Validate and safely serialize generated harness metadata

[emoriwan]

Observed behavior

Leia validates --module-format but still accepts --retry and --timeout as unrestricted strings. templates/body.def emits retry as raw JavaScript, while templates/header.def and templates/test.def interpolate paths, identifiers, version values, shell values, and other metadata directly into JavaScript string or template-literal contexts. Non-numeric option values or metadata containing JavaScript-significant quotes and backslashes can therefore make the generated harness invalid or change its meaning before tests run.

Expected behavior

Every value entering a generated CommonJS or ESM harness is validated according to its semantic type and serialized as JavaScript data rather than hand-escaped source. Invalid numeric CLI values fail early with an actionable error, and supported paths, identifiers, shell values, and metadata generate equivalent valid harnesses in both formats.

Reproduction or evidence

On the current main baseline, cli/default.js defines retry and timeout as string flags; templates/body.def renders this.retries({{=it.retry}});; and templates/header.def plus templates/test.def place metadata inside quoted JavaScript without a single serialization boundary. A non-numeric --retry value or a supported path containing a quote or backslash exercises the defect before Mocha can run the intended test.

Environment

Current main before Leia 2.0; both .leia.cjs and .leia.mjs generation paths are affected because they share the metadata templates.

Impact

Harness generation is Leia's core execution boundary. Malformed or JavaScript-significant metadata can prevent all tests from running and makes correctness depend on incidental path and argument characters across supported operating systems.

Delivery and verification

Open one linked draft completion pull request. Its first substantive change should add focused regression tests that fail against the current baseline for invalid numeric options and safely supported quote/backslash path metadata, then introduce centralized validation and serialization. Preserve the failing baseline evidence and show the same tests, CommonJS and ESM generation coverage, special-character shell coverage, lint, unit tests, and relevant CI examples passing with the fix.

Acceptance criteria

• retry and timeout accept only documented numeric values and ranges, with actionable errors for invalid input
• Every dynamic value rendered into generated JavaScript uses a semantic serialization boundary rather than hand-built quoting
• Paths, identifiers, version values, shell values, stdin settings, commands, quotes, and backslashes generate valid harnesses without changing their data
• CommonJS and ESM harnesses retain equivalent behavior
• Regression coverage includes invalid numeric input plus quote- and backslash-bearing metadata on supported platforms
• Existing shell-command serialization behavior and relevant Leia validation remain green

Task metadata

schema: tanaab/task-metadata/v2
mode: fallback
fallback:
  work-size: 5
  complexity: medium
  impact: high

[emoriwan]

Got the handoff — I'm taking it from here.

[emoriwan]

Leia currently lets unvalidated retry/timeout strings and directly interpolated metadata cross into generated CJS/ESM source, so valid paths or shell metadata containing quotes or backslashes can corrupt the harness before Mocha runs. I’m going to start with failing regressions for invalid numeric flags and special-character metadata in both formats, then add non-negative integer validation plus a centralized JSON serialization boundary, update the public option contract, and verify lint, unit tests, and the existing shell/module-format scenarios.

[emoriwan]

Pull request opened

• Pull request: Validate and safely serialize generated harness metadata #78
• Conversation: Comments on this issue and its delivery pull request now continue in the same private work session.
• Replies: Each response is posted back to the issue or pull request where its comment originated.