[BUG] [v0.0.7] cortex agent show --model <bad>` accepts any string without validation — inconsistent with `cortex agent generate --model` which validates and bails

[FredAmalasuintha311]

Project

cortex

Description

run_show includes the --model override in JSON/text output without calling validate_model_name. run_generate calls validate_model_name(model_arg)? and bails on invalid formats. A user running cortex agent show my-agent --model 'not/a/model' receives output with the invalid model name embedded, giving the impression the override is valid. The same string would cause an immediate error in agent generate.

Error Message

None for `agent show`; for `agent generate`: `Error: invalid model name 'not/a/model'`.

Debug Logs

System Information

- OS: Windows 11
- Cortex version: `cortex 0.0.7 (7954d02 2026-03-30)`

Screenshots

20260406_094346_50_8.mp4

Steps to Reproduce

1. Run cortex agent show my-agent --model 'totally@invalid!'.
2. Observe: output shows Model: totally@invalid! (override via --model) — no error.
3. Run cortex agent generate "test" --model 'totally@invalid!' — fails with validation error.

Expected Behavior

agent show --model should validate the model name format the same way agent generate --model does.

Actual Behavior

agent show --model should validate the model name format the same way agent generate --model does.

Additional Context

Code Evidence

• Path: src/cortex-cli/src/agent_cmd/handlers/show.rs
• Permalink: src/cortex-cli/src/agent_cmd/handlers/show.rs#L37-L43
• Symbols: run_show — model_override.clone() inserted directly with no validation; compare generate.rs L69-L76 which calls validate_model_name(model_arg)?

[echobt]

Validation Verdict: VALID

Reasoning:
The issue reports that cortex agent show --model <bad> accepts any string without validation, unlike cortex agent generate --model which validates the model name.

I verified the code in src/cortex-cli/src/agent_cmd/handlers/show.rs. The run_show function takes the --model override and directly inserts it into the JSON output or prints it without any validation:

    if args.json {
        // ...
            // Add model override if provided via --model flag
            if let Some(ref model_override) = args.model {
                map.insert(
                    "model_override".to_string(),
                    serde_json::Value::String(model_override.clone()),
                );
            }
        // ...
    }

    // ...
    // Show model - either from --model override or agent's configured model
    if let Some(ref model_override) = args.model {
        println!("Model: {model_override} (override via --model)");
    } else if let Some(ref model) = agent.model {
        println!("Model: {model}");
    }

In contrast, src/cortex-cli/src/agent_cmd/handlers/generate.rs correctly validates the model name:

    // Validate model argument
    let model_arg = args.model.trim();
    if model_arg.is_empty() {
        bail!("Error: Model name cannot be empty");
    }

    // Validate the model name format and existence
    let valid_model = validate_model_name(model_arg)?;

The screenshot confirms the behavior, showing Model: totally@invalid! (override via --model) when running cortex agent show my-agent --model 'totally@invalid!'.

The issue is valid, reproducible, and the code confirms the missing validation in run_show. No exact duplicates were found.

graph TD
    A[User runs agent show with invalid model] --> B[Command should validate model name and fail]
    A --> C[Command succeeds and outputs invalid model name]
    C --> D[Output shows invalid model override]
    style C fill:#ff6b6b
    style D fill:#ff6b6b

Loading