[Hackathon] invalid --since and missing --password-file crash instead of returning VALIDATION_ERROR #79
Description
Discord Username / User ID
uisupersaiyan3
What does this improvement do?
Summary
Two categories of invalid user input currently produce unhandled exceptions
(raw Node stack traces, exit code 1) instead of the CLI's standard typed
validation error (exit code 5):
- An extremely large
--sinceduration overflows the valid JavaScript date
range and crashes during date conversion. - A non-existent
--password-filepath during project creation or update
crashes with an unguarded filesystem error.
In both cases, input that a user could plausibly supply by mistake bypasses
the CLI's validation-error handling entirely and surfaces as an
unhandled exception instead.
Affected Code
| File | Function | Issue |
|---|---|---|
src/commands/test.ts |
parseDuration |
No bounds check on the parsed date before calling .toISOString() |
src/commands/project.ts |
Password file handling (create/update) | readFileSync call is unguarded; missing file throws raw ENOENT |
Details / implementation notes
issue fixed in PR #27
Confirmations
- I have searched existing issues and this is not a duplicate.
- I have provided my Discord identity above for reward coordination.
Activity
zeshi-du commentedon Jul 18, 2026
Status correction after re-auditing the code: PR #27 fixed only the --since half of this issue (parseDuration overflow). The --password-file half is still live on main — project.ts calls readFileSync(opts.passwordFile) bare at three sites, so a missing file still crashes with a raw ENOENT instead of a VALIDATION_ERROR envelope. Keeping this open scoped to the password-file half; the split-out password-file guard from #248's rework (see the review there) is the natural vehicle. Sorry for the earlier over-claim.
naufalfx805-source commentedon Aug 5, 2026
/assign
Picking up the remaining
--password-filehalf, scoped per @zeshi-du's 2026-07-18 status correction.Planning to cover the
project createandproject updatecall sites (project.ts:213,project.ts:329) and leaveproject auto-auth(project.ts:579) to #282, which is already in progress and covers that site alongside its three sibling flags. The guard will be a shared helper taking the flag name, so #282 can adopt it for--credential-file/--client-secret-file/--refresh-token-filewithout rework.testsprite-hob commentedon Aug 5, 2026
Assigned to @naufalfx805-source. Thanks for taking this on. (1 more slot available.)
Your open assigned issues (2/3):
fix(project): guard --password-file reads on create/update (#79) (#302)