fix(update): gate the npm cache before shutdown and stop persisting vendor output (replaces #557) - #1207

Merged

lidge-jun merged 17 commits into

devfrom

codex/260807-npm-cache-preflight

Aug 7, 2026

Commits on Aug 7, 2026

fix(update): preflight npm cache before shutdown
lidge-jun
committed
524b481
fix(update): stop the preflight from blocking legitimate updates (#557 replacement, round 2)
lidge-jun
committed
6678cfa
fix(update): make the budget fix actually reach the caller, and redact wrapped paths (round 3)
lidge-jun
committed
624f4a6
fix(update): drop wrap indentation before redacting, and accept a symlinked cache root (round 4)
lidge-jun
committed
327e3ee
fix(update): stop a redacted path from swallowing the log lines after it (round 5)
lidge-jun
committed
47e7cb7
fix(update): redact wrapped profile paths line-aware, not by guessing continuations (round 6)
lidge-jun
committed
4c70fc1
fix(update): stop persisting free-form vendor output (round 7)
lidge-jun
committed
0058231
fix(update): make the code allowlist an actual allowlist, and close single-line path leaks (round 8)
lidge-jun
committed
313dac3
fix(update): allow-list what gets persisted instead of redacting what does not (round 9)
lidge-jun
committed
6e41fed
fix(update): field-scoped persistence with rendered commands and withheld error text (round 10)
lidge-jun
committed
2429dc5
fix(update): never persist error message text, and delete the unwired provenance code (round 11)
lidge-jun
committed
bfcc66c
fix(update): stop copying Error.name, and validate the /healthz version at entry (round 12)
lidge-jun
committed
b0e2a41
fix(update): never echo a reported health version, matching or not (round 13)
lidge-jun
committed
5c24ff7
fix(update): restore diagnostics by reading npm's named fields (round 14)
lidge-jun
committed
6cced96
fix(update): validate field VALUES, not just field names (round 15)
lidge-jun
committed
c1d63e1
fix(update): echo only our own package spec and known registry hosts (round 16)
lidge-jun
committed
e3dae0e
fix(update): drop the package spec entirely from notarget (round 17)
lidge-jun
committed
821a845

Navigation Menu

fix(update): gate the npm cache before shutdown and stop persisting vendor output (replaces #557) - #1207

fix(update): gate the npm cache before shutdown and stop persisting vendor output (replaces #557)#1207
lidge-jun merged 17 commits into
devfrom
codex/260807-npm-cache-preflight

Commits on Aug 7, 2026

fix(update): preflight npm cache before shutdown

fix(update): stop the preflight from blocking legitimate updates (#557 replacement, round 2)

fix(update): make the budget fix actually reach the caller, and redact wrapped paths (round 3)

fix(update): drop wrap indentation before redacting, and accept a symlinked cache root (round 4)

fix(update): stop a redacted path from swallowing the log lines after it (round 5)

fix(update): redact wrapped profile paths line-aware, not by guessing continuations (round 6)

fix(update): stop persisting free-form vendor output (round 7)

fix(update): make the code allowlist an actual allowlist, and close single-line path leaks (round 8)

fix(update): allow-list what gets persisted instead of redacting what does not (round 9)

fix(update): field-scoped persistence with rendered commands and withheld error text (round 10)

fix(update): never persist error message text, and delete the unwired provenance code (round 11)

fix(update): stop copying Error.name, and validate the /healthz version at entry (round 12)

fix(update): never echo a reported health version, matching or not (round 13)

fix(update): restore diagnostics by reading npm's named fields (round 14)

fix(update): validate field VALUES, not just field names (round 15)

fix(update): echo only our own package spec and known registry hosts (round 16)

fix(update): drop the package spec entirely from notarget (round 17)