From 512aed191a21663b38f62ec6722e886f704ca90c Mon Sep 17 00:00:00 2001
From: leoca <leo.camus23@gmail.com>
Date: Sat, 12 Sep 2026 03:42:02 +0200
Subject: [PATCH] Fix --idle-timeout-seconds validation being skipped

The lower bound check ran before the parser had resolved the value, so it
only saw a value with the --idle-timeout-seconds=<value> form. With the
space-separated form the value was still undefined at that point,
Number(undefined) is NaN, and NaN <= 60 is false, so anything got through.

Move the check below the block that pulls the value from the next
argument so both forms are validated the same way.
---
 CHANGELOG.md               |  5 +++++
 src/node/cli.ts            |  8 ++++----
 test/unit/node/cli.test.ts | 10 ++++++++++
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9a3585ef0d5..1786abd36c48 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,11 @@ Code v99.99.999
 
 ## Unreleased
 
+### Fixed
+
+- `--idle-timeout-seconds` was only validated when passed as `--idle-timeout-seconds=<value>`;
+  values of 60 or less passed as `--idle-timeout-seconds <value>` were silently accepted.
+
 ## [4.137.0](https://github.com/coder/code-server/releases/tag/v4.137.0) - 2026-09-11
 
 Code v1.137.0
diff --git a/src/node/cli.ts b/src/node/cli.ts
index 623268f47e32..df915c0c532b 100644
--- a/src/node/cli.ts
+++ b/src/node/cli.ts
@@ -429,10 +429,6 @@ export const parse = (
         throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
       }
 
-      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
-        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
-      }
-
       const option = options[key]
       if (option.type === "boolean") {
         ;(args[key] as boolean) = true
@@ -452,6 +448,10 @@ export const parse = (
         throw error(`--${key} requires a value`)
       }
 
+      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
+        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
+      }
+
       if (option.type === OptionalString && value === "false") {
         continue
       }
diff --git a/test/unit/node/cli.test.ts b/test/unit/node/cli.test.ts
index 17f57a9666ef..e15a6afbfd04 100644
--- a/test/unit/node/cli.test.ts
+++ b/test/unit/node/cli.test.ts
@@ -268,6 +268,16 @@ describe("parser", () => {
     expect(() => parse(["--log", "invalid"])).toThrowError(/--log valid values: \[trace, debug, info, warn, error\]/)
   })
 
+  it("should error if idle-timeout-seconds is too low", () => {
+    expect(() => parse(["--idle-timeout-seconds=60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(() => parse(["--idle-timeout-seconds", "60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(parse(["--idle-timeout-seconds", "61"])).toEqual({ "idle-timeout-seconds": 61 })
+  })
+
   it("should error if the option doesn't exist", () => {
     expect(() => parse(["--foo"])).toThrowError(/Unknown option --foo/)
   })