Repository navigation
Conversation
The command stored the value, but addPaginationOptions() hardcoded the --per-page default to 50 and nothing read getPerPage(). List commands now default to the configured value.
The callback server accepted any request that carried a code. It never
compared the returned state with the one login() sent, and it listened on
every interface, so a request from another host on the network could
complete a login. It now binds to 127.0.0.1 and rejects a callback whose
state is missing or wrong.
The 5-minute login timer was never cleared, so a successful kit login kept
the process alive for the rest of those 5 minutes. The timer is cleared as
soon as the callback lands.
On Windows, openBrowser() ran execFile('start', ...). start is a cmd.exe
builtin, not a program, so the spawn failed with ENOENT and execFile
swallowed the error. Login then waited 5 minutes for a browser that never
opened. Windows now launches through rundll32, which takes the URL as a
plain argument with no shell escaping. When a launch fails on any platform,
the CLI prints the URL so the user can open it by hand.
docs/callback.html redirects to 127.0.0.1 to match the bind address.
release.yml and docs/RELEASING.md pin every action to a commit SHA and say Dependabot moves the pins. No dependabot.yml existed, so the pins never moved. A test holds the config to the two ecosystems the repo uses.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Six bug fixes from an audit of the repo. Each fix landed with a failing test first.
kit config set-per-pagehad no effect.addPaginationOptions()hardcoded the--per-pagedefault to 50. List commands now default to the configured value.state.login()sent it, but the callback server accepted any request that carried acode. A wrong or missingstatenow gets a 400 and rejects the login.127.0.0.1.docs/callback.htmlredirects to127.0.0.1to match.kit loginkept the process alive for 5 minutes. The login timer was never cleared. It is cleared as soon as the callback lands.kit loginnever opened a browser on Windows.execFile('start', ...)fails with ENOENT becausestartis a cmd.exe builtin, andexecFileswallowed the error. Windows now launches throughrundll32 url.dll,FileProtocolHandler <url>, with no shell in the path. When a launch fails on any platform, the CLI prints the URL to open by hand.release.ymlanddocs/RELEASING.mdrely on Dependabot to move the SHA-pinned actions, but nodependabot.ymlexisted. Added forgithub-actionsandnpm, weekly.waitForCallback,browserCommand, andopenBrowserare now exported with injectableport,host,timeoutMs, andrun, so the tests drive a real callback server on an ephemeral port.Not changed here:
spec/cli-surface.jsonis stale in key order only, since it predates the help-group reordering in c1173f0. The suite compares withdeepEqual, so it stays green.npm run surfacewould re-sort it.Test plan
npm test: 35 files, 813 tests, 812 pass, 1 skipped by design on macOSnpm audit: 0 vulnerabilitieskit loginon macOS completes and the process exits right awaykit loginon Windows opens the default browserkit config set-per-page 25thenkit tags list --format jsonreturns 25 rows