fix(openscience): harden atlasFetch signal, version coercion, atomic temp, env prefixes#123
Merged
Conversation
…omic temp, env prefixes Four defensive fixes in the managed-account module: - atlasFetch now COMBINES a caller-supplied signal with the timeout via AbortSignal.any instead of replacing it, so passing a signal never drops the 60s hang guard. (#46) - refreshIfStale coerces a numeric-string sync version ({"v":"5"}) instead of collapsing it to null — otherwise cached_v never updates and the CLI keeps deferring the background sync forever. (#47) - atomicWrite's temp path is unique per call (pid + uuid), so two concurrent syncs in the same process can't write the same temp file, interleave, and publish a torn synced-env.json. (#13) - filterEnvForSubprocess matches SAFE_ENV_PREFIXES exactly for plain names and only prefixes entries ending in '_' (LC_, XDG_), so HOME no longer matches HOMEBREW_GITHUB_API_TOKEN etc. (#49)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four defensive fixes in
openscience/index.ts(from the audit):atlasFetchcombines a caller-supplied signal with the timeout (AbortSignal.any) instead of replacing it, so passing a signal never silently drops the 60s hang guard.refreshIfStalecoerces a numeric-string sync version ({"v":"5"}) instead of collapsing it tonull; otherwisecached_vnever updates and the CLI defers the background sync for the whole TTL, so dashboard changes never land.atomicWrite's temp path is unique per call (pid.uuid), so two concurrent syncs in the same process (a per-request/sync+ the processor's background sync) can't write the same temp path, interleave, and publish a tornsynced-env.json.filterEnvForSubprocessmatchesSAFE_ENV_PREFIXESexactly for plain names and only prefix-matches entries ending in_(LC_,XDG_), soHOMEno longer matchesHOMEBREW_GITHUB_API_TOKEN,USERno longer matchesUSERPROFILE, etc.Typecheck + full backend suite (936 tests) green.