Fix --idle-timeout-seconds validation being skipped (#8009)

The lower bound check ran before the parser had resolved the value, so it
only saw a value with the --idle-timeout-seconds=<value> form. With the
space-separated form the value was still undefined at that point,
Number(undefined) is NaN, and NaN <= 60 is false, so anything got through.

Move the check below the block that pulls the value from the next
argument so both forms are validated the same way.

CHANGELOG.md

@@ -22,6 +22,11 @@ Code v99.99.999
 
 ## Unreleased
 
+### Fixed
+
+- `--idle-timeout-seconds` was only validated when passed as `--idle-timeout-seconds=<value>`;
+  values of 60 or less passed as `--idle-timeout-seconds <value>` were silently accepted.
+
 ## [4.138.0](https://github.com/coder/code-server/releases/tag/v4.138.0) - 2026-09-19
 
 Code v1.138.0

src/node/cli.ts

@@ -429,10 +429,6 @@ export const parse = (
         throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
       }
 
-      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
-        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
-      }
-
       const option = options[key]
       if (option.type === "boolean") {
         ;(args[key] as boolean) = true
@@ -452,6 +448,10 @@ export const parse = (
         throw error(`--${key} requires a value`)
       }
 
+      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
+        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
+      }
+
       if (option.type === OptionalString && value === "false") {
         continue
       }

test/unit/node/cli.test.ts

@@ -268,6 +268,16 @@ describe("parser", () => {
     expect(() => parse(["--log", "invalid"])).toThrowError(/--log valid values: \[trace, debug, info, warn, error\]/)
   })
 
+  it("should error if idle-timeout-seconds is too low", () => {
+    expect(() => parse(["--idle-timeout-seconds=60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(() => parse(["--idle-timeout-seconds", "60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(parse(["--idle-timeout-seconds", "61"])).toEqual({ "idle-timeout-seconds": 61 })
+  })
+
   it("should error if the option doesn't exist", () => {
     expect(() => parse(["--foo"])).toThrowError(/Unknown option --foo/)
   })