fix: address PR review findings

Reject a non-https webhook URL before curl sees it, and add --fail so an
HTTP error status reaches the retries and the warning instead of exiting 0.
Compare release identifiers with BigInt so two versions past 2^53 cannot
round to the same float and read as a match. Drop the conditional fallbacks
from the status colour test.

Author: elkaix

.github/workflows/release.yml

@@ -239,15 +239,28 @@ jobs:
             echo "::warning::DOKPLOY_CDN_DEPLOY_WEBHOOK not set — skipping CDN redeploy."
             exit 0
           fi
+          # The URL is itself the deploy credential, so never send it over a
+          # scheme that puts it on the wire in cleartext. Warn rather than fail:
+          # verify-cdn-release runs only if this job succeeds, and failing here
+          # would drop the consistency gate instead of tripping it.
+          case "$WEBHOOK" in
+            https://*) ;;
+            *)
+              echo "::warning::DOKPLOY_CDN_DEPLOY_WEBHOOK is not an https:// URL — refusing to send the deploy credential in cleartext."
+              exit 0
+              ;;
+          esac
           # The webhook matches the branch from the request body: a bare POST
           # answers 301 {"message":"Branch Not Match"} and deploys nothing.
           #
           # A transient failure must never fail the workflow. npm has already
           # published by now and that is irreversible, so dying here buys
           # nothing — an earlier version of this job was deleted because a
           # curl exit-28 timeout failed the 0.5.0 release. verify-cdn-release
-          # polls the manifest and is the gate that fails loudly.
-          curl -sS -X POST "$WEBHOOK" \
+          # polls the manifest and is the gate that fails loudly. `--fail` is
+          # what makes an HTTP error status reach the retries and the warning
+          # instead of exiting 0 and reading as a successful deploy.
+          curl -sS --fail -X POST "$WEBHOOK" \
             -H 'Content-Type: application/json' \
             -d '{"ref":"refs/heads/main"}' \
             --retry 3 --retry-all-errors --retry-delay 10 --max-time 60 \

apps/pythinker-code/test/scripts/release/cdn-consistency.test.ts

@@ -49,6 +49,13 @@ describe('compareRelease', () => {
     expect(compareRelease(parse('0.12.1'), parse('0.12.2'))).toBeLessThan(0);
     expect(compareRelease(parse('0.12.0'), parse('0.12.0'))).toBe(0);
   });
+
+  it('separates identifiers that float arithmetic would round together', () => {
+    const parse = (value: string) => /^(\d+)\.(\d+)\.(\d+)$/u.exec(value) as RegExpExecArray;
+    // 9007199254740992 and 9007199254740993 are the same IEEE-754 double.
+    expect(compareRelease(parse('9007199254740993.0.0'), parse('9007199254740992.0.0'))).toBe(1);
+    expect(compareRelease(parse('0.9007199254740992.0'), parse('0.9007199254740993.0'))).toBe(-1);
+  });
 });
 
 describe('classifyCdnVersion', () => {

apps/pythinker-code/test/tui/components/messages/background-agent-status.test.ts

@@ -64,8 +64,8 @@ describe('BackgroundAgentStatusComponent', () => {
     const previousLevel = chalk.level;
     chalk.level = 3;
     try {
-      const startedLine = started.render(120)[1] ?? '';
-      const completedLine = completed.render(120)[1] ?? '';
+      const startedLine = started.render(120).join('\n');
+      const completedLine = completed.render(120).join('\n');
 
       // A running task is ambient: dim dot, dim wording, no accent colour.
       expect(startedLine).toContain(currentTheme.fg('textDim', STATUS_BULLET));

scripts/release/cdn-consistency.mjs

@@ -15,11 +15,18 @@
 /** Stable release semver. The CDN manifest never advertises a prerelease. */
 const RELEASE_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
 
-/** Numeric major/minor/patch compare over two RELEASE_SEMVER matches. */
+/**
+ * Numeric major/minor/patch compare over two RELEASE_SEMVER matches.
+ *
+ * BigInt rather than Number: semver puts no ceiling on an identifier, and two
+ * distinct versions past 2^53 would round to the same float and compare equal —
+ * reporting a stale or impossible CDN as a match.
+ */
 export function compareRelease(left, right) {
   for (let index = 1; index <= 3; index += 1) {
-    const diff = Number(left[index]) - Number(right[index]);
-    if (diff !== 0) return diff;
+    const a = BigInt(left[index]);
+    const b = BigInt(right[index]);
+    if (a !== b) return a < b ? -1 : 1;
   }
   return 0;
 }