[ChiragAgg5k]

A stray closing brace in appwrite.config.json makes the CLI read only the first object, then silently delete the remaining resource definitions on its next write. Require a complete object and the end of the input after every top-level JSON value. Included resource arrays receive the same validation. Valid trailing whitespace, key order, and large integers remain supported.

Fixes #2130.

The CLI e2e harness now exercises malformed root configs and included arrays, checks nonzero exits and byte-for-byte preservation of every input file, and verifies that a valid config still rewrites successfully without losing resources or integer precision. The new regression fails against the original generated CLI and passes with this change.

Staging verification

Verified on 2026-10-23 using the existing CLI staging login (https://cloud.staging.appwrite.io/v1) and a disposable Frankfurt project (https://fra.cloud.staging.appwrite.io/v1). Built the original and patched generated CLIs with Go 1.26.5.

For example, ran appwrite client --project-id sdk-json-fix-oct23 with this malformed local config linked to the disposable staging project:

{"projectId":"sdk-json-fix-oct23","endpoint":"https://fra.cloud.staging.appwrite.io/v1","custom":{"keep":9007199254740993}},"tables":[{"$id":"orders","databaseId":"main","name":"Orders","columns":[]}]}

Input	Original CLI	Patched CLI
Config with the stray brace shown above	Exit 0; rewrites the config and drops tables	Exit 1; config bytes unchanged
Config missing its final }	Exit 0; rewrites the truncated object	Exit 1; config bytes unchanged
includes.tables pointing to an array followed by another value	Exit 0; rewrites both files and drops the included suffix	Exit 1; both files byte-identical
Valid config containing orders and integer 9007199254740993	Exit 0	Exit 0; resource and exact integer retained; regional project lookup succeeds

These are local config rewrites performed with the staging session; the sample resource entries were not pushed. The disposable project sdk-json-fix-oct23 was deleted after verification, and a subsequent get returned project-not-found.

The missing-brace behavior above reproduces with Go 1.26, as in the issue. Go 1.27 already rejects those incomplete-object examples due to a decoder error change; the stray-brace/trailing-input data loss still reproduces on both versions without this fix.

Validation

• Regenerated the CLI with php example.php cli and inspected the generated parser.
• Generated output is clean under gofmt without post-generation formatting.
• Go 1.26.5: go build, go vet ./..., and go test ./... pass.
• vendor/bin/phpunit tests/e2e/CLIGo126Test.php passes.
• composer refactor:check, composer lint-twig, and scoped PHPCS pass.
• vendor/bin/phpstan analyse --memory-limit=2G tests/e2e/CLIGo126Test.php passes (default level 0).

Related: appwrite-labs/cloud#6667

[hansi-codes]

🟢 Tier S · Ready to merge

The parser changes enforce the intended complete-input contract, and the e2e coverage exercises both rejection and successful rewriting.

The CLI JSON parser now requires complete objects and rejects any non-whitespace input after a top-level JSON value, including included resource arrays. The Go CLI e2e harness exercises malformed and valid config rewrites and checks that rejected inputs remain unchanged.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 3

File	Change
templates/cli/internal/jsonx/object.go	Rejects truncated objects and trailing JSON values after decoding.
tests/e2e/languages/cli/main.go	Adds malformed-config preservation cases and a valid rewrite check.
tests/e2e/CLIGo126Test.php	Includes the new config-validation conformance result in expected output.

---

_{Reviewed c3bc0d3 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary