fix(cmd): reject NaN and Inf for numeric sizing flags

[cristim]

Summary

Rejects NaN and +/-Inf for --coverage, --target-coverage, --min-pool-size and --min-savings-pct in the flag validators (one requireFinite(name, v) helper), before any API call. Explicit --target-coverage 0 stays valid (documented disabled); ranges are unchanged.

Root cause: every ordered comparison with NaN is false, so --target-coverage NaN passed the <0 || >100 check, then applySizing/fetchExistingCoverage read TargetCoverage > 0 as "unset" and silently sized with --coverage (default 80). --coverage NaN reaches recfilter.ApplyCoverage (sizing.go:23), producing NaN HourlyCommitment/costs for SP recs and an arch-dependent int(NaN*count) for RI recs. --min-pool-size NaN passed the whole-number check; --min-savings-pct had no validation.

Evidence (offline)

• TestValidateNumericFlagsRejectNonFinite drives the real flags via rootCmd.ParseFlags then the validators; it never calls runTool, so no AWS client is built. Cases: NaN, nan, +/-Inf per flag, 1e999 (rejected by the flag parser), explicit 0 and valid values.

• Pre-fix (validators.go stashed): all 9 non-finite cases fail; post-fix pass. go vet ./..., build and go test ./cmd (463s) pass; pre-commit hooks (incl. gocyclo) pass.

Not in this PR

• Range bounds for --min-savings-pct: fix(cmd): --min-savings-pct has no range validation #2161.
• Stale "assume zero existing coverage" comments and CSV/dry-run effects of go#306: deferred to the pin-bump PR (the comments are accurate at pin 73d3366).

Closes #2136

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 3 billable files and costs up to $0.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 52 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 88 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 5e750c3c-3c3c-49af-81c5-e3c245721374

---

📥 Commits

Reviewing files that changed from the base of the PR and between 22126ab and fa55e28.

---

📒 Files selected for processing (3)

• CHANGELOG.md
• cmd/validators.go
• cmd/validators_test.go

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Gate verdict (cli gate-1, independent adversarial review, claude-opus-5-5): APPROVE at fa55e28280e3d83125a019ab6c96d6d6909c877b

Local evidence (git archive of the head, GOWORK=off, go1.26.9, macOS; offline flag-parse and validator tests, no AWS):

• Fails before: the new test run against the original cmd/validators.go (22126ab) fails all 9 non-finite cases. The 5 NaN cases (target NaN, target nan, coverage NaN, min-pool-size NaN, min-savings-pct NaN) return a nil error, which is the bug. min-savings-pct Inf also returns nil. target ±Inf and coverage Inf were already rejected, so they fail only on the message. The 1e999 parse error, explicit --target-coverage 0 and the valid-values cases pass before and after.
• Mutations: deleting each of the four requireFinite call sites fails named subtests: coverage (coverage_NaN, coverage_Inf), target-coverage (target_NaN, target_nan_lowercase, target_±Inf), min-pool-size (min-pool-size_NaN), min-savings-pct (min-savings-pct_NaN, min-savings-pct_Inf).
• The test calls only rootCmd.ParseFlags and validateNumericRanges, so it never reaches runTool or any AWS client. Flag state and toolCfg are reset per case and restored in Cleanup.
• Range checks are unchanged, explicit --target-coverage 0 is still valid, and errors name the flag and print the value with %v. The validateCoverageAndSavingsPct split keeps the same checks; the only change is that a non-finite min-savings-pct is now reported before target-coverage errors. The CHANGELOG [Unreleased] Fixed entry is present.
• go vet ./..., go build -o /dev/null ./... ok; golangci-lint run ./...: 0 issues; go test ./cmd/...: ok (415s).
• CI: all checks green at this SHA, mergeStateStatus CLEAN. No findings. CodeRabbit not required: independent review plus local verification at the exact revision.