Skip to content

pm: lock brand boundary on the not-a-command front door#39

Merged
colinhacks merged 1 commit into
mainfrom
pnpm-compat-harness-bugs
Jun 21, 2026
Merged

pm: lock brand boundary on the not-a-command front door#39
colinhacks merged 1 commit into
mainfrom
pnpm-compat-harness-bugs

Conversation

@colinhacks

Copy link
Copy Markdown
Contributor

Investigated three pnpm-compat front-door divergences (B1 not-implemented→npm leak, B2 unsupported-command exit code, B3 self-update nag) against current nub and real pnpm 10.15.1. Most premises did not reproduce on current nub; this PR lands the one unambiguous, brand-correct guard plus a stale-comment fix.

What landed

  • Regression test (unimplemented_pm_commands_never_leak_npm): asserts that pnpm's npm-delegated not-implemented set (access/edit/issues/profile/team/xmas/prefix) and a wholly unsupported word are refused brand-clean — no npm error (or aube) line on any stream, nub-branded message. Locks the brand contract regardless of future wording/exit-code changes. Deliberately does not pin an exit code (that is an open behavior question, below).
  • Stale module-doc fix in store_config_family.rs: removed a reference to a deleted run_npm_fallback helper and corrected the pkg/set-script description (native engine verbs, not npm shell-outs).

Findings (grounded against pnpm 10.15.1 + current nub on origin/main)

  • B1: current nub has no npm-leak path — the unknown-command→npm passthrough the thread feared was already removed; these commands give a nub-branded refusal. pnpm 10.15 itself leaks npm error for them, so matching pnpm would introduce a leak. token/set-script are clean native supersets.
  • B2: real pnpm exits 254 for an unsupported command (via its implicit exec-shorthand, ERR_PNPM_RECURSIVE_EXEC_FIRST_FAIL); nub exits 1. The thread had this inverted (claimed pnpm=1/nub=254). Aligning would mean adopting an exec-shorthand nub deliberately rejects — a behavior call.
  • B3: already fixed. nub's embedder profile sets self_update_enabled: false; aube's notifier early-returns, only fires from the dead-under-nub aube --version/doctor path, and writes to stderr. A first-run install probe showed no nag on stdout.

Verification

  • cargo test -p nub-cli --test pm_verbs unimplemented_pm_commands_never_leak_npm → 1 passed
  • cargo clippy -p nub-cli --all-targets --all-features -- -D warnings → clean
  • cargo fmt --check → clean
  • e2e: diffed nub vs pnpm 10.15.1 across the full command set

Refs the pnpm-compat-harness-bugs thread.

pnpm 10.15 delegates its not-implemented command set (access, edit,
issues, profile, team, …) to the npm CLI, so those commands print
"npm error code …". nub does not inherit that: a command nub does not
implement is refused with a nub-branded message on every output stream.

Add a regression test asserting no `npm error` (or `aube`) leak for that
command set plus a wholly unsupported word, and that the refusal is
nub-branded. The test deliberately does not pin an exit code — exit-code
alignment with pnpm is a separate behavior question.

Also correct a stale module comment in store_config_family that referred
to a removed `run_npm_fallback` helper and called the native `pkg` /
`set-script` editors "npm-fallback verbs".

Claude-Session: https://claude.ai/code/session_01YRvztkcr4fzfg9rD5edUwa
Copilot AI review requested due to automatic review settings June 21, 2026 07:24
@vercel

vercel Bot commented Jun 21, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nub Ready Ready Preview, Comment Jun 21, 2026 7:26am

Request Review

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Locks the package-manager “unknown / not-implemented command” front door to stay brand-clean (never delegating to npm or leaking engine branding), and fixes stale module documentation in the PM config/store family.

Changes:

  • Add a regression test ensuring pnpm’s npm-delegated “not implemented” command set (plus a totally unknown command) is refused with nub-branded, brand-clean output.
  • Update store_config_family module docs to reflect that pkg / set-script are native engine verbs (and remove a reference to a deleted helper).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
crates/nub-cli/tests/pm_verbs.rs Adds the unimplemented_pm_commands_never_leak_npm regression test for brand-clean refusals on non-commands.
crates/nub-cli/src/pm_engine/store_config_family.rs Updates module-level docs to remove stale references and clarify native verb behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +781 to +786
assert!(
out.combined().contains("nub"),
"the refusal must be nub-branded:\nstdout: {}\nstderr: {}",
out.stdout,
out.stderr
);
@colinhacks colinhacks merged commit a074b4c into main Jun 21, 2026
27 checks passed
@colinhacks

Copy link
Copy Markdown
Contributor Author

Shipped in v0.1.10: https://github.com/nubjs/nub/releases/tag/v0.1.10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants