{"record":{"id":"267e5176834d4c59","repo":"stablyai/orca","slug":"usage-verify-skill-update-roundtrip-mjs-cli-ve","errorCode":null,"errorMessage":"Usage: verify-skill-update-roundtrip.mjs --cli=<version> --autocrlf=true|false --shape=symlink|copy --source=<owner/repo> --ref=<git-ref>","messagePattern":"Usage: verify-skill-update-roundtrip\\.mjs --cli=<version> --autocrlf=true\\|false --shape=symlink\\|copy --source=<owner/repo> --ref=<git-ref>","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/scripts/verify-skill-update-roundtrip.mjs","lineNumber":38,"sourceCode":"  return process.argv.find((value) => value.startsWith(`--${name}=`))?.slice(name.length + 3)\n}\n\nconst cliVersion = option('cli')\nconst autocrlf = option('autocrlf')\nconst shape = option('shape')\n// Why: PR branch names are untrusted workflow input. Keep them out of the\n// generated shell command and pass them to Node through the environment.\nconst source = option('source') ?? process.env.SKILL_UPDATE_SOURCE\nconst ref = option('ref') ?? process.env.SKILL_UPDATE_REF\nif (\n  !cliVersion ||\n  (autocrlf !== 'true' && autocrlf !== 'false') ||\n  (shape !== 'symlink' && shape !== 'copy') ||\n  !source ||\n  !ref ||\n  !/^[^/\\s]+\\/[^/\\s]+$/.test(source)\n) {\n  throw new Error(\n    'Usage: verify-skill-update-roundtrip.mjs --cli=<version> --autocrlf=true|false --shape=symlink|copy --source=<owner/repo> --ref=<git-ref>'\n  )\n}\n\nconst sandbox = await mkdtemp(path.join(tmpdir(), 'orca-skill-update-roundtrip-'))\nconst home = path.join(sandbox, 'home')\nconst stateHome = path.join(home, '.state')\nconst fakeBin = path.join(sandbox, 'bin')\nconst targetName = 'orca-cli'\nconst controlName = 'orchestration'\nconst manifest = JSON.parse(await readFile('resources/skills/current-manifest.json', 'utf8'))\nconst registry = JSON.parse(await readFile('resources/skills/snapshot-registry.json', 'utf8'))\nconst releaseMapping = JSON.parse(await readFile('resources/skills/release-mapping.json', 'utf8'))\n\nfunction currentSkill(name) {\n  const skill = manifest.skills.find((entry) => entry.name === name)\n  if (!skill) {\n    throw new Error(`Current manifest is missing ${name}`)","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/verify-skill-update-roundtrip.mjs#L20-L56","documentation":"Usage guard at the top of verify-skill-update-roundtrip.mjs: validates the five CLI options (cli version, autocrlf true/false, shape symlink|copy, source owner/repo, ref). It throws if any required option is missing or if source doesn't match the owner/repo regex. The options are also readable from SKILL_UPDATE_SOURCE / SKILL_UPDATE_REF env vars to keep PR-controlled branch refs out of the generated shell command.","triggerScenarios":"Omitting one of --cli, --autocrlf, --shape, --source, --ref; passing --autocrlf=yes or --shape=link (invalid enum); passing --source with a bare repo name or full URL instead of owner/repo; passing a ref containing whitespace.","commonSituations":"Workflow input matrix misconfiguration; upstream caller changed option names; copy-paste of the invocation with a stale option set; ref sourced from an untrusted PR head that contains unexpected characters.","solutions":["Supply all five options with valid values: --cli=1.5.20 --autocrlf=false --shape=symlink --source=stablyai/orca --ref=v1.5.20.","Ensure --autocrlf is exactly 'true' or 'false' and --shape is exactly 'symlink' or 'copy'.","Ensure --source is owner/repo format (no https://, no trailing .git, no spaces).","If passing ref via env, set SKILL_UPDATE_REF and SKILL_UPDATE_SOURCE and confirm the options block reads them."],"exampleFix":"# before\nnode config/scripts/verify-skill-update-roundtrip.mjs --cli=1.5.20\n# after\nnode config/scripts/verify-skill-update-roundtrip.mjs --cli=1.5.20 --autocrlf=false --shape=symlink --source=stablyai/orca --ref=v1.5.20","handlingStrategy":"validation","validationCode":"// Validate options before delegating to the script, mirroring its own checks:\nfunction assertRoundtripArgs({ cliVersion, autocrlf, shape, source, ref }) {\n  const ok = cliVersion &&\n    (autocrlf === 'true' || autocrlf === 'false') &&\n    (shape === 'symlink' || shape === 'copy') &&\n    typeof source === 'string' && /^[^\\/\\s]+\\/[^\\/\\s]+$/.test(source) &&\n    typeof ref === 'string' && ref.length > 0\n  if (!ok) throw new Error('Invalid verify-skill-update-roundtrip args')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass branch refs via SKILL_UPDATE_REF env, never interpolated into the command string.","Pin the workflow input enum for --autocrlf and --shape at the workflow level (choice type).","Validate --source is owner/repo in the workflow before calling the script."],"tags":["usage","cli-args","skill-update","ci-gate","validation"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}