fix(update): default self-update to public npm + truthful versioning#21
Merged
Merged
Conversation
`quoin update` passed no registry to ix-cli-core's runSelfUpdate, so npm used the ambient config. On machines whose npm points at a private snapshot registry, that 404s — @agent-ix/quoin is published to public npm. Default to https://registry.npmjs.org/ when no --registry is given (FR-022); --registry still overrides for local-dev snapshots. Also prevent the version drift this surfaced: - Bake `git describe --tags --dirty` into the build (vite define) and have packageVersion() prefer it, so `quoin --version` is truthful: a clean tag shows the tag (0.5.2), any other build reveals it's ahead/dirty (0.5.1-3-gabc123-dirty). Falls back to package.json for dev/test/no-git builds. - Add a release-drift CI guard that fails while main's src/ is ahead of the latest release tag, so fixes can't sit unreleased; self-heals on tag push. Updates FR-022 (spec, matrix, plan) and adds tests for both version branches. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Code-review finding: the fallback test used weak assertions (typeof/length). Assert the exact package.json version instead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Gap analysis (SR-001) flagged that baking git-describe into packageVersion() changed FR-002 behavior without updating the requirement, and that version.test.ts was untracked. - FR-002: Description + Behavior now specify "prefer the build-time baked version, fall back to package.json"; add FR-002-AC-4. - Matrix: add version.test.ts to the FR-002 row. - Add the gap-analysis SpecReview artifact (reviews/, quire-validated). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
quoin updatepassed no registry toix-cli-core'srunSelfUpdate, so npm used the ambient config. On a machine whose npm default points at a private snapshot registry (e.g.npm.ix), that 404s —@agent-ix/quoinis published to public npm.What
https://registry.npmjs.org/when no--registryis given;--registrystill overrides for local-dev snapshots. Spec (FR-022 / matrix / plan) and tests updated.git describe --tags --dirtyinto the build (vitedefine);packageVersion()prefers it. A clean tagged release reports its tag (0.5.2); any other build reveals drift (0.5.1-3-gabc123-dirty). Falls back topackage.jsonfor dev/test/no-git builds.release-drift.ymlfails whilemain'ssrc/is ahead of the latest release tag, so fixes can't sit unreleased. Self-heals — re-evaluates on tag push and daily.Verification
quoin update --checkresolves public npm (no ambient 404);--registry http://npm.ix/still honored.quoin --versionon a dirty tree →0.5.1-dirty; on a cleanv0.5.2tag →0.5.2.tests/version.test.tscovers both version branches;update.test.tsasserts the npmjs default.🤖 Generated with Claude Code