fix(explore): avoid panic when printing an empty result set

[thegoodengineer]

Summary

Pressing p ("print and exit") in the --format explore viewer panics when the result set is empty.

getSelectedContent indexes rowData at the table cursor without checking that a row exists:

https://github.com/openai/openai-cli/blob/7d87ee2/internal/jsonview/explorer.go#L423-L434

An empty array or object builds a TableView with no rows, table.Cursor() returns 0, and the index panics.

navigateForward already guards this exact case (added in TestNavigateForward_EmptyRowData), so this looks like the same oversight in the sibling path rather than an intended difference.

How it is reached

Any list endpoint that returns no results. ExploreJSONStream collects zero items, marshalItemsToJSONArray returns [], and newTableView builds a table with no rows:

https://github.com/openai/openai-cli/blob/7d87ee2/internal/jsonview/explorer.go#L331-L349

So on an account with no files:

openai files list --format explore

then press p, and the CLI exits with a runtime panic and a Go stack trace instead of printing anything. The same applies to a top level empty object via ExploreJSON.

Every other key binding (↑, ↓, ←, →, r, q) already handles the empty view fine. p is the only one that crashes.

Reproduction

Reverting just the one line change and running the test added here:

--- FAIL: TestGetSelectedContent_EmptyRowData (0.00s)
    --- FAIL: TestGetSelectedContent_EmptyRowData/[] (0.00s)
        Error: func (assert.PanicTestFunc) should not panic
            Panic value: runtime error: index out of range [0] with length 0
            Panic stack:
            github.com/openai/openai-cli/internal/jsonview.(*JSONViewer).getSelectedContent
                internal/jsonview/explorer.go:429
            github.com/openai/openai-cli/internal/jsonview.(*JSONViewer).Update
                internal/jsonview/explorer.go:415

With the fix applied, both cases pass.

Fix

Bounds check the cursor before indexing, and fall back to the container the view is already displaying, so p prints [] or {}. That matches the existing fallback for non table views a few lines above, which returns GetData().Raw.

The test drives Update with the actual p key message rather than calling the unexported helper directly, so it covers the real key binding path and asserts the printed output, not just the absence of a panic.

Notes

• No behavior change for non empty views: the cursor is always in range there, so the existing branch is taken unchanged.
• go build ./... and go vet ./... are clean; go test ./internal/... passes apart from internal/autocomplete, which fails identically on an unmodified checkout in my environment (it shells out to /bin/bash and I am on Windows), so it is unrelated to this change.

[markstuart-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T23:30:16.773433Z	72e912e	New commits
🔒 Security Review	✅ Completed 2026-09-14T23:34:21.842128Z	72e912e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 71dad7992b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 71dad7992b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[saioai]

i reproduced the crash on the old code when pressing p on an empty [] or {}, and this change prints the empty result instead. the new test passed 100 runs. the jsonview race tests, internal tests, repo compilation, vet, module verification, formatting, and diff checks passed locally too. github checks still need to run before merge.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

5 mixed files remain; 0 existing customizations changed.

Compared 552840e37ec4 → 72e912e43bed. Generated baselines verified.

5 existing customizations unchanged

• pkg/cmd/adminorganizationcertificate.go
• pkg/cmd/cmd.go
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34909096412 --repo openai/openai-cli \
  --name castiron-custom-code-34909096412-1 --dir /tmp/castiron-custom-code-34909096412-1
git apply --stat /tmp/castiron-custom-code-34909096412-1/custom-code.patch
cat /tmp/castiron-custom-code-34909096412-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 552840e37ec4b0156ec498159e3bf03804ee643d 72e912e43bed9f24717a2aa96ae594abb1a95eaf
python3 scripts/castiron/custom_code_report.py report \
  --base 552840e37ec4b0156ec498159e3bf03804ee643d \
  --head 72e912e43bed9f24717a2aa96ae594abb1a95eaf --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-72e912e43bed
cat /tmp/castiron-custom-code-72e912e43bed/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch