[PR #6296] test(cli): protect web execution duration schema and argv bounds #7263

New issue

Open

opened 2026-11-01 21:46:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6296
Author: @harshitethic
Created: 10/22/2026
Status: 🔄 Open

Base: main ← Head: fix/web-execution-duration-schema

📝 Commits (1)

8ec365a test(cli): protect execution-duration discovery and argv admission bounds

📊 Changes

1 file changed (+54 additions, -0 deletions)

View changed files

➕ tests/boundary/cli/webExecutionDurationSchema.test.ts (+54 -0)

📄 Description

Summary

Following maintainer feedback on the now-fixed #6290, this PR has been rebased onto current upstream main and narrowed to one CLI-boundary regression test file. The production schema and duration bounds are already correct upstream, so this PR no longer changes them.

Problem and expected behavior

The public observe-web-execution --schema --json contract must advertise the same 1–2,147,483,647 ms duration range the runtime admits. Incur must coerce explicit numeric argv values rather than reject them as strings. A future change to either boundary would cause avoidable client retries or incorrect CLI availability.

Change and scope

Adds tests/boundary/cli/webExecutionDurationSchema.test.ts (5 cases).
Validates the emitted JSON Schema using Ajv2020: default, minimum, maximum, fractional rejection, zero and overflow.
Invokes the real CLI parser for omitted, minimum, typical and maximum arguments, and asserts those requests reach endpoint admission; rejects overflow before connecting.
No changes to production implementation, authority, providers, persistent data, generated catalogs or packages.
Related: #6290 (fixed in upstream main; this change prevents regression).

Evidence and validation

Executed on the user's Kali Linux x64 workstation against upstream main ef11f77836ccf85d4458aa18398c36ba592616a5, Node 24.22.1 (pinned), npm 11.19.1, with npm ci --ignore-scripts --no-audit --no-fund:

npm run test:focused -- tests/boundary/cli/webExecutionDurationSchema.test.ts src/application/WebRuntimeService.test.ts — 16 passed (5 CLI, 11 service).
Negative control: temporarily changed the CLI maximum to Number.MAX_SAFE_INTEGER in an isolated local checkout; the new suite failed as intended (1 failed, 4 passed). Restored the original source; final remote diff contains the regression test only.
npm run verify:test-discovery — 2,681 test files discovered exactly once.
npm run check:fast — typecheck and lint passed.
npx --no-install oxfmt --check tests/boundary/cli/webExecutionDurationSchema.test.ts — passed.

The real CLI test intentionally attempts an unreachable loopback CDP endpoint at 127.0.0.1:1; no real browser/provider session is exercised. This does not verify actual browser execution. The full monorepo suite and other platforms were not run. Required upstream Actions currently report action_required for this fork; CI has not passed.

Contract and boundary impact

Semantic owner: unchanged; test validates the public CLI adapter's advertised schema and numeric argument admission against the existing runtime contract.
Contribution scope: ordinary regression coverage; no new provider or execution capability.
CLI/MCP contract: unchanged; existing behavior protected.
Evidence, selection, authority and cleanup: unchanged in product code.
Generated metadata, installation and release: no changes.

Author readiness

Human owner: @harshitethic

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

AI-assisted update; the declarations are intentionally left for the human owner. The PR remains a draft pending that review and maintainer authorization of required checks.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6296 **Author:** [@harshitethic](https://github.com/harshitethic) **Created:** 10/22/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/web-execution-duration-schema` --- ### 📝 Commits (1) - [`8ec365a`](https://github.com/morluto/rea/commit/8ec365ad5782391a3e8a88fe815733605eeb5b55) test(cli): protect execution-duration discovery and argv admission bounds ### 📊 Changes **1 file changed** (+54 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `tests/boundary/cli/webExecutionDurationSchema.test.ts` (+54 -0) </details> ### 📄 Description ## Summary Following maintainer feedback on the now-fixed #6290, this PR has been rebased onto current upstream main and narrowed to **one CLI-boundary regression test file**. The production schema and duration bounds are already correct upstream, so this PR no longer changes them. ## Problem and expected behavior The public `observe-web-execution --schema --json` contract must advertise the same 1–2,147,483,647 ms duration range the runtime admits. Incur must coerce explicit numeric argv values rather than reject them as strings. A future change to either boundary would cause avoidable client retries or incorrect CLI availability. ## Change and scope - Adds `tests/boundary/cli/webExecutionDurationSchema.test.ts` (5 cases). - Validates the emitted JSON Schema using Ajv2020: default, minimum, maximum, fractional rejection, zero and overflow. - Invokes the **real CLI parser** for omitted, minimum, typical and maximum arguments, and asserts those requests reach endpoint admission; rejects overflow before connecting. - No changes to production implementation, authority, providers, persistent data, generated catalogs or packages. - Related: #6290 (fixed in upstream main; this change prevents regression). ## Evidence and validation **Executed** on the user's Kali Linux x64 workstation against upstream main `ef11f77836ccf85d4458aa18398c36ba592616a5`, Node 24.22.1 (pinned), npm 11.19.1, with `npm ci --ignore-scripts --no-audit --no-fund`: - `npm run test:focused -- tests/boundary/cli/webExecutionDurationSchema.test.ts src/application/WebRuntimeService.test.ts` — **16 passed** (5 CLI, 11 service). - **Negative control:** temporarily changed the CLI maximum to `Number.MAX_SAFE_INTEGER` in an isolated local checkout; the new suite failed as intended (**1 failed, 4 passed**). Restored the original source; final remote diff contains the regression test only. - `npm run verify:test-discovery` — **2,681 test files discovered exactly once**. - `npm run check:fast` — **typecheck and lint passed**. - `npx --no-install oxfmt --check tests/boundary/cli/webExecutionDurationSchema.test.ts` — **passed**. The real CLI test intentionally attempts an unreachable loopback CDP endpoint at `127.0.0.1:1`; no real browser/provider session is exercised. This does not verify actual browser execution. The full monorepo suite and other platforms were not run. Required upstream Actions currently report `action_required` for this fork; **CI has not passed**. ## Contract and boundary impact - Semantic owner: unchanged; test validates the public CLI adapter's advertised schema and numeric argument admission against the existing runtime contract. - Contribution scope: ordinary regression coverage; no new provider or execution capability. - CLI/MCP contract: unchanged; existing behavior protected. - Evidence, selection, authority and cleanup: unchanged in product code. - Generated metadata, installation and release: no changes. ## Author readiness Human owner: @harshitethic - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. AI-assisted update; the declarations are intentionally left for the human owner. The PR remains a draft pending that review and maintainer authorization of required checks. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-01 21:46:35 +00:00

bsakaguchi referenced this issue

2026-11-05 01:47:43 +00:00

[PR #7263] [CLOSED] fix(javascript): keep timer cancellation within Node's handle family #7797