The Python branch-creation port accepts an oversized --number and crashes at int() instead of rejecting it

Project: github/spec-kit
Affected snapshot: 1c799bda6c136fcf42fb3475a922ccaac57e6c71

Summary

create_new_feature_branch.py validates --number only with the regular expression [0-9]+. A digit string longer than Python's integer-string conversion limit passes that check, but int(branch_number) later raises ValueError before any branch is created. The CLI reports an uncaught traceback instead of rejecting the value as out of domain.

Expected behavior

--number should be a bounded non-negative integer. An out-of-range value should produce the existing argument error (for example Error: --number must be a non-negative integer) and exit cleanly before branch construction.

Actual behavior

The regex accepts the 5,000-digit string. At feature_num = f"{int(branch_number):03d}", Python raises:

ValueError: Exceeds the limit (4300 digits) for integer string conversion

The command aborts with a traceback before git checkout.

Root cause

extensions/git/scripts/python/create_new_feature_branch.py:

• lines 107-116: --number is checked only by re.fullmatch(r"[0-9]+", args.branch_number).
• line 532: feature_num = f"{int(branch_number):03d}".

A digit string is not a bounded integer. The parser accepts values that the runtime cannot convert, and the conversion is not guarded.

Impact

• A normal CLI invocation with a malformed but syntactically numeric --number crashes with an uncaught traceback instead of a user-facing error.
• The feature-branch command aborts before creating or checking out the branch, leaving the caller with a partial/opaque failure.
• Automated callers that pre-validate --number with the documented "non-negative integer" rule can still crash the tool.

Suggested fix

Bound the accepted value before conversion, for example:

if not re.fullmatch(r"[0-9]{1,9}", args.branch_number):
    _err("Error: --number must be a non-negative integer")
    raise SystemExit(1)

or keep the regex and wrap the conversion:

try:
    feature_num = f"{int(branch_number):03d}"
except ValueError:
    _err("Error: --number is outside the supported range")
    raise SystemExit(1)

Define the supported maximum explicitly and test both the maximum and a value above it.