fix: reuse installed private packages without registry auth, add ponharu age keys, harden yarn scan#1022
Merged
exKAZUu merged 9 commits intoJul 19, 2026
Conversation
…finish yarn-scan substitution handling - wb setup-private-packages now copies @willbooster-private/* packages from node_modules when the installed version satisfies the specifier, so CI steps without Verdaccio credentials (e.g. ai-ocr's test step) can materialize them; downloads (and registry auth) are only required for packages that are not installed. - Add ponharu's two age public keys to wbfy's fnox recipient set. - Treat `$(...)` substitutions inside case subjects/patterns and array literals as executable in the yarn conversion scan, and tokenize `&>`/`&<` compound redirections correctly. - Name the CaseContext type so the type-aware linter accepts the outer-state snapshot field. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
… in the yarn scan `$(...)` inside a case subject/pattern or array literal executes its content, so yarn there must convert; also tokenize `&>`/`&<` compound redirections as redirects rather than separators, and fix adjacency detection for `name=(` array literals appearing mid-separator-run. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request optimizes the private package setup in packages/wb by reusing registry packages already installed in node_modules or the .bun store when they satisfy the version specifier, avoiding unnecessary downloads in credential-free environments like CI. Additionally, in packages/wbfy, it updates the FNOX age recipients and refactors the shell script tokenizer to correctly parse compound redirections (e.g., &>) and nested command substitutions within data contexts, supported by new test cases. There are no review comments, so I have no feedback to provide.
…enization - Compare exact versions as strings in installedVersionSatisfies, specifierSubset, and materializedVersionSatisfies: semver comparisons ignore build metadata, but resolveVersion fetches exact specifiers verbatim, so artifacts differing only in build metadata must not be conflated. - Preserve declared bundledDependencies subtrees when copying installed registry packages (the tarball legitimately contains them); git checkouts still exclude node_modules. - Tokenize `&<` as `&` followed by `<` (only `&>`/`&>>` are compound redirections), so `true &</dev/null yarn compile` converts. - Document the credential-free installed-package reuse in the CLI help and README. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
… yarn scan - Track enclosing case contexts in a stack so a nested case's esac restores the outer pattern context instead of discarding it. - Recognize adjacent `<(`/`>(` process substitutions as executable contexts in data positions (case subjects/patterns, array literals). - Reject --out-dir values overlapping node_modules or the registry staging directory, which the command would otherwise delete or silently discard. - Merge compatible nested version requirements (narrower wins) while a package is still queued, and accept requirements the selected materialization's actual version satisfies, so discovery order cannot fabricate conflicts. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
…use docs - In collectNestedPrivatePackages, a package still awaiting its download (no installed copy selected, nothing extracted) narrows to a compatible nested requirement instead of reporting a conflict, matching collectPrivatePackages' queue behavior; materialized entries still conflict loudly. - Document that only installed copies satisfying an exact version or semver range are reused without registry access; dist-tag specifiers always download (CLI help, error remediation, README). Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
- `*` resolves through the `latest` dist-tag, so installedVersionSatisfies and specifierSubset no longer treat it as a statically checkable range: an installed copy is never reused for `*`, and `*` never merges with other requirements. - Insert a package into privatePackages before deep-scanning its manifests so a self-referencing nested requirement validates against the already selected version instead of narrowing the specifier after selection. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
A symlink component (e.g. `escape -> node_modules`) could smuggle the recursive deletes past the lexical --out-dir guards and destroy the symlink's target. All containment/overlap checks (and the paths later deleted/created) now operate on canonicalized paths: symlinks in the deepest existing ancestor are resolved and the not-yet-existing remainder reattached. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
- setup-private-packages output directories (--out-dir, @willbooster-private, the staging directory) are recursively deleted, so any canonical/lexical mismatch (a symlink component) is now rejected up front instead of resolving the delete onto the symlink's target. - The yarn scan recognizes bash's `;&` clause terminator (tokenized as `;` plus an adjacent `&`) in addition to `;;`/`;;&`, so the following pattern is no longer rewritten as a command. Co-authored-by: WillBooster (Claude Code) <agent@willbooster.com>
…nstalled-copy-and-ponharu-keys # Conflicts: # packages/wbfy/src/generators/packageJson.ts # packages/wbfy/test/packageJson.test.ts
exKAZUu
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Customer Summary
wb setup-private-packagesnow works in environments without private-registry credentials (e.g. CI test steps) as long as the private packages are already installed, so repositories like ai-ocr can drop their custom workaround scripts.--out-dirvalues can no longer delete unrelated directories.Technical Summary
wb setup-private-packages: registry packages whose installed copy innode_modules(root or.bunstore) satisfies an exact-version or semver-range specifier are copied (dereferencing isolated-linker symlinks, preservingbundledDependenciessubtrees) instead of downloaded; registry auth is resolved and required only when a download remains (dist-tag specifiers, including*, always download). Nested private dependencies of installed copies are deep-scanned eagerly; compatible version requirements merge order-independently (narrower requirement wins while queued, and requirements satisfied by the selected materialization's actual version are accepted); packages are marked selected before their manifests are deep-scanned so self-references validate against the selection.--out-dirmust not overlap@willbooster-private,node_modules, or the staging directory, and every recursively deleted output path is rejected if it contains a symlink component (canonical/lexical mismatch).installedVersionSatisfies,specifierSubset, andmaterializedVersionSatisfies.wbfyfnox recipients: added ponharu's two age public keys; the next wbfy run on each repository re-encrypts committed secrets for the new recipient set.casestatements restore the enclosing context atesac;;∧;&clause terminators return to pattern context;<(/>(process substitutions and$(...)command substitutions execute even in data contexts;&<tokenizes as&+<(only&>/&>>are compound redirects).Why
bun wb setup-private-packageson CI because its test step deliberately receives no Verdaccio token; the packages are already installed there, so downloading was an unnecessary hard requirement (workaround: a hand-written copy script in the repo).Testing
bun verify(type check + lint) passes;bun run testinpackages/wb(171 tests) andpackages/wbfy(210 tests) passes.bun wb setup-private-packageswith noVERDACCIO_TOKENcopies@willbooster-private/llm-proxy@5.38.1from the isolated-install store without contacting the registry.*/dist-tag specifiers requiring registry access, self-referencing manifests validating against the selection, and symlinked/overlapping output paths being rejected while defaults succeed.skills review, run 20260719-182356-7csa1d) converged to "No concern." after 8 rounds; CI on this PR is green.