Issues

roster shows GitHub release body as package description instead of a short summary

HMythical/baller#92 · opened

on Sep 15, 2026

always builds a v-prefixed git tag, so pinning fails for repos whose tags have no v prefix

HMythical/baller#90 · opened

on Sep 15, 2026

Tag-to-version normalization is naive — repos like jqlang/jq render as vjq-1.8.2

HMythical/baller#91 · opened

on Sep 15, 2026

is non-recursive and falls back to arbitrary readdir order — GitHub drafts link the wrong file or none at all

HMythical/baller#89 · opened

on Sep 15, 2026

Default source chain leads with `https://registry.baller.dev/api`, which does not resolve — every default lookup pays a doomed first step (ties to #10)

HMythical/baller#87 · opened

on Sep 9, 2026

dnf/pacman command failures are mapped to `PackageNotFound` — a broken repo or missing `dnf` is reported as "package not found"; version defaults to `"unknown"`

HMythical/baller#86 · opened

on Sep 9, 2026

`atomic_write` uses a predictable `.tmp` sibling and `File::create` follows pre-planted symlinks (TOCTOU); partial `.tmp` files are left behind

HMythical/baller#84 · opened

on Sep 9, 2026

HTTP client retries non-404/403 errors 3× with backoff (400/401/429 included) and ignores Retry-After

HMythical/baller#83 · opened

on Sep 9, 2026

Baller Registry API interpolates package/version/query into the URL path without percent-encoding

HMythical/baller#82 · opened

on Sep 9, 2026

Chocolatey package names are interpolated into the OData `$filter` unescaped (`'` breaks out); custom feeds fall back to community.chocolatey.org when `media_src` is absent

HMythical/baller#81 · opened

on Sep 9, 2026

`dep_version` is parsed by splitting on `>` and keeping the first token — chained/comparison constraints are mis-recorded in DB metadata

HMythical/baller#80 · opened

on Sep 9, 2026

Multi-statement DB writes are not transactional — a crash mid-way leaves `insert_package`/`sync_lockfile_from_installed` half-applied

HMythical/baller#79 · opened

on Sep 9, 2026

`home_dir().unwrap()` panics instead of returning a `BallError`, unlike every other HOME lookup in the tree

HMythical/baller#72 · opened

on Sep 9, 2026

HOME resolution drift: `main.rs` uses `home_dir()` while `platform/linux.rs` uses `$HOME` — with HOME unset install_dir silently becomes `/usr/local/bin`

HMythical/baller#71 · opened

on Sep 9, 2026

`external.dependency_available` shells out to `which`/`where` — a probe failure reads as "missing" and a bare name can match a cwd-relative file

HMythical/baller#70 · opened

on Sep 9, 2026

An injected command killed by a signal (`status.code() == None`) is reported as success

HMythical/baller#69 · opened

on Sep 9, 2026

`sweep --threshold` gates on the total cache size while the default mode only sweeps archives

HMythical/baller#68 · opened

on Sep 9, 2026

`--source <X>` bypasses the `*_enabled` config switches, contradicting `docs/registry.md:150`

HMythical/baller#67 · opened

on Sep 9, 2026

`build` overwrites the manifest's version from the registry, but `--dry-run` reports the manifest version — the plan and the real run disagree

HMythical/baller#65 · opened

on Sep 9, 2026

`build`'s Cargo path silently defaults version to `0.0.0` for workspace-inherited versions and installs only the first `[[bin]]`

HMythical/baller#64 · opened

on Sep 9, 2026

`eject`/`update` recompute cache paths from the `<name>-<version>` convention instead of the DB's `install_path` — the package's own files are never deleted

HMythical/baller#63 · opened

on Sep 9, 2026

`eject` orphan-removal failures are swallowed (`let _ =`) yet still reported as removed in the JSON payload

HMythical/baller#62 · opened

on Sep 9, 2026

`eject`'s orphan cleanup removes only one level of transitive orphans per run, and order-dependently

HMythical/baller#61 · opened

on Sep 9, 2026

`tracing::info!(quiet, ...)` records a stray `quiet` field instead of suppressing the message — the only such call in the tree

HMythical/baller#60 · opened

on Sep 9, 2026

`substitute` never verifies the old package is installed: installs the new one, logs a Note, reports "Substitution complete", exit 0

HMythical/baller#58 · opened

on Sep 9, 2026

Navigation Menu

Repository navigation

Issues

roster shows GitHub release body as package description instead of a short summary

always builds a v-prefixed git tag, so pinning fails for repos whose tags have no v prefix

Tag-to-version normalization is naive — repos like jqlang/jq render as vjq-1.8.2

is non-recursive and falls back to arbitrary readdir order — GitHub drafts link the wrong file or none at all

Default source chain leads with `https://registry.baller.dev/api`, which does not resolve — every default lookup pays a doomed first step (ties to #10)

dnf/pacman command failures are mapped to `PackageNotFound` — a broken repo or missing `dnf` is reported as "package not found"; version defaults to `"unknown"`

`atomic_write` uses a predictable `.tmp` sibling and `File::create` follows pre-planted symlinks (TOCTOU); partial `.tmp` files are left behind

HTTP client retries non-404/403 errors 3× with backoff (400/401/429 included) and ignores Retry-After

Baller Registry API interpolates package/version/query into the URL path without percent-encoding

Chocolatey package names are interpolated into the OData `$filter` unescaped (`'` breaks out); custom feeds fall back to community.chocolatey.org when `media_src` is absent

`dep_version` is parsed by splitting on `>` and keeping the first token — chained/comparison constraints are mis-recorded in DB metadata

Multi-statement DB writes are not transactional — a crash mid-way leaves `insert_package`/`sync_lockfile_from_installed` half-applied

`home_dir().unwrap()` panics instead of returning a `BallError`, unlike every other HOME lookup in the tree

HOME resolution drift: `main.rs` uses `home_dir()` while `platform/linux.rs` uses `$HOME` — with HOME unset install_dir silently becomes `/usr/local/bin`

`external.dependency_available` shells out to `which`/`where` — a probe failure reads as "missing" and a bare name can match a cwd-relative file

An injected command killed by a signal (`status.code() == None`) is reported as success

`sweep --threshold` gates on the total cache size while the default mode only sweeps archives

`--source <X>` bypasses the `*_enabled` config switches, contradicting `docs/registry.md:150`

`build` overwrites the manifest's version from the registry, but `--dry-run` reports the manifest version — the plan and the real run disagree

`build`'s Cargo path silently defaults version to `0.0.0` for workspace-inherited versions and installs only the first `[[bin]]`

`eject`/`update` recompute cache paths from the `<name>-<version>` convention instead of the DB's `install_path` — the package's own files are never deleted

`eject` orphan-removal failures are swallowed (`let _ =`) yet still reported as removed in the JSON payload

`eject`'s orphan cleanup removes only one level of transitive orphans per run, and order-dependently

`tracing::info!(quiet, ...)` records a stray `quiet` field instead of suppressing the message — the only such call in the tree

`substitute` never verifies the old package is installed: installs the new one, logs a Note, reports "Substitution complete", exit 0