Repository navigation
fix: Validate the wait_for_action_attempt option - #573
Merged
Merged
Conversation
Base automatically changed from
claude/ruby-sdk-audit-xbhaia-poll-deadline
to
main
November 5, 2026 19:39
Any wait_for_action_attempt value other than true, a Hash, or the client's DeepHashAccessor fell through the resolver and returned the unresolved action attempt, so 1 or "true" silently skipped both waiting and raising on a failed attempt. A string-keyed options hash was accepted and then read with symbol keys, so its timeout and polling_interval were ignored in favor of the defaults, and passing nil to the constructor meant "do not wait" while nil on a route call meant "use the default". Reject anything but true, false, or a hash with numeric timeout and polling_interval values, at construction on both clients and again on each route call, symbolize the option keys before reading them, and normalize a nil constructor value to the default. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
razor-x
force-pushed
the
claude/ruby-sdk-audit-xbhaia-wait-option-validation
branch
from
November 5, 2026 19:55
dcbcf13 to
f064171
Compare
razor-x
deleted the
claude/ruby-sdk-audit-xbhaia-wait-option-validation
branch
November 5, 2026 20:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK audit finding M2.
ActionAttemptResolver.wait_optionsreturned nil for any value that was not aHashorDeepHashAccessor, so:wait_for_action_attempt: 1or"true"(an env string) silently skipped waiting and skipped raisingActionAttemptFailedErroron a failed attempt. The caller believed the door unlocked.{"timeout" => 120}) was accepted and read with symbol keys, so its options were ignored and the 5s / 0.5s defaults applied.Seam.new(wait_for_action_attempt: nil)meant "don't wait" whilenilon a route call meant "use the default".Fix
Ported from seamapi/python#637. The resolver validates at construction (both
Http::SingleWorkspaceandHttp::WithoutWorkspace) and again on every route call, raisingSeam::Http::Options::SeamInvalidOptionsErrorwith:The wait_for_action_attempt option must be true, false, or a hash with "timeout" and "polling_interval" keys, got IntegerThe wait_for_action_attempt option got an unknown key :poll_interval, expected "timeout" or "polling_interval"The wait_for_action_attempt option :timeout must be a number, got StringOption keys are symbolized before being read, and a nil constructor value normalizes to the default (
true). Also adds the missingrequire_relative "deep_hash_accessor"the resolver relied on transitively.Stacked on #572 (both change
action_attempt_resolver.rb).Tests
New
spec/seam_client/wait_for_action_attempt_option_spec.rb: constructor and per-call rejection with exact messages and no poll request, nil as default, string keys honored on the client and per call.Revert-check against the previous source: 10 failures, including string-keyed options polling nine times against a 0.1s timeout and junk values returning without an error.
🤖 Generated with Claude Code
https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
Generated by Claude Code