[dealako]

Summary

lfx api declares -H/--header, -F/--field and --raw-field as urfave/cli v3 StringSliceFlags. By default urfave/cli splits every slice flag value on ,, and there is no way to escape a literal comma. So one flag value turned into several entries:

• --raw-field 'a=x,b=y' produced the body {"a":"x","b":"y"} instead of {"a":"x,b=y"}
• --field 'note=hi,active=true' also added "active": true as a boolean
• -H 'X: a,Authorization: z' set a second header, and because headers use Header.Set, it replaced the Authorization/Content-Type values the command had already set

If a wrapper script puts untrusted text into a single flag value, whoever controls that text can add arbitrary body fields or headers to a request sent with the user's bearer token. The endpoint, method and token can't be changed this way. It also broke ordinary values that contain commas, such as Accept: a, b and desc=hello, world.

Changes

• internal/commands/api.go: set DisableSliceFlagSeparator: true on the api command, so each flag occurrence becomes exactly one element. This setting has to go on api and not the root command: urfave/cli uses the setting of the command that parses the flag and does not take it from parent commands. You still pass multiple fields or headers by repeating the flag.
• internal/commands/api_test.go: regression tests that run the real api command under a root command:
  • --raw-field 'a=x,b=y' → {"a":"x,b=y"}
  • --field 'c=1,active=true' → {"c":"1,active=true"}
  • -H 'X: a,Authorization: z' → one header value

Behavior change

Anyone who relied on -H 'A: 1,B: 2' or -F a=1,b=2 meaning two entries now needs to repeat the flag. This splitting was never documented in the README.

Testing

• go test ./... passes. Without the fix, the new tests fail and show the injected entries.
• make check passes (go vet, golangci-lint: 0 issues).
• An independent review checked every way these flags can be passed (--flag v, --flag=v, -H v, -H=v, flags after the path, root flags before api) and found each one now produces a single entry.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Kvw34hYiaHVuYdeVXA7TLd

---

Generated by Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused parser change correctly addresses the issue and is covered by command-level regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Prevents comma-containing API flag values from being split into unintended fields or headers.

Changes:

• Disables slice-value comma splitting for lfx api.
• Adds regression tests for comma-containing fields and headers.

File	Description
internal/​commands/​api.go	Preserves each slice-flag occurrence as one value.
internal/​commands/​api_test.go	Verifies comma-safe field and header parsing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The targeted fix and regression tests address the reported issue, with only a non-blocking documentation follow-up remaining.

0 open findings

🧠 Review effort: Balanced