fix(longbridge-tools): validate calendar event args before exec - #11
Merged
Merged
Conversation
kbkb628
force-pushed
the
fix/calendar-args-validation
branch
from
September 11, 2026 05:25
3a29a76 to
a6ba4e9
Compare
getCalendarEvents was the only tool that passed user-supplied symbols
straight into the LongBridge CLI argv without the repo-wide symbol check
(CLAUDE.md: validate with /^[A-Z0-9]{1,5}\.(US|HK|SG|SH|SZ|HAS)$/ before
exec). It also forwarded unvalidated start/end/count strings, so values
like "--symbol" could be misread as CLI flags.
- validate every symbol with validateSymbolOrThrow (INVALID_SYMBOL)
- require YYYY-MM-DD for start/end (new INVALID_ARGUMENT code)
- require a positive integer for count
- add regression tests for all three rejections
kbkb628
force-pushed
the
fix/calendar-args-validation
branch
from
September 11, 2026 07:28
a6ba4e9 to
abb6a0a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
getCalendarEvents是唯一一个把用户提供的符号直接塞进 LongBridge CLI argv、而没有走仓库统一符号校验的工具（CLAUDE.md 关键规则：exec 前必须用/^[A-Z0-9]{1,5}\.(US|HK|SG|SH|SZ|HAS)$/校验）。同时start/end/count也未经校验直接转发——像"--symbol"这样的值会被 CLI 误读为参数标志。改动
packages/longbridge-tools/src/tools/calendar.ts：validateSymbolOrThrow校验（INVALID_SYMBOL），与其他工具一致start/end必须是YYYY-MM-DD格式count必须是正整数INVALID_ARGUMENT（errors.ts 中扩展 ErrorCode union）验证
bun test packages/longbridge-tools：新增 3 个回归测试全部通过（非法 symbol / 非日期 start-end / 非法 count 均拒绝且execa未被调用）；现存 7 个失败均为仓库已知的未提交 account fixtures 问题（见 test(longbridge-tools): skip account-fixture tests when fixtures are absent #10），与本次改动无关bun run typecheck全绿