internal/cmn/config/loader_test.go (1)

461-479: Add one negative assertion in the env-based passthrough test.

Line 461 onward verifies positive inclusion but not exclusion of unrelated keys. Mirroring the YAML test’s negative check would harden regression coverage.

💡 Suggested test hardening

 func TestLoad_BaseEnvIncludesConfiguredEnvPassthroughFromEnv(t *testing.T) {
 	tempDir := t.TempDir()
 	configFile := filepath.Join(tempDir, "config.yaml")
 	preserveTZEnv(t)
 	t.Setenv("EXACT_FROM_ENV", "exact-value")
 	t.Setenv("PREFIX_FROM_ENV_TOKEN", "prefix-value")
+	t.Setenv("BLOCKED_FROM_ENV", "blocked-value")
 	t.Setenv("DAGU_ENV_PASSTHROUGH", " EXACT_FROM_ENV , EXACT_FROM_ENV ,,")
 	t.Setenv("DAGU_ENV_PASSTHROUGH_PREFIXES", " PREFIX_FROM_ENV_ , PREFIX_FROM_ENV_ ,,")
 	require.NoError(t, os.WriteFile(configFile, []byte("# minimal config"), 0o600))

 	cfg := testLoad(t, WithConfigFile(configFile), WithAppHomeDir(tempDir))
 	baseEnv := cfg.Core.BaseEnv.AsSlice()

 	require.Equal(t, []string{"EXACT_FROM_ENV"}, cfg.Core.EnvPassthrough)
 	require.Equal(t, []string{"PREFIX_FROM_ENV_"}, cfg.Core.EnvPassthroughPrefixes)
 	require.Contains(t, baseEnv, "EXACT_FROM_ENV=exact-value")
 	require.Contains(t, baseEnv, "PREFIX_FROM_ENV_TOKEN=prefix-value")
+	require.NotContains(t, baseEnv, "BLOCKED_FROM_ENV=blocked-value")
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/cmn/config/loader_test.go` around lines 461 - 479, Add a negative
assertion to TestLoad_BaseEnvIncludesConfiguredEnvPassthroughFromEnv to ensure
unrelated environment variables are not passed through: after computing baseEnv
(cfg.Core.BaseEnv.AsSlice()) assert that an unrelated key (e.g.,
"UNRELATED_ENV=some-value" or simply ensure "UNRELATED_ENV" is not present) is
not in baseEnv; use the same style as the existing positive assertions and
reference cfg.Core.EnvPassthrough / cfg.Core.EnvPassthroughPrefixes to mirror
the YAML test’s exclusion check so the test fails if non-configured keys slip
into BaseEnv.

internal/cmn/config/env.go (1)

136-145: dedupePreserveOrder can be linear-time with a seen map.

Line 139 repeatedly calls slices.Contains, making this O(n²). A map-backed check keeps order while reducing overhead.

♻️ O(n) dedupe preserving order

 func dedupePreserveOrder(values []string) []string {
-	var deduped []string
+	deduped := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
 	for _, value := range values {
-		if slices.Contains(deduped, value) {
+		if _, ok := seen[value]; ok {
 			continue
 		}
+		seen[value] = struct{}{}
 		deduped = append(deduped, value)
 	}
 	return deduped
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@internal/cmn/config/env.go` around lines 136 - 145, The dedupePreserveOrder
function is currently O(n²) because it calls slices.Contains for each element;
change it to O(n) by using a map (e.g., map[string]struct{}) named seen to track
which strings were already encountered, iterate the input slice once, append
each value to deduped only if not present in seen, and mark it in seen to
preserve original order while avoiding repeated containment checks.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes