openclaw - 💡(How to fix) Fix [Bug]: update --timeout accepts partially numeric strings despite positive-integer contract [1 pull requests]

Summary

A local code audit found that update CLI timeout parsing accepts partially numeric strings even though the option contract is a positive integer in seconds.

Affected area

• src/cli/update-cli/shared.ts
• parseTimeoutMsOrExit

Repro

Pass values such as --timeout 1.5 or --timeout 10abc to an update subcommand. The parser accepts the numeric prefix instead of rejecting the full value.

Expected

The parser should reject any value that is not entirely a positive integer string.

Suggested fix

Trim the input and require a full-string decimal integer match, then verify the parsed number is a safe positive integer before converting seconds to milliseconds.

Suggested regression test

Add update CLI timeout validation cases for 1.5 and 10abc that expect the existing positive-integer error and exit path.

Source: local code audit.