Repository navigation
fix(core): foreign-session digest render throws RangeError on finite out-of-range timestamps #3822
Description
What happened
Rendering a foreign-session digest can crash the resume/send flow with RangeError: Invalid time value.
packages/core/src/foreign-session.ts:635 guards the toISOString() call with Number.isFinite(digest.updatedAtMs), with a comment claiming this prevents exactly that RangeError. It does not:
`updated_at=${Number.isFinite(digest.updatedAtMs) ? new Date(digest.updatedAtMs).toISOString() : 'unknown'}`,Date clamps at ±8.64e15 ms (TimeClip); any finite value beyond that makes new Date(ts) an Invalid Date, and .toISOString() throws. Verified on Node 24:
$ node -e "console.log(new Date(1e16).toISOString())"
RangeError: Invalid time value
The untrusted value flows straight through: normalizeEpochMs (packages/core/src/foreign-session.ts:404-413) accepts any finite number ≥ 1,577,836,800,000 as-is, so a corrupt or future-schema Codex SQLite row (e.g. a nanosecond epoch ≈ 1.7e18) passes validation, survives the 30-day window filter in codexRowsToSummaries, and reaches the digest render via buildForeignSessionHandoffMessage.
How to reproduce
- Point Maka at a Codex store whose
threads.updated_at_mscontains e.g.10000000000000000(1e16) - Resume / send in that session — the digest render throws
RangeError: Invalid time value
Suggested fix
Validate epoch range, not just finiteness — accept only Math.abs(t) <= 8_640_000_000_000 inside normalizeEpochMs (rejecting or clamping out-of-range rows), or apply the same range check at line 635.
Activity
hydraxman commentedon Aug 25, 2026
I can take this.
Dev design: define the ECMAScript
TimeClipbound once, reject normalized store timestamps outside that range, and keep the prompt-render boundary fail-closed by emittingupdated_at=unknownfor any invalid digest timestamp.Scope / non-goals: no schema migration, no clamping, and no change to valid seconds-to-milliseconds normalization.
Test plan / acceptance: add a RED regression for a Codex row with
updated_at_ms = 1e16plus direct digest rendering at that boundary; after the fix, the row must not carry the invalid timestamp, rendering must not throw, valid timestamps must remain ISO-formatted, and the full@maka/coresuite must pass.hydraxman commentedon Aug 25, 2026
Implemented in #3835 at
a68af7b193cfa9333cc56f7ec818868e88da0faf.RED / GREEN evidence:
main:npm --workspace @maka/core testreported 656 passed / 2 failed; the invalid timestamp was retained and direct digest rendering threwRangeError.git diff --checkpass.Acceptance:
updated_at=unknownwithout throwing