feat(capy): add capy secrets-manager package#230
Conversation
Installs the Capy CLI (@capysc/cli@0.6.1) into a Minimal environment and pinholes the developer's ~/.capy session into the box, so in-box `capy run -- <cmd>` injects branch-scoped secrets without transporting any key material (shared-session model). - build.ncl: @capysc/cli install, runtime deps (node-lts, git, ca-certificates, coreutils, glibc, base), node_modules output, and a ~/.capy Credential pinhole (read-write; trusted dev shells only). - build.sh: npm global install into the output prefix. - self-test: capy --version runs in a clean room and matches the pin. Verified: minimal package capy + minimal check capy pass; capy runs in a box.
|
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| mkdir -p "$PREFIX" | ||
|
|
||
| # Keep npm's cache inside the build sandbox (no writable $HOME). | ||
| export npm_config_cache="$(pwd)/.npm-cache" |
There was a problem hiding this comment.
Hmmm, does it work without this?
There was a problem hiding this comment.
Good catch. You probably have your own caching in dep management that this interferes with?
|
/build |
The previous `export npm_config_cache="$(pwd)/.npm-cache"` was redundant and non-deterministic: node/node-lts already wire NPM_CONFIG_CACHE to a Minimal- managed state dir via env_state_wiring. Simplify build.sh to match the other npm-CLI packages (pyright, typescript-language-server, mermaid-cli). Verified: minimal package capy + minimal check capy still pass (incl. self-test).
|
I'm going to swtich this to draft. There's some stuff I want to confirm with @jtnkminimal |
Declares capysc/capy-cli as the source of record per the new-package checklist. (Building from source vs the npm prebuilt is deferred — still npm-install for now.)
3 participants
Installs the Capy CLI (@capysc/cli@0.6.1) into a Minimal environment and pinholes the developer's ~/.capy session into the box, so in-box
capy run -- <cmd>injects branch-scoped secrets without transporting any key material (shared-session model).Verified: minimal package capy + minimal check capy pass; capy runs in a box.
Summary
Related issues
Changes
Checklist
min checkpasses for the affected packages/harnesses.min patched-build <name>succeeds for any package I added or modified.source_provenancepoints to the canonical upstream and the source builds from source (not a prebuilt release binary) where the required toolchain is available.sha256against the upstream archive.Notes for reviewers