Release: multiple -p/-r flags support

[yimsk]

Changes from develop

• feat: support multiple -p/-r flags with comma separation (feat: support multiple -p/-r flags with comma separation #111)
• fix: support -p __env_only__ and __sdk_default__ special IDs
• refactor: extract parseFlagsFromArgs for test isolation

Merge with merge commit (not squash)

[claude]

Code Review - PR #112: Release: multiple -p/-r flags support

Summary

This PR implements support for multiple profiles and regions via comma-separated values or repeated flags. The changes are well-structured with good test coverage. Overall, this is high-quality work, but there are a few important issues to address.

---

Critical Issues

1. Validation bypassed for special profile IDs (Security/Bug)

Location: cmd/claws/main.go:43-49

The validation loop rejects special profile IDs like env_only and sdk_default because they contain underscores, which pass the regex but the validation error message suggests only alphanumeric, hyphen, underscore, period are valid. However, looking at the code:

• profileNamePattern allows underscores
• But the special IDs env_only and sdk_default are mentioned in the PR description as supported
• These special IDs are correctly handled in ProfileSelectionFromID() at line 253

Issue: The validation will incorrectly reject these special profile IDs when passed via CLI flags.

Recommendation: Update the validation to explicitly allow these special profile IDs or adjust IsValidProfileName to handle them.

---

Code Quality Issues

2. Assignment in condition (Code Quality)

Location: cmd/claws/main.go:135, 144

While this works, using assignment within the condition can reduce readability. Consider separating the assignment from the condition check for better readability and easier debugging.

---

3. Missing edge case tests (Test Coverage)

Location: cmd/claws/main_test.go

The tests are comprehensive but missing a few edge cases:

• Behavior when both -p and -e (env credentials) flags are provided
• What happens when a flag is provided without a value (e.g., -p -r us-east-1)
• Testing with the special profile IDs env_only and sdk_default
• Maximum number of profiles/regions (potential memory concerns)
• Very long comma-separated lists

Recommendation: Add tests for these scenarios to ensure robust handling.

---

4. Flag parsing may consume next flag as value (Bug)

Location: cmd/claws/main.go:131-148

If a user provides -p or -r as the last argument or followed by another flag, the code will silently consume the next argument as a value. For example: claws -p -r us-east-1 would treat -r as the profile name.

Recommendation: Add validation to check if the next arg is a flag before consuming it.

---

Performance Considerations

5. O(n²) complexity with slices.Contains (Performance)

Location: cmd/claws/main.go:135, 144

Using slices.Contains in a loop creates O(n²) complexity for deduplication. For typical use cases (few profiles/regions), this is fine. However, consider using a map for better performance with many values.

Priority: Low (only matters with many values)

---

Positive Observations

✅ Excellent test coverage - The new tests are well-structured and cover most scenarios
✅ Good refactoring - Extracting parseFlagsFromArgs makes the code testable
✅ Consistent code style - Follows existing patterns in the codebase
✅ Documentation updated - README and docs reflect the new feature
✅ Backward compatible - Single values still work as before
✅ Demo updated - The tape and GIF show the feature in action

---

Security Considerations

No significant security issues identified. The validation functions IsValidProfileName and IsValidRegion provide good input sanitization, though see issue #1 about special profile IDs.

---

Minor Suggestions

• Consider adding an example in the help text showing how to mix comma-separated and repeated flags
• The demo tape changes (/public → /web, j → G) seem unrelated to this PR - consider mentioning why in the PR description
• Line 84: The log statement could be formatted to be more readable with multiple profiles/regions

---

Recommendation

Request changes - Address issue #1 (special profile ID validation) and issue #4 (flag value validation) before merging. The other issues are nice-to-haves that can be addressed in follow-up work if preferred.

---

Great work overall! This is a useful feature with solid implementation.