Skip to content

fix: reject unfilled blanks under --no-interactive with a usage error - #323

Merged
hivecommons-hive[bot] merged 3 commits into
mainfrom
scanner/fix-322
Oct 23, 2026
Merged

hivecommons-hive[bot] merged 3 commits into
mainfrom
scanner/fix-322

Conversation

@hivecommons-hive

Copy link
Copy Markdown
Contributor

Closes #322

run() now checks, after resolve(), for blanks missing from any iteration's values and throws a UsageError (Missing value for {{file}}: pass --file=<value> or run without --no-interactive to be asked.) instead of printing the placeholder and exiting 0. --status, expand() and blanks with defaults are unchanged.

Tests added in cli.test.ts (error case, default case, flag case); changelog fragment added; dist/ regenerated with npm run build.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Oct 23, 2026
@kubestellar-prow

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow kubestellar-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 23, 2026
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

hive/awaiting-ci: CI pending — sweep will merge when green.


🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot added author/hive This repository's own hive (the App or one of its agent lanes) authored this PR dco All commits are DCO signed-off role/trusted Author is trusted for unattended merge (trusted-author role or registry/claim tier in require_tiers) stage/070-fixing Hive-authored PR: CI red, changes requested or needs rebase; a hive agent is fixing it labels Oct 23, 2026

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed (security) — no security findings. Variable names interpolated into the new UsageError are constrained to [\w-]+ by VAR_PATTERN (src/parser.ts:32) and the message passes through sanitizeForTerminal in main().catch (src/cli.ts:196), so no terminal-escape injection surface is added.

One in-scope blocker (severe enough to flag across perspectives): CI is red on all six build-and-test jobs. The pre-existing test cli treats non-TTY stdin as non-interactive instead of printing nothing (src/cli.test.ts:712-723) pins the old behavior — it spawns Hi {{pa_unfilled}} with piped stdin and asserts status === 0 and stdout Hi {{pa_unfilled}}\n (:721-722). The new check at src/cli.ts:163-170 now makes exactly that invocation exit 1, which is the intended behavior per #322. Fix: update that test to assert status === 1, empty stdout, and the Missing value for {{pa_unfilled}} stderr message, then rebuild so dist/cli.test.js/.js.map stay in sync with the dist-sync gate.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — the fix matches #322's spec exactly, but it breaks an existing test and CI is red on all six build-and-test jobs.

  1. Pre-existing test pins the old behaviour — src/cli.test.ts:712-723 (cli treats non-TTY stdin as non-interactive instead of printing nothing) spawns Hi {{pa_unfilled}} with piped stdin and asserts status === 0 and stdout === 'Hi {{pa_unfilled}}\n'. With the new guard at src/cli.ts:163-170 that invocation now exits 1 (CI: not ok 62 ... expected: 0 / actual: 1). The test's actual purpose (non-TTY stdin must not hang/print nothing) still holds under the new contract — update it to expect status === 1, empty stdout, and the Missing value for {{pa_unfilled}} message on stderr, then regenerate dist/cli.test.js + .map (CI's dist-sync gate requires it).

  2. PR body says "Tests added" but does not mention the test run; please confirm npm test is green locally before re-pushing.

Advisory (non-blocking): README.md:522 still describes --no-interactive as "Skip questions, use defaults only"; a short note that an unfilled blank is now a usage error would keep the docs aligned. README.md:451 is about library expand() and correctly stays unchanged.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

Hive filed review findings that do not block this PR as backlog items:

Cap: 10 backlog item(s) per PR per day.

…error

The non-TTY stdin and SKILL.md pitfall tests pinned the old behaviour
(literal {{name}} printed, exit 0). Update them to expect the Missing
value usage error and reword the pitfall accordingly.

Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

hive/awaiting-ci: CI pending — sweep will merge when green.


🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: feeebea

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot removed the stage/070-fixing Hive-authored PR: CI red, changes requested or needs rebase; a hive agent is fixing it label Oct 23, 2026

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correctness review (head 803e1ff)

The new guard in src/cli.ts:104-111 does what #322 asks, and the three new tests pass. But the PR breaks two existing tests and CI is red on all six build-and-test jobs (e.g. job 120327902550):

  1. src/cli.test.ts:712-723 — cli treats non-TTY stdin as non-interactive instead of printing nothing spawns Hi {{pa_unfilled}} with stdio: ['ignore', …] and asserts status === 0 / stdout Hi {{pa_unfilled}}\n. Under this PR that invocation now correctly throws the new UsageError, so the assertion fails (1 !== 0). Update the test to assert exit 1 and the Missing value for {{pa_unfilled}} message on stderr (its purpose — non-TTY must not hang — is still served).

  2. src/skill.test.ts:200-208 — asserts ['Explain {{concept}} now', '--no-interactive'] exits 0 with the literal placeholder; same breakage. It pins skills/promptargs/SKILL.md:92, which still documents the old behavior ("A blank with no value and no default stays as literal {{name}} in the output"). Both the doc line and the test need updating to the new error contract (README.md:451 is about the library expand() and is still accurate).

Remember to regenerate dist/ (CI dist-sync gate) after fixing the tests.

Minor, non-blocking: --file= with an empty value falls through as absent (src/resolver.ts:129-133) and now produces pass --file=<value>… — arguably the right outcome, just noting the message doesn't distinguish "empty" from "omitted".

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot added the stage/050-review-pending Review swarm requested; awaiting a verdict for the current head label Oct 23, 2026

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed (correctness) — no blocking findings; implementation matches #322.

Advisory (non-blocking): src/resolver.ts:129-134 leaves a blank absent when a flag expands to nothing (--file=, or --file=@empty.txt, see resolver.test.ts:94), so the new guard at src/cli.ts:163-170 reports "Missing value for {{file}}: pass --file= …" even though --file was passed. Erroring is the right outcome; the hint wording is just slightly off for that path.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style review (read at head feeebea, the PR has advanced past 803e1ff)

Hint is wrong for the piped-stdin path — src/cli.ts:163-170 always appends or run without --no-interactive to be asked. But src/cli.ts:115 makes a run non-interactive whenever process.stdin.isTTY !== true, regardless of the flag. The changelog fragment and the updated test (src/cli.test.ts:712-723, spawned with stdio: ['ignore', ...] and no --no-interactive) both cover exactly that case, and there the user is told to drop a flag they never passed. Suggested fix: branch the tail on flags['no-interactive'], e.g. pass --${first}=<value> + (flags['no-interactive'] ? or run without --no-interactive to be asked. : ; stdin is not a terminal, so it cannot be asked for.), and assert the second variant in the non-TTY test. Advisory: the sibling error for the same condition at src/resolver.ts:193 uses Variable "${name}" has no value and stdin is closed; … — matching that phrasing would keep the two messages consistent.

Placement after the --status early return (src/cli.ts:154-158) is right — --status still works as the SKILL.md pitfall advises — and Object.hasOwn matches the idiom in resolver.ts:122 / status.ts:19.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot added stage/070-fixing Hive-authored PR: CI red, changes requested or needs rebase; a hive agent is fixing it and removed stage/050-review-pending Review swarm requested; awaiting a verdict for the current head labels Oct 23, 2026
@kubestellar-prow kubestellar-prow Bot added dco-signoff: no Indicates the PR's author has not signed the DCO. and removed dco-signoff: yes Indicates the PR's author has signed the DCO. labels Oct 23, 2026
@github-actions github-actions Bot added dco-signoff: yes Indicates the PR's author has signed the DCO. and removed dco-signoff: no Indicates the PR's author has not signed the DCO. labels Oct 23, 2026
@kubestellar-prow kubestellar-prow Bot removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 23, 2026
@kubestellar-prow kubestellar-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 23, 2026
@hivecommons-hive hivecommons-hive Bot added no-dco A commit is missing Signed-off-by — run `git rebase --signoff` and removed dco All commits are DCO signed-off labels Oct 23, 2026
- Say "stdin is not a terminal" instead of "run without --no-interactive"
  when the flag was never passed (piped stdin).
- Say "give --name a non-empty value" when the flag was passed but
  expanded to nothing (e.g. --name=@empty.txt).
- Drop "or --no-interactive" from the resolver stdin-EOF hint, since that
  now yields a second usage error; suggest a default instead.
- Mention the new missing-blank usage error in the README.

Hive-Fix-Attempt: 1/6
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

hive/awaiting-ci: re-signed 21bf589 → 8986904 (DCO sign-off was missing; content unchanged). CI pending — sweep will merge when green.


🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot added dco All commits are DCO signed-off stage/050-review-pending Review swarm requested; awaiting a verdict for the current head and removed no-dco A commit is missing Signed-off-by — run `git rebase --signoff` stage/070-fixing Hive-authored PR: CI red, changes requested or needs rebase; a hive agent is fixing it labels Oct 23, 2026

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Read the tree at 89869046 rather than just the diff. This looks correct to me.

  • src/cli.ts:163 — the missing check runs after resolve() and after the --status early return at :157, so --status keeps its old behaviour as the body claims. resolve() (src/resolver.ts:122-158) only ever sets values[v.name] when a flag, autodetect, default, or interactive answer supplies one; an empty flag expansion deliberately falls through (:129-133), so Object.hasOwn is the right test and iteration-aware filtering covers the zip/cross case where every iteration carries the base values (:174).
  • src/cli.ts:166-172 — the two hint variants are consistent with interactive at :115: when --no-interactive is absent the only way to reach this branch is a non-TTY stdin, so "stdin is not a terminal" is accurate.
  • src/resolver.ts:194 — dropping "or --no-interactive" from the closed-stdin hint is right, since that flag would now also fail.
  • Verified locally: npm run build leaves dist/ unchanged (dist-sync gate satisfied); npm test → 454 pass / 0 fail. CI is green apart from pending tide.

Matches the scope of #322 (no change to expand()'s placeholder preservation, which the issue explicitly keeps). README, SKILL.md and the changelog fragment were updated alongside the behaviour.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

@hivecommons-hive
hivecommons-hive Bot merged commit 6909f65 into main Oct 23, 2026
11 of 12 checks passed
@kubestellar-prow
kubestellar-prow Bot deleted the scanner/fix-322 branch October 23, 2026 09:20
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author
Evidence bundle `#3238986904` sha256:e2df1e002ffb8c3102c3e833dda18734a8d3a5ef27044b616686676d7a6950d0 — download from the dashboard or `hivectl review evidence #323`.

@github-actions

Copy link
Copy Markdown

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

@hivecommons-hive hivecommons-hive Bot removed the stage/050-review-pending Review swarm requested; awaiting a verdict for the current head label Oct 23, 2026

@hivecommons-hive hivecommons-hive Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Read the diff against the tree at 8986904 and ran the suite locally (454/454 pass, dist/ in sync with src/). Looks correct to me.

What I verified:

  • src/cli.ts:163 — the guard runs after resolve() and before expand(), and only on the output paths; --status returns at cli.ts:157 first, so it still renders unfilled blanks for inspection (the SKILL.md pitfall text pointing at --status remains accurate).
  • src/resolver.ts:150-160 — when interactive is false and a blank has no flag/autodetect/default, no key is written, so Object.hasOwn is the right test. An empty expansion (--file=@empty.txt) falls through at resolver.ts:129 with no key either, which is why the "give --file a non-empty value" branch fires — matches the test at cli.test.ts:123.
  • src/iterate.ts:21-28 — zip() cycles with i % a.length, so multi-value iterations never carry an undefined key that would slip past hasOwn.
  • src/resolver.ts:194 — dropping "or --no-interactive" from the stdin-EOF hint is right: following that advice would now land on the new usage error.

One note for whoever merges: this converts exit 0 + literal {{name}} into exit 1 under piped stdin as well as --no-interactive, so any pipeline relying on the old passthrough will start failing. The changelog fragment and README state this plainly, so it is discoverable; just flagging that it is a behaviour change, not only a bug fix. I could not re-read #322 this kick (API cap), so I judged the change against the PR text.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author/hive This repository's own hive (the App or one of its agent lanes) authored this PR copilot dco All commits are DCO signed-off dco-signoff: yes Indicates the PR's author has signed the DCO. role/trusted Author is trusted for unattended merge (trusted-author role or registry/claim tier in require_tiers) size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[scanner] --no-interactive emits unfilled {{blank}} placeholders with exit 0 instead of a usage error

0 participants