From 08f48fd58971aa260df4774551b93eb7a2a9215a Mon Sep 17 00:00:00 2001
From: zjncs <18910855655@163.com>
Date: Fri, 4 Sep 2026 15:39:45 +0800
Subject: [PATCH] fix(list): return an error for a negative offset

A negative --offset value passed the out-of-bounds guard, which only
covers offsets past the end of the list, and then panicked in the slice
expression rresults[l.Offset:last]. Validate the offset up front and
return an error instead, for both the CLI and SDK consumers.

Signed-off-by: zjncs <18910855655@163.com>
---
 pkg/action/list.go      | 7 +++++++
 pkg/action/list_test.go | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/pkg/action/list.go b/pkg/action/list.go
index 7902837fd..31b9a2f78 100644
--- a/pkg/action/list.go
+++ b/pkg/action/list.go
@@ -17,6 +17,7 @@ limitations under the License.
 package action
 
 import (
+	"errors"
 	"path"
 	"regexp"
 
@@ -151,6 +152,12 @@ func (l *List) Run() ([]ri.Releaser, error) {
 		return nil, err
 	}
 
+	// A negative offset would otherwise panic in the slice expression below,
+	// as the out-of-bounds guard only covers offsets past the end of the list.
+	if l.Offset < 0 {
+		return nil, errors.New("list offset cannot be negative")
+	}
+
 	var filter *regexp.Regexp
 	if l.Filter != "" {
 		var err error
diff --git a/pkg/action/list_test.go b/pkg/action/list_test.go
index 1c849028d..ac25a2866 100644
--- a/pkg/action/list_test.go
+++ b/pkg/action/list_test.go
@@ -179,6 +179,15 @@ func TestList_LimitOffsetOutOfBounds(t *testing.T) {
 	is.Len(list, 2)
 }
 
+func TestList_NegativeOffset(t *testing.T) {
+	req := require.New(t)
+	lister := newListFixture(t)
+	lister.Offset = -1
+	makeMeSomeReleases(t, lister.cfg.Releases)
+	_, err := lister.Run()
+	req.Error(err)
+}
+
 func TestList_StateMask(t *testing.T) {
 	is := assert.New(t)
 	req := require.New(t)