[JacobStephens2]

Summary

Allow a positive decimal issue number anywhere a Run accepts its Issue URL, using the Launch directory’s GitHub origin.

thirdshift [merge/options] <number | Issue URL>
  parse issue and flags
  number → origin’s GitHub repository → IssueUrl
  existing Run startup and Origin match → reviewed pull request

Supports nested directories and existing HTTPS/SSH origin spellings. Rejects invalid numbers and unresolved origins before tracker or session activity; help and README show shorthand examples.

Closes #106

Evidence

• Before: cargo test --test issue_number a_number_and_a_full_url_deliver_the_same_issue -- --exact failed: not a GitHub issue URL: 7 (exit 2).
  After: The same test passes, delivering the same issue, session URL and PR for either input.
• cargo test --test issue_number --test preflight --test command_surface: 41 passed, including invalid/no-origin rejection without tracker calls, nested SSH/HTTPS origins, Merge runs and existing full-URL Origin match.
• cargo test --bin thirdshift args::tests: 30 passed, including numeric option values remaining attached to their flags.
• cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings: passed.
• cargo nextest run: final full Rust suite passed — 1,792 tests passed, 2 existing helper tests skipped. cargo test also passed before synchronizing the incoming test/help commits.

Merge Danger

Door: two-way

Revert the change to remove shorthand support.

Blast Radius: CLI

Issue-number parsing and early origin resolution; full URLs enter the existing startup path unchanged.

Test seams

• The thirdshift executable: CLI arguments, exit status, output, and delivered PR/session through real local Git repositories and the existing fake GitHub/Harness executables.
• The public argument parser: parsed issue input and Run flags, without repository access.

Review coverage

Independent Standards and Spec reviews used git diff main...HEAD at final head c06e6f7, with main fixed at 106d16e. Both read all nine changed files. Changed files left unread: none on either axis.

Security: single-session guidance-mode review of 106d16e032828d5e4f04d39ea2de9c288c492f04...HEAD at c06e6f7d6844739c86ed5accbebfd4b187f1f01f covered all nine changed files and supporting parsing, origin identity, Run startup, process arguments and logging code. No introduced security findings were identified. Relevant attack-class guidance and repository domain/security-policy documentation were read; no SECURITY.md or dedicated threat model was present.

Security validation passed in a sandbox with external networking disabled, an empty allowlisted environment, read-only source/toolchain mounts and resource limits: cargo test --offline --locked --test issue_number --test preflight --test command_surface -- --test-threads=1 (41 tests), cargo test --offline --locked --bin thirdshift args::tests -- --test-threads=1 (30 tests), and cargo test --offline --locked --bin thirdshift issue::tests -- --test-threads=1 (1 test). No source changes were needed.

Security validation for this session rebuilt HEAD offline and passed cargo test --offline --locked --test issue_number --test preflight --test command_surface -- --test-threads=2 (41 tests) and cargo test --offline --locked --bin thirdshift args::tests -- --test-threads=2 (30 tests). Execution used an isolated network namespace, scratch home/temp/cache, read-only source and toolchain, two CPUs, a 4 GiB per-process address-space limit, 256-process limit, 128 MiB file-size limit, 1.5 GiB scratch filesystem and 300-second wall-clock limit. The review of 106d16e032828d5e4f04d39ea2de9c288c492f04...HEAD found no introduced Security findings; no fix commits were needed.

Unaddressed findings

• Security: none; 0 findings.
• Standards: none; 0 findings.
• Spec: none; 0 findings.

Built with codex · gpt-6.1-sol · high

Security review outcome

No unaddressed introduced findings.