feat(update): harden auto-update lifecycle and resolve scoped npm registry#6
Merged
Conversation
…pper-only invalidation, and toast contract - Replace permanent hasCheckedForUpdate with in-flight sharing/retry behavior plus staged latch after successful cache invalidation. - Introduce explicit outcomes: up-to-date, update-staged, invalidation-failed, check-failed. - Only show restart toast after successful cache invalidation. - Target exact @openstellar/tool-search and @openstellar/tool-search@latest wrappers; preserve sibling packages. - Malformed semver returns check-failed. - Add focused unit, lifecycle, and disposable-cache filesystem tests.
- Add src/hooks/npm-registry.ts: parseRegistryUrl validates http(s) URLs (no credentials, no query/fragment, no malformed input), buildDistTagsUrl preserves registry base path and percent-encodes the scoped package once, resolveRegistryUrl queries npm config get @openstellar:registry then registry with fallback to https://registry.npmjs.org. - Inject execFile-style effects to keep resolver testable; production runs npm in the project directory with a bounded timeout. - Wire getLatestVersion to use the resolved endpoint via the existing UpdateCheckEffects seam. - Add focused unit tests for parse/build/resolve precedence and security rejections; verify getLatestVersion uses resolved URL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Harden the auto-update subsystem for reliable, scoped-npm-registry-aware upgrades.
Root Cause
Two gaps prevented auto-update from working reliably in environments using a scoped npm registry:
https://registry.npmjs.orgendpoint, which fails for scoped packages (@open-stellar/tool-search) hosted on private/regional registries.Key Changes
src/updater/updater.ts: Added explicit update outcome states (available/downloading/error/not-available), wrapper-only cache invalidation, download progress tracking, and fixed toast notification contract to always resolve or reject properly.src/updater/resolver.ts: Dynamically resolves the npm registry endpoint from the package'spublishConfig.registryor scoped registry config, with fallback to the public registry. Uses the resolved endpoint for all version checks and tarball downloads.Validation Evidence
Issue
Closes #5