fix(update): require integer timeout values#83310
Conversation
|
Codex review: needs maintainer review before merge. Workflow note: Future ClawSweeper reviews update this same comment in place. How this review workflow works
Summary Reproducibility: yes. Current main’s shared parser uses PR rating Rank-up moves:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. Real behavior proof Next step before merge Security Review detailsBest possible solution: Land the narrow shared parser fix with its regression coverage, then let the linked bug close through the PR’s closing reference. Do we have a high-confidence way to reproduce the issue? Yes. Current main’s shared parser uses Is this the best way to solve the issue? Yes. Fixing the shared update timeout parser is the narrow maintainable path because update, status, finalize, and wizard all flow through this helper. What I checked:
Likely related people:
Remaining risk / open question:
Codex review notes: model gpt-5.5, reasoning high; reviewed against 645ef817b66e. |
f01d899 to
8dfb6eb
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
8dfb6eb to
fc07931
Compare
|
Thanks, fixed in f5e6e06. Behavior addressed: Verification:
I also tried the requested @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
* fix(update): require integer timeout values * fix(update): reject blank timeout values
Summary
--timeoutvalues to be complete positive integer second values1.5and10abcFixes #83281.
Real behavior proof
Behavior or issue addressed: update
--timeoutnow rejects values that are not complete positive integer seconds instead of accepting numeric prefixes.Real environment tested: WSL Ubuntu-24.04 source worktrees for
origin/mainandfix-update-timeout-integer-83281; proof generated with the established deterministic before/after image artifact pattern and published toproof-artifacts/pr-83310-fresh.Exact steps or command run after this patch: Ran the same source-level CLI parser command on
origin/mainand PR head:node --import tsx /tmp/pr83310-timeout-proof.mjs, importing the realparseTimeoutMsOrExit()implementation and exercising1.5,10abc,0,-1,10,001, and omitted timeout.Evidence after fix:
Fresh deterministic proof artifacts:
Observed result after fix:
origin/mainaccepts partial numeric prefixes such as1.5=>1000ms and10abc=>10000ms, so the regression proof fails before the patch. PR head rejects1.5,10abc,0, and-1with the invalid-timeout path while still accepting complete positive integer strings like10and001.What was not tested: A full live package update was not run; this proof isolates the real CLI timeout parser before any network/package-manager update work begins.
Before evidence: The linked before log shows
origin/mainreturning1000for1.5and10000for10abc, followed byASSERTION FAILED: --timeout must reject partial numeric strings and non-positive values..Root Cause
Number.parseInt, which accepts numeric prefixes instead of requiring the full string to match the option contract.NaNand non-positive parsed values.Regression Test Plan
src/cli/update-cli/shared.command-runner.test.ts.parseTimeoutMsOrExitbefore any update command runs.Validation
CI=1 node scripts/run-vitest.mjs src/cli/update-cli/shared.command-runner.test.tspnpm check:changed