Skip to content

fix(cli): reject flags as --base branch values - #1431

Open
vianmangal wants to merge 1 commit into
OWASP:mainfrom
vianmangal:codex/issue-1430-base-flag-value
Open

vianmangal wants to merge 1 commit into
OWASP:mainfrom
vianmangal:codex/issue-1430-base-flag-value

Conversation

@vianmangal

@vianmangal vianmangal commented Oct 27, 2026 •

Copy link
Copy Markdown

What changed and why

--base --offline was accepted with --offline stored as the branch name, silently disabling offline mode. The --base=--offline form also accepted a flag as its branch value.

Both forms now use required-value validation to reject missing, empty, or dash-prefixed branch values before scanning. Valid branches, including names with slashes and hyphens, preserve a following --offline flag. The guard uses the same requireFlagValue implementation as #1382, applied to --base here.

Closes #1430

Validation

  • npm ci --no-audit --no-fund
  • npm run lint:tests
  • npm run build
  • node dist/index.js advisories sync
  • npm test: 184 suites and 2,519 tests passed.
  • node scripts/typecheck-changed-tests.mjs origin/main: the new test file passed.
  • git diff origin/main HEAD --check

The 11 new parser cases cover both forms, missing and empty values, long and short flags, and valid branch values followed by --offline. Four regression cases failed on the original code and pass with this fix. Both malformed CLI invocations now exit 1 with --base requires a branch name argument.

The older src/docs/CONTRIBUTING.md mentions npm run format, but current main has no format script or Prettier configuration. This patch follows the existing style and passes the whitespace check.

Summary by CodeRabbit

  • Bug Fixes
    • The --base option now rejects missing, empty, or flag-like values and reports that a branch name is required.
    • Valid branch names continue to work with both spaced and = syntax.

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d265ce18-39ea-46a6-a5f4-773d04e6db94
Commits

Reviewing files that changed from the base of the PR and between ff40875 and 4e8f62b.

Files selected for processing: 2
  • src/cli/args.ts
  • tests/cli/base-args.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

Walkthrough

The CLI parser now rejects missing, empty, and flag-prefixed values for both --base forms. Tests cover these invalid values and confirm that valid branch names are preserved and a following --offline option is enabled.

Changes: Base argument validation

Layer / File(s) Summary
Required value validation and regression tests
src/cli/args.ts, tests/cli/base-args.test.ts
Both --base forms use a helper that rejects undefined, empty, and hyphen-prefixed values. Tests cover invalid values, valid branch names, and preserving a following --offline option.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: sonukapoor

Merge Risk: Minimal · up to 4e8f6

The --base validation change is mergeable with no identified current-head risk.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: rejecting flag-shaped values for the --base branch argument.
Description check Passed The description includes the required change rationale and issue reference. It also provides implementation details and validation results.
Linked Issues check Passed Issue #1430 requires rejection of missing, empty, and flag-shaped --base values before scanning. src/cli/args.ts now applies requireFlagValue to both spaced and equals forms. The guard rejects `…
Out of Scope Changes check Passed The pull request changes only src/cli/args.ts and adds focused parser tests in tests/cli/base-args.test.ts. These changes directly implement and verify issue #1430. No unrelated production behavio…
Full details: Linked Issues check

Explanation

Issue #1430 requires rejection of missing, empty, and flag-shaped --base values before scanning. src/cli/args.ts now applies requireFlagValue to both spaced and equals forms. The guard rejects undefined, empty strings, and values starting with -, and reports --base requires a branch name argument. tests/cli/base-args.test.ts covers both forms, long and short flags, and valid branch names followed by --offline.

Full details: Out of Scope Changes check

Explanation

The pull request changes only src/cli/args.ts and adds focused parser tests in tests/cli/base-args.test.ts. These changes directly implement and verify issue #1430. No unrelated production behavior or unrelated files are changed.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 2 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonukapoor
sonukapoor requested a balanced review from Copilot October 27, 2026 18:31
@coderabbitai

coderabbitai Bot commented Oct 27, 2026

Copy link
Copy Markdown

Add Carrot credits or activate Agent usage billing to use Autofix

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

Both parsing paths enforce the intended validation, and focused regression coverage addresses the reported bug with no blocking issues identified.

No open issues 🎉

What changed in this PR

This PR fixes --base argument parsing so malformed branch values are rejected instead of consuming a following flag such as --offline.

Changes:

  • Adds required-value validation to both --base value and --base=value.
  • Adds 11 regression cases covering invalid values and valid branches that preserve --offline.
File Description
tests/​cli/​base-args.test.ts Tests rejected values and valid branches in both argument forms.
src/​cli/​args.ts Adds and applies the required-value guard to --base.

Review effort: Balanced

@sonukapoor sonukapoor left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, nice first PR, and the tests catch it: reverting the fix fails four of them, and --base main --offline still keeps offline on.

One thing on ordering: requireFlagValue is also arriving with #1382 and #1392, so this will land after those and should use that copy rather than adding its own. I'll check it again once they're in.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] --base accepts another flag as its branch name and drops --offline

3 participants