Fix GCL_ array env vars not splitting semicolon-separated values

[firecow]

• Fix GCL_VARIABLE and other array-type env vars not splitting semicolon-separated values (e.g. GCL_VARIABLE="VAR1=hello;VAR2=world")
• Array keys derived from yargs at runtime — no hardcoded list to maintain
• Simplify argv.ts: getStringArray() helper reduces getter boilerplate, early return in injectDotenv()
• Fix regex backtracking vulnerability in variable getter (SonarCloud S5852)

Fixes #992

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/argv.ts">

<violation number="1" location="src/argv.ts:115">
P1: Bug: `flatMap` splitting on array elements corrupts CLI values containing semicolons. When multiple CLI flags are used (e.g., `--variable "MY_VAR=host=db;port=5432"`), the CLI framework already parses them into individual array elements. Splitting those elements on `;` corrupts values that legitimately contain semicolons (connection strings, CSS, etc.). The old code correctly left arrays untouched — only string inputs (from env vars) should be split.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tests/test-cases/gcl-env-variable-split/integration.test.ts">

<violation number="1" location="tests/test-cases/gcl-env-variable-split/integration.test.ts:170">
P2: This test doesn't verify what its name claims. It passes already-split values (`["VAR1=hello", "VAR2=world"]`) directly to `handler()` rather than providing a semicolon-joined `GCL_VARIABLE` env var. The `splitSemicolonEnvVars` middleware is never exercised. To actually test env-split → handler integration, set `process.env.GCL_VARIABLE` (or mock it) and pass an unsplit argv.</violation>
</file>

<file name="src/argv.ts">

<violation number="1" location="src/argv.ts:125">
P2: Potential `TypeError` crash if a non-string, non-array value is stored in the map (e.g. `VOLUME=true` in a `.env` file gets stored as boolean `true` by `injectDotenv`). The old getters checked `typeof val == "string"` before calling `.split()`. Consider adding a type guard.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud