feat(cli): add verified npm distribution candidate - #15
feat(cli): add verified npm distribution candidate#15integrate-your-mind wants to merge 11 commits into
Conversation
Remove a dead source-mode initialization wrapper that failed clippy, and require packaged binaries to report the Cargo SemVer core corresponding to the npm prerelease.
Document the exact Cargo SemVer core required by the clean-consumer package proof.
…f' into codex/public-distribution
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
integrate-your-mind
left a comment
integrate-your-mind
left a comment
There was a problem hiding this comment.
Found one deterministic cross-platform test failure plus two correctness issues in candidate publication and the default init flow. The host-specific release gate can remain macOS-arm64-only, but the root test suite and generated user instructions need to stay valid on their normal paths.
| const { renameImpl, ...candidateOptions } = options; | ||
| return createCliCandidateImpl({ | ||
| publishDirectoryImpl: renameImpl ?? rename, | ||
| ...candidateOptions, |
There was a problem hiding this comment.
[P1] Pin the simulated target instead of using the live host defaults. The root pnpm test now runs this file on every host, but each positive fixture reaches createCliCandidateImpl without platform or arch; on Linux or Intel macOS it fails immediately because only darwin/arm64 is defined. Pass platform: "darwin", arch: "arm64" through this helper and through the direct verifyCliCandidate calls, or gate the host-only cases.
| priorMoved = true; | ||
| await verifyCliCandidate(backup, { platform, arch }); | ||
| } | ||
| await publishDirectoryImpl(staging, destination); |
There was a problem hiding this comment.
[P2] Verify the destination before treating publication as complete. The default publisher is the supplied candidate binary and this path trusts only its exit status. If that executable returns 0 without moving staging, an absent destination is reported as success and the staging tree is leaked; after a prior candidate was moved to backup, the later cleanup can also remove the last verified output. Run verifyCliCandidate(destination, { platform, arch }) and confirm the staging path disappeared before deleting the backup or clearing stagingLive.
| #[arg( | ||
| default_value = "ferrite-app", | ||
| help = "New, absent directory to initialize" | ||
| )] |
There was a problem hiding this comment.
[P2] Update the follow-up command for the new default target. A bare ferrite init now creates ./ferrite-app, but the success path still prints next: npm install && npm run dev; following that runs npm in the parent directory instead of the generated app. Print a safely quoted cd <project> && ... command, or otherwise make the next step run inside the returned project path.
2 participants
Summary
@ferrite/cliand macOS arm64@ferrite/cli-darwin-arm64package candidatesferrite initoutput and publish through Rust OS-levelNOREPLACE, rejecting symlink/non-empty/current-directory targetsExact source
afe2636fc401c786254f3505ed52b229ee4273f0ae237df3327518475359b80dbb4810e1c397e4c2Validation
pnpm lint- passedpnpm typecheck- passedpnpm build- passedpnpm test- passed; Rust workspace, 162 script tests, 203 runtime tests, native and CLI tests, Chromium QA, production serve, examples, deep routes, 404s, and artifact tamper rejectionnode --test --experimental-test-coverage packages/cli/test/*.test.mjs- 31/31; 84.34% lines, 78.81% branches, 88.00% functionscargo llvm-cov --package ferrite-cli --all-targets --summary-only- 43/43; 74.07% lines, 80.67% functionspnpm release:verify:cli- passed with optimized 3,625,328-byte binary, SHA-25619934499f30213e40ff8a100508ab0e46b1ac6d1f13c56d9e4da0e75f4d467adpnpm release:verify:npm- passed clean starter install/check/build/serve for the existing portable/native package setpnpm release:verify:cargo- all 11 crates packagedgitleaks git --redact- 367 commits scanned, no leakscargo audit --deny warnings- no advisoriesNormal / failure / odd paths
ferrite --version, project init including paths with spacesferrite-appand was cleaned after observationIndependent review
Independent exact-head review: ACCEPT WITH NONBLOCKING LIMITS after reproducing and closing symlink-target, binary TOCTOU, partial-init, and candidate no-replace findings.
Known limits
404does not prove ownershipE401; provenance and registry-backed consumer install are unprovenbkauthentication is unavailable and no exact-head check is reportedSIGKILLcan leave a private temporary executable for OS temp cleanupRollback
Revert this PR before publication. After any future prerelease publication, npm versions remain immutable; deprecate the affected version and publish a corrected version rather than overwriting it.