Merge pull request #121 from paritytech/fix/mod-origin-and-repo-probe

fix(mod): silence false origin warning and verify repo before download

Author: UtkarshBhardwaj007

.changeset/fix-mod-origin-and-private-repo-probe.md

@@ -0,0 +1,5 @@
+---
+"playground-cli": patch
+---
+
+`dot mod` no longer prints a misleading `[contracts] No origin configured — using dev fallback (Alice) for query dry-run` warning when the user is signed in via `dot init`. The CDM meta-registry lookup that resolves the live playground registry address now receives the signer's address as `defaultOrigin`. `dot mod` also lazy-probes the picked app's repository between picker dismount and the setup steps, surfacing a clear "private or does not exist" error before any files are written when a publisher has flipped repo visibility after deploying.

CLAUDE.md

@@ -23,7 +23,7 @@ These are things that aren't self-evident from reading the code and have bitten
 - **Throttle TUI info updates** — bulletin-deploy logs per-chunk and builds (vite/next) stream thousands of lines/sec. Calling `setState` on every log event floods React's reconciler with so much backpressure the process can balloon past 20 GB and freeze the OS. `RunningStage` coalesces "latest info" updates to ≤10/sec via a ref + timer and caps line length at 160 chars. Any new hot-path event sink should do the same; don't hook raw per-line streams directly into Ink state.
 - **Process-guard safety net** (`src/utils/process-guard.ts`) — deploy pipelines open several long-lived WebSockets + child processes and any one of them can keep the event loop alive after the TUI visibly finishes, turning `dot` into a zombie that accumulates retry buffers indefinitely (seen climbing past 25 GB). We defend in depth: (1) `installSignalHandlers()` catches SIGINT/TERM/HUP + `unhandledRejection` and forces cleanup + exit within 3 s; (2) `scheduleHardExit()` installs an `unref`'d timer that kills the process if the event loop doesn't drain within a grace period; (3) `startMemoryWatchdog()` aborts if RSS exceeds 4 GB — a generous cap because legit deploys on Bun SEA binaries routinely touch 1–1.5 GB from runtime-metadata decoding + Bun's JSC heap + Ink yoga. Do NOT re-add a per-window growth detector: we tried 300 MB / 3 s and it false-positived on the single-burst metadata-loading spike, aborting deploys that would have succeeded. Set `DOT_MEMORY_TRACE=1` to stream per-sample RSS/heap/external stats — useful when diagnosing a real leak report. **Telemetry bootstrap** (`src/bootstrap.ts`) is the FIRST import in `src/index.ts`. It sets `BULLETIN_DEPLOY_USE_AMBIENT_SENTRY=1` and `BULLETIN_DEPLOY_HOST_APP=playground-cli` before `bulletin-deploy` can evaluate, then maps `DOT_TELEMETRY`/internal-context detection to `BULLETIN_DEPLOY_TELEMETRY`. Do not leave `BULLETIN_DEPLOY_TELEMETRY` unset while setting the host app: `bulletin-deploy@0.7.6` treats `playground-cli` as an internal host, which would enable deploy telemetry for external users. `BULLETIN_DEPLOY_MEM_REPORT` is not forced off by default anymore because upstream guards the Bun-incompatible memory-report path. Any new long-running command should register a cleanup hook via `onProcessShutdown()`.
 - **Parser MUST NOT emit an event per log line.** `DeployLogParser.feed()` is called for every console line bulletin-deploy prints — hundreds per deploy on the happy path, thousands if retries fire. We intentionally emit events ONLY for phase-banner matches and `[N/M]` chunk progress. Everything else returns `null`. Adding a catch-all `info` emit turns the parser into a firehose that allocates ~200 bytes × thousands of lines, and was a measurable contributor to chunk-upload memory pressure.
-- **`dot mod` is GitHub-tarball-only and must stay that way.** `src/utils/mod/source.ts` downloads from `codeload.github.com` (no auth, no `git`/`gh` required for the public-repo case) and extracts via `node:zlib` + the pure-JS `tar` package. Do NOT re-introduce `git clone` or `gh repo fork` paths — both would re-add a hard tooling requirement and the fork path was specifically removed because GitHub caps you to one fork per source-repo per account, which broke "mod the same starter twice." A non-modable app (no `metadata.repository`) returns a hard error from `dot mod`; the interactive picker filters those out so the user never sees an unmoddable option.
+- **`dot mod` is GitHub-tarball-only and must stay that way.** `src/utils/mod/source.ts` downloads from `codeload.github.com` (no auth, no `git`/`gh` required for the public-repo case) and extracts via `node:zlib` + the pure-JS `tar` package. Do NOT re-introduce `git clone` or `gh repo fork` paths — both would re-add a hard tooling requirement and the fork path was specifically removed because GitHub caps you to one fork per source-repo per account, which broke "mod the same starter twice." A non-modable app (no `metadata.repository`) returns a hard error from `dot mod`; the interactive picker filters those out so the user never sees an unmoddable option. The picker does NOT pre-probe each app's repo visibility, because that would burn the 60 req/hr anonymous GitHub API quota on every `dot mod`. Instead, `runModCommand` lazy-probes the picked app once via `assertPublicGitHubRepo()` between picker dismount and `SetupScreen` mount; `dot deploy --modable` already rejects private repos at deploy time, so this fires only when a publisher has flipped visibility post-publish.
 - **`ensureGhAuthed()` does NOT shell out to `gh auth login`.** Even from the interactive deploy, Ink owns stdout + raw-mode stdin and a `stdio: "inherit"` child would race Ink's `useInput` for keystrokes — producing garbled output and dropped key events. Both interactive and non-interactive paths that need GitHub repo creation fail with the same actionable message: run `gh auth login` once outside `dot`, then retry. Existing `origin` URLs do not require `gh` auth. Properly suspending Ink to hand off stdio is possible but requires unmounting + re-rendering with state preservation, and we deemed that complexity not worth it for a one-time-per-machine speedbump. If you ever do implement it, the wiring point is `ModablePreflightStage` in `src/commands/deploy/DeployScreen.tsx`.
 - **`metadata.repository` is set ONLY when `--modable` is opted in.** Older code in `publishToPlayground` would silently probe `git remote get-url origin` and stuff whatever it found into the metadata, which surprised users who didn't realise their fork was being advertised. The new contract: `runDeploy` takes an explicit `repositoryUrl: string | null`, and `publishToPlayground` writes the field iff that param is non-null. The CLI command is responsible for resolving the URL upstream via `src/utils/deploy/modable.ts::resolveRepositoryUrl()`, which uses an existing `origin` URL without pushing, or runs `gh repo create --public --push` to set up a fresh public repo when no origin exists. Re-deploys never delete user repos.
 - **`startMemoryWatchdog()` runs for both `dot deploy` and `dot mod`.** Mod's tarball download is a streaming pipe through `node:zlib` + `tar.extract()`, and a stuck IPFS gateway or a malformed tarball can leak buffers. Same 4 GB cap, same worker-thread sampler. Any new top-level command that does meaningful I/O should also call `startMemoryWatchdog()` and register `stopWatchdog` via `onProcessShutdown()`.

src/commands/mod/index.ts

@@ -10,6 +10,7 @@ import { AppBrowser, type AppEntry } from "./AppBrowser.js";
 import { SetupScreen } from "./SetupScreen.js";
 import { defaultRepoName } from "../../utils/git/repoName.js";
 import { runCliCommand } from "../../cli-runtime.js";
+import { assertPublicGitHubRepo, ModablePreflightError } from "../../utils/deploy/modable.js";
 
 export const modCommand = new Command("mod")
     .description("Mod a playground app — clone the source as a fresh project to customise")
@@ -56,6 +57,41 @@ async function runModCommand(
             metadata = picked;
         }
 
+        // Lazy verify that the picked app's source repository is publicly
+        // reachable. The picker filters apps that have NO repository URL, but
+        // a publisher can flip a repo to private after deploying, which would
+        // break the anonymous codeload download a few steps down. Bail here
+        // with a clean message so the user can pick a different app before we
+        // mount SetupScreen and start writing files.
+        //
+        // The direct-domain path (`dot mod some-domain.dot`) has no metadata
+        // at this point and falls through to SetupScreen, where the same
+        // 404/401 surfaces from `resolveDefaultBranch` as a step failure.
+        // Slightly less polished UX, but lifting the metadata fetch up here
+        // just for symmetry would be a larger refactor.
+        if (metadata?.repository) {
+            const repoUrl = metadata.repository;
+            try {
+                await withSpan(
+                    "cli.mod.repo-check",
+                    "verify repository is public",
+                    { "cli.mod.repo": repoUrl },
+                    () => assertPublicGitHubRepo(repoUrl),
+                );
+            } catch (err) {
+                if (err instanceof ModablePreflightError) {
+                    console.error();
+                    console.error(`  ${err.message}.`);
+                    console.error(
+                        `  Pick a different app or ask the publisher to make the repo public.`,
+                    );
+                    process.exitCode = 1;
+                    return;
+                }
+                throw err;
+            }
+        }
+
         const targetDir = await withSpan("cli.mod.resolve-target", "resolve target directory", () =>
             resolveTargetDir({ domain }),
         );

src/utils/contractManifest.test.ts

@@ -80,10 +80,31 @@ describe("resolveLiveContractAddresses", () => {
             expect.arrayContaining([
                 expect.objectContaining({ name: "getAddress", type: "function" }),
             ]),
+            expect.any(Object),
         );
         expect(getAddressQueryMock).toHaveBeenCalledWith(PLAYGROUND_REGISTRY_CONTRACT);
     });
 
+    it("forwards defaultOrigin to createContractFromClient when provided", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await resolveLiveContractAddresses(assetHub, [PLAYGROUND_REGISTRY_CONTRACT], {
+            defaultOrigin: origin,
+        });
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
+
     it("omits libraries when the live registry has no address", async () => {
         getAddressQueryMock.mockResolvedValue({
             success: true,
@@ -136,4 +157,47 @@ describe("withLiveContractAddresses", () => {
             ]),
         ).rejects.toThrow(/CDM meta-registry did not return live address/);
     });
+
+    it("forwards defaultOrigin through withLiveContractAddresses", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await withLiveContractAddresses(manifest(), assetHub, [PLAYGROUND_REGISTRY_CONTRACT], {
+            defaultOrigin: origin,
+        });
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
+
+    it("forwards defaultOrigin through withRequiredLiveContractAddresses", async () => {
+        getAddressQueryMock.mockResolvedValue({
+            success: true,
+            value: { isSome: true, value: liveAddress },
+        });
+
+        const assetHub = {} as any;
+        const origin = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+        await withRequiredLiveContractAddresses(
+            manifest(),
+            assetHub,
+            [PLAYGROUND_REGISTRY_CONTRACT],
+            { defaultOrigin: origin },
+        );
+
+        expect(createContractFromClientMock).toHaveBeenCalledWith(
+            assetHub,
+            CDM_REGISTRY_ADDRESS,
+            expect.any(Array),
+            expect.objectContaining({ defaultOrigin: origin }),
+        );
+    });
 });

src/utils/contractManifest.ts

@@ -102,14 +102,27 @@ function patchContractAddresses(
     return patched;
 }
 
+/**
+ * Options for the meta-registry lookup. `defaultOrigin` is forwarded to the
+ * underlying contract handle so the read-only `getAddress` dry-run uses the
+ * caller's logged-in account instead of the dev fallback (Alice). Without it,
+ * `@polkadot-apps/contracts` emits a misleading `[contracts] No origin
+ * configured` warning even when the user has signed in via `dot init`.
+ */
+export interface LiveContractLookupOptions {
+    defaultOrigin?: string;
+}
+
 export async function resolveLiveContractAddresses(
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<Record<string, HexString>> {
     const registry = await createContractFromClient(
         assetHub,
         CDM_REGISTRY_ADDRESS,
         CDM_REGISTRY_ABI,
+        { defaultOrigin: options.defaultOrigin },
     );
     const entries = await withoutReviveTraceNoise(() =>
         Promise.all(
@@ -133,17 +146,19 @@ export async function withLiveContractAddresses(
     manifest: CdmJson,
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<CdmJson> {
-    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries);
+    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries, options);
     return patchContractAddresses(manifest, liveAddresses);
 }
 
 export async function withRequiredLiveContractAddresses(
     manifest: CdmJson,
     assetHub: PolkadotClient,
     libraries: readonly string[] = LIVE_CONTRACTS,
+    options: LiveContractLookupOptions = {},
 ): Promise<CdmJson> {
-    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries);
+    const liveAddresses = await resolveLiveContractAddresses(assetHub, libraries, options);
     const missing = libraries.filter((library) => !liveAddresses[library]);
     if (missing.length > 0) {
         throw new Error(`CDM meta-registry did not return live address for ${missing.join(", ")}`);

src/utils/registry.test.ts

@@ -48,9 +48,12 @@ describe("getRegistryContract", () => {
 
         await getRegistryContract(rawClient, fakeSigner);
 
-        expect(withRequiredLiveContractAddressesMock).toHaveBeenCalledWith(cdmJson, rawClient, [
-            "@w3s/playground-registry",
-        ]);
+        expect(withRequiredLiveContractAddressesMock).toHaveBeenCalledWith(
+            cdmJson,
+            rawClient,
+            ["@w3s/playground-registry"],
+            { defaultOrigin: fakeSigner.address },
+        );
         expect(fromClientMock).toHaveBeenCalledWith(patchedManifest, rawClient, {
             defaultSigner: fakeSigner.signer,
             defaultOrigin: fakeSigner.address,

src/utils/registry.ts

@@ -21,9 +21,12 @@ export async function getRegistryContract(
 ) {
     let manifest: CdmJson;
     try {
-        manifest = await withRequiredLiveContractAddresses(cdmJson, rawClient, [
-            PLAYGROUND_REGISTRY_CONTRACT,
-        ]);
+        manifest = await withRequiredLiveContractAddresses(
+            cdmJson,
+            rawClient,
+            [PLAYGROUND_REGISTRY_CONTRACT],
+            { defaultOrigin: signer.address },
+        );
     } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(