Fix CLI archive README generation - #36
Conversation
Why: - An unquoted packaging heredoc treated Markdown backticks as shell syntax, executed the npm package command, and copied its output into the released CLI README. - Source-only public checks could not observe this payload-time transformation. Changed: - Generate static README Markdown from quoted literal blocks and interpolate only the validated versioned archive values. - Inspect the extracted final tarball with a fake-command sentinel, literal-command assertion, and exact-checkout-root rejection. - Bind the generated README behavior to explicit build-and-test requirements. Verification: - Focused regression failed on the original behavior and passed after the fix. - npm run test:docs (42 passed). - npm test (258 public files; 294 broker-core; 256 client; 24 harness-adoption; 171 app). - Routed spec-only profile and staged current-source audits passed. Affected: - CLI tarball README generation and its public verification contract. - No broker runtime, npm payload, macOS app, release workflow, tag, or retained artifact changes. Refs: - https://how.complexsystems.fail Session: - task-sessions/rr20-cli-package-readme-20260831
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8893c4e8f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Reviewed top-level PR feedback and left the current code unchanged. These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.
|
1 participant
What changed
CLI packaging now writes static README Markdown from quoted literal blocks and interpolates only the validated versioned archive values. This prevents backticked documentation commands from running during packaging or copying their stdout into the released tarball.
The existing final-archive test now installs a deterministic fake
npmsentinel, extracts the completed tarball, preserves the literal backticked command, and rejects command output or the exact checkout root. The build-and-test contract binds both requirements to that verifier.The failure required several conditions together: an unquoted heredoc, Markdown backticks, a runnable package command, path-bearing stdout, and defenses that inspected source rather than generated bytes. The correction removes that interpretation coupling and checks the durable payload boundary.
How you verified
npm run test:docs— 42 passednpm test— public surface 258 files; broker-core 294; client 256; harness adoption 24; app 171spec-onlyverification profile passedNotes
The guard is intentionally scoped to the generated CLI README and exact checkout root rather than introducing a broad temporary-path rule. Other release payload transformations still require terminal artifact audit. No release, tag, retained artifact, npm payload, app, or workflow behavior is changed.
This project is Alpha, macOS-only, and needs Xcode to talk to iOS Simulators. See CONTRIBUTING.md.