morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #6316] [MERGED] fix(runtime): align remaining Node security pins and setup guidance #7277

New issue

Closed

opened 2026-11-01 21:46:41 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:46:41 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6316
Author: @GamerDubz
Created: 10/22/2026
Status: ✅ Merged
Merged: 10/23/2026
Merged by: @gensokyo-dev

Base: main ← Head: fix/node-security-follow-through

📝 Commits (4)

25f46ca fix(runtime): align remaining Node security pins and setup guidance
da9a927 fix(runtime): synchronize environment security pins with main
f64cb0e fix(runtime): cover newly added setup language on current main
ba3f91f fix(runtime): refresh Node security guidance on repaired main

📊 Changes

51 files changed (+334 additions, -309 deletions)

View changed files

📝 docs/agent-environments.md (+1 -1)
📝 docs/readme/README_ar.md (+1 -1)
📝 docs/readme/README_de.md (+1 -1)
📝 docs/readme/README_el.md (+1 -1)
📝 docs/readme/README_es.md (+1 -1)
📝 docs/readme/README_fa.md (+1 -1)
📝 docs/readme/README_fr.md (+1 -1)
📝 docs/readme/README_id.md (+1 -1)
📝 docs/readme/README_it.md (+1 -1)
📝 docs/readme/README_ja.md (+1 -1)
📝 docs/readme/README_ko.md (+1 -1)
📝 docs/readme/README_ml.md (+1 -1)
📝 docs/readme/README_pl.md (+1 -1)
📝 docs/readme/README_pt-BR.md (+1 -1)
📝 docs/readme/README_ru.md (+1 -1)
📝 docs/readme/README_th.md (+1 -1)
📝 docs/readme/README_tr.md (+1 -1)
📝 docs/readme/README_uk.md (+1 -1)
📝 docs/readme/README_ur-Latn.md (+1 -1)
📝 docs/readme/README_vi.md (+1 -1)

...and 31 more files

📄 Description

The Node security floor in #6315 is now merged, but exported Dockerfiles, translated setup instructions and the getting-started website still select or advertise older releases. This completes that follow-through for #6283 and #6480.

Generate the exported Docker base-image version from .nvmrc through the existing package-metadata owner. The current image is node:24.22.1-bookworm-slim; future pin changes no longer require a separate source constant.
Test both the generated Dockerfile and real CLI export against the supported pinned runtime. Keep byte preservation, identity, permission, cleanup and capacity coverage.
Cover the newly added Roman Urdu README/catalog and align active setup translations with 22.23.4 / 24.22.1 / 26.12.1; retain translation history. SQLite CI was already updated by #6315.

Validation after integrating main cc8835c7a, on Linux x64, Node 24.22.1 / npm 11.16.0, one test worker:

npm run test:focused -- src/application/environment/environmentBundle.test.ts src/application/environment/environmentBundleWrite.test.ts tests/conformance/package/environmentBundlePackagePin.test.ts tests/conformance/readmeConsistency.test.ts tests/boundary/cli/environmentExportCli.test.ts tests/boundary/cli/environmentExportInputsCli.test.ts: 46 passed, including real compiled CLI exports.
Earlier controlled mutations on the byte-identical pin owner: the old image fails the new oracle; a stale generated pin and non-exact .nvmrc are rejected; regenerating a changed pin propagates to the Dockerfile. All mutations restored.
npm run check passed (6 tasks plus architecture guards; 0 lint errors).
python scripts/website.py check passed with isolated Python 3.12: 420 HTML pages, 29,531 local references, and the complete website regression suite.
npm run docs:check passed; discovery found all 2,124 test files exactly once.

Focused preparation + tests: 74.000 s elapsed, 65.996 s CPU, peak sampled descendant RSS 1,139.4 MiB. RSS sampling can double-count shared pages and miss short-lived children. Fresh processes with warm installed dependencies/filesystem and partly cached preparation; no cold-cache, before/after speedup or token-count claim. Website check: 199.971 s elapsed, 185.670 CPU s, 87.5 MiB sampled family RSS. The existing .nvmrc global Turbo input covers pin-driven cache invalidation.

Current-head CI passed all eight built-test shards, five real Linux/Docker agentenv cases, Linux package baseline and website checks. The source lane fails three unrelated managed CIL/signature cases identically on clean main (107/110 passed in a separate clean worktree); see #6650. Portable/CI-required aggregates remain red because they include that source lane. These failures are retained and are not reported as green; this PR contains no managed changes. Real-provider behavior beyond the stated Docker/CLI scope is unverified. The existing Malayalam and newly added Roman Urdu website catalogs use English fallback; this change does not claim its translation is complete.

Author readiness

Human owner: @GamerDubz

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6316 **Author:** [@GamerDubz](https://github.com/GamerDubz) **Created:** 10/22/2026 **Status:** ✅ Merged **Merged:** 10/23/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `fix/node-security-follow-through` --- ### 📝 Commits (4) - [`25f46ca`](https://github.com/morluto/rea/commit/25f46ca9f923aff94f7b1f58e748b87ba5b135e1) fix(runtime): align remaining Node security pins and setup guidance - [`da9a927`](https://github.com/morluto/rea/commit/da9a927b7f34654d64ff508ef79e562204c38b88) fix(runtime): synchronize environment security pins with main - [`f64cb0e`](https://github.com/morluto/rea/commit/f64cb0ec1e11c6405a7a1b8fdd93c54e73d6c0c6) fix(runtime): cover newly added setup language on current main - [`ba3f91f`](https://github.com/morluto/rea/commit/ba3f91fbee4a6748f8a72dcbb80b4147be0e4574) fix(runtime): refresh Node security guidance on repaired main ### 📊 Changes **51 files changed** (+334 additions, -309 deletions) <details> <summary>View changed files</summary> 📝 `docs/agent-environments.md` (+1 -1) 📝 `docs/readme/README_ar.md` (+1 -1) 📝 `docs/readme/README_de.md` (+1 -1) 📝 `docs/readme/README_el.md` (+1 -1) 📝 `docs/readme/README_es.md` (+1 -1) 📝 `docs/readme/README_fa.md` (+1 -1) 📝 `docs/readme/README_fr.md` (+1 -1) 📝 `docs/readme/README_id.md` (+1 -1) 📝 `docs/readme/README_it.md` (+1 -1) 📝 `docs/readme/README_ja.md` (+1 -1) 📝 `docs/readme/README_ko.md` (+1 -1) 📝 `docs/readme/README_ml.md` (+1 -1) 📝 `docs/readme/README_pl.md` (+1 -1) 📝 `docs/readme/README_pt-BR.md` (+1 -1) 📝 `docs/readme/README_ru.md` (+1 -1) 📝 `docs/readme/README_th.md` (+1 -1) 📝 `docs/readme/README_tr.md` (+1 -1) 📝 `docs/readme/README_uk.md` (+1 -1) 📝 `docs/readme/README_ur-Latn.md` (+1 -1) 📝 `docs/readme/README_vi.md` (+1 -1) _...and 31 more files_ </details> ### 📄 Description The Node security floor in #6315 is now merged, but exported Dockerfiles, translated setup instructions and the getting-started website still select or advertise older releases. This completes that follow-through for #6283 and #6480. - Generate the exported Docker base-image version from `.nvmrc` through the existing package-metadata owner. The current image is `node:24.22.1-bookworm-slim`; future pin changes no longer require a separate source constant. - Test both the generated Dockerfile and real CLI export against the supported pinned runtime. Keep byte preservation, identity, permission, cleanup and capacity coverage. - Cover the newly added Roman Urdu README/catalog and align active setup translations with 22.23.4 / 24.22.1 / 26.12.1; retain translation history. SQLite CI was already updated by #6315. Validation after integrating main `cc8835c7a`, on Linux x64, Node 24.22.1 / npm 11.16.0, one test worker: - `npm run test:focused -- src/application/environment/environmentBundle.test.ts src/application/environment/environmentBundleWrite.test.ts tests/conformance/package/environmentBundlePackagePin.test.ts tests/conformance/readmeConsistency.test.ts tests/boundary/cli/environmentExportCli.test.ts tests/boundary/cli/environmentExportInputsCli.test.ts`: **46 passed**, including real compiled CLI exports. - Earlier controlled mutations on the byte-identical pin owner: the old image fails the new oracle; a stale generated pin and non-exact `.nvmrc` are rejected; regenerating a changed pin propagates to the Dockerfile. All mutations restored. - `npm run check` passed (6 tasks plus architecture guards; 0 lint errors). - `python scripts/website.py check` passed with isolated Python 3.12: 420 HTML pages, 29,531 local references, and the complete website regression suite. - `npm run docs:check` passed; discovery found all **2,124 test files** exactly once. Focused preparation + tests: 74.000 s elapsed, 65.996 s CPU, peak sampled descendant RSS 1,139.4 MiB. RSS sampling can double-count shared pages and miss short-lived children. Fresh processes with warm installed dependencies/filesystem and partly cached preparation; no cold-cache, before/after speedup or token-count claim. Website check: 199.971 s elapsed, 185.670 CPU s, 87.5 MiB sampled family RSS. The existing `.nvmrc` global Turbo input covers pin-driven cache invalidation. [Current-head CI](https://github.com/morluto/rea/actions/runs/39941322974) passed all eight built-test shards, five real Linux/Docker agentenv cases, Linux package baseline and website checks. The source lane fails three unrelated managed CIL/signature cases identically on clean main (107/110 passed in a separate clean worktree); see #6650. Portable/CI-required aggregates remain red because they include that source lane. These failures are retained and are not reported as green; this PR contains no managed changes. Real-provider behavior beyond the stated Docker/CLI scope is unverified. The existing Malayalam and newly added Roman Urdu website catalogs use English fallback; this change does not claim its translation is complete. ## Author readiness Human owner: @GamerDubz - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:46:41 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-05 01:47:47 +00:00

[PR #7277] fix(cli): preserve provider acronym spellings #7804

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7277

No description provided.

Rows
Columns