Repository navigation
projector(config): PORT and GITHUB_APP_INSTALL_ID are never validated — PORT=0 silently binds a random port, typos crash with a RangeError naming neither variable, and a garbage install ID is silently treated as unset #2172
Description
Summary
The pm-stack projector's two numeric environment inputs are parsed with bare Number() and never validated:
PORT(pm-stack/projector/src/index.ts:6):const port = Number(env.PORT ?? 7801)is passed straight toBun.serveinpm-stack/projector/src/server.ts(serve(db, env, port)).PORT=0silently binds a random ephemeral port while every consumer expects 7801;PORT=abc/99999/-1/4870.5crash at startup with a BunRangeErrorthat names neitherPORTnor the projector.GITHUB_APP_INSTALL_ID(pm-stack/projector/src/github.ts:121):installId = Number(env.GITHUB_APP_INSTALL_ID).'abc'becomesNaN, which is falsy, so the configured installation is silently skipped as if unset — reconcile then falls back toGITHUB_TOKENor throwsno_github_credentials_for_<repo>, an error that blames credentials when the real problem is a typo'd install ID.'12.5'is truthy and is interpolated verbatim intohttps://api.github.com/app/installations/12.5/access_tokens, producing a misleadinginstallation_token_failed_404.
Evidence (verified this run on main c58507a3)
pm-stack/projector/src/index.ts:6— the only parse ofPORT; no range/integer check anywhere insrc/(grep).pm-stack/projector/src/github.ts:121— the only parse ofGITHUB_APP_INSTALL_ID; the result is used at:122(&& installId) and:125(URL interpolation).- Sandbox Bun probe of the exact pattern (
port = Number(raw), thenBun.serve({port, hostname:"127.0.0.1"})):"abc"→NaN→RangeError [ERR_OUT_OF_RANGE]: The value of "options.port" is out of range. It must be an integer. Received NaN"99999"→RangeError ... must be >= 0 and <= 65535. Received 99999"-1"→ same RangeError;"4870.5"→RangeError ... must be an integer. Received 4870.5"0"→ bound port 36647 (random ephemeral) and reported as listening;"7801"→ bound 7801 (control)
- Install-ID coercion probe:
Number("abc")→NaN,!!NaN === false(so the:122gate treats a configured-but-garbage ID exactly like an unset one);Number("12.5")→12.5, truthy, used verbatim in the access-token URL. - No test covers either input:
pm-stack/projector/test/has noPORT/GITHUB_APP_INSTALL_IDvalidation cases (grep). - The fleet already has the strict precedent:
bin/proxy-port.mjs(parseProxyPort) rejects non-integer / out-of-range ports with an error naming the variable.
Why it matters
The projector is the PM stack's GitHub→database intake; its consumers (the aggregator's live source, per pm-stack/projector/README.md) find it at the expected port. A one-character typo in PORT either makes the service silently live on a random port (unit healthy, data stale, nothing in the log points at the cause) or kills it with a runtime error that does not name the variable to fix. A typo in GITHUB_APP_INSTALL_ID silently downgrades or breaks reconcile auth with an error that sends the operator to check the wrong credential.
Acceptance criteria
- A
PORTthat is not an integer in 1–65535 (including0, unless 0 is made an explicit documented opt-in) fails at startup with an error namingPORT, the offending value, and the valid range — before any bind. - A
GITHUB_APP_INSTALL_IDthat is not a positive integer fails (or at minimum logs a loud warning naming the variable and value) instead of being silently treated as unset; a fractional value is never interpolated into the access-token URL. - Defaults unchanged: unset
PORT→ 7801; unsetGITHUB_APP_INSTALL_ID→ existing discovery/token fallback path. - Tests cover
'abc','0','-1','99999','4870.5'forPORTand'abc'/'12.5'for the install ID, plus the unset defaults.
Dedup / distinctness
- projector: read-API limit is never validated — ?limit=-1 returns the whole table and ?limit=2.7 500s the request #1547 (OPEN) is the projector's read-API
?limit=validation — a different input surface (query param → SQL) in the same service. - aggregator(config): PM_AGG_PORT / PM_AGG_HOSTS are never validated — port 0 silently binds a random port, a typo crashes with a Bun RangeError that names neither variable, and an all-separator PM_AGG_HOSTS exits 0 serving nothing #2161 (OPEN) is the aggregator's
PM_AGG_PORT/PM_AGG_HOSTSin a different service (pm-stack/aggregator/src/config.ts); this issue is the projector's own entry-point/auth env parsing (src/index.ts,src/github.ts). If triage prefers, the fix patterns should be shared, but the code paths and failure modes are separate. - projector(github): GITHUB_APP_PRIVATE_KEY 'base64 of PEM' form fails — decodePem never unwraps it, appJwt throws Invalid keyData #1529 (OPEN) is
GITHUB_APP_PRIVATE_KEYPEM decoding in the same file — unrelated to the install-ID number parse.
Metadata
Metadata
Assignees
Labels
pm-stack (Pad/Grist) in developing-today/codeTrivial: expected under 30 minutes of workSomething isn't working (prefixed form of the classic bug label)Ordinary priority (the default)Filed by the new-issue-creator jobFiled by the repo design architect jobQueue packet kind: verify, reproduce, and route this item
Activity
developing-today commentedon Oct 29, 2026
CODE-1065
dezren39 commentedon Oct 29, 2026
🤖 Agent note · filed
dezren39 commentedon Oct 30, 2026
agent-note:v1 — design-architect pass 22 (2026-10-30): ADOPTED as Phase 2 of design #2835 (pm-stack services, with #2161/#2758): PORT validates at boot in index.ts (digits-only, 1-65535, 0 invalid); GITHUB_APP_INSTALL_ID validates at its github.ts read site — a present non-numeric value throws an error naming GITHUB_APP_INSTALL_ID instead of falling through to the token/no-credentials path (absent/empty remains the only unset spelling). Per the design doc, not a one-off patch. Linked as a sub-issue of #2835 (verified in its sub_issues list). Triage: do NOT re-file/re-scope/split this issue; record the phase structure and land it as the phase, with the decisions recorded on #2835 and in its design doc (files/designs/code-env-config-strict-parse.md). This issue keeps its own queued triage packet.
14 remaining items
dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
ses_e5e663ac7b4ffehaBQ2P5BOKT; queue task 5209dezren39 commentedon Nov 2, 2026
🤖 Agent note · PR opened
ses_e5e663ac7b4ffehaBQ2P5BOKT; queue task 5209queue/5209-2172-projector-config-validation, commit77f3d6985)git diff --checkpassed.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked — CI pending
ses_e5e663ac7b4ffehaBQ2P5BOKT; queue task 5209testcheck remained queued/pending after five minutes of polling. CodeRabbit was skipped.dezren39 commentedon Nov 2, 2026
agent-note:v1 — task 5209 (small_fix, #2172) DONE / fixed_merged by lane B worker, 2026-11-02T02:02Z: PR #4106 merged (squash, merge commit caacf3a); issue auto-closed by the merge. Lane B resumed the parked awaiting_ci task, re-reviewed the diff fresh against the #2172 acceptance (parsePort in src/config.ts invoked at boot in src/index.ts; parseConfiguredInstallId at the github.ts read site, absent/empty fallback preserved, invalid present values fail loudly before any token URL), confirmed the Codex review completed with no findings, and merged per merge authority — laptop test evidence on the task: bun test config+github 14/14, full projector suite 59/59. GitHub PR test run 41371458826 was still queued at merge time (known runner backlog); main-branch CI is the post-merge check.