feat(windows): CU-17tkuw63weu report install metadata in the programs table - #132

🦩 Flamingo Code Review

➖ No tests ran on this commit (no lane ran): nothing here proves the change works.

2 findings: 🔴 0 action required · 🟠 1 recommended · 🔵 1 informational

Advisory: findings do not block the merge.

Checks: missing-test ×1 · 1 defect outside any rule

🟠 Recommended (1)

🔵 Informational (1)

✅ What this change does well

• osquery/tables/system/windows/programs.cpp adds system_component/installer_type/install_scope/install_arch derivation consistently alongside existing field-extraction loop without altering unrelated logic.
• specs/windows/programs.table documents each new column's semantics and edge cases (e.g. empty for MSIX packages) clearly.
• tests/integration/tables/programs.cpp was updated in lockstep with the new schema columns using the existing ValidationMap/NormalType pattern.
• osquery/tables/system/windows/programs.cpp correctly derives install_scope/install_arch from the already-expanded registry key path (HKEY_USERS and WOW6432Node), consistent with how programKeys are built in genPrograms.
• tests/integration/tables/programs.cpp extends the ValidationMap to cover all four new columns, keeping the sanity test aligned with the schema in specs/windows/programs.table.
• programs.cpp sets the new flags inside the existing if (!r.empty()), so a subkey holding only a flag still produces no row and the row set does not change.

Inline comments: 1 new

Outside the lines this diff changes (no inline comment possible)

• 🔵 Informational · info · Minor · missing-test Tool-checked · osquery/tables/system/windows/programs.cpp:223: 2 new or changed definitions have no test referencing them
  No test file in this checkout mentions these definitions. Add or extend tests for the ones that carry logic.

  void keyEnumPrograms(const std::string& key,
  

🧪 Tests and mutation

Tests per lane

Stage 2 ran no lanes: the C++ lane is checks only, with no test or mutation command planned and no check available on this machine. The Windows-only code was not compiled or run.

Address these code-review findings on pull request #132 of flamingo-stack/osquery, most important first.
For each one, make the minimal change that resolves it and do not refactor unrelated code.
If you can show a finding is wrong, skip it and say why.

1. [Recommended] tests/integration/tables/programs.cpp:40 The new classification columns are validated as any text, so the integration test checks none of their values
   The four new columns use NormalType, which accepts any value, and no other test covers the new logic in keyEnumPrograms. A wrong or missing value in system_component, installer_type, install_scope or install_arch passes test_sanity.
2. [Informational] osquery/tables/system/windows/programs.cpp:223 2 new or changed definitions have no test referencing them
   No test file in this checkout mentions these definitions. Add or extend tests for the ones that carry logic.

Next: commit a suggestion, or hand a comment's prompt to your coding agent. React 👍 on a finding that helped and 👎 on one that is wrong: the reviewer learns from both.

Review again. New commits are not reviewed until you ask:

• Review the new commits: only what was pushed since this review
• Review the whole diff again: everything, including what was already reviewed

Or comment @flamingo-review (new commits) or @flamingo-review full (everything). Add the flamingo-review-always label to review every push.

Updated 2026-11-05 17:11 UTC · reviewed from Denys Slieptsov's machine