Repository navigation
commandcode-proxy: COMMANDCODE_PROXY_TIMEOUT_MS is parsed with a bare Number() — a typo'd, negative, or >2^31 value makes every request 'time out' in ~1ms instead of failing at startup #1809
Description
commandcode-proxy: COMMANDCODE_PROXY_TIMEOUT_MS is parsed with a bare Number() — a typo'd, negative, or >2³¹ value makes every request "time out" in ~1 ms instead of failing at startup
Evidence
bin/commandcode-proxy.mjs:60 (main e91098f1):
const TIMEOUT_MS = Number(process.env.COMMANDCODE_PROXY_TIMEOUT_MS || 240000);No validation follows. TIMEOUT_MS drives every timeout in the proxy:
:567— the ACPrequest()timer (ACP … timed out after ${timeoutMs}ms),:675/:682— the ACP prompt timer, and the request timer derived astimeoutMs + 30000,:945— the spawn-fallback kill timer,:1067— the user-visible error text:`commandcode timed out after ${TIMEOUT_MS}ms`.
The sibling env values in the same bin/ family were hardened against exactly this failure class: ports go through the strict shared parser in bin/proxy-port.mjs (#483, #494 — "a bare parseInt is not a validator"), which fails at startup naming the variable and its value. The timeout never got the same treatment.
Probe (laptop, verbatim :60 expression + the same setTimeout use as :567/:675/:945)
Probe: ~/git/fleet/probe-2026-10-28-laneB-cctimeout/probe.mjs:
COMMANDCODE_PROXY_TIMEOUT_MS |
parsed TIMEOUT_MS |
timer fired after |
|---|---|---|
abc |
NaN |
~6 ms (TimeoutNaNWarning … set to 1) |
240000junk |
NaN |
~1 ms |
-5000 |
-5000 |
~2 ms (TimeoutNegativeWarning … set to 1) |
9999999999999 |
9999999999999 |
~2 ms (TimeoutOverflowWarning … does not fit into a 32-bit signed integer … set to 1) |
300 (control) |
300 |
~306 ms |
Why it matters
One typo in the service environment (a unit, a home-manager option, a hand edit) silently converts the proxy into a machine that fails every chat/agency request instantly, while reporting commandcode timed out after NaNms (or after -5000ms) — an error that points at the upstream engine, not at the configuration. The proxy starts cleanly and answers /health, so supervisors see a healthy process. A large-but-sane-looking value (e.g. 9999999999999, or anything above 2³¹−1 ≈ 24.8 days in ms) overflows Node's timer the same way. Startup is the right place for this to fail, as the port parser already established for this family.
Acceptance criteria
- An invalid
COMMANDCODE_PROXY_TIMEOUT_MS(non-numeric, trailing junk, zero, negative, or above a pinned maximum ≤ 2³¹−1) makes the proxy exit at startup with an error naming the variable and its value, in the style ofproxy-port.mjs'sparseProxyPort. - The parsing lives in a shared/strict helper (extending
proxy-port.mjsor a sibling) rather than an inline copy unique to this proxy, or the triage comment pins why inline is right here. - Tests in
bin/commandcode-proxy.test.mjs(or the helper's test file) cover: unset → 240000 default; a plain value → itself; each invalid class above → startup error. - No behaviour change for valid values: ACP request/prompt timers and the spawn kill timer receive the same millisecond values as today.
Related: #483 / #494 (strict port parsing for this same proxy family).
Activity
developing-today commentedon Oct 28, 2026
CODE-743
dezren39 commentedon Oct 28, 2026
🤖 Agent note · filed
e91098f1that bin/commandcode-proxy.mjs:60 parses COMMANDCODE_PROXY_TIMEOUT_MS with a bare Number() and no validation, while every timeout in the proxy (ACP request :567, prompt :675, spawn kill :945, error text :1067) consumes it. Laptop probe of the verbatim expression + same setTimeout use: 'abc'/'240000junk' → NaN, timer fires ~1-6ms; '-5000' → fires ~2ms; '9999999999999' → TimeoutOverflow, fires ~2ms; control '300' → 306ms. The bin/ family's ports were hardened against this exact class in bin proxies: *_PROXY_PORT parsed with bare parseInt — invalid values crash opaquely or bind the wrong port #483/antigravity-ls-proxy: ANTIGRAVITY_LS_ADDRESS port parsed with bare parseInt — malformed addresses silently discarded, managed daemon spawned instead #494 (proxy-port.mjs strict parser, startup failure naming the variable); the timeout was not.queue-packets/packet-1809.json(repo-health-code-pilot, triage); probe~/git/fleet/probe-2026-10-28-laneB-cctimeout/(laptop); related bin proxies: *_PROXY_PORT parsed with bare parseInt — invalid values crash opaquely or bind the wrong port #483, antigravity-ls-proxy: ANTIGRAVITY_LS_ADDRESS port parsed with bare parseInt — malformed addresses silently discarded, managed daemon spawned instead #494dezren39 commentedon Oct 30, 2026
agent-note:v1 — design-architect pass 22 (2026-10-30): ADOPTED as Phase 1 of design #2835 (bin/ proxies, with #2823/#2786/#2096): this issue's timeout parses through the NEW shared millis helper Phase 1 adds to bin/proxy-port.mjs (digits-only, 1-2^31-1, boot failure naming the variable) — not a private guard. Linked as a sub-issue of #2835 (verified in its sub_issues list). Triage: do NOT re-file/re-scope/split this issue; record the phase structure and land it as the phase, with the decisions recorded on #2835 and in its design doc (files/designs/code-env-config-strict-parse.md). This issue keeps its own queued triage packet.
62 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: picked-up
task: 7726 (triage, repo-health-code-pilot; worker repo-worker-code; lane c8b9355e-319a-4640-8096-7ad19480d151)
by: OpenChamber scheduled lane
at: 2026-11-04T07:14:30Z
Claimed and checkpointed task 7726. Fresh GitHub revalidation: #1809 is OPEN and assigned to Drew; PR #4026 (
queue/5042-1809-strict-timeout) is OPEN, non-draft, and Drew-authored. This is active Drew-owned work. I will not inspect or modify PR #4026, touch its branch, or create competing work; parking the triage claim for 30 minutes, then rechecking ownership fresh.dezren39 commentedon Nov 4, 2026
agent-note:v1
event: parked
task: 7726 (triage, repo-health-code-pilot; worker repo-worker-code; lane c8b9355e-319a-4640-8096-7ad19480d151)
by: OpenChamber scheduled lane
at: 2026-11-04T07:15:15Z
resume-after: 2026-11-04T07:44:50Z
Parked for 30 minutes. Fresh GitHub state: #1809 is OPEN and Drew-assigned; matching implementation PR #4026 (
queue/5042-1809-strict-timeout) is OPEN and Drew-authored. This is active Drew-owned work, so no PR or branch was touched and no competing follow-up was created. Resume after the delay with fresh issue/PR/ownership checks; proceed only if the Drew-owned work is no longer active. Labels now reflect parked state (queue/parked,status/parked,work/assigned).dezren39 commentedon Nov 4, 2026
Agent note — task 7726 handed off to opencode execution lane
repo-queue lane task 7726):opencodeopencode-claimantlaunches a session bound to task 7726 to drive it to a terminal state.handed_off. If the claimant has not launched by lease expiry, task 7726 returns to the queue.dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off