From 3305ef10598ae33cc1a6984a54b535fe6282b897 Mon Sep 17 00:00:00 2001 From: safishamsi Date: Thu, 16 Jul 2026 23:38:09 +0100 Subject: [PATCH] fix(merge-chunks): coerce non-numeric chunk token counts (follow-up to #1953) An untrusted chunk with a non-numeric input_tokens/output_tokens would abort the whole merge with a TypeError after other chunks had already merged. Coerce to 0 so a bad token field can't defeat the per-chunk validation guard. Co-Authored-By: Claude Opus 4.8 (1M context) --- graphify/cli.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/graphify/cli.py b/graphify/cli.py index e51283ba9..adccc16e8 100644 --- a/graphify/cli.py +++ b/graphify/cli.py @@ -3064,8 +3064,12 @@ def dispatch_command(cmd: str) -> None: merged["nodes"].append(n) merged["edges"].extend(chunk.get("edges", [])) merged["hyperedges"].extend(chunk.get("hyperedges", [])) - merged["input_tokens"] += chunk.get("input_tokens", 0) - merged["output_tokens"] += chunk.get("output_tokens", 0) + # Coerce token counts: a chunk is untrusted, so a non-numeric + # input_tokens/output_tokens must not abort the whole merge with a + # TypeError after other chunks already merged. + for _tok in ("input_tokens", "output_tokens"): + _v = chunk.get(_tok, 0) + merged[_tok] += _v if isinstance(_v, (int, float)) else 0 out_path.parent.mkdir(parents=True, exist_ok=True) out_path.write_text(json.dumps(merged, ensure_ascii=False), encoding="utf-8") print(