Release 0.4.2 - #58
Merged
Merged
Conversation
PR #57 added a SKILL_RECORDER_NPM_REGISTRY escape hatch that made both installers reference the npm registry environment variable directly. That trips the deliberate compliance guard in scripts/compliance.test.mjs, which asserts the installers never pin an npm registry -- the exact regression that broke installs for users behind a corporate proxy in the first place. The escape hatch was redundant anyway: npm already honours a caller-set registry environment variable, so users keep the same capability without the installer sources dictating a registry. The actual fix stays: the installers still point the portable runtime at the machine's existing npm configuration via NPM_CONFIG_GLOBALCONFIG, which discovers rather than overrides the configured registry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 02a84c32-5401-470c-a8f1-b5f7a3f1b05b
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 02a84c32-5401-470c-a8f1-b5f7a3f1b05b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cuts v0.4.2, a patch release that makes the source installers work on machines
whose npm registry is configured globally (corporate proxies, including
Microsoft-managed devices), and repairs
main, which is currently red.This PR contains two commits:
1.
fix(install): drop the registry escape hatch from the installersmain@1a1f5e9is failing both the Windows and Non-Windows workflows.PR #57 introduced a
SKILL_RECORDER_NPM_REGISTRYescape hatch, which made bothinstallers reference the npm registry environment variable by name. That trips the
deliberate compliance guard in
scripts/compliance.test.mjs(source and release instructions remain compliance-preserving), which asserts the installers never pinan npm registry — the exact regression that broke installs in the first place.
The escape hatch was redundant: npm already honours a caller-set registry
environment variable, so users keep the same capability without the installer
sources dictating a registry.
The actual fix from #57 is untouched. The installers still point the portable
Node runtime at the machine's existing npm configuration via
NPM_CONFIG_GLOBALCONFIG, which discovers the configured registry rather thanoverriding it. Users with no npm configuration are unaffected — the variable is
only set when a config file actually exists on disk.
INSTALL.mdnow documentsnpm config set registry <url> --location=globalas thesupported way to point at a mirror.
2.
chore(release): prepare 0.4.2Version bump only, in
package.jsonandpackage-lock.json.User-visible changes since v0.4.1
registry.npmjs.orgbutprovide a mirror through the machine's global npm configuration. Previously the
portable runtime never read that configuration and fell back to the public
registry, failing with
ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE.npm cifailures now report which registry was actually used and how toconfigure a mirror.
INSTALL.mdgains a "Networks that block registry.npmjs.org" section.Validation
Run with the portable runtime's npm 11.17.0 (
package.jsonrequires>=11.17.0):npm run fix:lockfile-registry— normalized 0 URLs, no internal feed URLs leakednpm run check:lockfilenpm ci --no-audit --no-fund --ignore-scripts=false --dangerously-allow-all-scripts=false --strict-allow-scripts— 459 packagesnpm run compliance:licenses— 227 package licenses, 0 source materialsnpm run buildnpm run typecheck:evalsnpm test— 147/148 pass; the compliance guard passes again. The one failureis environmental only:
electron/debug-bundle.test.tsshells out tounzip,which is not present on this Windows machine.
bash -n install.shscripts/install-windows.test.ps1install.ps1parses under both PowerShell 5.1 and 7End-to-end proof of the underlying fix is in #57: with the fix applied, npm fetched
zod-4.4.3.tgzfrom the corporate proxy instead of the blocked public registry.Release model
Source-only, per
RELEASING.md. No binaries,dist/,dist-electron/, ornode_modules/will be attached to the GitHub Release — this is what keeps uscompliant with third-party licensing.
Follow-up (not in this PR)
623 of 625 lockfile entries carry SHA-1 integrity (
sha1-…) rather thansha512-…, because the feed that generated the lockfile only returns the legacydist.shasum. Worth regenerating from a registry that serves SHA-512.