.

Suggested fix:
- Validate format at CLI and control API boundaries.
- Reject malformed entries with actionable errors.

### 3) Low: TTY resize goroutine leak

Files:
- `container/terminal.go:85`
- `container/terminal.go:84`

Details:
- Resize goroutine loops on `for range sigCh`.
- `signal.Stop(sigCh)` stops notifications but does not close the channel.
- Goroutine can remain blocked after session exit.

Suggested fix:
- Add explicit shutdown signaling for the goroutine (e.g., `done` channel).

## Test Gaps

### A) Missing CIDR resolver-error behavior test

File:
- `proxy/http_test.go`

Gap:
- No test asserts behavior when DNS resolution errors occur in CIDR check path.

### B) Missing malformed allow-entry validation tests

Files:
- `cmd` tests and/or `proxy/api_test.go`

Gap:
- No tests assert rejection of invalid `allow-http` entries (e.g. missing port pattern).
