fix(input): restrict interactive binary choices to 1/2

[seonghobae]

Current classification

이 변경은 원격 공격 경계가 입증된 MEDIUM 취약점으로 분류하지 않습니다. 실제 문제는 로컬 대화형 프롬프트가 의미상 "1"/"2"만 허용하면서 모든 숫자 문자열을 먼저 수락해 0, 3, 큰 정수 문자열 등이 후속 제어 흐름에 들어갈 수 있었던 correctness/robustness 결함입니다.

• protected base: master@f87c2324f1686135e57d8730c1b0b9420874f300
• exact head: 4903bd7cacf311eb56637f946ae0d9d150c1c370
• lifecycle: Draft / overlapping stronger successor candidate exists

Valid delta on this branch

세 readline() 경로가 broad grepl("^[0-9]+$", n) 대신 exact n %in% c("1", "2")를 사용합니다. 이 방향 자체는 유효하지만 이 branch는 production 세 군데를 각각 수정할 뿐, 해당 세 경로를 실행하는 회귀 테스트를 포함하지 않습니다. 기존 본문의 100% 커버리지 달성 주장은 이 exact diff와 hosted evidence로 입증되지 않았으므로 merge evidence로 사용하지 않습니다.

Canonical successor candidate

#349 fix(input): centralize bounded interactive choices exact 170484002b50a7254316d9b417dfd13e41de05b5가 같은 세 입력 경계를 공통 .read_binary_choice()로 중앙화하고 다음 실행형 계약을 추가합니다.

• exact "1"/"2" acceptance
• 0, 3, 10, oversized integer text, whitespace, empty/non-numeric input rejection
• 3회 invalid 입력 뒤 bounded failure
• checkCorrect(), old-form BILOG prior, new-form BILOG prior 세 실제 nested helper의 shared-reader wiring
• 1L -> TRUE, 2L -> FALSE prior assignment preservation
• 원격 심각도를 꾸미지 않은 sentinel traceability

Fresh compare에서 #373과 #349는 현재 공통 protected base에서 diverged 상태입니다. #349가 의미상 stronger successor candidate라고 해서 이 PR을 지금 닫지는 않습니다. #349의 current exact head도 R CMD check, Code Quality, Security Audit/Scan, SAST, Required CodeQL이 아직 queued이며 qualifying current-head approval이 없습니다.

Retirement / landing boundary

이 PR은 Draft/open으로 유지합니다. #349의 unchanged exact successor가 applicable hosted gates와 independent review를 모두 통과하고, 그 후 exact comparison으로 이 PR의 모든 유효 production 의미와 traceability가 정상 ancestry 또는 보호 브랜치 통합을 통해 완전 승계됐음을 증명한 뒤에만 verified-successor 사유로 retire할 수 있습니다.

Leaf no-op commit, manual rerun, synthetic status, self-approval, force push, destructive rebase, gate weakening 또는 predecessor evidence transfer는 사용하지 않습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Convergence handoff: canonical #349 has been repaired as ordinary descendant 170484002b50a7254316d9b417dfd13e41de05b5. It preserves the valid .Rbuildignore Semgrep packaging delta from intervening 03469f4... while restoring one shared bounded .read_binary_choice() plus execution regressions for exact 1/2 acceptance, retries/exhaustion, whitespace/oversized input rejection, all three production prompt helpers, and old/new BILOG prior 1/2→TRUE/FALSE assignments. Fresh compare from prior strong #349 9a5ec881... is ahead 2 / behind 0 with effective delta only .Rbuildignore. #373’s duplicated one-shot regex source therefore has no known unique semantic/test delta at this point, but do not close it yet: #349 exact-head hosted gates and current-head independent review are still nonterminal, so verified-successor retirement is not established.

[google-labs-jules]

Convergence handoff: canonical #349 has been repaired as ordinary descendant 170484002b50a7254316d9b417dfd13e41de05b5. It preserves the valid .Rbuildignore Semgrep packaging delta from intervening 03469f4... while restoring one shared bounded .read_binary_choice() plus execution regressions for exact 1/2 acceptance, retries/exhaustion, whitespace/oversized input rejection, all three production prompt helpers, and old/new BILOG prior 1/2→TRUE/FALSE assignments. Fresh compare from prior strong #349 9a5ec881... is ahead 2 / behind 0 with effective delta only .Rbuildignore. #373’s duplicated one-shot regex source therefore has no known unique semantic/test delta at this point, but do not close it yet: #349 exact-head hosted gates and current-head independent review are still nonterminal, so verified-successor retirement is not established.

Acknowledged.