From c7841a621dcecd85ef415eaf030be239c31a7f80 Mon Sep 17 00:00:00 2001
From: MarkXian <mark-xian@foxmail.com>
Date: Tue, 28 Jul 2026 14:24:49 +0800
Subject: [PATCH] fix(web): reject malformed port values

---
 .changeset/strict-web-port-values.md     | 5 +++++
 apps/kimi-code/src/cli/sub/web/shared.ts | 3 +++
 apps/kimi-code/test/cli/web/web.test.ts  | 2 ++
 3 files changed, 10 insertions(+)
 create mode 100644 .changeset/strict-web-port-values.md

diff --git a/.changeset/strict-web-port-values.md b/.changeset/strict-web-port-values.md
new file mode 100644
index 0000000000..ddc5099678
--- /dev/null
+++ b/.changeset/strict-web-port-values.md
@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Reject malformed port values for the web server command.
diff --git a/apps/kimi-code/src/cli/sub/web/shared.ts b/apps/kimi-code/src/cli/sub/web/shared.ts
index 79dfff7d41..e914a05026 100644
--- a/apps/kimi-code/src/cli/sub/web/shared.ts
+++ b/apps/kimi-code/src/cli/sub/web/shared.ts
@@ -95,6 +95,9 @@ function parseHost(raw: string | boolean | undefined): string {
 
 export function parsePort(raw: string | undefined, label: string, fallback: number): number {
   if (raw === undefined) return fallback;
+  if (!/^\d+$/.test(raw)) {
+    throw new Error(`error: invalid ${label} value: ${raw}`);
+  }
   const n = Number.parseInt(raw, 10);
   if (!Number.isFinite(n) || n < 0 || n > 65535) {
     throw new Error(`error: invalid ${label} value: ${raw}`);
diff --git a/apps/kimi-code/test/cli/web/web.test.ts b/apps/kimi-code/test/cli/web/web.test.ts
index d23497b5d1..2d1e933e31 100644
--- a/apps/kimi-code/test/cli/web/web.test.ts
+++ b/apps/kimi-code/test/cli/web/web.test.ts
@@ -520,6 +520,8 @@ describe('shared parsers stay strict', () => {
     const { parsePort } = await import('#/cli/sub/web/shared');
     expect(() => parsePort('99999', '--port', 58627)).toThrow(/invalid --port/);
     expect(() => parsePort('-1', '--port', 58627)).toThrow(/invalid --port/);
+    expect(() => parsePort('123abc', '--port', 58627)).toThrow(/invalid --port/);
+    expect(() => parsePort('1.5', '--port', 58627)).toThrow(/invalid --port/);
     expect(parsePort(undefined, '--port', 58627)).toBe(58627);
     expect(parsePort('8080', '--port', 58627)).toBe(8080);
   });