fix(cli): validate integer tokens before coercion

Validate decimal tokens at the CLI owner before safe-number parsing. Apply the same rule to positional indexes/generations and repeated record selectors, retaining leading-zero decimals and canonical MCP inputs.

Refs #4182

Co-authored-by: Arjun Prabhulal <arjun.prabhulal@gmail.com>
This commit is contained in:
morlutoandArjun Prabhulal committed 2026-10-16 03:13:06 +08:00
1 parent 08a897b2cd
commit 8d8257928b
7 files changed
+123 -23

No files matched your search

+2 -1
View File
@@ -5,6 +5,7 @@ import { CLI_COMMANDS } from "../cliCommandNames.js";
import { logCliCommand } from "../cliLogging.js";
import type { Logger } from "pino";
import type { CliInstance } from "./types.js";
import { cliIntegerArgument } from "./options.js";
import { withCommandCancellation } from "./commandCancellation.js";
import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
@@ -26,7 +27,7 @@ export const registerWebNetworkCaptureCommands = (
}),
options: z.object({
record: z
.array(z.coerce.number().int().nonnegative())
.array(cliIntegerArgument(0))
.optional()
.describe("Zero-based producer ordinals; repeat to select several"),
sensitiveValue: z