Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bounty proposal] fix(agent-vm): oversized lease expiry escapes the ambiguity guard as OverflowError

Closed Beginner friendly
  • Is something wrong?
#19,798 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@Ranjit2111 is already working on this.

Since Oct 15, 2026.

  • #21745 by @Ranjit2111 — open

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
backend

Research direction

Start with _migration_reconcile_lease_active in services/users/agent_vm_account_cleanup.py and the existing hermetic fixture in tests/unit/test_agent_vm_account_cleanup.py. Reproduce the oversized expiry case, then run pytest tests/unit/test_agent_vm_account_cleanup.py. Done when oversized positive and negative integers and decimal strings raise the controlled RuntimeError, while normal future and past leases retain their behavior.

Written by the indexing model from the issue text.

Description

Summary

services/users/agent_vm_account_cleanup.py::_migration_reconcile_lease_active (line ~93) validates a stored agent-VM migration journal lease. Its documented contract is that every malformed/ambiguous lease value raises a controlled RuntimeError('Agent VM migration reconcile lease is ambiguous'). The conversion step breaks that contract for one input class:

try:
    expires_at = float(raw_expires_at)
except (TypeError, ValueError) as exc:
    raise RuntimeError('Agent VM migration reconcile lease is ambiguous') from exc

A stored expiresAt that passes the isinstance(raw, (int, float, str)) guard but is numerically beyond sys.float_info.max (e.g. a 400-digit integer from a corrupted or hostile journal document) makes float() raise OverflowError, which is not in the except tuple. The reconcile/cleanup path (delete_agent_vm_for_account) then crashes with an unhandled OverflowError instead of the controlled RuntimeError the guard is documented to produce. Same defect class as #15913 (oversized expiry escaping the validation boundary), different module.
Reproduced on current main, Python 3.12, hermetic unit lane. No live API or credentials needed.

Reproduction

vm = {'reconcile': {'lease': {'expiresAt': int('9' * 400)}}}
_migration_reconcile_lease_active(vm, [{}], now=1000.0)
# actual: OverflowError: int too large to convert to float
# expected: RuntimeError('Agent VM migration reconcile lease is ambiguous')

The negative oversized integer fails identically.

Reachability & framing (read before objecting it cannot happen)

  • A plain Firestore int64 (expiresAt <= 2^63-1) never overflows float() — the guard's existing isinstance/math.isfinite checks already cover all in-range and float-based values, including decimal strings that convert to inf.
  • The hole fires specifically when the stored value arrives as an unbounded Python int (309+ digits): a corrupted or hostile serialized journal document, or any future in-memory caller passing arbitrary-precision integers. That input class is exactly what this guard exists to reject.
  • The function's documented contract is "every malformed/ambiguous lease value raises the controlled RuntimeError" — and delete_agent_vm_for_account (the account-deletion path) is built on that promise. OverflowError is the last escape route that violates it. One-line fix, zero behavior change for every valid input.

Proposed fix

Add OverflowError to the except tuple (one line, plus a comment documenting the intent). Controlled RuntimeError is raised with the existing from exc chain.

Regression coverage

tests/unit/test_agent_vm_account_cleanup.py (extends the existing hermetic fixture, no new stubs):

  • test_reconcile_lease_oversized_expiry_is_ambiguous_not_overflow: positive oversized int, negative oversized int, and oversized decimal string all raise the controlled RuntimeError.
  • test_reconcile_lease_normal_expiry_still_evaluated: future/past finite leases still evaluate to True/False (no behavior change for valid inputs).

Validation

  • New oversized case fails on the unfixed implementation (OverflowError escapes) and passes after the fix; normal-expiry case passes in both directions.
  • pytest tests/unit/test_agent_vm_account_cleanup.py: 8 passed (existing 6 + new 2).
  • black --line-length 120 --skip-string-normalization clean; ruff check clean.

Proposed bounty

  • $30 (one-line robustness fix closing a documented-contract hole, with hermetic regression coverage). Payable through the documented PayPal process after acceptance and merge.
    cc @josancamon19 @kodjima33 @Git-on-my-level
    Disclosure: the investigation, patch, and tests were prepared with an AI assistant. This proposal does not represent independent human technical review.
Dominant language
Python
Stars
13.8k
Forks
2.7k
Avg merge
6h 40m
Merged PRs (30d)
635

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from BasedHardware/omi

All issues in BasedHardware/omi

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.