[Detail Bug] CLI: `bugs list` shows impossible page numbers on some client-side filtered empty results

[detail-app]

Detail Bug Report

https://app.detail.dev/org_5f375fe3-a706-4e9a-a6f7-800f2439b3f6/bugs/bug_97b4a1ed-ed53-471a-8b10-8f3a58c83f73

Introduced in #264 by @sachiniyer on Apr 22, 2026

Summary

• Context: In bugs.rs, client-side filtering early-return paths display impossible page numbers like "Page: 5 of 1"
• Bug: In bugs.rs, client-side filtering early-return paths display impossible page numbers like "Page: 5 of 1"
• Actual vs. expected: Actual: when a user requests a high page (e.g. --page 5) and client-side filtering yields 0 results, output can show an impossible pager like Page: 5 of 1. Expected: page should be clamped to the last valid page (typically 1), e.g. Page: 1 of 1.
• Impact: Misleading pagination output in bugs list for certain client-side filtered, empty-result scenarios; original issue [Detail Bug] CLI: Filtered scans/bugs list can show impossible pagination (page > total pages) #328 was only partially fixed.

Code with Bug

// bugs.rs:557
return output_list(&filtered, 0, *page, *limit, format);
// <-- BUG 🔴 passes raw requested page in early-return path; not clamped

// bugs.rs:567
return output_list(&filtered, 0, *page, *limit, format);
// <-- BUG 🔴 passes raw requested page in early-return path; not clamped

Explanation

clamp_page(page, total, limit) exists specifically to prevent "impossible" paging when client-side filtering shrinks the result set below the requested page. Commit 2de4743 applied clamp_page in the main client-side filtered path, but these early-return branches still call output_list with the raw *page. When filtering produces total = 0 (or otherwise fewer pages than requested), these branches can still render Page: N of 1.

Recommended Fix

Clamp the page before calling output_list in both early-return branches, e.g.:

let page = clamp_page(*page, 0, *limit);
return output_list(&filtered, 0, page, *limit, format);

History

This bug was introduced in commit 6cd3823. The commit added an early-return path for the --vulns empty-results case that passed the raw *page value to output_list without clamping. This duplicated an existing bug pattern from commit 50f8400 (which added a similar unclamped early return for --introduced-by). When commit 2de4743 later fixed issue #328 by adding clamp_page to the main filtered path, it missed both early-return branches, leaving the bug partially unfixed.