[jnnngs]

📋 Findings

Functional (prioritized):

1. High-ish: loadInjectionData (go3270Connect.go): a JSON null went through fmt.Sprint and became the literal text <nil>, typed onto the host screen. Fixed here.
2. Low: nested objects/arrays in an injection entry become Go-formatted text (map[a:b]) and are typed as such, instead of being rejected.
3. Low: injectDynamicValues replaces placeholders in random map order, so a value containing another placeholder substitutes non-deterministically.
4. Low: workflow.Validate accepts negative Row/Column and negative FillString Length; only caught at run time.
5. Design question: with AUTH_MODE=none, killProcessHandler can kill any PID on the machine.

UX: not audited in depth this pass.

🐛 Fixed

Finding 1. Null is now empty text via injectionValueText. Added TestLoadInjectionDataTreatsNullAsEmpty; it fails without the fix (got "<nil>") and passes with it. go vet and go test -short ./... pass; build ok.

⚠️ Risk/Follow-up

Anyone relying on null producing <nil> text is affected; implausible.

❓ Questions

• Should nested objects/arrays in injection entries be an error (finding 2)?
• Should the kill endpoint be limited to PIDs that have a metrics file (finding 5)?

📝 Noted, not fixed

Findings 2 to 5.

---

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.