feat: harden private Pro distribution#712
Conversation
rafaelscosta
requested review from
Pedrovaleriolopez and
oalanicolas
as code owners
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR implements PRO-13.5: removes Pro assets from public core tarballs, enforces a public-only tarball boundary via npm-pack validation, refactors pro setup/update to use the installer wizard (supporting license-server signed-artifact acquisition with SHA256/size verification), converts aiox-pro into a thin delegating wrapper, updates manifests/docs/tests, and records QA evidence. ChangesPro-13.5 Distribution Hardening
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
area: agents
📊 Coverage ReportCoverage report not available
Generated by PR Automation (Story 6.1) |
github-actions
Bot
removed
area: agents
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
bin/utils/validate-publish.js (1)
51-67:⚠️ Potential issue | 🟠 Major | ⚡ Quick winNormalize legacy
npm noticelines to extract file paths correctly.The fallback parser doesn't account for the size column in legacy
npm packoutput. Lines likenpm notice 1.2kB pro/license/license-api.jsare currently parsed to1.2kB pro/license/license-api.js, which fails thePRO_PATH_PATTERNcheck (starts with size, notpro/). This allows premium files to pass the validation gate.The codebase already contains a correct pattern in
scripts/validate-package-completeness.jsthat properly extracts the path after the size:line.match(/npm notice\s+[\d.]+[kMG]?B?\s+(.+)/). Apply the same approach here.Suggested fix
return packOutput .split('\n') .filter( (line) => line.includes('npm notice') && !line.includes('Tarball') && !line.includes('name:') && !line.includes('version:') && !line.includes('filename:') && !line.includes('package size:') && !line.includes('unpacked size:') && !line.includes('shasum:') && !line.includes('integrity:') && !line.includes('total files:'), ) - .map((line) => line.replace(/^.*npm notice\s+/, '').trim()) + .map((line) => { + const match = line.match(/npm notice\s+[\d.]+[kMG]?B?\s+(.+)/); + return match ? match[1].trim() : ''; + }) .filter(Boolean);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@bin/utils/validate-publish.js` around lines 51 - 67, The parser that builds the npm notice lines from packOutput should normalize legacy lines that include a size column before the path; update the mapping logic in bin/utils/validate-publish.js (the packOutput -> .split(...).map(...) pipeline) to first attempt extracting the path with the same regex used in scripts/validate-package-completeness.js (e.g. match for npm notice + optional size and capture the remainder), falling back to the existing replace(/^.*npm notice\s+/, '') if no size is present, so that downstream checks (like PRO_PATH_PATTERN) receive the actual file path rather than a leading size token.packages/aiox-pro-cli/bin/aiox-pro.js (1)
150-176:⚠️ Potential issue | 🟡 Minor | ⚡ Quick win
install/setup/wizarddrops the-kshort key flag.The wrapper only reads
--key, sonpx aiox-pro install -k <KEY>won’t pass the key and may unexpectedly fall back to interactive prompts.💡 Suggested fix
-function getArgValue(flag) { - const idx = args.indexOf(flag); - if (idx !== -1 && idx + 1 < args.length) { - return args[idx + 1]; - } +function getArgValue(...flags) { + for (const flag of flags) { + const idx = args.indexOf(flag); + if (idx !== -1 && idx + 1 < args.length) { + return args[idx + 1]; + } + } return null; } @@ function installPro() { - runProWizard(getArgValue('--key')); + runProWizard(getArgValue('--key', '-k')); } @@ case 'setup': case 'wizard': { // Run the Pro Installation Wizard with license gate - const wizardKey = getArgValue('--key'); + const wizardKey = getArgValue('--key', '-k'); runProWizard(wizardKey); break; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/aiox-pro-cli/bin/aiox-pro.js` around lines 150 - 176, The install/setup/wizard handlers only read the long flag '--key' so short flag '-k' is ignored; update call sites to accept both forms (use getArgValue('-k') || getArgValue('--key')) when retrieving the key (e.g., in installPro() and where wizardKey is set before runProWizard), or extend getArgValue to accept aliases so runProWizard receives the provided '-k' value; ensure you reference installPro, runProWizard, and getArgValue when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/guides/workflows/pro-developer-workflow.md`:
- Line 221: In the table row containing the text "npm artifact for maintainers,
customer access through license-server signed URL" update the compound modifier
by hyphenating it to "license-server-signed URL" so the cell reads "npm artifact
for maintainers, customer access through license-server-signed URL"; locate the
exact string in the table line that currently starts with "**aiox-pro** | With
aiox-core cloned" and replace the unhyphenated phrase accordingly.
In `@outputs/qa/2026-05-pro-13-5-npm-access-pro-status.json`:
- Around line 1-3: The QA artifact currently shows "@aiox-squads/pro" as
"public" (pre-hardening) and lacks post-hardening evidence; run the final
release step that sets the package visibility to private for the package
"@aiox-squads/pro", verify the npm registry (or org) reports visibility
"private", and add a new QA artifact file (e.g.,
2026-05-pro-13-5-npm-access-pro-status-final.json) containing
{"@aiox-squads/pro": "private"} to the PR to confirm the post-step state.
In `@outputs/qa/2026-05-pro-13-5-npm-view-core.json`:
- Around line 1-7: The pre-publish snapshot shows dist-tags.latest is 5.1.15
instead of the expected 5.1.16; update or add a post-publish snapshot that
verifies dist-tags.latest becomes "5.1.16" and also add a check that the packed
tarball (the package produced during validate:publish) does not contain the
"pro/" directory; locate the snapshot generation logic (the test or script that
produces qa/2026-05-pro-13-5-npm-view-core.json) and modify it to run after
publish, assert dist-tags.latest === "5.1.16", and assert the tarball contents
exclude "pro/" so the validate:publish hardening has complete evidence.
In `@outputs/qa/2026-05-pro-13-5-npm-view-pro.json`:
- Around line 1-6: The snapshot shows "version": "0.4.0" and "dist-tags.latest":
"0.4.0" for `@aiox-squads/pro` but was taken before the 0.4.1 publish; update the
snapshot capture so it runs after the package is published (while still public)
and re-record the JSON to reflect "version": "0.4.1" and "dist-tags.latest":
"0.4.1" (i.e., re-run the npm view step and replace the current snapshot object
containing the "version" and "dist-tags.latest" keys).
In `@packages/installer/src/wizard/pro-setup.js`:
- Around line 839-845: The code currently installs the pro package and persists
the local license cache before calling scaffoldProContent, which leaves
activated cache and node_modules/@aiox-squads/pro behind on scaffold failure;
change the flow so that cache persistence happens only after scaffoldProContent
succeeds, and on any scaffoldProContent error roll back the just-installed
package and temporary extraction (use installedProSourceDir/targetDir to remove
the installed package or call the inverse uninstall helper if available, and
clean extractedProSourceDir), keeping test hook support
(module.exports._testing.installProArtifactIntoTarget/targetInstaller) intact;
apply the same change to the other similar installation blocks in the file.
- Around line 700-724: The downloadArtifactFile function currently calls
fetch(artifactUrl) without an abort signal which can hang; add an
AbortController with a timeout (e.g., configurable constant or parameter) and
pass controller.signal to fetch, start a setTimeout that calls
controller.abort() after the timeout, and clear the timeout on success or error;
ensure you catch the abort error and rethrow a clear timeout-specific Error
before continuing with the existing response checks and writing the file so
downloadArtifactFile fails promptly on network hangs.
---
Outside diff comments:
In `@bin/utils/validate-publish.js`:
- Around line 51-67: The parser that builds the npm notice lines from packOutput
should normalize legacy lines that include a size column before the path; update
the mapping logic in bin/utils/validate-publish.js (the packOutput ->
.split(...).map(...) pipeline) to first attempt extracting the path with the
same regex used in scripts/validate-package-completeness.js (e.g. match for npm
notice + optional size and capture the remainder), falling back to the existing
replace(/^.*npm notice\s+/, '') if no size is present, so that downstream checks
(like PRO_PATH_PATTERN) receive the actual file path rather than a leading size
token.
In `@packages/aiox-pro-cli/bin/aiox-pro.js`:
- Around line 150-176: The install/setup/wizard handlers only read the long flag
'--key' so short flag '-k' is ignored; update call sites to accept both forms
(use getArgValue('-k') || getArgValue('--key')) when retrieving the key (e.g.,
in installPro() and where wizardKey is set before runProWizard), or extend
getArgValue to accept aliases so runProWizard receives the provided '-k' value;
ensure you reference installPro, runProWizard, and getArgValue when making the
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 12b511c7-4d98-4152-8632-c6b48d6eafb2
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (24)
.aiox-core/cli/commands/pro/index.js.aiox-core/install-manifest.yamlbin/utils/validate-publish.jsdocs/PUBLISHING.mddocs/guides/workflows/pro-developer-workflow.mddocs/stories/epic-pro-13/STORY-PRO-13.5-PRIVATE-PRO-DISTRIBUTION-HARDENING.mdoutputs/qa/2026-05-pro-13-5-core-pack-dry-run.jsonoutputs/qa/2026-05-pro-13-5-npm-access-core-status.jsonoutputs/qa/2026-05-pro-13-5-npm-access-pro-status.jsonoutputs/qa/2026-05-pro-13-5-npm-view-core.jsonoutputs/qa/2026-05-pro-13-5-npm-view-pro.jsonoutputs/qa/2026-05-pro-13-5-pro-artifact-0.4.1.jsonoutputs/qa/2026-05-pro-13-5-smoke.jsonoutputs/qa/2026-05-pro-13-5-vercel-manifest-0.4.1.jsonpackage.jsonpackages/aiox-pro-cli/bin/aiox-pro.jspackages/installer/src/pro/pro-scaffolder.jspackages/installer/src/wizard/i18n.jspackages/installer/src/wizard/pro-setup.jsprotests/cli/validate-publish.test.jstests/installer/pro-setup-auth.test.jstests/license/license-api.test.jstests/pro-wizard.test.js
| { | ||
| "@aiox-squads/pro": "public" | ||
| } |
There was a problem hiding this comment.
Missing post-hardening QA evidence for @aiox-squads/pro private access.
This artifact shows @aiox-squads/pro as "public", which is the pre-hardening state. The PR's release order lists setting visibility to private as the final step (step 4), but no corresponding QA artifact confirming the private state was applied is included. Without that post-step evidence, the core hardening objective of this PR is unverified in the QA record.
Consider adding a 2026-05-pro-13-5-npm-access-pro-status-final.json (or equivalent) after executing step 4, confirming "private".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@outputs/qa/2026-05-pro-13-5-npm-access-pro-status.json` around lines 1 - 3,
The QA artifact currently shows "@aiox-squads/pro" as "public" (pre-hardening)
and lacks post-hardening evidence; run the final release step that sets the
package visibility to private for the package "@aiox-squads/pro", verify the npm
registry (or org) reports visibility "private", and add a new QA artifact file
(e.g., 2026-05-pro-13-5-npm-access-pro-status-final.json) containing
{"@aiox-squads/pro": "private"} to the PR to confirm the post-step state.
| { | ||
| "version": "5.1.15", | ||
| "dist-tags": { | ||
| "preview": "5.1.4", | ||
| "latest": "5.1.15" | ||
| } | ||
| } |
There was a problem hiding this comment.
Pre-publish baseline snapshot — dist-tags.latest is 5.1.15, not 5.1.16.
This captures state before publishing the version introduced in this PR. A post-publish snapshot confirming 5.1.16 became latest (and that the packed tarball excludes pro/) would complete the evidence chain for the validate:publish hardening.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@outputs/qa/2026-05-pro-13-5-npm-view-core.json` around lines 1 - 7, The
pre-publish snapshot shows dist-tags.latest is 5.1.15 instead of the expected
5.1.16; update or add a post-publish snapshot that verifies dist-tags.latest
becomes "5.1.16" and also add a check that the packed tarball (the package
produced during validate:publish) does not contain the "pro/" directory; locate
the snapshot generation logic (the test or script that produces
qa/2026-05-pro-13-5-npm-view-core.json) and modify it to run after publish,
assert dist-tags.latest === "5.1.16", and assert the tarball contents exclude
"pro/" so the validate:publish hardening has complete evidence.
| { | ||
| "version": "0.4.0", | ||
| "dist-tags": { | ||
| "latest": "0.4.0" | ||
| } | ||
| } |
There was a problem hiding this comment.
Pre-publish snapshot — dist-tags.latest is 0.4.0, not 0.4.1.
This was captured before publishing @aiox-squads/pro@0.4.1. Since @aiox-squads/pro will eventually be set to private (step 4), npm view won't be usable post-release to confirm. Consider capturing this snapshot post-publish (while still public) to close the audit loop.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@outputs/qa/2026-05-pro-13-5-npm-view-pro.json` around lines 1 - 6, The
snapshot shows "version": "0.4.0" and "dist-tags.latest": "0.4.0" for
`@aiox-squads/pro` but was taken before the 0.4.1 publish; update the snapshot
capture so it runs after the package is published (while still public) and
re-record the JSON to reflect "version": "0.4.1" and "dist-tags.latest": "0.4.1"
(i.e., re-run the npm view step and replace the current snapshot object
containing the "version" and "dist-tags.latest" keys).
…-pro-distribution # Conflicts: # .aiox-core/install-manifest.yaml # bin/utils/validate-publish.js # packages/aiox-pro-cli/bin/aiox-pro.js # tests/cli/validate-publish.test.js
There was a problem hiding this comment.
🧹 Nitpick comments (2)
tests/pro-recover.test.js (1)
224-230: ⚡ Quick winOptional: deduplicate repeated
readFileSyncacross all three tests in the describe block.All three tests in the
CLI alias reset-passworddescribe block (lines 203–230) perform the samereadFileSync+path.joincall inline. Hoisting it to abeforeAll/ sharedletwould reduce duplication and make the tests cheaper to maintain if the path ever changes.♻️ Proposed refactor
describe('CLI alias reset-password', () => { + let cliSource; + + beforeAll(() => { + const fs = require('fs'); + const path = require('path'); + cliSource = fs.readFileSync( + path.join(__dirname, '../packages/aiox-pro-cli/bin/aiox-pro.js'), + 'utf-8', + ); + }); + test('aiox-pro.js switch handles reset-password same as recover', () => { - const cliSource = require('fs').readFileSync( - require('path').join(__dirname, '../packages/aiox-pro-cli/bin/aiox-pro.js'), - 'utf-8', - ); expect(cliSource).toContain("case 'recover':"); expect(cliSource).toContain("case 'reset-password':"); expect(cliSource).toContain('reset-password'); }); test('showHelp includes reset-password as alias for recover', () => { - const cliSource = require('fs').readFileSync( - require('path').join(__dirname, '../packages/aiox-pro-cli/bin/aiox-pro.js'), - 'utf-8', - ); expect(cliSource).toMatch(/reset-password\s+.*alias/i); }); test('install and wizard accept short -k key flag', () => { - const cliSource = require('fs').readFileSync( - require('path').join(__dirname, '../packages/aiox-pro-cli/bin/aiox-pro.js'), - 'utf-8', - ); expect(cliSource).toContain("getArgValue('--key', '-k')"); }); });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/pro-recover.test.js` around lines 224 - 230, The three tests in the "CLI alias reset-password" block repeat the same fs.readFileSync + path.join call to load the CLI source; extract that into a shared variable (e.g., let cliSource) and populate it in a beforeAll hook so each test (including the test 'install and wizard accept short -k key flag') reuses the loaded string; update references in the tests to use cliSource and remove the duplicate readFileSync calls (look for occurrences of readFileSync/path.join in the tests and the test name 'install and wizard accept short -k key flag' to locate them).tests/cli/validate-publish.test.js (1)
112-116: ⚡ Quick winRefactor to avoid shell parsing, but handle stderr capture properly (Line 112).
Using
execSyncwith shell string redirection (2>&1) introduces unnecessary shell parsing. However, the proposed change requires adjustment:execFileSyncby default doesn't capture stderr. Since the script outputs to bothconsole.logandconsole.error, preserve both streams using thestdiooption.Suggested fix:
-const { execSync } = require('child_process'); +const { execFileSync } = require('child_process'); @@ - const result = execSync(`node "${SCRIPT_PATH}" 2>&1`, { + const result = execFileSync(process.execPath, [SCRIPT_PATH], { encoding: 'utf8', cwd: path.join(__dirname, '..', '..'), timeout: 330000, + stdio: ['pipe', 'pipe', 'pipe'], });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/cli/validate-publish.test.js` around lines 112 - 116, Replace the shell-invoking execSync call with execFileSync to avoid shell parsing: call execFileSync('node', [SCRIPT_PATH], ...) instead of execSync(`node "${SCRIPT_PATH}" 2>&1`, ...), and ensure you capture both stdout and stderr by setting stdio to pipe (e.g., stdio: ['pipe','pipe','pipe']) and keep encoding:'utf8', cwd and timeout as before so console.log and console.error output are both returned; update the test in tests/cli/validate-publish.test.js to use execFileSync and those options.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/cli/validate-publish.test.js`:
- Around line 112-116: Replace the shell-invoking execSync call with
execFileSync to avoid shell parsing: call execFileSync('node', [SCRIPT_PATH],
...) instead of execSync(`node "${SCRIPT_PATH}" 2>&1`, ...), and ensure you
capture both stdout and stderr by setting stdio to pipe (e.g., stdio:
['pipe','pipe','pipe']) and keep encoding:'utf8', cwd and timeout as before so
console.log and console.error output are both returned; update the test in
tests/cli/validate-publish.test.js to use execFileSync and those options.
In `@tests/pro-recover.test.js`:
- Around line 224-230: The three tests in the "CLI alias reset-password" block
repeat the same fs.readFileSync + path.join call to load the CLI source; extract
that into a shared variable (e.g., let cliSource) and populate it in a beforeAll
hook so each test (including the test 'install and wizard accept short -k key
flag') reuses the loaded string; update references in the tests to use cliSource
and remove the duplicate readFileSync calls (look for occurrences of
readFileSync/path.join in the tests and the test name 'install and wizard accept
short -k key flag' to locate them).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: bbb0dd97-082f-4d3e-b2eb-7d6dff1ed773
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (9)
.aiox-core/install-manifest.yamlbin/utils/validate-publish.jsdocs/guides/workflows/pro-developer-workflow.mddocs/stories/epic-pro-13/STORY-PRO-13.5-PRIVATE-PRO-DISTRIBUTION-HARDENING.mdpackage.jsonpackages/aiox-pro-cli/bin/aiox-pro.jspackages/installer/src/wizard/pro-setup.jstests/cli/validate-publish.test.jstests/pro-recover.test.js
✅ Files skipped from review due to trivial changes (3)
- docs/guides/workflows/pro-developer-workflow.md
- .aiox-core/install-manifest.yaml
- docs/stories/epic-pro-13/STORY-PRO-13.5-PRIVATE-PRO-DISTRIBUTION-HARDENING.md
🚧 Files skipped from review as they are similar to previous changes (4)
- package.json
- packages/aiox-pro-cli/bin/aiox-pro.js
- bin/utils/validate-publish.js
- packages/installer/src/wizard/pro-setup.js
…-pro-distribution # Conflicts: # .aiox-core/install-manifest.yaml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.aiox-core/data/entity-registry.yaml (1)
8858-8869:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRestore
ai-providersandmemory-queryto dependencies array.The
subagent-dispatcher.jsmodule imports bothai-providers(line 18) andmemory-query(line 28) at runtime, but line 8858 declaresdependencies: []. This metadata inconsistency will degrade dependency-aware tooling and impact analysis.Proposed fix
- dependencies: [] + dependencies: + - ai-providers + - memory-query🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.aiox-core/data/entity-registry.yaml around lines 8858 - 8869, Update the YAML entry so the declared runtime dependencies match the imports used by subagent-dispatcher.js: add "ai-providers" and "memory-query" back into the dependencies array (they already appear in plannedDeps) so dependency-aware tooling sees them; reference the existing plannedDeps list and ensure dependencies: includes ai-providers and memory-query and keep plannedDeps unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.aiox-core/data/entity-registry.yaml:
- Around line 8858-8869: Update the YAML entry so the declared runtime
dependencies match the imports used by subagent-dispatcher.js: add
"ai-providers" and "memory-query" back into the dependencies array (they already
appear in plannedDeps) so dependency-aware tooling sees them; reference the
existing plannedDeps list and ensure dependencies: includes ai-providers and
memory-query and keep plannedDeps unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c72da2fe-ad8b-4ef2-b747-1091fa56cc38
📒 Files selected for processing (2)
.aiox-core/data/entity-registry.yaml.aiox-core/install-manifest.yaml
✅ Files skipped from review due to trivial changes (1)
- .aiox-core/install-manifest.yaml
…-pro-distribution # Conflicts: # .aiox-core/data/entity-registry.yaml # .aiox-core/install-manifest.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pro`:
- Line 1: The CI failure is caused by the pro submodule pointer change which
removed/relocated tests so `jest --roots pro/` finds “No tests found”; either
pin the submodule to the commit that contains the expected test layout (restore
the commit SHA that previously contained the test files) or update the
CI/workflow Jest roots to the new layout (adjust the jest roots in the workflow
step that runs `jest --roots pro/` or update pro/package.json/jest.config.js to
include the new test directories), and keep the submodule checkout recursive at
this pinned commit so CI checks out the correct tree.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1837e27b-cb7a-454b-84cb-f7e3440fd144
📒 Files selected for processing (3)
.aiox-core/data/entity-registry.yaml.aiox-core/install-manifest.yamlpro
✅ Files skipped from review due to trivial changes (1)
- .aiox-core/install-manifest.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- .aiox-core/data/entity-registry.yaml
| @@ -1 +1 @@ | |||
| Subproject commit 9197e00ff59d19b1000e21a973f75bd71d2c221e | |||
| Subproject commit 5d125ecf1c2eaaad9d3f0da0c5a178150e467961 | |||
There was a problem hiding this comment.
Submodule bump is breaking Pro integration test discovery in CI
This pointer update is associated with a blocking CI failure (jest --roots pro/ → “No tests found”). Please ensure the pinned commit includes the expected test layout or adjust the workflow/Jest roots to match the new Pro repo structure (and keep submodule checkout recursive at this commit).
🧰 Tools
🪛 GitHub Actions: Pro Integration / 0_Pro Integration Tests.txt
[error] 1-1: jest --roots pro/ --no-coverage --verbose failed: No tests found, exiting with code 1. Use --passWithNoTests to exit with code 0.
🪛 GitHub Actions: Pro Integration / Pro Integration Tests
[error] 1-1: Jest unit test step failed: No tests found. Command: npx jest --roots pro/ --no-coverage --verbose (exiting with code 1; Run with --passWithNoTests to exit with code 0).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pro` at line 1, The CI failure is caused by the pro submodule pointer change
which removed/relocated tests so `jest --roots pro/` finds “No tests found”;
either pin the submodule to the commit that contains the expected test layout
(restore the commit SHA that previously contained the test files) or update the
CI/workflow Jest roots to the new layout (adjust the jest roots in the workflow
step that runs `jest --roots pro/` or update pro/package.json/jest.config.js to
include the new test directories), and keep the submodule checkout recursive at
this pinned commit so CI checks out the correct tree.
Dismissed as stale: current head 0d53fdf has Pro Integration Tests passing, including the submodule checkout/test discovery path. No code change required.
|
Ready for CODEOWNER review. Current head 0d53fdf has all required checks green: Jest Node 18/20/22/24/25, Pro Integration, Pro Machine ID Stability on macOS/Ubuntu/Windows, Install Manifest Validation, Installer Smoke, Brownfield Install, ESLint, TypeScript, Security Audit, CodeRabbit. aiox-pro PR #13 was merged first and the submodule points to merged main commit 5d125ec. Earlier stale CodeRabbit changes-requested reviews were dismissed with evidence after current-head checks passed. |
|
Update: @aiox-squads/pro@0.4.1 is now published on npm as the transitional public release. Verification: npm view reports version/latest 0.4.1; npm access status is still public; temp install smoke passed and loaded license/license-api.js. I am intentionally not switching @aiox-squads/pro to private yet because core 5.1.16 has not been merged/published; making the package private before the new signed-artifact-capable core release could break legacy/current install paths. Final step after core merge + publish + smoke: npm access set status=private @aiox-squads/pro and verify access status. |
1 participant
Summary
Validation
Operational evidence
Dependency
Release order
Summary by CodeRabbit
New Features
Documentation
Refactor
Chores
Tests