fix(cli): update no longer rolls back on a busy port; guard against stale npm publish - #16
Merged
Merged
Conversation
…tale npm publish Two defects found while smoke-testing the v0.3.0 release: B) `burnless update` ran the new version's `doctor --json` as its post-swap health gate, and `doctor` exited non-zero whenever the port was in use. During an in-place update the OLD instance still holds the port, so every update-while-running spuriously failed and rolled back. Fix: the port and secrets_key checks are now non-fatal (`fatal:false`) — reported but never fatal for the health probe — so `doctor` exits 0 on a busy port. `start` keeps its own hard port enforcement, so a busy port still blocks `start`. The fix lives in the fat-artifact doctor, which is what the gate execs, so it unblocks existing 0.2.x/0.3.0 users updating to a fixed version. A) burnless@0.3.0 shipped to npm with a stale dist/ (0.2.1 code under a 0.3.0 package.json): the manual `npm publish` path bypassed CI's verify-npm-package.sh and there was no prepublishOnly to force a rebuild. Fix: add prepublishOnly that rebuilds then asserts the built CLI's reported version equals package.json (scripts/assert-dist-version.mjs), so a manual publish can no longer ship stale/mislabeled dist. Guards: regression test that a busy port stays non-fatal + hasFatalFailure contract; a unit test tying CLI_VERSION to package.json (forgotten-bump catch). Bumps the CLI to 0.3.1 (0.3.0 is consumed on npm and cannot be republished). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two defects surfaced while smoke-testing the v0.3.0 release (install paths 1–3). Both are fixed here and shipped as v0.3.1.
Defect B —
burnless updaterolls back for anyone with a running instanceupdateexecs the new version'sdoctor --jsonas its post-swap health gate.doctorexited non-zero whenever the port was in use — but during an in-place update the old instance still holds the port, so every update-while-running failed its gate and rolled back to the prior version.Fix: the
portandsecrets_keychecks are now non-fatal (fatal:false) — surfaced but never fatal for the health probe — sodoctorexits0on a busy port (shown as⚠, not✗).startkeeps its own hard port enforcement (it must bind), so a busy port still blocksstart. Because the gate execs the new fat-artifact's doctor, this unblocks existing 0.2.x / 0.3.0 users updating to 0.3.1.Proof: the built 0.3.1 fat artifact's
doctor --jsonagainst a busy port now exits0(node/db/secrets/port all reported; portfatal:false).Defect A — npm shipped a stale
dist/burnless@0.3.0published withpackage.json= 0.3.0 but compileddist/built from 0.2.1 source. The manualnpm publishbypassed CI'sverify-npm-package.sh, and there was noprepublishOnlyto force a rebuild.Fix: add
prepublishOnlythat rebuilds then asserts the built CLI's reported version equalspackage.json(scripts/assert-dist-version.mjs). A manual publish can no longer ship stale/mislabeleddist/.Guards (so it doesn't happen again)
hasFatalFailurepost-swap contract.CLI_VERSION↔package.json(catches a forgotten bump in CI).prepublishOnlyrebuild + version-drift assertion (catches a stale built dist at publish time).Verification
assert-dist-version.mjspasses against the fresh build (reports 0.3.1).doctorexits 0 on a busy port (the exact post-swap command).Release steps after merge
Same ritual as v0.3.0: tag
v0.3.1→ workflow drafts the release → publish the draft →npm publish(now guarded byprepublishOnly).🤖 Generated with Claude Code