fix(tui): slash menu hijacks fully-typed commands via description matches

[Desperado]

Problem

Typing /update in the REPL runs /set instead (reproduced twice by the user on v1.28.0):

qmax [7107817d] > /set
✗ Usage: /set <key> <value>
● Keys: model, project, ...

Root cause

Two defects compound in internal/tui/input.go:

1. /update is missing from slashMenuItems (as are /context, /gemma, /plan). Typing / on an empty line opens the slash menu, so a command absent from the table can never be submitted as typed text — Enter always submits a menu row.
2. The menu filter matches descriptions, not just command names, and /set's description is literally "Update config". Filter update → the only visible row is /set → Enter submits it.

Fix

• Add the missing commands to the menu (/update, /context, /gemma, /plan).
• filteredMenuItems ranks command-name matches ahead of description matches, so a typed name is never outranked by a description coincidence.
• Enter with a filter that exactly names a command submits that command verbatim, regardless of which row the selection sits on — typing any real command in full always runs exactly that command.

Tests

• TestSlashMenuFilterRanksCmdMatchAheadOfDescMatch — filter update: /update (Cmd match) ranks before /set (Desc "Update config")
• TestSlashMenuEnterSubmitsExactTypedCommand — selection deliberately parked on the /set row, Enter still submits /update
• TestSlashMenuCoversCriticalCommands — the four missing commands plus the core set are present in the table

Test plan

• go test ./... — 0 failures; gofmt/vet clean
• Manual: type /update in a session on a build with this fix → the update flow runs

[sigilix]

Sigilix Overview

Effort: 2/5 (small)

Quality gates

• ✅ PR title follows convention
• ✅ PR description is complete
• ℹ️ PR is linked to an issue — No Closes #N / Closes SIG-N keyword found in PR body or commit messages.

Summary — latest push

Fixes a bug where typing a fully-qualified slash command like /update in the TUI would execute /set instead, because /update was missing from the menu and /set description-matched the filter. Adds the four missing commands to the slash menu table, ranks command-name matches ahead of description matches in the filter, and introduces an exact-match rule so Enter always submits a verbatim command when the filter exactly names one. Targeted tests cover the ranking fix, the exact-match submission override, and the completeness of the menu table.

Important files

File	Score	Notes	Next step
internal/tui/input.go	4/5	Adds missing slash commands to the menu table, rewrites the filter to rank command matches ahead of description matches, and adds an exact-match Enter override to prevent command hijacking.	Add a comment to the exact-match block explaining why the loop iterates slashMenuItems instead of filtered to clarify that the intent is to validate against the authoritative command registry, not just the current view.
internal/tui/input_test.go	3/5	Adds three tests pinning the filter ranking, the exact-match Enter submission, and the presence of critical commands in the menu table.	Add a test verifying that when the filter does not exactly match a command, Enter falls back to submitting the currently selected menu row to ensure the exact-match override doesn't regress normal menu behavior.

Sequence diagram

sequenceDiagram
    participant User
    participant InputModel
    participant Filter
    participant Menu
    User->>InputModel: Type /update
    InputModel->>Filter: filter = "update"
    Filter->>Menu: Rank /update (Cmd match) ahead of /set (Desc match)
    User->>InputModel: Press Enter
    InputModel->>InputModel: Exact match "/update" found in slashMenuItems
    InputModel-->>User: Submit /update verbatim

Loading

Confidence: 4/5

The fix is narrow and well-targeted with three focused tests covering the core regression, though the exact-match Enter override introduces a new control-flow path that should be manually verified to ensure it doesn't interfere with partial matches.

• Verify the exact-match Enter override at lines 366-375 doesn't prevent submitting a partial filter match when the user intentionally selects a different row than the exact command.
• Confirm the four newly added commands (/context, /plan, /gemma, /update) at lines 66-82 are wired to their actual handlers in the REPL dispatch.
• Check that the filteredMenuItems ranking at lines 421-434 preserves the original relative order within cmdMatches and descMatches slices to avoid unpredictable menu jumping.

Suggested labels: bug

---

_{Posted · defeb4b · 0 findings — View review
Dismiss @sigilix dismiss <reason> (not-a-bug | bad-anchor | already-covered | too-minor | wrong-context) · Re-run /sigilix review}

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: evidence-backed scan

Files eligible: 2 · Files reviewed: 2 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 2, reviewed 2 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 2, reviewed 2 · hybrid · served qwen3.7-plus
Overall review evidence	clean
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Change diagram — Flow

graph TD
    A[User presses Enter] --> B{Exact command match?}
    B -- Yes --> C[Submit exact command]
    B -- No --> D[Submit selected menu item]
    E[User types filter] --> F{Filter matches}
    F --> G[Rank Cmd matches first]
    G --> H[Rank Desc matches second]

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit defeb4beeb904cfd16881ac4aaa578bfbd2f841e · run 2026-09-02T16:34:22+00:00 · model served qwen3.7-plus, gemini-3.1-flash-lite · model requested qwen3.7-plus, gemini-3.1-flash-lite · model review recorded — 927 model output tokens · model source repository ai_review_preferences.preferred_model · re-review 2 · proof counts {}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; inline findings are attached to this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	✅ Clean · gemini-3.1-flash-lite · completed · 2 eligible / 2 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 2 eligible / 2 reviewed · qwen3.7-plus
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5092353224 and overview #5512924864 confirmed
🧪 Repo Tests	✅ 725/725 passed (go)

_{Powered by QualityMax — AI-Powered Test Automation}