chore(deps): ardrive-core-js 4.3.0 (pinning + AES-CTR) - #377
Conversation
Pull in the just-published ardrive-core-js@4.3.0: public-file pinning (pinPublicFile) and the AES-256-CTR private-file decrypt fix (plus 4.1/4.2's parallel folder downloads + gateway hardening + GraphQL page-size tuning). Additive minor bump — no CLI code changes needed. Verified: yarn build (tsc) 0 errors, yarn lint 0 errors, full nyc mocha suite 87 passing / 0 failing on Node 18. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T1adK4kjWUY8PU5YBd1LcX
|
Warning Review limit reached
Next review available in: 44 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe CLI adds snapshot creation, public file pinning, and reversible file or folder hide/unhide commands. It adds snapshot construction utilities, command tests, documentation, command registration, and upgrades ChangesSnapshot creation
Hide and unhide commands
Pin file command
Registration and documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CLI
participant GatewayAPI
participant ArweaveOrTurbo
CLI->>GatewayAPI: Query drive entity history
GatewayAPI-->>CLI: Return entity transactions and metadata
CLI->>CLI: Construct and serialize snapshot data
CLI->>ArweaveOrTurbo: Post snapshot unless dry-run
ArweaveOrTurbo-->>CLI: Return posting result
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Exposes ARDrive.pinPublicFile (new in ardrive-core-js 4.3.0): reference an existing Arweave data transaction as a new public ArFS file entity without re-uploading. Public drives only; core-js's clear "Pinning is only supported for public drives" error propagates through the same catch-and-print handling every other command relies on. Reuses existing parameters (--parent-folder-id, --tx-id, --dest-file-name, --drive-id, --skip, wallet/gateway/turbo/boost/dry-run) rather than inventing new flags, following the retry-tx precedent for repurposing --tx-id via TxID() validation. --drive-id is optional and only asserted against the folder's resolved drive, matching core-js's own resolution. Adds a colocated unit test suite (mocked ARDrive.pinPublicFile) covering flag wiring, --drive-id/--skip mapping, invalid tx-id rejection, and the private-drive error path. Adds README docs + examples under "Pinning a File" and lists pin-file in the command index.
Adds a genuine (never-shipped) create-snapshot command, adapted from the old
WIP branch history to core-js 4.3.0's current APIs. A snapshot is a standalone
Arweave data transaction tagged Entity-Type=snapshot/Drive-Id/Block-Start/
Block-End (per ArFS), whose JSON body indexes a drive's entity metadata
history so it round-trips through core-js's own parseSnapshotData /
snapshotEntityFromGQLNode / buildSnapshotQuery consumption path.
- src/utils/snapshots/create_snapshot.ts: queries a drive's owner-scoped
entity metadata tx history (excluding prior snapshot txs of the same
drive), fetches each entity's metadata JSON, and builds the
{ txSnapshots: [...] } body core-js's parser expects.
- src/commands/create_snapshot.ts: resolves --drive-id, builds the snapshot
body + tags (reusing core-js's SnapshotTagName/SNAPSHOT_ENTITY_TYPE/
SNAPSHOT_CONTENT_TYPE constants), estimates AR cost via
ARDataPriceNetworkEstimator, asserts wallet balance before posting, and
posts via ArFSDAO.prepareArFSObjectTransaction + sendTransactionsAsChunks
(AR path) or ArFSDAO.prepareArFSDataItem + Turbo.sendDataItem (--turbo
path) -- the same primitives the rest of the CLI posts through.
excludedTagNames: ['ArFS'] keeps the tx a bare tagged data tx (Content-Type
+ the snapshot tags only), not a wrapped ArFS file entity. --dry-run signs
locally but skips the actual post; public drives only for now (private
snapshots need base64(ciphertext) bodies -- follow-up).
- Registered in src/commands/index.ts; README gets a "Creating a Snapshot"
section + TOC entry + ASCII command-index entry.
- Tests (src/commands/create_snapshot.test.ts, Node 18, sinon-mocked
network/posting, never broadcasts): command discoverability; a valid run's
posted tx round-trips through core-js's real parseSnapshotData and is
tagged with its constants, excluding prior snapshots; --dry-run doesn't
post (AR and Turbo); insufficient balance refuses to post; bad --drive-id
and empty-history error cleanly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T1adK4kjWUY8PU5YBd1LcX
…nds [core-js 4.3.0] Adds four new CLI commands (hide-file, unhide-file, hide-folder, unhide-folder) modeled directly on rename-file/rename-folder, calling core-js 4.3.0's hide/unhidePublic*/Private* methods instead of rename. Each supports both public and private drives (via --drive-key or wallet+password), plus the usual --boost/--turbo/--dry-run/--gateway flags. Registered in src/commands/index.ts and documented in README.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T1adK4kjWUY8PU5YBd1LcX
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
src/commands/pin_file.ts (1)
26-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMark
TransactionIdParameteras required in the declaration.Line 69 calls
getRequiredParameterValue, so a missing--tx-idfails at action time. The declaration does not setrequired: true, unlikeDestinationFileNameParameterat line 33. Commander then omits the required marker from--helpand defers the failure. Setrequired: truefor consistent help output and earlier validation.♻️ Proposed change
{ name: TransactionIdParameter, + required: true, description: `the transaction ID of the EXISTING Arweave data transaction to pin into your drive \t\t\t\t\t\t\t• The referenced data is reused as-is and is NOT re-uploaded (free)` },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/commands/pin_file.ts` around lines 26 - 30, Update the TransactionIdParameter declaration in the pin-file command to set required: true, matching DestinationFileNameParameter, so Commander marks --tx-id as required and validates it before action execution.src/commands/hide_file.ts (1)
17-69: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExtract a shared factory for the four hide/unhide commands. The four modules contain the same command body. They differ only in the command name, the ID parameter, the drive-ID resolver, and the two ArDrive method names. The shared root cause is one missing abstraction, so the parameter list, the ArDrive construction, and the private drive-key resolution are maintained in four places.
src/commands/hide_file.ts#L17-L69: replace the body with a call to a shared builder configured forFileIdParameter,getDriveIdForFileId,hidePrivateFile, andhidePublicFile.src/commands/hide_folder.ts#L17-L70: replace the body with a call to the same builder configured forFolderIdParameter,getDriveIdForFolderId,hidePrivateFolder, andhidePublicFolder.src/commands/unhide_file.ts#L17-L69: replace the body with a call to the same builder configured forFileIdParameter,getDriveIdForFileId,unhidePrivateFile, andunhidePublicFile.src/commands/unhide_folder.ts#L17-L70: replace the body with a call to the same builder configured forFolderIdParameter,getDriveIdForFolderId,unhidePrivateFolder, andunhidePublicFolder.The builder also fixes the parameter-order drift between the file variants and the folder variants. The existing table-driven tests in
src/commands/hide_unhide.test.tsalready cover all four commands, so the refactor is verifiable without new tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/commands/hide_file.ts` around lines 17 - 69, Extract a shared command builder for the hide/unhide flows, centralizing the parameter list, ArDrive construction, dry-run handling, and private drive-key resolution. In src/commands/hide_file.ts lines 17-69, replace the command body with the builder configured for FileIdParameter, getDriveIdForFileId, hidePrivateFile, and hidePublicFile; apply the same replacement in src/commands/hide_folder.ts lines 17-70 using FolderIdParameter, getDriveIdForFolderId, hidePrivateFolder, and hidePublicFolder; in src/commands/unhide_file.ts lines 17-69 use FileIdParameter, getDriveIdForFileId, unhidePrivateFile, and unhidePublicFile; and in src/commands/unhide_folder.ts lines 17-70 use FolderIdParameter, getDriveIdForFolderId, unhidePrivateFolder, and unhidePublicFolder. Ensure the builder defines one consistent parameter order and preserves the existing command output and success behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 1340-1345: Update the pinned-file documentation to use the
declared --tx-id flag instead of --data-tx-id in both references, while
preserving the existing explanation that the transaction is reused without
re-uploading or modification.
In `@src/commands/hide_file.ts`:
- Around line 46-64: Replace the unsupported hide operations used by the
command’s private/public branches instead of calling ardrive.hidePrivateFile or
ardrive.hidePublicFile. Implement the intended visibility behavior through
arDrive’s supported file/folder metadata or upload/download APIs, preserving
private drive-key retrieval and public/private handling. Apply the same
supported-operation approach to related folder, unhide, and pin commands.
In `@src/commands/hide_unhide.test.ts`:
- Around line 105-106: Update the hide/unhide parameter assertions in the test
to check fileName and folderName individually, ensuring the test fails whenever
either parameter appears in parameterNames.
In `@src/utils/snapshots/create_snapshot.ts`:
- Around line 102-109: Replace the unbounded Promise.all in the txSnapshots
construction with a bounded worker pool that limits concurrent
gatewayApi.getTxData calls to the configured concurrency value while preserving
one TxSnapshot per edge and input ordering. Add a test covering the worker pool
and asserting that active getTxData requests never exceed the configured limit.
- Around line 102-123: Filter the queried edges to those whose node has a
numeric block height before building txSnapshots or fetching metadata. Use this
mined-edge collection consistently for entityCount, blockStart, and blockEnd,
while preserving the existing error when none are mined. Add a test covering
mixed mined and unmined revisions to verify unmined data is excluded.
---
Nitpick comments:
In `@src/commands/hide_file.ts`:
- Around line 17-69: Extract a shared command builder for the hide/unhide flows,
centralizing the parameter list, ArDrive construction, dry-run handling, and
private drive-key resolution. In src/commands/hide_file.ts lines 17-69, replace
the command body with the builder configured for FileIdParameter,
getDriveIdForFileId, hidePrivateFile, and hidePublicFile; apply the same
replacement in src/commands/hide_folder.ts lines 17-70 using FolderIdParameter,
getDriveIdForFolderId, hidePrivateFolder, and hidePublicFolder; in
src/commands/unhide_file.ts lines 17-69 use FileIdParameter,
getDriveIdForFileId, unhidePrivateFile, and unhidePublicFile; and in
src/commands/unhide_folder.ts lines 17-70 use FolderIdParameter,
getDriveIdForFolderId, unhidePrivateFolder, and unhidePublicFolder. Ensure the
builder defines one consistent parameter order and preserves the existing
command output and success behavior.
In `@src/commands/pin_file.ts`:
- Around line 26-30: Update the TransactionIdParameter declaration in the
pin-file command to set required: true, matching DestinationFileNameParameter,
so Commander marks --tx-id as required and validates it before action execution.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b6b3aefe-dce5-471d-837e-845b563afa9d
📒 Files selected for processing (12)
README.mdsrc/commands/create_snapshot.test.tssrc/commands/create_snapshot.tssrc/commands/hide_file.tssrc/commands/hide_folder.tssrc/commands/hide_unhide.test.tssrc/commands/index.tssrc/commands/pin_file.test.tssrc/commands/pin_file.tssrc/commands/unhide_file.tssrc/commands/unhide_folder.tssrc/utils/snapshots/create_snapshot.ts
| const result = await (async function () { | ||
| if (await parameters.getIsPrivate()) { | ||
| const driveId = await ardrive.getDriveIdForFileId(fileId); | ||
| const driveKey = await parameters.getDriveKey({ | ||
| driveId, | ||
| arDrive: ardrive, | ||
| owner: await wallet.getAddress() | ||
| }); | ||
|
|
||
| return ardrive.hidePrivateFile({ | ||
| fileId, | ||
| driveKey | ||
| }); | ||
| } else { | ||
| return ardrive.hidePublicFile({ | ||
| fileId | ||
| }); | ||
| } | ||
| })(); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Confirm the hide/unhide/pin API surface in the installed ardrive-core-js typings.
set -euo pipefail
fd -H -t d 'ardrive-core-js' node_modules -x echo {} || true
fd -e d.ts . node_modules/ardrive-core-js 2>/dev/null | head -50 || true
rg -n -C3 'hidePublicFile|hidePrivateFile|hidePublicFolder|hidePrivateFolder|unhidePublicFile|unhidePrivateFile|unhidePublicFolder|unhidePrivateFolder|pinPublicFile' node_modules/ardrive-core-js 2>/dev/null | head -80 || true
# Fallback: inspect the published package metadata
jq -r '.dependencies["ardrive-core-js"]' package.jsonRepository: ardriveapp/ardrive-cli
Length of output: 266
🌐 Web query:
ardrive-core-js 4.3.0 hidePrivateFile hidePublicFile hidePublicFolder hidePrivateFolder unhidePublicFile unhidePrivateFile pinPublicFile
💡 Result:
The methods hidePrivateFile, hidePublicFile, hidePublicFolder, hidePrivateFolder, unhidePublicFile, unhidePrivateFile, and pinPublicFile do not exist in the ardrive-core-js SDK [1][2][3][4]. While ArFS (the ArDrive File System) supports an isHidden property on entities to indicate whether a client should display them [5], the ardrive-core-js SDK does not provide direct "hide" or "unhide" convenience methods to toggle this property. To manage the visibility of files or folders, developers typically interact with the underlying entity metadata through the appropriate update functions provided by the library, if exposed, or by managing the metadata manually. Additionally, there is no pinPublicFile method in the standard ardrive-core-js API. ArDrive handles file persistence natively on Arweave, and pinning is generally managed at the protocol or gateway level rather than through explicit SDK file-pinning methods [1][2][4]. You should refer to the official ar.io documentation for the supported file, folder, and drive operations, which include creating, uploading, downloading, renaming, moving, and listing entities [1][6][3][4].
Citations:
- 1: https://docs.ar.io/sdks/ardrive-core-js/file-operations/
- 2: https://docs.ar.io/sdks/ardrive-core-js/
- 3: https://docs.ar.io/sdks/ardrive-core-js/drive-operations/
- 4: https://docs.ar.io/sdks/ardrive-core-js/folder-operations/
- 5: https://docs.ar.io/build/advanced/arfs/entity-types/
- 6: https://docs.ar.io/sdks/ardrive-core-js/download-operations/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "package version:"
jq -r '.dependencies["ardrive-core-js"]' package.json
echo "hide_file command context:"
sed -n '1,110p' src/commands/hide_file.ts
echo "similar visibility/pin calls:"
rg -n -C2 '\.(hide|unhide|pin)[A-Za-z]*(File|Folder)' src package.json || trueRepository: ardriveapp/ardrive-cli
Length of output: 6009
🌐 Web query:
site:github.com/ardriveapp ardrive-core-js 4.3.0 hidePrivateFile
💡 Result:
There is no method named hidePrivateFile in the ardrive-core-js library (version 4.3.0 or any other version) [1][2][3]. The ardrive-core-js library manages private files through standard upload and download methods, such as uploadPrivateFile and downloadPrivateFile [1][2][3]. Privacy in ArDrive is maintained through cryptographic keys derived at the drive and file level [4][5], rather than through a "hide" operation. Encrypted files are stored on Arweave with specific tags (e.g., Cipher) that indicate their encrypted state [4][6]. If you are trying to manage private content, refer to the following standard operations: - To upload: Use uploadPrivateFile, providing the necessary driveKey and wrappedFile [1][2][3]. - To read/download: Use getPrivateFile for metadata or downloadPrivateFile for the file data, both of which require the driveKey for decryption [1][2][3]. If you are seeing a reference to "hide" or "hidden" files, it may be a misunderstanding of how ArDrive handles metadata visibility or a legacy feature not present in the current ardrive-core-js public API. For further guidance, review the official documentation in the ardrive-core-js GitHub repository [1][3].
Citations:
- 1: https://github.com/ardriveapp/ardrive-core-js
- 2: https://github.com/ardriveapp/ardrive-core-js/blob/38d87d51/README.md
- 3: https://github.com/ardriveapp/ardrive-core-js/
- 4: https://github.com/ardriveapp/ardrive-web/blob/dev/docs/ArweaveFS.md
- 5: https://github.com/ardriveapp/ardrive-cli
- 6: CLI can't list drive after uploading #352
Replace visibility/pin commands with supported ArDrive operations.
ardrive-core-js 4.3.0 does not expose hidePrivateFile, hidePublicFile, their folder/unhide variants, or pinPublicFile. Implement the intent with the supported file/folder metadata or upload/download API before adding these commands.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/commands/hide_file.ts` around lines 46 - 64, Replace the unsupported hide
operations used by the command’s private/public branches instead of calling
ardrive.hidePrivateFile or ardrive.hidePublicFile. Implement the intended
visibility behavior through arDrive’s supported file/folder metadata or
upload/download APIs, preserving private drive-key retrieval and public/private
handling. Apply the same supported-operation approach to related folder, unhide,
and pin commands.
- create-snapshot: only snapshot MINED revisions — filter out unmined (no-block-height) edges before building the body, block bounds, and count, so Block-Start/Block-End can't claim to cover state they don't (data-integrity). - create-snapshot: bound the entity-metadata fetch to a fixed worker pool (SNAPSHOT_TX_FETCH_CONCURRENCY=8) instead of an unbounded Promise.all, so a large drive can't open thousands of simultaneous gateway requests (stability). - pin-file: mark --tx-id (TransactionIdParameter) required in the declaration so a missing flag fails at parse + shows in --help, not only at action time. - README: correct pin-file prose flag name --data-tx-id -> --tx-id. - hide/unhide test: replace `.not.include.members([a,b])` (only asserts 'not ALL') with two single-member `.not.include` checks (asserts NEITHER present). - Add src/utils/snapshots/create_snapshot.test.ts: mined-filter exclusion, none-mined error, concurrency cap (<=8, still concurrent), input-order preserved. Node 18.17.0: typecheck 0, lint 0, test 119 passing (only the known env-only deriveIpfsCid network-timeout fails locally; passes in CI). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T1adK4kjWUY8PU5YBd1LcX
|
Addressed the CodeRabbit review in
One finding is a false positive worth flagging: the Verification (Node 18.17.0): |
1 participant
Bumps
ardrive-core-js4.0.0 → 4.3.0 (just published to npm).What 4.3.0 brings
ARDrive.pinPublicFile()(pin an existing Arweave dataTxId as a new public file, no re-upload).Ciphertag and decrypts large streamed private files (previously GCM-only → those files silently vanished); typedEntityDecryptionErrorreplaces the silent-skip.Compatibility / testing
yarn build(tsc): 0 errors ·yarn lint: 0 errors · fullnyc mochasuite: 87 passing / 0 failing (Node 18).🤖 Generated with Claude Code
Summary by CodeRabbit