fix: managed npm LSP installs - #27
Conversation
ian-pascoe
changed the title
|
@codex review for bugs and security vulns |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ead97a61c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| resolve(); | ||
| return; | ||
| } | ||
| const detail = compactInstallOutput(stderr) || compactInstallOutput(stdout); |
There was a problem hiding this comment.
With stdio switched to pipes, building the error detail in the exit handler can run before the child stdout/stderr streams have closed, so npm failures that write diagnostics as the process terminates can still surface the old opaque message or a truncated one. This affects the managed install failure path this patch is trying to improve; wait for close (or otherwise wait for both streams to finish) before calling compactInstallOutput.
Useful? React with 👍 / 👎.
1 participant
Summary
Root Cause
The managed npm installer ran
npm install --ignore-scripts --prefix <cache> <package>@<version>while inheriting user npm config. On this machine,allow-scripts=@nubjs/nubcaused npm 11 to reject the project-scoped install withEALLOWSCRIPTS. The installer usedstdio: "ignore", so downstream callers only saw an opaque exit code.Validation
pnpm test tests/unit/installer.test.tspnpm run typecheckpnpm run lintpnpm run format:checkpnpm run buildoxfmt . --check,oxlint .,tsgo -p tsconfig.json --noEmit,vitest run(27 files, 335 tests),pnpm run build