cmd/admin.go:31

• Import block is not gofmt/goimports formatted (stdlib imports are mixed with module imports and there’s no blank line separation). This tends to drift further over time and makes diffs noisier; running gofmt/goimports on this file should reorder/group the imports correctly.

import (
	"fmt"
	"github.com/ProxySQL/dbdeployer/admin"
	"github.com/ProxySQL/dbdeployer/defaults"
	"os"
	"path"
	"sort"

	"github.com/ProxySQL/dbdeployer/common"
	"github.com/ProxySQL/dbdeployer/globals"
	"github.com/ProxySQL/dbdeployer/sandbox"
	"github.com/pkg/errors"
	"github.com/spf13/cobra"
)

admin/actions.go (1)

26-31: Consider adding a timeout for script execution.

The script execution has no timeout, which could cause the HTTP request to hang indefinitely if the sandbox script doesn't terminate. For a web UI, this could lead to poor user experience.

♻️ Proposed fix using context with timeout

+import (
+	"context"
+	"time"
+	...
+)
+
 func ExecuteSandboxScript(sandboxName string, script string) error {
 	sbDir := sandboxDirFor(sandboxName)
 
 	scriptPath := filepath.Join(sbDir, script)
 	if _, err := os.Stat(scriptPath); err != nil {
 		// Try the _all variant for multi-node sandboxes.
 		scriptPath = filepath.Join(sbDir, script+"_all")
 		if _, err2 := os.Stat(scriptPath); err2 != nil {
 			return fmt.Errorf("script %q not found in %s", script, sbDir)
 		}
 	}
 
-	cmd := exec.Command("bash", scriptPath)
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "bash", scriptPath)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
+		if ctx.Err() == context.DeadlineExceeded {
+			return fmt.Errorf("%s timed out after 60s", script)
+		}
 		return fmt.Errorf("%s failed: %s: %w", script, string(output), err)
 	}
 	return nil
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@admin/actions.go` around lines 26 - 31, The script executor currently uses
exec.Command("bash", scriptPath) with no timeout; change it to use a context
with timeout (e.g., context.WithTimeout) and exec.CommandContext(ctx, "bash",
scriptPath) inside the same function so the process is cancelled when the
timeout elapses; ensure you capture cmd.CombinedOutput(), detect
context.DeadlineExceeded (or ctx.Err()) and return a clear timeout error that
includes any captured output, and cancel the context (or defer cancel()) to free
resources (refer to the cmd/exec invocation and the error-return block around
CombinedOutput).

docs/superpowers/specs/2026-03-24-admin-webui-poc-design.md (2)

29-37: Optional: Add language specifier to fenced code blocks.

Per markdownlint, fenced code blocks should have a language specified. For ASCII diagrams, use text or plaintext.

📝 Suggested fix

-```
+```text
 dbdeployer admin
   └─ starts HTTP server on 127.0.0.1:<port>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/superpowers/specs/2026-03-24-admin-webui-poc-design.md` around lines 29
- 37, The fenced ASCII diagram block (the one starting with "dbdeployer admin"
and listing behaviors like "starts HTTP server...", "generates OTP...", "opens
browser to http://127.0.0.1:<port>/login?token=<otp>", "serves embedded HTML
templates via Go's html/template", and "HTMX handles dynamic actions") needs a
language specifier; update the triple-backtick fence to use ```text (or
```plaintext) so markdownlint stops flagging it—i.e., replace the opening ```
with ```text for that code block in the
docs/superpowers/specs/2026-03-24-admin-webui-poc-design.md file.

---

131-132: Spec mentions auto-port selection, but implementation doesn't include it.

The spec states "If busy, find next free port" but the current implementation in cmd/admin.go simply uses the provided port without fallback. This is fine for a POC, but consider updating either the spec or implementation to match.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/superpowers/specs/2026-03-24-admin-webui-poc-design.md` around lines 131
- 132, The spec requires auto-port selection when the desired port is busy;
update cmd/admin.go (the routine that parses --port and starts the HTTP
server—e.g., startAdminServer/runAdminServer) to attempt binding starting at the
configured port (default 9090) and, on EADDRINUSE, increment the port and retry
until a free port is found (or a reasonable max attempts), then start the server
on the successful port and print the full URL to the terminal. Ensure the loop
only reacts to "address in use" errors, preserves any explicit --port value as
the starting point, and logs the final chosen port.

admin/auth.go (1)

40-46: Sessions accumulate without expiration.

The time.Time value stored for each session is never used—sessions remain valid indefinitely. For a localhost POC this is acceptable, but consider adding session expiration or a logout endpoint if this evolves beyond a proof-of-concept.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@admin/auth.go` around lines 40 - 46, CreateSession currently stores
time.Now() so sessions never expire; update it to record an expiration time
(e.g., time.Now().Add(sessionTTL)) instead of the creation time and add logic to
enforce expiry: introduce a sessionTTL constant and either implement a
ValidateSession(sessionID string) bool that checks the stored expiry and deletes
expired entries from a.sessions, or run a background cleanup goroutine on
AuthManager that periodically removes expired sessions; reference AuthManager,
CreateSession, a.sessions, generateOTP and add ValidateSession or Logout as
appropriate.

admin/server.go (1)

64-70: Browser may open before server is ready.

openBrowser(url) is called before the listener is created. If the browser is fast, it could attempt to connect before the server is listening, showing a connection error. Consider opening the browser after the listener is established.

Proposed fix

 	listener, err := net.Listen("tcp", addr)
 	if err != nil {
 		return fmt.Errorf("listen on %s: %w", addr, err)
 	}
+
+	openBrowser(url)
+
 	return http.Serve(listener, mux)

And remove the earlier openBrowser(url) call on line 64.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@admin/server.go` around lines 64 - 70, openBrowser(url) is currently invoked
before the server listener is created, which can cause the browser to try
connecting too early; remove the earlier openBrowser(url) call and instead call
openBrowser(url) after net.Listen succeeds (after listener, err :=
net.Listen("tcp", addr) returns without error) and before returning
http.Serve(listener, mux) — you may invoke it synchronously or in a goroutine to
avoid blocking; update code around net.Listen, listener, http.Serve, addr, mux
and url accordingly.

admin/sandbox_status.go (1)

46-119: Sandbox list ordering is unstable due to map iteration.

At Line 46, iterating a map directly makes dashboard card order nondeterministic between refreshes. Sorting keys first will keep HTMX updates stable.

Proposed refactor

 import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"syscall"
@@
-	for name, item := range catalog {
+	keys := make([]string, 0, len(catalog))
+	for name := range catalog {
+		keys = append(keys, name)
+	}
+	sort.Strings(keys)
+
+	for _, name := range keys {
+		item := catalog[name]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@admin/sandbox_status.go` around lines 46 - 119, The loop iterates the map
variable catalog directly which yields nondeterministic ordering; to stabilize
sandbox list order, collect the map keys into a slice, sort them (e.g., using
sort.Strings), and then iterate over the sorted keys to build SandboxStatus
entries (the block that currently ranges "for name, item := range catalog").
Keep the rest of the logic intact (uses sandboxHome, SandboxStatus,
item.Destination, item.Nodes, common.ReadSandboxDescription, isRunning and
appends to result) but replace the direct map iteration with an iteration over
the sorted key slice so HTMX/dashboard card order is stable.