fix(vendor): an install that exits 0 is not an install (recovers #58) - #59
Merged
Conversation
`crawlproof update` said "installed with pnpm" and left the old version in place, so the bug it was run to fix was still there. Same shape for `hqtui`. pnpm 11 ships a `minimumReleaseAge` cooldown that refuses versions published in the last little while, and it does not fail when it refuses one: it resolves to the newest release old enough to pass, writes a note about an exclude list, and exits 0. Reproduced in an empty directory on pnpm 11.18.0, with the registry reporting 0.2.0: pnpm add @profullstack/crawlproof@latest -> 0.1.0, exit 0 npm install @profullstack/crawlproof@latest -> 0.2.0 So both wrappers now ask what landed instead of trusting the exit code, and move to the next package manager when the answer is the wrong version. The version installed is printed, because "installed" without a number is exactly the claim that turned out to be false. Deliberately not `--config.minimumReleaseAge=0`. The cooldown is a real supply-chain protection, and switching it off wholesale in a tool that installs on other people's machines is a bigger decision than fixing an update. Falling through to npm leaves it as pnpm's default and still lets a deliberate update finish. An unreachable registry means the wanted version is unknown, and an unknown want passes: an offline box must still be able to reinstall what it has. Two failures on this branch are not from it: root-ubuntu's `groups` test fails on master as of #56, and registry's summary test fails on an untracked bin/argontv.ts sitting in the working tree. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD
Merged
ThreatCrush Security Scan12 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 4 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#58 was squash-merged carrying only its first commit.
updateworks; the fix that makes it deliver did not land.The squash contains
bin/crawlproof.ts,src/crawlproof.tsandtest/crawlproof.test.ts. It does not containsrc/vendor-verify.ts, and neithersrc/crawlproof.tsnorsrc/hqtui.tson master imports it. So on master today,crawlproof updatestill accepts whatever pnpm leaves behind.This is a straight cherry-pick of the dropped commit onto master.
What it fixes
pnpm 11 ships a
minimumReleaseAgecooldown that refuses versions published in the last little while, and it does not fail when it refuses one: it resolves to the newest release old enough to pass, writes an exclude-list note, and exits 0. Reproduced in an empty directory on pnpm 11.18.0, registry reporting 0.2.0:Both wrappers now ask what landed instead of trusting the exit code, and move to the next package manager when the answer is the wrong version. Verified from a wiped vendor prefix:
An unreachable registry means the wanted version is unknown, and unknown passes, so an offline box can still reinstall what it has.
Not
--config.minimumReleaseAge=0: the cooldown is a real supply-chain protection, and switching it off in a tool that installs on other people's machines is a bigger decision than fixing an update.51 tests pass across
vendor-verify,crawlproofandhqtui;tscclean on the touched files.Note
This is the third squash in this session to drop a commit pushed shortly before the merge (crawlproof.com #240 lost
bin/crawlproof.mjs, #243 lost the version bump). Worth checking merged content rather than the PR view when a branch had more than one commit.🤖 Generated with Claude Code
https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD