[sergo] Sergo Report: DELTA-67to68-newlinter-audit(bufferresetbeforereuse) - 2026-09-11

[github-actions[bot]]

Overview

Run Sec34559696103 (R63). Registry grew 67 -> 68 with a new analyzer, bufferresetbeforereuse, which had never been audited before. This run gave it a first full read and found a structural false-negative in its core detection logic. A cached-vein probe carried over from last run (R62) came back clean.

Tool and registry changes

• Serena: still 24 tools, no change from R62. activate_project reports go/typescript/bash language servers active; source-level Read/Grep was sufficient for this runs single-file audit, so LSP diagnostics were not re-exercised.
• Registry: pkg/linters/registry.go allAnalyzers grew from 67 to 68. The new entry is bufferresetbeforereuse (pkg/linters/bufferresetbeforereuse/bufferresetbeforereuse.go), a plain diagnostic-only analyzer (no SuggestedFix) that flags bytes.Buffer/strings.Builder reuse without an intervening Reset().

Strategy: 50/50 split

• Cached half (reused, proven vein): last runs memory flagged manualmutexunlock (manualmutexunlock: mutexKey collapses distinct receivers for 2+-level field selector chains #59875, still open) as one instance of a nested-selector key-collapse bug, and suggested probing deferinloop, panic-in-library-code, timeafterleak, and wgdonenotdeferred for the same per-instance struct-field-selector keying pattern. All four were read and grepped for Selections[/types.Object/SelectorExpr-based keying: none use per-instance struct-field keying at all, so this vein is exhausted for these four linters. No issue filed from this half; recorded as audited-clean in memory.
• New-explore half: full read of the brand-new bufferresetbeforereuse analyzer, since it had zero prior audit history.

Findings

bufferresetbeforereuse tracks write/read/reset events with two per-block maps (analyzeStraightLineBlock, lines 86-130) that are re-initialized fresh every time analyzeBlockForBufferReuse (lines 74-84) walks into a new *ast.BlockStmt. Its event collector, collectEvents (lines 133-155), explicitly refuses to descend into If/For/Range/Switch/TypeSwitch/Select bodies when gathering events for the enclosing block. The combination means a write followed by a read in an outer scope, and then a reuse-write inside a nested if/for/switch body, are never linked: the inner blocks isolated event list sees the reuse-write as though it were the very first write. This is exactly the pattern the linter exists to catch, and it escapes detection whenever it spans a control-flow boundary -- arguably the most common real-world shape of the bug. The existing testdata only covers same-block reuse plus one true-negative early-return case; nothing exercises the cross-block scenario.

Generated task / issue

Filed one issue (temporary id aw_sg63a1): bufferresetbeforereuse per-block state isolation misses reuse across if/for/switch boundaries. Recommends restructuring the state tracking to span the whole FuncDecl/FuncLit (still stopping only at FuncLit boundaries, which the analyzer already does correctly at the top level), mirroring how the existing resourcetracker framework tracks acquisitions for fileclosenotdeferred/contextcancelnotdeferred/manualmutexunlock. Includes a concrete repro, a validation checklist, and an effort estimate of small-medium.

Metrics

• Findings this run: 5 (1 new linter first-audit finding filed as an issue, 4 cached-vein linters audited clean)
• Tasks generated: 1
• Issues created: 1 (of a max 3)
• Success score: 8/10 (strong single-linter finding with a clear root cause and repro; cached vein came back empty rather than yielding a second issue)

Historical context

62 prior runs, 417 total findings, 111 total tasks before this run. Four sergo issues remain open from before this run: #59875 (sg62a1, manualmutexunlock 2+-level selector collapse, still unfixed), #59627 (sg61a1, library-scope os.Exit-family main-guard gap, still unfixed), #59122 (nolint space-prefixed directive parsing), #58376 (13 linters missing a HasOverlappingComment guard on SuggestedFix bodies). None were touched this run beyond reconciling that they remain open.

Recommendations and next-run focus

• Re-check all 5 open sergo issues (the 4 above plus this runs aw_sg63a1) for landed-but-still-open status, since the team has historically fixed things without closing the tracking issue.
• If the registry grows past 68, give the new linter the same first-audit treatment this run gave bufferresetbeforereuse.
• Lower-priority, not filed: bufferresetbeforereuse only recognizes bare identifier receivers (sel.X must be *ast.Ident), so a buffer stored as a struct field (s.buf) is never tracked at all -- likely an intentional scope limit rather than a bug, worth a second look only if it recurs as a pattern in a future audit.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 252.5 AIC · ⌖ 6.37 AIC · ⊞ 6.8K · ◷

• expires on Sep 11, 2026, 7:58 PM UTC-08:00