Repository navigation
chore: v2.6.0 - #201
Merged
Merged
chore: v2.6.0#201
Conversation
Ships #195 and #189. #195: npm package identity now comes from npm's own parser -- nopt, @npmcli/config and npm-package-arg, loaded from the npm the command actually resolves to, running in a persistent node child. Where anything is unusual it REFUSES rather than guessing: every parsed config key must be in {yes, package}, the server env overlay must set no npm_config_*/PATH/HOME/NODE_*/PREFIX/NVM_*, npm must set no local prefix from the effective cwd, and the spec must be a tag/version/range that does not begin with a dash. Minor rather than patch: behaviour visibly changes. A server launched with an unusual config can no longer be auto-updated -- it refuses by name rather than probing. All 79 bundled npm servers still resolve and match the real binary, so the shipped fleet is unaffected. #189: the release-path workflow guards run in CI. release.yml triggers only on tag push, so it never appeared in PR checks; three layers now gate it -- structural invariants, job-set drift against the merge base, and a label tripwire for the remainder. 37 committed mutants, 31 killed. Known residual: user and global .npmrc are invisible to the resolver, so a package= or registry= line there can still redirect what npm fetches. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T61zMNiPF4K29186r3uqc3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts 2.6.0. Ships #195 (PR #199) and #189 (PR #198).
Why minor, not patch
Behaviour visibly changes. A server launched with an unusual config can no longer be auto-updated —
gateway.update_serverrefuses it by name rather than probing. That is deliberate: guessing is what produced five consecutive identity defects, and a refusal fails every freshness comparison closed.All 79 bundled npm servers still resolve, and match the real binary, so the shipped fleet is unaffected.
Contents
nopt+@npmcli/config+npm-package-arg) in a persistent node child, loaded from the npm the command actually resolves to. Gates are an allowlist, not a denylist.release-change-approvedlabel tripwire. 37 committed mutants, 31 killed,actionlintkills only 4 of them.Verification
Known residual
User and global
.npmrcare invisible to the resolver, so apackage=orregistry=line there can still redirect what npm fetches. Stated here rather than discovered later.CHANGELOG
[Unreleased]folded into## [2.6.0]; extraction verified to yield one### Addedand one### Fixed, no duplicate headings.🤖 Generated with Claude Code
https://claude.ai/code/session_01T61zMNiPF4K29186r3uqc3
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.