Skip to content

[Improve] Harden DCG binary installation - #1060

Open
navedmerchant wants to merge 7 commits into
feat/managed-binary-infrastructurefrom
feat/dcg-binary-service
Open

[Improve] Harden DCG binary installation#1060
navedmerchant wants to merge 7 commits into
feat/managed-binary-infrastructurefrom
feat/dcg-binary-service

Conversation

@navedmerchant

@navedmerchant navedmerchant commented Jul 30, 2026 •
edited by zoomote Bot
Loading

Copy link
Copy Markdown
Contributor

What changed

Completes the DCG binary-service safeguards with macOS temporary-directory support, an explicit skipped ZIP-only test on non-Windows CI, and coverage for trusted cross-host GitHub release redirects.

Why this change was made

DCG must run with the minimum viable environment and install predictably across supported platforms and GitHub's release-asset redirect flow. Closes #1056.

Impact

DCG installation and execution are more reliable across platforms while keeping extension-host secrets out of the child process environment.

Related PRs

@navedmerchant navedmerchant added the enhancement New feature or request label Jul 30, 2026
@navedmerchant navedmerchant added the enhancement New feature or request label Jul 30, 2026
@navedmerchant navedmerchant self-assigned this Jul 30, 2026
@coderabbitai

coderabbitai Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b4749f9-5909-4294-9c8f-15535cfe3ecd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 95.34884% with 4 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/services/destructive-command-guard/runner.ts 92.15% 0 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!

@navedmerchant navedmerchant mentioned this pull request Jul 30, 2026
Closed
9 tasks
@navedmerchant
navedmerchant force-pushed the feat/dcg-binary-service branch from 5c460bd to baade5f Compare July 30, 2026 04:50
@github-actions github-actions Bot added the awaiting-review PR changes are ready and waiting for maintainer re-review label Jul 30, 2026
edelauna
edelauna requested changes Jul 31, 2026
View reviewed changes

@edelauna edelauna left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good - just had 2 comments for increased test coverage.

Comment thread src/services/destructive-command-guard/__tests__/runner.spec.ts
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts Outdated
@github-actions github-actions Bot added awaiting-author PR is waiting for the author to address requested changes and removed awaiting-review PR changes are ready and waiting for maintainer re-review labels Jul 31, 2026
@edelauna edelauna mentioned this pull request Jul 31, 2026
Open
edelauna
edelauna reviewed Jul 31, 2026
View reviewed changes
Comment thread src/services/destructive-command-guard/constants.ts
@navedmerchant
navedmerchant force-pushed the feat/dcg-binary-service branch from baade5f to e1a0c39 Compare August 1, 2026 17:17
@github-actions github-actions Bot added awaiting-author PR is waiting for the author to address requested changes and removed awaiting-author PR is waiting for the author to address requested changes labels Aug 1, 2026
edelauna
edelauna requested changes Aug 2, 2026
View reviewed changes

@edelauna edelauna left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅 have a couple additional comments related to the logic used for the guard.

Comment thread src/services/destructive-command-guard/manager.ts Outdated
Comment thread src/services/destructive-command-guard/manager.ts
Comment thread src/services/destructive-command-guard/manager.ts Outdated
Comment thread src/services/destructive-command-guard/manager.ts
Comment thread src/services/destructive-command-guard/runner.ts Outdated
Comment thread src/services/destructive-command-guard/runner.ts
Comment thread src/services/destructive-command-guard/runner.ts Outdated
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts
@github-actions github-actions Bot added awaiting-author PR is waiting for the author to address requested changes and removed awaiting-author PR is waiting for the author to address requested changes labels Aug 2, 2026
edelauna
edelauna approved these changes Aug 2, 2026
View reviewed changes

@edelauna edelauna left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good - approving with some minor nits, which could also always be addressed later if we want.

Comment thread src/services/destructive-command-guard/runner.ts Outdated
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts Outdated
Comment thread src/services/destructive-command-guard/__tests__/manager.spec.ts
@github-actions github-actions Bot added awaiting-review PR changes are ready and waiting for maintainer re-review and removed awaiting-author PR is waiting for the author to address requested changes labels Aug 2, 2026
@github-actions github-actions Bot removed the awaiting-review PR changes are ready and waiting for maintainer re-review label Aug 2, 2026
@zoomote zoomote Bot changed the title [Feat] Add the Destructive Command Guard binary service [Improve] Harden DCG binary installation Aug 2, 2026
This was referenced Aug 2, 2026
Open
Open
@zoomote

zoomote Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Addressed all current unresolved review feedback in 5f3854a. DCG now preserves TMPDIR, covers trusted release redirects, and reports the ZIP-only scenario as skipped on non-Windows CI.

@zoomote zoomote Bot mentioned this pull request Aug 2, 2026
Draft
@github-actions github-actions Bot added the awaiting-review PR changes are ready and waiting for maintainer re-review label Aug 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@edelauna edelauna edelauna approved these changes
@taltas taltas Awaiting requested review from taltas taltas is a code owner
@JamesRobert20 JamesRobert20 Awaiting requested review from JamesRobert20 JamesRobert20 is a code owner
@hannesrudolph hannesrudolph Awaiting requested review from hannesrudolph hannesrudolph is a code owner

Assignees

@navedmerchant navedmerchant

Labels

awaiting-review PR changes are ready and waiting for maintainer re-review enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@navedmerchant @edelauna