mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
ee97c443b7
## Why The tools-server shows an update reminder (a `note` appended to every tool response) once a newer `@swmansion/argent` lands on npm. Two pain points: 1. **No way to turn it off.** Suppression is in-memory only (`dismiss-update`, 30-min auto), so it comes back on every server restart. 2. **It nags about versions you can't install yet.** Registries with a **minimum-release-age** (package-cooldown) security policy refuse to install a version until it has been public for N days. Until then the reminder repeats every day for the whole cooldown window with nothing the user can do about it — exactly the "reminded for 5+ days" situation. ## What's in this PR **1. A config option to disable the reminder** - New env var **`ARGENT_DISABLE_UPDATE_NOTIFICATIONS=1`** (`"1"` or `"true"`). - When set, `startUpdateChecker()` is a no-op: **no registry request** is made and **no note** is ever attached. - The opt-out is also surfaced inside the reminder text itself, so the agent can tell the user how to silence it permanently. **2. Minimum-release-age awareness** (answers "detect the policy and check the update is actually installable first") - The checker now fetches the **npm packument** (`registry.npmjs.org/@swmansion/argent`) instead of `/latest`, because only the packument carries the `time` map of version → publish timestamp. - It detects the machine's policy and only reminds once the latest version has **aged past** it. Notification is gated on a new **`updateInstallable`** flag (newer **and** old enough) rather than `updateAvailable`. - `updateAvailable` keeps its pure version-comparison meaning; with no policy, `updateInstallable === updateAvailable` (no behavior change for users without a policy). ### Is detecting the user's min-age policy possible? Yes — partially. Each package manager stores it differently, and the tools-server has no reliable signal for *which* PM installed argent, so we probe every PM present and take the **most restrictive** (largest) value. Erring toward over-waiting is intentional: a slightly late reminder beats nagging about a forbidden version. | PM | Config key | Unit | Detect via | Min PM version | |----|-----------|------|-----------|----------------| | npm | `min-release-age` | days | `npm config get min-release-age` | 11.10.0 | | pnpm | `minimumReleaseAge` | minutes | `pnpm config get minimumReleaseAge` | 10.16 | | yarn (berry) | `npmMinimalAgeGate` | minutes | `yarn config get npmMinimalAgeGate` | 4.10 | | bun | `minimumReleaseAge` (bunfig.toml `[install]`) | seconds | no `config get` — not auto-probed | 1.3 | | yarn classic | — (unsupported) | — | — | — | Because bun has no `config get` for this and auto-detection is best-effort, there's also an explicit override: - **`ARGENT_MIN_RELEASE_AGE_DAYS`** — positive number of days; wins outright and skips probing (useful for bun users, locked-down CI, or pinning the value). When a policy holds an update back, a single stderr line explains the silence; no reminder reaches the agent. ## Conservative edge handling - Network/registry failure → state unchanged (never crashes the server). - Policy in effect but publish time missing/unparseable → treated as **not** installable (stay silent rather than nag). - PM probe errors / PM absent → treated as no policy (0). - Probes shell out via PATH (`exec`, 3s timeout, constant commands only — no caller input) so Windows `.cmd`/`.ps1` shims resolve. ## Tests - `test/min-release-age.test.ts` (new): unit-level parsing, override precedence, unit normalization, most-restrictive-wins, PM-absent. - `test/update-checker.test.ts`: rewritten for the packument shape; new cases for held-by-policy, aged-past-policy, unknown publish time, and the disable flag (probe mocked so tests never spawn a real PM). - `test/http-update-note.test.ts`: gate now keys off `updateInstallable`; added a "available but held by policy → no note" case. - Full tool-server suite green (**732 tests**), `tsc --noEmit` and `typecheck:tests` clean. ## Follow-up (not in this PR) The env-var reference lives in the `argent-private` submodule (`docs/environment-variables.md`), which is a separate repo — needs a companion PR. Suggested rows for the tools-server table: ``` | `ARGENT_DISABLE_UPDATE_NOTIFICATIONS` | `"1"`/`"true"` or unset | disabled | When truthy, disables the update reminder entirely (no registry check, no note). | | `ARGENT_MIN_RELEASE_AGE_DAYS` | number | _(auto-detect)_ | Minimum age (days) a newer version must reach before it is advertised. Overrides auto-detection of the npm/pnpm/yarn minimum-release-age policy. | ``` ## Open questions for review - **Most-restrictive-across-PMs** vs. detecting a single PM — is "max wins" the behavior we want, or should it follow `npm_config_user_agent`? - Should an update held by policy stay fully silent (current), or emit a softened "available, installable in ~N days" note? --------- Co-authored-by: Cursor <cursoragent@cursor.com>
123 lines
4.3 KiB
TypeScript
123 lines
4.3 KiB
TypeScript
import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
|
|
|
|
// Stable mock for child_process.exec so detection never spawns a real PM.
|
|
const { mockExec } = vi.hoisted(() => ({ mockExec: vi.fn() }));
|
|
vi.mock("node:child_process", () => ({ exec: mockExec }));
|
|
|
|
import { detectMinReleaseAgeMs, detectMinReleaseAgeMsForPm } from "../src/min-release-age";
|
|
|
|
const NOW = new Date("2026-06-01T00:00:00Z");
|
|
const DAY_MS = 24 * 60 * 60 * 1000;
|
|
const MINUTE_MS = 60 * 1000;
|
|
const ENV = "ARGENT_MIN_RELEASE_AGE_DAYS";
|
|
|
|
/**
|
|
* Drive the mocked exec: `byCommand` maps a full `<pm> config get <key>`
|
|
* command to the stdout it should print. Unlisted commands error (PM absent).
|
|
*/
|
|
function stubPmConfig(byCommand: Record<string, string>) {
|
|
mockExec.mockImplementation((cmd: string, _opts: unknown, cb: unknown) => {
|
|
const callback = cb as (err: Error | null, stdout: string, stderr: string) => void;
|
|
if (cmd in byCommand) {
|
|
callback(null, byCommand[cmd]!, "");
|
|
} else {
|
|
callback(new Error("command not found"), "", "");
|
|
}
|
|
});
|
|
}
|
|
|
|
beforeEach(() => {
|
|
vi.useFakeTimers();
|
|
vi.setSystemTime(NOW);
|
|
mockExec.mockReset();
|
|
delete process.env[ENV];
|
|
});
|
|
|
|
afterEach(() => {
|
|
vi.useRealTimers();
|
|
delete process.env[ENV];
|
|
});
|
|
|
|
describe("detectMinReleaseAgeMs (probe every PM)", () => {
|
|
it("returns 0 when no package manager reports a policy", async () => {
|
|
stubPmConfig({
|
|
"npm config get before": "null",
|
|
"pnpm config get minimumReleaseAge": "null",
|
|
"yarn config get npmMinimalAgeGate": "",
|
|
});
|
|
expect(await detectMinReleaseAgeMs()).toBe(0);
|
|
});
|
|
|
|
it("returns 0 when no package manager is installed", async () => {
|
|
stubPmConfig({}); // every probe errors
|
|
expect(await detectMinReleaseAgeMs()).toBe(0);
|
|
});
|
|
|
|
it("normalizes units and takes the most restrictive policy across PMs", async () => {
|
|
// npm: effective `before` 2 days ago; pnpm: 1440 min = 1 day; yarn: 60 min.
|
|
const twoDaysAgo = new Date(NOW.getTime() - 2 * DAY_MS).toISOString();
|
|
stubPmConfig({
|
|
"npm config get before": twoDaysAgo,
|
|
"pnpm config get minimumReleaseAge": "1440",
|
|
"yarn config get npmMinimalAgeGate": "60",
|
|
});
|
|
expect(await detectMinReleaseAgeMs()).toBe(2 * DAY_MS);
|
|
});
|
|
|
|
it("reads npm's effective `before` cutoff when min-release-age is flattened away", async () => {
|
|
const sevenDaysAgo = new Date(NOW.getTime() - 7 * DAY_MS).toISOString();
|
|
stubPmConfig({
|
|
"npm config get before": sevenDaysAgo,
|
|
"pnpm config get minimumReleaseAge": "undefined",
|
|
"yarn config get npmMinimalAgeGate": "undefined",
|
|
});
|
|
expect(await detectMinReleaseAgeMs()).toBe(7 * DAY_MS);
|
|
});
|
|
|
|
it("reads pnpm minutes when npm has no policy", async () => {
|
|
stubPmConfig({
|
|
"npm config get before": "null",
|
|
"pnpm config get minimumReleaseAge": "30",
|
|
"yarn config get npmMinimalAgeGate": "undefined",
|
|
});
|
|
expect(await detectMinReleaseAgeMs()).toBe(30 * MINUTE_MS);
|
|
});
|
|
|
|
it("honors the ARGENT_MIN_RELEASE_AGE_DAYS override and skips probing", async () => {
|
|
process.env[ENV] = "3";
|
|
expect(await detectMinReleaseAgeMs()).toBe(3 * DAY_MS);
|
|
expect(mockExec).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("treats an invalid or non-positive override as no policy", async () => {
|
|
process.env[ENV] = "0";
|
|
expect(await detectMinReleaseAgeMs()).toBe(0);
|
|
|
|
process.env[ENV] = "not-a-number";
|
|
expect(await detectMinReleaseAgeMs()).toBe(0);
|
|
|
|
expect(mockExec).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe("detectMinReleaseAgeMsForPm (known PM)", () => {
|
|
it("probes only the selected package manager", async () => {
|
|
const sevenDaysAgo = new Date(NOW.getTime() - 7 * DAY_MS).toISOString();
|
|
stubPmConfig({ "npm config get before": sevenDaysAgo });
|
|
expect(await detectMinReleaseAgeMsForPm("npm")).toBe(7 * DAY_MS);
|
|
expect(mockExec).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it("returns 0 for bun (no `config get`, covered by the override instead)", async () => {
|
|
stubPmConfig({});
|
|
expect(await detectMinReleaseAgeMsForPm("bun")).toBe(0);
|
|
expect(mockExec).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("honors the override and skips probing", async () => {
|
|
process.env[ENV] = "2";
|
|
expect(await detectMinReleaseAgeMsForPm("pnpm")).toBe(2 * DAY_MS);
|
|
expect(mockExec).not.toHaveBeenCalled();
|
|
});
|
|
});
|