[sergo] Sergo Report: ctx-family FuncLit-boundary systematic audit - 2026-07-06

[github-actions[bot]]

Overview

Run R58 on a stable registry (42 analyzers, no delta vs R57). A stable registry — no new linter to audit — forces full new-exploration (as in R54/R55). This run ran a systematic audit of the ctx-inheritance linter family for a single failure mode: how each handles FuncLit (closure) boundaries when walking enclosing scopes for a context.Context parameter.

Result: 1 new, high-confidence issue — execcommandwithoutcontext is the last ctx-family linter still crossing callback FuncLit boundaries without the guard that every sibling already received.

Reconcile (do this first — the team is fast now)

Before selecting a strategy, gh api ...issues?labels=sergo reconciliation showed the maintainers closed nearly every open Sergo issue since R57:

Issue	Topic	State
#43465 (sg57a1)	httprespbodyclose closure FN	✅ closed
#43313 (sg56a1)	autofix verification-parity	✅ closed
#43113	fprintlnsprintf newline drop	✅ closed
#42004, #41845, #41844	httpstatuscode / fmterrorf / nolint-parity	✅ closed
#42174	hardcodedfilepath verb-set	⬜ still open

Only #42174 remained open at run start.

Strategy — 50/50 split

• Cached component (proven funclit_boundary vein): landed precedents timesleepnocontext: enclosing-scope walk crosses arbitrary FuncLit boundaries — false positives + misleading fix for request/cal [Content truncated due to length] #42901 (timesleepnocontext), ctxbackground: enclosing-scope walk only inspects *ast.FuncDecl, skipping FuncLit boundaries — false negative for closures with [Content truncated due to length] #41164 (ctxbackground), httprespbodyclose: FuncDecl-only scope + FuncLit skip misses responses closed inside closures (goroutines/handlers) — false nega [Content truncated due to length] #43465 (httprespbodyclose), panicinlibrarycode: init() and documented-contract exemptions cross FuncLit boundaries — false negatives for panics in nested cl [Content truncated due to length] #41606 (panicinlibrarycode), wgdonenotdeferred precision: non-deferred wg.Done() inside a goroutine launched in a loop escapes detection (FuncLit scope bound [Content truncated due to length] #40947 (wgdonenotdeferred). Reuse the diagnosis technique.
• New exploration: apply it systematically across the whole ctx family in one sweep rather than one linter, and specifically audit execcommandwithoutcontext (newly CI-enforced at R57 via errortypeassertion (new 38th linter) + execcommandwithoutcontext enforce-readiness: zero production violations, add both to the [Content truncated due to length] #42416).
• Targets: 1-2 single-file precision findings; zero duplicates; CI-enforced linters weighted higher (an FP there fails the build).

Key finding

Four linters walk cur.Enclosing((*ast.FuncDecl)(nil), (*ast.FuncLit)(nil)) innermost-first looking for a ctx param. They diverge on what happens at a ctx-less callback closure:

Linter	Boundary handling	Verdict
timesleepnocontext	break at ctx-less FuncLit unless it's a go/defer closure (isGoOrDeferClosure)	✅ fixed (#42901)
ctxbackground	break on first ctx-less enclosing func (conservative)	✅ fixed (#41164)
httpnoctx	hasContextInEnclosingFunc returns true if any enclosing has ctx	⚠️ crosses boundaries, but weaker (message "ctx in scope" is literally true)
execcommandwithoutcontext	always continues past a ctx-less FuncLit	🔴 over-attribution FP

Evidence — the bug (execcommandwithoutcontext.go:54-62)

for encl := range cur.Enclosing((*ast.FuncDecl)(nil), (*ast.FuncLit)(nil)) {
    funcType := astutil.EnclosingFuncType(encl.Node())
    if funcType == nil { continue }
    ctxParamName, hasCtx := astutil.ContextParamName(pass, funcType)
    if !hasCtx {
        continue          // <-- crosses the FuncLit boundary; borrows the OUTER func's ctx
    }
    ... pass.Report( use exec.CommandContext(ctxParamName, ...) ) ...
    break
}

False-positive scenario:

func serve(ctx context.Context) {
    http.HandleFunc("/run", func(w http.ResponseWriter, r *http.Request) {
        _ = exec.Command("ls")   // FLAGGED with serve()'s ctx — WRONG scope (should be r.Context())
    })
}

The fixed twin (timesleepnocontext.go:62-65) does exactly the right thing:

if !hasCtx {
    if _, isFuncLit := funcNode.(*ast.FuncLit); isFuncLit && !isGoOrDeferClosure(encl) {
        break   // regular callback closure -> stop, don't borrow outer ctx
    }
    continue    // go/defer closure -> keep walking (it captures + shares ctx)
}

The testdata confirms this is an oversight: it covers OuterCtxInnerClosure (a go func(){...}() that should be flagged) but has no non-go/defer callback case — the exact FP scenario is untested.

Impact: false positives + a misleading autofix (exec.CommandContext(outerCtx, ...) wires in a context whose lifetime doesn't match the callback), elevated because the linter is CI-enforced (#42416).

Generated task

Port the timesleepnocontext boundary guard to execcommandwithoutcontext.

• Copy isGoOrDeferClosure (timesleepnocontext.go:79-122; add golang.org/x/tools/go/ast/inspector import).
• Replace the if !hasCtx { continue } with the break-on-non-go/defer-FuncLit form.
• Add testdata: callback FuncLit (http.HandleFunc/sort.Slice) inside a ctx func → no diagnostic; keep go/defer closures flagged.
• Effort: Small (~40 lines, single file + testdata; direct port of already-reviewed code).

Issue created

• execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries — false positives + misleading fix (same [Content truncated due to length] #43683 — execcommandwithoutcontext: enclosing-scope walk crosses non-go/defer FuncLit boundaries (same class as timesleepnocontext: enclosing-scope walk crosses arbitrary FuncLit boundaries — false positives + misleading fix for request/cal [Content truncated due to length] #42901). Label sergo.

Metrics

Metric	Value
Registry (analyzers)	42 (stable, no delta)
Serena LSP tools	23 (stable)
ctx-family linters audited	4
Findings	6
Issues created	1
Duplicates skipped	0 (only #42174 was open)
Success score	9 / 10

Historical context

The funclit_boundary failure mode has now been surfaced across the entire ctx-inheritance family over R44-R58. With execcommandwithoutcontext filed, every ctx-family linter's closure-boundary handling is accounted for (fixed or filed) — this vein is effectively exhausted.

Recommendations / Next-run focus (R59)

1. Watch the 43rd analyzer — grep -c Analyzer cmd/linters/main.go vs 42; a new linter is the highest-value fresh audit target.
2. httpnoctx boundary-crossing is real but weaker — file only if a concrete production FP is found.
3. Broaden to non-ctx ancestor-walking linters (deferinloop, timeafterleak) for analogous scope-boundary bugs.
4. Reconcile via gh api first — the team now closes Sergo issues within a day or two.

References:

• §28768949756

Generated by 🤖 Sergo - Serena Go Expert · 217.8 AIC · ⌖ 14.1 AIC · ⊞ 5.9K · ◷

• expires on Jul 6, 2026, 9:13 PM UTC-08:00