[Hackathon] invalid --since and missing --password-file crash instead of returning VALIDATION_ERROR

[crypticsaiyan]

Discord Username / User ID

uisupersaiyan3

What does this improvement do?

Summary

Two categories of invalid user input currently produce unhandled exceptions
(raw Node stack traces, exit code 1) instead of the CLI's standard typed
validation error (exit code 5):

1. An extremely large --since duration overflows the valid JavaScript date
   range and crashes during date conversion.
2. A non-existent --password-file path during project creation or update
   crashes with an unguarded filesystem error.
   In both cases, input that a user could plausibly supply by mistake bypasses
   the CLI's validation-error handling entirely and surfaces as an
   unhandled exception instead.

---

Affected Code

File	Function	Issue
src/commands/test.ts	parseDuration	No bounds check on the parsed date before calling .toISOString()
src/commands/project.ts	Password file handling (create/update)	readFileSync call is unguarded; missing file throws raw ENOENT

Details / implementation notes

issue fixed in PR #27

Confirmations

• I have searched existing issues and this is not a duplicate.
• I have provided my Discord identity above for reward coordination.

[zeshi-du]

Status correction after re-auditing the code: PR #27 fixed only the --since half of this issue (parseDuration overflow). The --password-file half is still live on main — project.ts calls readFileSync(opts.passwordFile) bare at three sites, so a missing file still crashes with a raw ENOENT instead of a VALIDATION_ERROR envelope. Keeping this open scoped to the password-file half; the split-out password-file guard from #248's rework (see the review there) is the natural vehicle. Sorry for the earlier over-claim.

[naufalfx805-source]

/assign

Picking up the remaining --password-file half, scoped per @zeshi-du's 2026-07-18 status correction.

Planning to cover the project create and project update call sites (project.ts:213, project.ts:329) and leave project auto-auth (project.ts:579) to #282, which is already in progress and covers that site alongside its three sibling flags. The guard will be a shared helper taking the flag name, so #282 can adopt it for --credential-file / --client-secret-file / --refresh-token-file without rework.

[testsprite-hob]

Assigned to @naufalfx805-source. Thanks for taking this on. (1 more slot available.)

Your open assigned issues (2/3):

• test: cover cross-process credential mutation race #279 — test: cover cross-process credential mutation race