Mutating seams read --dir through the permissive flag reader

john commented

2026-08-15 14:33:39 +00:00

Owner

Source: deep dive F6
Verdict: AGREE - medium (narrowed from the reviewer's framing)

Claim as reviewed

optionalFlag deliberately returns undefined for both an absent flag and a present flag with no value, and multiple effectful entry points then apply flag('--dir') || process.cwd(). The stricter flagValue helper exists specifically to distinguish the two, but the mutating seams do not use it.

At HEAD `f354864` (v3.3.0)

cadence-core/bin/lib/seam-input.mjs:45-60 - optionalFlag collapses absent and present-with-no-value.

cadence-core/bin/lib/seam-input.mjs:63-89 - flagValue exists for exactly this, and its doc comment names the failure class: "the caller got ok:true and the Cadence repo's numbers for a tree it never named. That is the quiet-wrong-number class, and it is worse than a hard error because the envelope looks correct."

cadence-core/bin/git-publish.mjs:204-215 - publish(flag('--dir') || process.cwd(), flag('--remote') || 'origin').
cadence-core/bin/release-bump.mjs:202-219 - same shape for --dir and --date.

Note

Narrowed on verification: git-publish still re-checks repoAutoClose and the protected-branch list against whatever directory it landed on, so pushing an unintended repository requires that repository to have repo-layer auto_close true as well.

release-bump is the live one - an empty --dir bumps whatever manifest sits under the session's cwd, with no second check.

**Source:** deep dive F6 **Verdict:** AGREE - medium (narrowed from the reviewer's framing) ### Claim as reviewed `optionalFlag` deliberately returns `undefined` for both an absent flag and a present flag with no value, and multiple effectful entry points then apply `flag('--dir') || process.cwd()`. The stricter `flagValue` helper exists specifically to distinguish the two, but the mutating seams do not use it. ### At HEAD f354864 (v3.3.0) `cadence-core/bin/lib/seam-input.mjs:45-60` - `optionalFlag` collapses absent and present-with-no-value. `cadence-core/bin/lib/seam-input.mjs:63-89` - `flagValue` exists for exactly this, and its doc comment names the failure class: "the caller got ok:true and the Cadence repo's numbers for a tree it never named. That is the quiet-wrong-number class, and it is worse than a hard error because the envelope looks correct." `cadence-core/bin/git-publish.mjs:204-215` - `publish(flag('--dir') || process.cwd(), flag('--remote') || 'origin')`. `cadence-core/bin/release-bump.mjs:202-219` - same shape for `--dir` and `--date`. ### Note Narrowed on verification: `git-publish` still re-checks `repoAutoClose` and the protected-branch list against whatever directory it landed on, so pushing an unintended repository requires that repository to have repo-layer `auto_close` true as well. `release-bump` is the live one - an empty `--dir` bumps whatever manifest sits under the session's cwd, with no second check.

john added the

bug

external-review

labels

2026-08-15 14:33:39 +00:00

john added this to the v3.5.4 milestone

2026-08-15 15:09:28 +00:00

john commented

2026-08-15 15:09:31 +00:00

Author

Owner

v3.5.4 also carries #147, which is the extraction question for this exact defect. Answer it here, not after: the fix is either (a) switch the mutating seams to the existing flagValue reader, which is a few lines and closes the reported defect, or (b) build the declarative parser #147 describes. Do not build (b) speculatively - the zero-dependency constraint and the size of (a) both argue for (a), and #147 should close as not-worth-it if that is what the work shows.

john modified the milestone from v3.5.4 to v3.5.5

2026-08-18 10:23:29 +00:00

john commented

2026-08-19 20:59:52 +00:00

Author

Owner

Closed by v3.5.5 (ARG-01, verified against the shipped tree).

john closed this issue

2026-08-19 20:59:56 +00:00

Rows
Columns

Mutating seams read --dir through the permissive flag reader #137

Claim as reviewed

At HEAD f354864 (v3.3.0)

Note

At HEAD `f354864` (v3.3.0)