fix(cli): refuse a fraction the integer parse silently drops

Above 2^52 a double's spacing is 1, so Number('4503599627370496.5') is an
integer and the safe-integer guard passed it — the API received a value the
caller never typed. Read the raw text alongside the parsed number. Digits
that are all zero are not a fraction, so 1.0 stays a whole number.

Also corrects a chat test comment that described a UUID check the command
does not perform; it refuses only a blank -c.

Author: waleedlatif1

packages/sim-cli/src/commands/protocol/chat.test.ts

@@ -144,9 +144,9 @@ describe('sim chat', () => {
   })
 
   /**
-   * A conversation id as the command prints it: the route requires a UUID and
-   * the CLI now says so before the request, so a stand-in like `conv-1` is
-   * refused rather than sent.
+   * A conversation id as the command prints it. The shape is the route's rule
+   * to enforce — the CLI refuses only a blank `-c`, which is falsy and would
+   * otherwise be dropped from the body and start a new conversation.
    */
   it('passes -c through as the conversation to continue', async () => {
     requestRaw.mockResolvedValue(ndjson([FINAL]))

packages/sim-cli/src/runtime/build.test.ts

@@ -1689,6 +1689,9 @@ describe('bodies and fields the generator cannot flatten', () => {
         ['0', '--limit must be 1 or more'],
         ['-1', '--limit must be 1 or more'],
         ['1.5', '--limit must be a whole number'],
+        // Above 2^52 the parse itself drops the fraction, so `Number.isInteger`
+        // alone would pass this and send a value the caller never typed.
+        ['4503599627370496.5', '--limit must be a whole number'],
       ] as const) {
         for (const command of ['batch-delete', 'batch-update'] as const) {
           const argv = ['tables', 'rows', command, 'tbl_1', '--filter', '{"all":[]}']

packages/sim-cli/src/runtime/request.ts

@@ -318,6 +318,17 @@ export function encodeFolderPath(value: string): string {
     .join('/')
 }
 
+/**
+ * A fractional part `Number` cannot keep.
+ *
+ * Above 2^52 a double's spacing is 1, so `Number('4503599627370496.5')` is an
+ * integer — `Number.isInteger` passes and the API receives a value the caller
+ * did not type. Read the text as well as the parsed number so the refusal
+ * covers the range where the parse itself loses the fraction. Digits that are
+ * all zero are not a fraction, so `1.0` stays a whole number.
+ */
+const FRACTIONAL_DIGITS = /\.\d*[1-9]/
+
 /**
  * Points at `@` when a value that failed to parse looks like a filename.
  *
@@ -390,7 +401,10 @@ export function coerce(raw: unknown, field: FieldSpec, flag: FlagSpec, flagName:
      * nor anything the caller typed, on the one flag whose blank, zero and
      * non-numeric cases all had a sentence written for them.
      */
-    if (field.kind === 'integer' && !Number.isInteger(value)) {
+    if (
+      field.kind === 'integer' &&
+      (!Number.isInteger(value) || FRACTIONAL_DIGITS.test(String(raw)))
+    ) {
       throw new SimApiError(`--${flagName} must be a whole number`, 0)
     }
     if (field.kind === 'integer' && !Number.isSafeInteger(value)) {