Address review feedback and fix Windows prebuild

- Reject negative numeric strings in cover fields: strtoull wraps
  "-1" to UINT64_MAX (and e.g. "-18446744073709551615" silently to 1);
  add a regression test
- Fix stale README note: hdp patch auto-detects both diff formats
- Install node-gyp globally on Windows runners: bun creates exe shims
  while prebuildify spawns node-gyp.cmd, so the prebuild step failed

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sunnylqm

.github/workflows/ci.yml

@@ -27,6 +27,9 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      # bun 在 Windows 上生成 exe shim,而 prebuildify 硬编码 spawn node-gyp.cmd
+      - if: runner.os == 'Windows'
+        run: npm install -g node-gyp
       - run: bun install --ignore-scripts
       - run: bun run prebuild
       - run: node test/test.js

.github/workflows/publish.yml

@@ -34,6 +34,9 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      # bun 在 Windows 上生成 exe shim,而 prebuildify 硬编码 spawn node-gyp.cmd
+      - if: runner.os == 'Windows'
+        run: npm install -g node-gyp
       - run: bun install --ignore-scripts
       - run: bun run prebuild
       - run: node test/test.js

README.md

@@ -109,9 +109,9 @@ hdp diff <oldFile> <newFile> <outDiff>
 hdp patch <oldFile> <diffFile> <outNew>
 ```
 
-Note: `hdp patch` applies diffs created by `hdp diff` (streaming format). Diffs
-created by the in-memory `diff()` / `diffWithCovers()` APIs must be applied with
-`patch()` or `patchSingleStream()` instead.
+Note: `hdp patch` auto-detects the diff format by its header, so it can apply
+both streaming diffs created by `hdp diff` and single-compressed diffs created
+by the in-memory `diff()` / `diffWithCovers()` APIs.
 
 ## License
 

src/main.cc

@@ -42,6 +42,8 @@ namespace hdiffpatchNode
 
     inline bool parseUint64String(const std::string& value, uint64_t* out) {
         if (value.empty()) return false;
+        // strtoull 会接受前导 '-' 并做二补回绕("-1" → UINT64_MAX),显式拒绝
+        if (value.find('-') != std::string::npos) return false;
         errno = 0;
         char* end = nullptr;
         unsigned long long parsed = std::strtoull(value.c_str(), &end, 10);

test/test.js

@@ -104,6 +104,12 @@ assert.throws(
   () => hdiffpatch.diffWithCovers(coverOld, coverNew, [], { mode: "invalid" }),
   /Invalid options.mode/
 );
+assert.throws(
+  () => hdiffpatch.diffWithCovers(coverOld, coverNew, [
+    { oldPos: "-1", newPos: "0", len: "1" },
+  ]),
+  /Invalid cover/
+);
 console.log("  ✓ diffWithCovers patch(old, diff) === new");
 
 console.log("\nTest 6: Single-compressed patchSingleStream (file paths)...");