fix(cli): clarify oversized config mutation file errors#110593
Conversation
|
Codex review: needs maintainer review before merge. Reviewed July 18, 2026, 11:15 PM ET / July 19, 2026, 03:15 UTC. Summary PR surface: Source +8, Tests +13. Total +21 across 2 files. Reproducibility: yes. from source and the contributor’s direct CLI transcript: pass an existing file above Review metrics: none identified. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Next step before merge
Security Review detailsBest possible solution: Land the focused diagnostic and boundary-test improvement after maintainers confirm the current-head merge result and required checks; retain the existing shared config-mutation limit rather than adding another capacity setting. Do we have a high-confidence way to reproduce the issue? Yes, from source and the contributor’s direct CLI transcript: pass an existing file above Is this the best way to solve the issue? Yes. Reusing the existing config-mutation bounded-read contract and improving its CLI-specific diagnostic is narrower and safer than creating another file-size setting or a parallel reader. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against ed546bdcf540. Label changesLabel justifications:
Evidence reviewedPR surface: Source +8, Tests +13. Total +21 across 2 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
Review history (15 earlier review cycles; latest 8 shown)
|
Behavior Proof — Bounded Batch File ReadTest Coverage运行 Live Bounded-Read Validation直接验证 三种场景全部通过:
CI Gate
|
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
PR body updated with behavioral proof. @clawsweeper re-review |
|
PR body updated with batch-file size boundary proof (small, 7 MB near-limit, 20 MB rejected). @clawsweeper re-review |
|
@clawsweeper re-review |
|
@clawsweeper re-review |
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
Comprehensive Runtime Behavior ProofThis comment provides detailed runtime proof for all code paths changed in this PR, covering normal operation, boundary behavior, and error handling. 1. Existing Test Suite — 11/11 Passing2. Runtime Boundary Proof — 9/9 ScenariosTerminal transcript from exercising the actual 3. Size Contract RationaleThe 8 MB limit is chosen for the following reasons:
Even 10,000 batch entries (a genuinely extreme case — configuring thousands of settings at once) produces only ~400 KB of JSON, which is 5% of the 8 MB cap. The 8 MB limit is more than sufficient for any legitimate batch operation while preventing OOM from corrupted files, runaway scripts, or malicious input. 4. Key Assertions
@clawsweeper re-review |
|
Updated PR body with comprehensive boundary proof and size contract rationale. Added exact-boundary acceptance test (8 MB boundary) and pushed commit 70699db. @clawsweeper re-review |
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@joshavant This PR introduces an 8 MB cap for ClawSweeper requires a maintainer to confirm whether:
Could you let me know which direction to take? Happy to make any adjustments needed. |
Behavior Proof — Updated (July 19)Test Coverage — Fresh runRunning This covers normal batch file parsing, exact 8 MB boundary acceptance, oversized file rejection with the documented error message, malformed file handling, and missing file handling. Existing CLI-level proof (from PR body)
Full CIAll CI gates green — preflight, lint, types, checks, tests, security scans. Remaining: maintainer decision on batch-file capacity contractThe
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
9f312eb to
e7c5417
Compare
|
Rebased on latest main — now uses @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
Co-authored-by: 陈宪彪0668000387 <[email protected]>
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: fix(cli): clarify oversized config mutation file errors This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
|
Merged via squash.
|
) * fix(cli): bound batch file read with size cap and user-friendly error message * chore: retrigger CI after flaky ACP test failure * fix(cli): clarify config mutation file limits Co-authored-by: 陈宪彪0668000387 <[email protected]> --------- Co-authored-by: Peter Steinberger <[email protected]>
Context: #110516
What Problem This Solves
Current
mainalready bounds config mutation files at 8 MiB through the pinned descriptor reader landed in #110516. Its overflow error is intentionally generic, however, so users ofconfig set --batch-fileorconfig patch --fileonly seeFile exceeds 8388608 byteswithout the responsible flag or supported limit.Why This Change Was Made
The shared
readConfigMutationFileSyncowner now accepts the source flag and translates bounded-reader overflow consistently for both file-based config mutation commands. This keeps the existing security boundary, symlink behavior, descriptor pinning, and inclusive byte limit unchanged while avoiding duplicated caller policy.The original contributor patch supplied the batch-file diagnostic and exact-boundary regression. The maintainer preparation consolidated that message at the shared reader, applied it to the sibling patch-file path, simplified the exact-limit fixture, and preserved contributor credit.
User Impact
Files smaller than or exactly 8 MiB continue to work. Oversized inputs now report the responsible flag, the 8 MiB limit, the exact byte limit, and the path. Missing-file and malformed-JSON behavior is unchanged.
Evidence
node scripts/run-vitest.mjs src/cli/config-set-input.test.ts src/cli/config-cli.test.ts— 2 files, 155 tests passed.oxfmt --checkpassed for all four touched files.git diff --checkpassed.Provenance
#110516 established the shared 8 MiB bounded reader on current
main. This PR retains the original contributor's diagnostic and boundary-test work while finishing the sibling caller consistency at the same owner boundary.