openclaw - 💡(How to fix) Fix Direct mutation of Commander's internal commands array bypasses internal bookkeeping [1 comments, 2 participants]

Severity: medium / Confidence: medium / Category: maintainability Triage: risk Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• src/cli/program/command-tree.ts:4-9 (removeCommand)

const commands = program.commands as Command[];
  const index = commands.indexOf(command);
  if (index < 0) {
    return false;
  }
  commands.splice(index, 1);

Reasoning

program.commands is typed as readonly Command[] in Commander's public API. Casting it to Command[] and splicing it mutates the array in place. Commander internally tracks commands in a _name lookup map and maintains parent references on each sub-command object; splicing the array does not clear those. If Commander ever iterates its name map (e.g. during parseAsync or help generation) after a splice, the removed command's entry may still be found via the name map even though it is absent from the array, producing inconsistent results. This is also a fragile dependency on an undocumented internal representation that can break silently across Commander minor versions.

Reproduction

Register a command, call removeCommandByName, then call program.parseAsync(['node','cli','<removed-command>']); depending on Commander version, it may still route to the removed command.

Recommendation

Use Commander's public removeCommand API if available in the pinned version, or track placeholder commands in the registry layer rather than surgically removing them from the live program tree.

Why existing tests miss this

No tests for command-tree.ts are present in the provided test suite; the associated test file targets a different module.

Suggested regression test

Register a command, call removeCommandByName, and assert both program.commands.find(c => c.name() === name) and program.parseAsync with that name correctly reflect removal.

Minimum fix scope

src/cli/program/command-tree.ts removeCommand function

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-0f69ccd6ad-_780a07cf0d.