fix(update): harden npm cache recovery preflight logs - #557
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Thanks for taking over this change. I agree that #557 should be the merge vehicle. For the remaining nonzero-installer policy, I recommend keeping the current fail-closed behavior and documenting the manual recovery path. Without reliable descendant containment, automatically starting a recovery package could race with an installer process that is still mutating the global package tree. Once #557 is ready and merged, #533 can be closed as superseded. Please also retain attribution to #533 and @WZBbiao in the PR description and final merge commit. The imported commits currently preserve the original |
WP1 docs-only cycle. Five decade docs at diff-level precision, ordered by dependency (auth gate -> response layer -> adapter -> PR cleanup) rather than effort: - 010 SSH remote proxy: isLoopbackRequestHost couples loopback identity to port equality, so ssh -L on a different local port 403s the whole /v1/* data plane. The sibling isLoopbackOriginValue already dropped its port check in e4e0612 for the same reason. - 020 issue lidge-jun#553: the same three-line 'Provider unreachable' shape repeats at core.ts 1197/1746/1788; fold into one helper and give ERR_TLS_CERT_ALTNAME_INVALID its own wording plus a verification command. - 030 issue lidge-jun#545: the anthropic adapter prepends the Claude Code identity unconditionally on OAuth, so a classifier that already carries it loses output budget it capped at 64 tokens and retries. - 040 PR lidge-jun#527: its first commit already landed on dev as 9dd3c42, which is what makes the branch dirty; rebase keeping only a64aa58. - 050 PR lidge-jun#557: no code work remains, only a security-boundary decision. No production code changed in this cycle.
2 participants
Summary
Maintainer takeover follow-up for #533. This keeps the contributor PR unmerged and addresses the two high-severity review blockers from the latest Wibias review:
The medium policy question around nonzero installer recovery behavior is intentionally left for maintainer review; this PR is draft and should not be merged automatically.
Verification
bun test tests/update-npm-cache-preflight.test.ts tests/update-job.test.ts→ 70 pass / 0 failbun test tests/update-npm-cache-preflight.test.ts tests/update-stop-first.test.ts tests/update-job.test.ts tests/update-install-process.test.ts tests/config.test.ts tests/ocx-launcher-source.test.ts tests/windows-deploy-close-regressions.test.ts→ 162 pass / 0 failbun x tsc --noEmit→ passgit diff --check origin/dev...HEAD→ passbun run privacy:scan→ passbun scripts/test.ts→ 5127 pass / 0 failRefs #533.