🛡️ Sentinel: [MEDIUM] Fix error handling exposing stack traces

[seonghobae]

🚨 Severity: MEDIUM
💡 Vulnerability: fast-mlsirm CLI의 진입점(main() 함수)에서 발생하는 예외를 상위 레벨에서 적절하게 처리하지 않아, 파일이 없거나(예: 잘못된 경로 제공) CSV 형식이 올바르지 않은 경우 프로그램이 충돌하며 파이썬 스택 트레이스와 내부 파일 경로가 콘솔에 그대로 노출되는 문제가 있었습니다.
🎯 Impact: 로컬 환경에서 실행되는 도구이긴 하지만, 원시 스택 트레이스를 그대로 보여주는 것은 내부 구현 구조를 노출하는 것이며(정보 노출), 사용자 경험 측면에서도 좋지 않습니다. 또한 "Fail Securely" 원칙에 위배됩니다.
🔧 Fix: python/fast_mlsirm/cli.py 내의 main() 함수 로직을 try...except Exception as e 블록으로 감싸서 처리되지 않은 예외를 모두 잡도록 수정했습니다. 에러 정보는 sys.stderr로 깨끗하게 정제되어 출력되며, 프로그램은 상태 코드 1을 반환하며 종료되도록 변경했습니다. 관련 보안 교훈은 .jules/sentinel.md 저널에 기록했습니다.
✅ Verification: python -m pytest tests/ 및 cargo test를 실행하여 기능 저하가 없는 것을 확인했으며, 존재하지 않는 파일을 입력하여 이전처럼 스택 트레이스가 아닌 에러 메시지가 출력되는 것을 직접 검증했습니다.

---

PR created automatically by Jules for task 15303214005939160278 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[opencode-agent]

OpenCode Review Overview

• Head SHA: f30ab29222727d742edecac40ab95c3b98db7585
• Workflow run: 28418306610
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch sentinel-fix-cli-stack-traces-15303214005939160278 cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into sentinel-fix-cli-stack-traces-15303214005939160278, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 24 --repo ContextualWisdomLab/fast-mlsirm
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278
# rebase path only: git push --force-with-lease origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["required checks"]
  Evidence --> S2["Test (7 files)"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: f30ab29222727d742edecac40ab95c3b98db7585
• Workflow run: 28418306610
• Workflow attempt: 1

Merge Conflict Guidance

• Current merge state: DIRTY
• Base branch: main
• Head branch: sentinel-fix-cli-stack-traces-15303214005939160278
• Fix direction: merge or rebase origin/main into sentinel-fix-cli-stack-traces-15303214005939160278, resolve conflict markers in the changed files, rerun the focused checks, then push the same branch.
• Repair commands:

gh pr checkout 24 --repo ContextualWisdomLab/fast-mlsirm
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278
# rebase path only: git push --force-with-lease origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch sentinel-fix-cli-stack-traces-15303214005939160278 cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into sentinel-fix-cli-stack-traces-15303214005939160278, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 24 --repo ContextualWisdomLab/fast-mlsirm
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278
# rebase path only: git push --force-with-lease origin HEAD:sentinel-fix-cli-stack-traces-15303214005939160278

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Change Flow DAG

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["required checks"]
  Evidence --> S2["Test (7 files)"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: f30ab29222727d742edecac40ab95c3b98db7585
• Workflow run: 28418306610
• Workflow attempt: 1

[seonghobae]

중복 정리: 동일 주제의 최신 PR #27 로 통합합니다. 작업 내용이 필요하면 재오픈 가능합니다.

[google-labs-jules]

중복 정리: 동일 주제의 최신 PR #27 로 통합합니다. 작업 내용이 필요하면 재오픈 가능합니다.

알겠습니다. 이 PR은 최신 PR #27 에 통합되어 더 이상 유효하지 않으므로 작업 및 수정을 중단하겠습니다.