Repository navigation
Keep toolchain bumps compatible with audited presets and installer behavior - #127
Merged
Merged
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary by CodeRabbit
WalkthroughThe changes update preset replacement and dry-run handling, prepare-launcher error behavior, and development toolchain pin checks. The README and PM records describe the updated behavior and verification. ChangesPreset application
Prepare launcher
Toolchain pin checks and tracking
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to No concrete issue requiring a fix before merge was identified in the supplied evidence. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Description check |  |
The description directly explains the toolchain-pin validation, installer behavior, preset replacement, preview behavior, tests, and validation results covered by the changeset. |
| Title check | |
The title clearly summarizes the main changes: keeping toolchain bumps compatible with audited presets and installer behavior. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files. (3 skipped: 3 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
📝 Generate docstrings
-
-
- Commit to this branch
- Create a new PR
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideThis PR hardens weekly toolchain bumps by deriving and validating exact versions from manifest, lockfile, and installation metadata; updates preset replacement and preview behavior to honor the audited SDK and --force contract; and makes the prepare hook resilient to pm-ops template revisions while preserving installer diagnostics and safety coverage. Sequence diagram for audited preset application and template safetysequenceDiagram
participant User
participant Preset as applyPreset
participant SDK as AuditedSettingsSDK
participant FS as TemplateFilesystem
User->>Preset: applyPreset
Preset->>SDK: audit and commit settings
SDK-->>Preset: audited result
alt existing template and no --force
Preset->>FS: existsSync
FS-->>Preset: template exists
Preset-->>User: skip template
else --force or template absent
Preset->>FS: write template
FS-->>Preset: template written
end
Sequence diagram for resilient pm-ops installer preparationsequenceDiagram
participant Install as npm install
participant Launcher as prepare-merge-driver
participant Resolver as Node resolver
participant Ops as pm-ops installer
participant PM as pm merge install
Install->>Launcher: run prepare hook
Launcher->>Resolver: resolve pm-ops
alt pm-ops absent
Resolver-->>Launcher: MODULE_NOT_FOUND
Launcher-->>Install: skip with notice
else pm-ops present or probe inconclusive
Resolver-->>Launcher: installed export or retained error
Launcher->>Ops: run installer
alt pm on PATH
Ops->>PM: pm merge install
PM-->>Ops: result
else pm unavailable
Ops-->>Launcher: skip with notice
end
Ops-->>Launcher: exit status
Launcher-->>Install: success or installer failure
end
Flow diagram for manifest-derived toolchain compatibility checksflowchart TD
A[Read package.json] --> B[Read lock root and locked packages]
B --> C[Read installed CLI pm-ops and pm-changelog metadata]
C --> D{Exact development pins match?}
D -- No --> E[Reject drift or ranged pin]
D -- Yes --> F{Peer and extension floors satisfied?}
F -- No --> E
F -- Yes --> G[Accept toolchain compatibility]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Owner
Author
|
@coderabbitai full review Please review head 43e8e7b, including outside-diff findings. |
✅ Action performedFull review finished. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly grouped toolchain bumps failed when the installed prepare template changed and when the newer audited settings SDK retained an unrecognized stored field. Existing-template previews also proposed an overwrite without
--force.Pin checks now derive expected versions from
package.jsonand compare the lock root, locked package entries, and installed metadata for the CLI, pm-ops, and pm-changelog. Exact development pins remain required; peer and extension floors remain compatible minima. Negative fixtures reject ranged pins and each independently drifted version source without an approved-version constant.Before, preparation required byte equality with the installed template and preview ignored the existing-template skip. After, the launcher delegates to the installed export under a durable behavior contract, preserves the original resolution diagnostic for inconclusive presence probes, and preview follows the same force rule as application. Replacement assertions check recognized overrides and effective named-policy defaults through the real SDK. Audited mutation and history safety remain covered for all seven presets. Numeric README toolchain statements are replaced by manifest references.
Validation:
npm run release:checkbun run release:checknpm run release:checkbun run release:checkEvery full run met the unchanged 100% line/branch/function thresholds across the configured 16 files, documented 95 declarations in 38 TypeScript files, found zero production audit vulnerabilities, packed 62 files, and passed changelog, publish-attestation, and version-derived date checks. The original manifest pair was restored byte for byte and reinstalled before committing. Changelog generation and its check ran after tracker writes.
The focused and tracker-linked suite passed 29/29. Independent direct and tracker-linked verification passed 4/4. Reverting only the changed production files while retaining the regressions caused 2/2 expected assertion failures (force-aware preview and retained installer diagnostic); restoring the source passed. These tests import TypeScript source directly. Installer safety tests retain real fresh Git checkouts, the installed installer, omission, stale/broken package, nonzero exit, and signal cases. SDK tests use real temporary trackers.
Strict tracker health with required merge drivers passed under an empty HOME and disabled global/system Git configuration; tracker history hashes match. Ambient health correctly refuses a globally installed pm-github host-version mismatch (repo CLI 2026.10.3 versus extension metadata 2026.10.11); no global configuration was changed.
CI passed on exact head
43e8e7b1658be32394ecced227c14e31388e9814: Node 22 and Node 26 each passed 162/162 tests, and Windows prepare passed 1/1; CodeQL passed. Both Node jobs also passed strict tracker health, committed-build drift, audit, package, changelog, attestation/date, and Bun dependency installation checks. Substantive review remains pending where review services skipped. Coverage describes the configured 16-file scope. Unknown stored fields remain under host serializer authority.PM: pm-0czt, claim released and item retained for orchestrator verification.