[repo-health] Medium: --memory and --cpus flags have no validation — invalid values silently pass to docker run

[Liohtml]

Summary

The --memory and --cpus CLI flags (and their MEM/CPUS env counterparts) are passed verbatim to docker run with no format validation. Invalid values like agentbox up --memory abc --cpus -1 produce a cryptic Docker error at container start time instead of a clear up-front message.

Category

Bug

Severity

Medium

Location

• File: src/cli/config.ts, lines 28-29
• File: src/docker/index.ts, lines 203-206 (runContainer)

Details

// src/cli/config.ts:28-29
const memory = str(flags.memory) ?? env.MEM ?? DEFAULTS.memory;
const cpus = str(flags.cpus) ?? env.CPUS ?? DEFAULTS.cpus;
// No validation — any string passes through

These values are forwarded directly to docker run:

// src/docker/index.ts:203-206
"--memory", config.memory,
"--cpus",   config.cpus,

Docker's own error messages for invalid resource limits (invalid memory limit: abc, invalid cpus value) are not surfaced clearly to the user. This is the same class of defect as the NaN port bug (issue #4), just for resource limits.

Valid formats Docker accepts:

• --memory: <number>[b|k|m|g], e.g. 512m, 4g, 2048m
• --cpus: a positive decimal number, e.g. 1, 2.5, 4

Suggested Fix

Add a lightweight validation guard in resolveConfig or cmdUp:

// In resolveConfig, after lines 28-29:
const memoryPattern = /^\d+(\.\d+)?[bkmgBKMG]?$/;
if (!memoryPattern.test(memory)) {
  throw new Error(`Invalid --memory value: ${JSON.stringify(memory)} (examples: 512m, 4g, 2048m)`);
}
const cpusNum = Number(cpus);
if (!Number.isFinite(cpusNum) || cpusNum <= 0) {
  throw new Error(`Invalid --cpus value: ${JSON.stringify(cpus)} (must be a positive number, e.g. 2 or 2.5)`);
}

cmdDoctor could also include these checks in its checklist.

Effort Estimate

15 min

---

Automated finding by repo-health-agent v1.0