Repository navigation
docs: new installs default to verified releases with pharn-cli 0.15.0 (7.1.4) - #404
Merged
Merged
Conversation
… (7.1.4) @pharn-dev/pharn 0.15.0 (pharn-dev/pharn-cli#326) installs the newest v<SKILLS_VERSION> release when init gets no --ref, records "ref": "latest", and exits 1 naming --ref main when none resolves. main stays what the main channel receives: an install recording no ref, --ref main, and an older CLI's default. README, CONTRIBUTING, CLAUDE.md and docs/limitations.md no longer call main the default; pharn-dev-ship Step 2c and a check-changelog-entry comment get the same fix. pharn/LIMITS.md section 11 is human-only and is applied in a separate commit by a maintainer; SKILLS_VERSION 7.1.4 is the patch bump it needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t cause (review) Address review: the CHANGELOG 7.1.4 entry states the main channel as one group (no recorded ref) and says update prints its notice on each run; README, docs/limitations.md and the CHANGELOG name api.github.com's unauthenticated limit as a cause of the exit 1; CLAUDE.md and CONTRIBUTING cite pharn/LIMITS.md section 11 instead of restating who is on main; a checker comment is rewrapped to the print width. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ails; older CLIs take main by default Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
…pharn-cli 0.15.0 (7.1.4) Applied by the maintainer from the agent-drafted patch script (exact-string replacement; LIMITS.md is human-only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🛡️ pharn-ci · ✅ PassTip Pass · Diff coverage of this change is 100% against a threshold of 100%; 38 agent setup files found.
🧪 Diff coverage100% of changed lines covered (3/3, threshold 100%) Changed files (1)
🔍 Test integrityNo test-integrity findings (mode: block). 💬 Messages (1)
🤖 Agent setup (38 files)Agent setup: 38 files · claude-code Agent setup files (38)
pharn-ci 0.2.0 · report schema v2 · coverage format lcov |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The docs now match
@pharn-dev/pharn0.15.0 (pharn-dev/pharn-cli#326): a new install takes the newest verified release by default.mainis still what installs on themainchannel receive, but it is no longer the default.Checked against the published CLI and pharn-cli's source (v0.15.0 tag)
npm view @pharn-dev/pharn version→0.15.0.init --help:--refis"latest"(the default) or"main"(for contributors).update --help: without--ref, update follows the recorded channel (mainwhen none is recorded).src/lib/pharn-config.ts: only the literal"ref": "latest"survives a load; any other value,"main"included, is dropped, so the install followsmain. 0.14.1 only ever wroteref: 'latest'. So "themainchannel is any install with no recordedref" holds for old installs too.src/lib/release.ts: two unauthenticated GETs to api.github.com; any failure refuses (exit 1). The CLI reads no GitHub token variable (pharn --help).src/lib/repo.ts: onmain, a failed lookup still installs and recordscommit: null; a release always records its tag's commit.docs/limitations.mdnow says so (its old "records the exact installed commit" didn't cover that).MIN_CLI0.14.0 refuses every CLI older than 0.14.0, and 0.14.x already accepts--ref latest. So "an older installer takesmainunless given--ref latest" covers every CLI that can still install.release.ymlruns on push tomainand waits forfloor,check,Analyze (javascript-typescript)andSocket Security: Project Report. Tagsv7.1.2andv7.1.3exist, so the old "no GitHub releases or git tags yet" bullet was already false.What changed
--ref latest. The channel paragraph says the default is the newest release (recorded as"ref": "latest"), lists when no release resolves (none published, api.github.com unreachable, or its 60-requests-an-hour unauthenticated limit used up, whichstatus --stricton shared CI can hit), and says--ref mainis the contributor channel. "Already installed?" addsnpx @pharn-dev/pharn@latest update --ref latest. Badge → 7.1.4.mainis the default. They citepharn/LIMITS.md §11for who is on themainchannel instead of restating it.pharn-dev-ship.mdStep 2c and a comment in.dev/floor/check-changelog-entry.mjs.SKILLS_VERSION7.1.3 → 7.1.4 (patch), with a## [7.1.4]CHANGELOG section, becausepharn/LIMITS.mdships. This merge becomes release v7.1.4.pharn/LIMITS.md §11is applied by a human and is not in this PR yetLIMITS.md is a trusted doc, so the agent did not edit it. A maintainer applies the §11 edit with the patch script from the session (exact-string replacement, tested on copies) and commits it to this branch. Do not merge before that commit is here. Without it, the 7.1.4 CHANGELOG entry and the §11 citations in CLAUDE.md and CONTRIBUTING describe text the release doesn't contain.
Left unchanged
pharn/THREAT-MODEL.md§3 item 2 ("pharn-cli's--ref latestchannel does not receive it"): still true..github/workflows/release.ymlheader comment: out of scope, and still true..dev/floor/check-skills-version-recorded.mjs:68: a historical "why it grew" note about the old trigger.docs/capabilities/*.md(generated): "installs withnpx @pharn-dev/pharn@latest init" is still true.MIN_CLIstays 0.14.0: an older CLI still installs a working tree.Gates
check:changelog-entryGREEN,check:surface-bumpGREEN, prettier/markdownlint/eslint clean on the touched files.check:reconcilein the working checkout is RED for a reason outside this PR: a leftover epoch from the mergedrelease-workflowbuild (ci(release): publish a verified release once a SKILLS_VERSION bump's required checks pass on main #402) judges these files against that build's scope. The baseline was left alone.npm run checkwas run in a clean copy (no.githistory, nopharn/.run) with the LIMITS script applied; the result is posted in a comment below.🤖 Generated with Claude Code