fix: failed trust reads misreported as unconfigured; publish boolean replaces permissions - #15
Merged
Merged
Conversation
…n replaces permissions - listTrust distinguishes a failed npm trust list (EOTP etc.) from an empty config; sync probes after the browser 2FA approval and stops with a clear message if it didn't stick, mid-run failures are listed as unreadable, and add/wizard fails the package instead of writing blind. - npm grants createStagedPackage to every trusted publisher, so a publish-only config read back as drift on every package. The setting is now a boolean `publish` (--publish / --no-publish); the old `permissions` still works with a deprecation note.
|
The changes in this PR will be included in the next version bump.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two bugs found while syncing the varlock monorepo
syncreported every package as "not configured". Trust configs are read with a capturednpm trust list --json, which can't run npm's browser 2FA itself. When the read failed (npm's "remember for 5 minutes" approval wasn't ticked or had lapsed) it returned[], indistinguishable from an empty config — sosyncclaimed nothing was set up and offered to "fix" all 32 packages.listTrustnow returns a result that distinguishes a failed read (EOTPetc., parsed from npm's JSON error) from an empty config.syncprobes one captured read right after npm's interactive approval (with a short retry for the registry's grace to become visible) and cancels with an actionable message if it didn't stick.add/wizard fail that package instead of writing blind.31 packages showed as out of sync on permissions. npm grants
createStagedPackageto every trusted publisher, so a config created with--allow-publishreads back with both, and fledgling flagged drift on everything."publish": true(default) /--publish/--no-publish.fledgling initasks a yes/no. Drift only compares whethercreatePackageis present.configureTrustalways passes--allow-stage-publish(npm requires at least one flag).permissions: publish | stage | bothstill works (stage→false, others →true) with a deprecation note.Verified
Local build against the varlock worktree: with the 2FA grace active,
syncreports 31 in sync + 1 unconfigured (the package whose trust step had failed duringadd); a scopedsync <pkg> --yesconfigured it. Bogus--otpexercises the failed-read paths in bothsyncandadd.--permissions stagewarns and resolves to staged only;--no-publishrenders "no (staged only)". Typecheck + build pass.