Skip to content

fix(miner): stop hooks check --tool/--input consuming an adjacent flag as their value - #6062

Merged
loopover-orb[bot] merged 1 commit into
JSONbored:mainfrom
reyanthony062001-ops:fix/5833
Jul 15, 2026
Merged

fix(miner): stop hooks check --tool/--input consuming an adjacent flag as their value#6062
loopover-orb[bot] merged 1 commit into
JSONbored:mainfrom
reyanthony062001-ops:fix/5833

Conversation

@reyanthony062001-ops

Copy link
Copy Markdown
Contributor

Summary

parseDenyCheckArgs in packages/loopover-miner/lib/deny-check.js consumed the next token unconditionally for its --tool/--name and --input branches, with no check that the consumed token is itself a flag. So loopover-miner hooks check --tool --input '{}' silently set options.tool = "--input", and the loop's next iteration hit the literal '{}' — which matches no known flag and doesn't start with - — falling through to the generic DENY_CHECK_USAGE string instead of the specific, actionable Missing value for --tool. error this file already uses for the same class of mistake.

Every sibling flag parser in this package already guards this: attempt-cli.js (if (!value || value.startsWith("-")) ...) and claim-ledger-cli.js (four instances). This PR adds that same guard to both value-consuming branches, rejecting --input's value before it is JSON-parsed. Messages reuse this file's existing conventions (Missing value for --tool. / Missing value for --input., the latter already emitted by parseToolInput for a missing value).

Closes #5833

Scope

  • The PR title follows type(scope): short summary Conventional Commit format.
  • This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
  • This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
  • I linked a currently open issue this PR resolves (Closes #5833).

Validation

  • git diff --check — clean
  • npm run actionlint — no workflow changes
  • npm run typecheck — passes (whole project)
  • npm run test:coverage — both arms of both new guards are exercised (!value via --tool / --tool Write --input with no value; value.startsWith("-") via --tool --input {}, --name --json, and --tool Write --input --json), and the pass-through arm by the existing valid-parse tests, so codecov/patch on the diff is 100% branch-counted. test/unit/miner-cli-deny-check.test.ts passes 5/5; the new test fails on the pre-fix code and passes after, with all four pre-existing tests unchanged and green on both.
  • npm run test:workers — unaffected (no worker changes)
  • npm run build:miner — passes (node --check over the miner CLI incl. deny-check.js)
  • npm run test:miner-pack — passes (package dry-run ok)
  • npm run build:mcp / test:mcp-pack — unaffected (no MCP changes)
  • npm run ui:openapi:check / ui:lint / ui:typecheck / ui:build — unaffected (no UI/OpenAPI changes)
  • npm audit --audit-level=moderate — no dependency changes
  • New or changed behavior has unit tests — a regression test covering a flag consumed as --tool's value, as --name's value, and as --input's value, plus both missing-value cases, each asserting the specific "Missing value" error rather than the generic usage fallback

If any required check was skipped, explain why:

  • Change is two guard conditions in packages/loopover-miner/lib/deny-check.js plus its test. It introduces no workflow, MCP, UI, OpenAPI, or dependency changes. I additionally ran npm run engine-parity:drift-check and the backend drift checks (docs, manifest, command-reference, selfhost env-reference), all green.

Safety

  • No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
  • Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
  • Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — N/A (none).
  • API/OpenAPI/MCP behavior is updated and tested where needed — N/A (none).
  • UI changes use live API data or real empty/error/loading states — N/A (no UI changes).
  • Visible UI changes include a UI Evidence section — N/A (no UI/frontend/docs/extension changes).
  • Public docs/changelogs are updated where needed — N/A.

Notes

  • Behavior is unchanged for every well-formed invocation: the guard only fires where the parser previously mis-assigned a flag as a value (or had no value at all), so the existing tests pass untouched. hooks check now reports the same specific, actionable error the rest of the package's flag parsers already give.

…g as their value

parseDenyCheckArgs took the next token unconditionally for --tool/--name
and --input, so `hooks check --tool --input '{}'` silently set
options.tool = "--input" and then fell through to the generic usage string
on the following token, instead of the specific "Missing value for --tool."
error every sibling flag parser in this package gives for the same mistake.

Adds the same `!value || value.startsWith("-")` guard already used by
attempt-cli.js and claim-ledger-cli.js to both value-consuming branches,
rejecting --input's value before it is JSON-parsed. Messages reuse this
file's existing conventions ("Missing value for --tool." /
"Missing value for --input.").

Closes JSONbored#5833
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jul 15, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.22%. Comparing base (ac89623) to head (5d4afa9).
⚠️ Report is 12 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6062      +/-   ##
==========================================
- Coverage   95.22%   95.22%   -0.01%     
==========================================
  Files         594      594              
  Lines       46996    46974      -22     
  Branches    15015    15015              
==========================================
- Hits        44754    44732      -22     
  Misses       1493     1493              
  Partials      749      749              
Flag Coverage Δ
shard-1 43.97% <0.00%> (-0.03%) ⬇️
shard-2 36.55% <0.00%> (+0.12%) ⬆️
shard-3 31.93% <100.00%> (-0.15%) ⬇️
shard-4 31.98% <0.00%> (-1.03%) ⬇️
shard-5 32.67% <0.00%> (+1.17%) ⬆️
shard-6 44.70% <0.00%> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
packages/loopover-miner/lib/deny-check.js 88.37% <100.00%> (+0.56%) ⬆️

... and 4 files with indirect coverage changes

@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 15, 2026
@loopover-orb

loopover-orb Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

Review updated: 2026-07-15 08:18:32 UTC

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

  • safe to merge

Review summary
This is a small, well-targeted fix adding the standard `!value || value.startsWith("-")` guard (already used elsewhere in this package) to both the `--tool`/`--name` and `--input` branches of `parseDenyCheckArgs`, preventing an adjacent flag from being silently consumed as a value. The test additions exercise both new guard arms and both flags, matching the PR's stated coverage claims and the existing conventions in this file. The fix is at the correct layer (the parser itself) and closes the linked issue #5833 with a minimal, non-scope-creeping change.

Nits — 2 non-blocking
  • nit: the comment above the new test (test/unit/miner-cli-deny-check.test.ts) restates what the assertions already make clear from their expected error strings — could be trimmed.
  • Consider extracting the `!value || value.startsWith("-")` check into a small shared helper across deny-check.js, attempt-cli.js, and claim-ledger-cli.js to avoid the same guard being copy-pasted in multiple files (packages/loopover-miner/lib/deny-check.js).
Signal Result Evidence
Code review ✅ No blockers 1 reviewer
Linked issue ✅ Linked #5833
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (1 linked issue).
Validation posture ✅ 25/25 PR body includes validation/test evidence.
Contributor workload ✅ 10/10 Author activity: 27 registered-repo PR(s), 15 merged, 1 issue(s).
Contributor context ✅ Confirmed Gittensor contributor reyanthony062001-ops; Gittensor profile; 27 PR(s), 1 issue(s).
Gate result ✅ Passing No configured blocker found.
Improvement ✅ Minor risk: clean · value: minor · LLM: minor
Linked issue satisfaction

Addressed
The diff adds the exact `!value || value.startsWith("-")` guard to both the --tool/--name and --input branches, producing the specific error messages requested, and includes regression tests covering the required cases (--tool --input '{}' and --tool foo --input --json).

Review context
  • Author: reyanthony062001-ops
  • Role context: outside_contributor
  • Public audience mode: oss maintainer
  • Lane context: Repository is configured for direct PR review.
  • Public profile languages: Cuda, HTML, JavaScript, Python, TypeScript
  • Official Gittensor activity: 27 PR(s), 1 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Keep the PR focused and include validation evidence before maintainer review.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.
🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

  • @loopover ask &lt;question&gt; answers contribution-quality Q&A with source citations and freshness.
  • @loopover chat &lt;question&gt; answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
  • A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

  • Re-run LoopOver review

@loopover-orb loopover-orb Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LoopOver approves — the gate is satisfied and CI is green.

@loopover-orb
loopover-orb Bot merged commit 2eadda7 into JSONbored:main Jul 15, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(miner): hooks check --tool/--input don't guard against consuming another flag as their value

1 participant