normalizeIssueNumber parsed with Number.parseInt, which stops at the
first non-digit ("42oops" -> 42, "42.9" -> 42, "4e2" -> 4) and loses
precision past 2^53 (9007199254740993 became 9007199254740992). The CLI
shares this helper for --issue, --limit, and the positional issue number,
so malformed values silently targeted the wrong issue before any integer
guard downstream could notice.
Validate the entire trimmed decimal token and require
Number.isSafeInteger so malformed or out-of-range values throw
"Invalid issue number" during argument parsing, before the state store
is opened or GitHub is contacted. Whitespace, leading plus, and leading
zero tolerance is preserved. Regression coverage added at both the
library level (tests/lib/github-coordination-gh-api.test.js) and the CLI
argument parser (tests/scripts/github-coordination.test.js).
Fixes#3514
Reuse the existing scripts boundary asset and guard for commands-core without hooks. Preflight selected helper scopes and preserve user module metadata, unowned/edited JS interpretation, and boundary ownership through uninstall. Actual installed ESM help/JSON, receipt, reinstall/uninstall and 34 focused cases pass. OpenCode boundary 8/8, adapters 51/51, manifests 43/43; focused coverage exceeds 80%. Two root-owned legacy ESM core-profile fixtures require correction; no unsupported states weakened.
Scoped adaptation of PR #2716: keep compact rendering as the default and require ECC_STATUSLINE_USAGE=1. Installer registration, managed aliases and the Codex background bar remain outside this slice.
Scoped adaptation from PR #3088. Keep the canonical atomic writer and dispatcher; exclude the broader provider/tool changes.
Co-authored-by: Geronimo <varungore1@gmail.com>
Reproduced issue #3485 on installed Codex CLI 0.162.0. Keep user legacy choices for explicit migration and verify disposable install, repair, reinstall and removal.
- questionIdsFor and condensedHintFor take an optional
{ externalContract: true }; without it a code change that handles data
asks data-schema only, and an unknown profile gets the original four
questions and condensed hint.
- The hook reads GATEGUARD_EXTERNAL_CONTRACT_QUESTION with the same
spellings as GATEGUARD_METRICS and passes it to the full denial, the
condensed denial and the metrics record, so all three agree.
- The effectiveness harness's arm patch forwards the option, so an arm
never drops it silently.
Docs: change-profile.md gains an External-contract question section and
qualifies "byte-identical to the fixed four questions"; design-notes.md,
SKILL.md (switch table, data rule, word-for-word set) and CHANGELOG say
the fifth question is opt-in; question-effectiveness.md and the harness
README note that the runner clears GATEGUARD_* variables, so a gate arm
from a current tree measures the gate without the question.
skill-triggers@1.json: registryDigest refreshed for the SKILL.md body
change; the description and triggers are unchanged.
- Read file-type filters as include and exclusion globs: rg -t/--type
and the Grep tool's type include ripgrep 14.1's globs for the type,
rg -T/--type-not exclude them, fd -e/--extension includes *.<ext>.
An unknown type name, --type-add or --type-clear is an unreadable
filter and never credits, like --exclude-from.
- Treat a path pattern as a filter: the Glob tool's pattern must match
the target below its root; a shell glob operand must match the target
or a directory above it; a git pathspec matches the same way with its
* also matching /. One operand that admits the target is enough.
- Extend "a search of the target itself gives nothing" to searches
confined to the target's own file name: when every include, the Glob
pattern, or every path pattern ends in that exact name, the stem never
credits, and the closest-miss note says it was a lookup.
- Tokenize PowerShell searches with backslashes kept as path separators,
as the read-only shell check already does; the old literal-prefix scope
hid that src\core\*.ts reached the parser as srccore*.ts.
- Make an edit non-trivial when either text holds U+2028, U+2029 or
U+0085, which end a JavaScript or C# line comment; the lexer splits
lines only at \n and \r.
Extracting applyLongFilter, grepDetail and stemCredits leaves every
touched function at or below its complexity on main.
haelyra