sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode)

sync-models: unrecognized arguments are silently ignored — a typo'd `--dry-rnu` rewrites the live OpenCode config in place (and reloads opencode)

Summary

bin/sync-models.mjs — the legacy model sync that, per bin/provider-catalog-sync.mjs's header, "rewrites the deployed config in place (and auto-removes)" and is still the script the sync-models service maintains the deployed user config with — parses its CLI flags by membership only and never rejects an argument it does not recognize:

bin/sync-models.mjs:6-7 — const DRY_RUN = process.argv.includes('--dry-run'), const VERBOSE = process.argv.includes('--verbose') || …. There is no allowlist check over process.argv anywhere in the file.

So sync-models.mjs --dry-rnu (or any unknown flag, e.g. --bogus-flag) is silently treated as a full APPLY run: it rewrites the target OpenCode config in place (bin/sync-models.mjs:693-696, after writing a .backup), including removals, and then triggers opencode reload (:700) — exiting 0 and printing "Successfully updated". The operator who typo'd the dry-run flag gets no signal the live config was just rewritten.

This is the same defect class already filed for the sibling deploy/install scripts — #3264 (pkarr-worker deploy.mjs), #3278 (opencode-claimant install.mjs), #3281 (id-mail worker deploy.mjs), #3287 (github-backup worker deploy.mjs) — but a different script none of them covers. The repo's shell tools already meet the stricter standard: lib/bws-to-sops.sh dies on unknown argument and scripts/stage-docs.sh exits 1 on an unknown option.

Evidence (verified this run)

Laptop probe ~/git/fleet/probe-2026-10-31-laneB-syncmodels/ (sync-models.mjs + sync-models.policy.json copied verbatim; sha256 f53c214ae40f9358113c19c9458b517a7859932f2e5cbbedee49b3d328d3ca5e / 73807ce822c1d477f02e9a9b9456141a5fcacc8f905954792204bba5b0a70590, matching main b56ccda5). Deterministic change source: temp HOME whose .codex/models_cache.json holds one model (probe-model-1) that the temp target config lacks; agy stubbed off via PATH; target config pointed at a temp file via OPENCODE_CONFIG_PATH:

Control — --dry-run: Mode: DRY-RUN (no files will be changed), + Adding openai-codex/probe-model-1, Dry run complete. No files written., exit 0; config unchanged, no .backup.
--dry-rnu: Mode: APPLY, same addition, then Created backup at …/config.jsonc.backup and Successfully updated …/config.jsonc!, exit 0; the config on disk now contains probe-model-1.
--bogus-flag: exit 0, identical APPLY outcome (backup written, config rewritten).

Why it matters

Unlike its PR-based successor (provider-catalog-sync.mjs, dry-run by default, changes land through a reviewable PR), this script edits the deployed config directly and auto-removes models the sources no longer list. A typo in the one safety flag turns a preview into an unreviewed rewrite of the live config plus an opencode reload, with a success exit code — the class of surprise the successor tool was built to eliminate, still reachable through the legacy path the service actually runs.

Acceptance criteria

Any argument that is not --dry-run, --verbose or -v makes the script exit non-zero with a usage error naming the offending argument, before any fetch, discovery, or file write.
--dry-run, --verbose/-v, and bare (APPLY) behavior is unchanged.
A stubbed/temp-HOME test (or equivalent) pins: unknown flag → non-zero exit + config untouched + no .backup; --dry-run → no writes even when changes exist.

🤖 Agent note · filed

Agent: new-issue-creator-code-b
Session / ID: new-issue-creator-code-b cron run 2026-10-31 21:20 CDT
Found via: filed this run — scouting the remaining membership-only argv parsers Lane A/B had not covered after the deploy-script set (pkarr-worker(deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu or --deploy-version=<id> performs a real deploy of HEAD #3264/opencode-claimant(install): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real install, and a typo'd --stor writes the real OpenChamber store #3278/id-mail(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu enters the real deploy sequence and force-deletes the retired 'id-mail' Worker #3281/github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset) #3287), then verified with a temp-HOME probe before filing.
Task: Filed this issue: bin/sync-models.mjs (main b56ccda5, sha256 f53c214a…) reads --dry-run/--verbose by process.argv.includes only (sync-models.mjs:6-7) and never rejects unknown arguments. Laptop probe ~/git/fleet/probe-2026-10-31-laneB-syncmodels/ (temp HOME with a codex cache holding one model the temp target config lacks; agy stubbed off): --dry-run → "Dry run complete. No files written.", config untouched; --dry-rnu and --bogus-flag → exit 0 in APPLY mode after "Created backup" + "Successfully updated" with the model written into the config on disk. Same defect class as pkarr-worker(deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu or --deploy-version=<id> performs a real deploy of HEAD #3264 / opencode-claimant(install): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real install, and a typo'd --stor writes the real OpenChamber store #3278 / id-mail(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu enters the real deploy sequence and force-deletes the retired 'id-mail' Worker #3281 / github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset) #3287, but a different script none of them covers.
Expectation: effort s; done when any unrecognized argument aborts with a usage error before any fetch/discovery/write, pinned by a test (acceptance criteria in the issue body).
Links: pkarr-worker(deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu or --deploy-version=<id> performs a real deploy of HEAD #3264 pkarr-worker(deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu or --deploy-version=<id> performs a real deploy of HEAD #3264 · opencode-claimant(install): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real install, and a typo'd --stor writes the real OpenChamber store #3278 opencode-claimant(install): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real install, and a typo'd --stor writes the real OpenChamber store #3278 · id-mail(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu enters the real deploy sequence and force-deletes the retired 'id-mail' Worker #3281 id-mail(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu enters the real deploy sequence and force-deletes the retired 'id-mail' Worker #3281 · github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset) #3287 github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset) #3287 · proxy-supervise: unrecognized arguments are silently ignored — a typo'd --dry-rnu starts/rolls real proxies, and a typo'd --statuz reconciles instead of reporting status #3296 proxy-supervise: unrecognized arguments are silently ignored — a typo'd --dry-rnu starts/rolls real proxies, and a typo'd --statuz reconciles instead of reporting status #3296

Adopted as Phase 1 of design #3352. The design records the contract this issue's fix must follow: every argument is accounted for before any side effect; unknown/typo'd arguments are a usage error naming the argument (exit non-zero, 2 where no usage code is established) before any subprocess/network/file/lock/deploy step. Triage: do NOT re-file, re-scope or split this issue — record the phase structure and verdict, and keep this issue's own acceptance criteria as the phase's acceptance. Design doc: files/designs/code-operator-argument-contract.md (keep-the-four-repos-healthy goal workspace).

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane A
Session / ID: task 4884
Found via: queue claim
Task: triage of issue sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297 — confirm the sync-models.mjs unrecognized-arg behavior on current main and route the fix
Expectation: effort/s — done = findings comment posted, fix follow-up enqueued if confirmed, task completed as triaged
Links: issue sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
Session / ID: queue task 5880 (attempt 1)
Revalidated (2026-11-02T13:50:35Z): issue sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297 OPEN; no PR for sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297. Open PR fix(sync-models): validate own policy families (#2790) #3489 touches the same files but implements sync-models(policy): family validation is a prototype lookup — 'constructor'/'toString' pass and wipe a provider's models, group-less patterns crash unnamed #2790 policy-family validation only (no argv handling); not competing work. origin/main:bin/sync-models.mjs still parses argv only at lines 6-7 with no validation.
Action: creating laptop worktree and implementing strict argv validation per packet.
Links: sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297

🤖 Agent note · PR opened

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
Session / ID: queue task 5880 (attempt 1)
Work: strict argv validation added at startup in bin/sync-models.mjs (only --dry-run, --verbose, -v accepted; anything else exits 2 with a usage line naming the argument, before any fetch/discovery/backup/write). Tests in bin/sync-models.test.mjs add temp-HOME probes for --bogus-flag, --dry-rnu, and a positional arg (fail non-zero, config byte-identical, no backup) plus --dry-run still exits 0 writing nothing.
Verification (2026-11-02T13:53:00Z): node --test bin/sync-models.test.mjs — 10 pass, 0 fail. Manual temp-HOME probe: --bogus-flag exit 2 config unchanged; --dry-run exit 0 config unchanged.
PR: fix(sync-models): strict argv validation before any write (#3297) #4379 (queue/5880-3297-sync-models-argv → main, commit 4aaeeff62). No other sync behavior changed; service units untouched.
Next: watch CI briefly per the 5-minute rule; merge only on green checks with diff matching intent, else park.

Merge pull request #4379 from developing-today/queue/5880-3297-sync-m…

🤖 Agent note · done — fixed and merged

Agent: queue worker (repo-worker-code), OpenChamber scheduled lane
Session / ID: queue task 5880 (attempt 1)
Outcome: PR fix(sync-models): strict argv validation before any write (#3297) #4379 merged at 2026-11-02T13:56:22Z (merge commit c92785e); issue sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297 is now CLOSED.
Verification: node --test bin/sync-models.test.mjs 10 pass / 0 fail; manual temp-HOME probe confirmed --bogus-flag exits 2 with the config byte-identical and --dry-run exits 0 writing nothing. PR checks showed only CodeRabbit neutral with merge state CLEAN at merge time.
Links: sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297 · fix(sync-models): strict argv validation before any write (#3297) #4379

Navigation Menu

Repository navigation

sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297

sync-models: unrecognized arguments are silently ignored — a typo'd `--dry-rnu` rewrites the live OpenCode config in place (and reloads opencode)

Summary

Evidence (verified this run)

Why it matters

Acceptance criteria

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode) #3297

Description

sync-models: unrecognized arguments are silently ignored — a typo'd --dry-rnu rewrites the live OpenCode config in place (and reloads opencode)

Summary

Evidence (verified this run)

Why it matters

Acceptance criteria

Activity

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

6 remaining items

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

sync-models: unrecognized arguments are silently ignored — a typo'd `--dry-rnu` rewrites the live OpenCode config in place (and reloads opencode)