chore(cli): --output silently truncates an existing CSV (A10-010) [cli part] #2050

Summary

One low-severity correctness defect confirmed against the audited commit: --output silently truncates an existing CSV.

Findings

• --output silently truncates an existing CSV (A10-010)
  • Location: cmd/multi_service_csv.go:198 (os.Create); validateFilePaths at cmd/validators.go:213-222 stats only the parent directory; generateCSVFilename returns cfg.CSVOutput verbatim at cmd/multi_service_helpers.go:162-165 at 3c0f8ac
  • Note: Verifier downgraded from medium to low: the audit log remains as the durable purchase record on the main path.
  • Failure scenario: An operator runs cudly --purchase --output run.csv, then re-runs with the same --output while iterating on filters. os.Create truncates the first run's purchase report. The auto-generated filename is timestamped and safe, so the hazard is confined to the explicit-path case. Scope note from the verifier: on the main purchase path the durable record of what was bought is the append-only audit log (cmd/multi_service.go:401-404, pkg/common/audit.go:28, LeanerCloud/cloud-commitments-go), so the CSV is not the only record; the harm holds fully only on the --input-csv path, which writes no audit records.
  • Evidence:

    file, err := os.Create(filepath) // #nosec G304 -- CLI tool: filepath is an operator-supplied output path argument

  • Suggested fix: In validateFilePaths, os.Stat the --output path and refuse when it exists, or open with os.O_CREATE|os.O_EXCL and surface the collision.

Found by the 2026-09-02 codebase audit, finding A10-010, reported by one reviewer and independently confirmed by a second. Full report: docs/audits/codebase-audit-2026-09-02.md.

Scope after the split

Monorepo split: this repo is now CLI-only (cmd/*.go). A05-015, A06-009, A06-019 lived in internal/purchase, internal/server, internal/analytics, which are not in this repo, so they were split out. A06-022 lived in internal/reporter, which moved to pkg/reporter in the go repo, so it was split out too. This issue is now scoped to A10-010 only, which remains this repo's own code.

Sibling issues:

• chore(purchase/server/analytics): low correctness findings from the 2026-09-02 audit [platform part] cloud-commitments-platform#339 -- A05-015 (empty-selection purchase confirmation), A06-009 (health sub-check), A06-019 (GCP CUD mislabelled RI).
• chore(reporter): filtered-reason summary emitted in Go map order (A06-022) [go part] cloud-commitments-go#110 -- A06-022 (filtered-reason summary map order, now in pkg/reporter).