Catch tool-package source changing without a version bump - #267
Merged
Conversation
…without a version bump Tool resolution keys on name@version, so new source under an unchanged version never reaches a running agent and the hub rejects it at publish time — which aborts seeding partway and leaves a tenant with no assistant definition. check:tool-package-pins compares a pin against its manifest and passes when both sides agree at the same stale version, which is the shape that has now recurred five times. This reads the change's own git history instead, and scopes itself to the packages the tool registry publishes. Bumps @corbits/github-tools to 0.0.6 and its two pins, which is the live instance of exactly that drift.
vendor/intx/* is a workspace glob, so bun install materializes a directory holding nothing but node_modules for every linked package. The scan read those as unregistered vendored trees and failed with sixteen violations for paths that carry no source at all. Only a directory with its own source is something the ledger owes a kill date.
The specifier pattern spans newlines, so a comment mentioning the word import before a real import swallowed the lines between them and reported the file's genuine type-only import as a value import. Comments are now blanked before matching, preserving offsets.
A concurrent lane's classification fix landed here by mistake; it belongs to its own change (PR #277) rather than to the tool-package freshness guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seeding a fresh tenant currently aborts partway:
Because seeding aborts, the tenant never gets its
assistantdefinition — so every workbench template then fails with "No default setup agent found for this workbench", which is what a person actually sees. The cause is three layers away from the symptom.Bumps
@corbits/github-toolsto 0.0.6 and both pins that reference it, which unblocks seeding.Why this keeps happening
This is the fifth instance of the same drift.
check:tool-package-pinscompares a{ name, version }pin literal against its package's manifest — it passes when both sides agree at the same stale version, which is exactly this shape. Its own comments, AGENTS.md, and two tickets all record that the other half was out of scope, and it stayed out of scope through four more incidents.check:tool-package-freshnessis that other half. It reads the change's git history rather than a snapshot of the working tree: a package whose non-testsrc/moved must carry a version bump in the same change. A package that did not exist at the base ref is new, and its first version counts.It scopes itself to the packages the tool registry actually publishes, read from
CORBITS_TOOL_PACKAGE_DIRSinpackages/tool-registry-publish/src/registry.ts— the same list the publish step walks, so the check and the publisher cannot disagree about what a tool package is. An earlier draft flagged every workspace package and produced 21 violations on a historical range, most of them packages resolved by path rather than by version.Wired into
check:structural(sobun run checkcovers it) and into CI, where the base ref comes from the pull request rather than a local merge base.