Skip to content

feat(info): display commit-snapshot provenance (P1) - #114

Merged
tonythethompson merged 3 commits into
masterfrom
feat/p1-commit-snapshot-intake
Aug 10, 2026
Merged

tonythethompson merged 3 commits into
masterfrom
feat/p1-commit-snapshot-intake

Conversation

@tonythethompson

@tonythethompson tonythethompson commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Implements the client side of P1 (Commit-Snapshot Intake) from the intake process reform ADR.
  • VersionEntry gains an optional provenance: Option<String> field (#[serde(default)], backward compatible).
  • numan info prints a note under a version when provenance == "commit-snapshot": "built from a commit snapshot, not a tagged release".
  • No resolver/update changes needed: latest_compatible and update already order purely by semver::Version::cmp, which correctly ranks a real tagged release above a 0.0.0-snapshot.* prerelease with no special-casing required.

Test plan

  • cargo build — clean
  • cargo test — 659+ passed across lib and all integration test binaries, 0 failed
  • cargo fmt --check — clean
  • New tests: VersionEntry provenance parsing (present/absent), numan info note rendering (present/absent)

Ref: docs/plans/2026-08-09-intake-process-reform.md (P1, in numan-registry/ADR PR #113 context).

🤖 Generated with Claude Code

Review in cubic

VersionEntry gains an optional provenance field parsed from the
registry index. numan info shows a note when a version's provenance
is "commit-snapshot" ("built from a commit snapshot, not a tagged
release"). Other fixture-only VersionEntry literals across
tests/cmd updated for the new field.

Ref: docs/plans/2026-08-09-intake-process-reform.md (P1)
@coderabbitai

coderabbitai Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8285f965-1d57-4aef-8c33-e8fd775ef5a9

📥 Commits

Reviewing files that changed from the base of the PR and between fa1c937 and 2afc50e.

📒 Files selected for processing (3)
  • src/cli.rs
  • src/cmd/completions.rs
  • src/cmd/info.rs
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • tonythethompson/QuickShell (manual)
  • tonythethompson/numan (manual)
  • tonythethompson/dependency-chain-substrate (manual)
📜 Recent review details
🧰 Additional context used
📓 Path-based instructions (9)
**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Use Serena's semantic, symbol-aware tools as the primary tools for reading and editing code; use built-in Read, Glob, Grep, and Edit only under the stated exceptions.
Before editing a code file, inspect its symbol overview, read the specific symbols being changed, and edit them with Serena's symbol-aware tools.
Understand the existing code before changing it and make the smallest change that satisfies the request; avoid unrelated cleanup, premature abstractions, unnecessary error handling, feature flags, and compatibility shims.
Prefer editing existing files over creating new ones, and never create Markdown or README files unless explicitly requested.
For exploratory questions, provide a 2–3 sentence recommendation with the main tradeoff and do not implement until the user agrees.
For UI or frontend changes that cannot be tested in a browser, explicitly state that browser testing was not performed rather than claiming success.
Address security issues when discovered, including injection, XSS, SQL injection, path traversal, and secret leaks.
Pause and obtain confirmation before destructive, hard-to-reverse, externally visible, or third-party-upload actions, including deleting files or branches, dropping tables, force-pushing, modifying CI/CD, posting externally, or uploading content.
When blocked, investigate the root cause instead of bypassing it with --no-verify, --force, or deletion; investigate unfamiliar files, branches, and configuration before deleting them.
Only commit when explicitly asked; do not proactively update git configuration or push changes.
Do not skip Git hooks unless explicitly asked; if a pre-commit hook fails, fix the issue, re-stage, and create a new commit rather than amending.
Stage files by name rather than using git add -A or git add ., to avoid accidentally including secrets or large binaries.
Use a HEREDOC for commit messages, and add co-author attribution only when the user explicitly requests the exact trailer.
Do not force-pus...

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}

📄 CodeRabbit inference engine (CLAUDE.md)

Add comments only when the WHY is non-obvious; do not narrate what the code does, reference the current task, or reference the PR in comments.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
!**/.env,!**/credentials.json,!**/*.pem

📄 CodeRabbit inference engine (CLAUDE.md)

Do not commit files that appear to contain secrets, including .env, credentials.json, and PEM files; warn before doing so even if explicitly requested.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.rs: Use the Rust 2021 edition.
Use anyhow::Result with .context(...) in application code; use thiserror for library error types that callers match on.
Use clap derive macros for CLI definitions.
Use serde with serde_json or toml for serialization.
Function parameters must use &Path, not &PathBuf.
Library code must not panic; error paths should return anyhow::Result with context where appropriate.
Add or update tests for behavior changes, including relevant failure paths.
New mutating code paths must acquire the mutation lock via acquire_mutation_lock(root) and snapshot the lockfile before writes.
Lockfile, journal, and state-file JSON writes must use write_json_atomic.
numan install must write only to $NUMAN_ROOT; it must not invoke Nu or register plugins/autoloads.
Only activate and deactivate may modify Nu integration state.
Treat the lockfile as the authoritative source of truth; derived projections such as autoload state must not be authoritative.
Install payloads under versioned, content-addressed paths and never overwrite them in place.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass plugin paths through environment variables only; do not use runtime interpolation in Nu program strings.

**/*.rs: All CI gates must pass: cargo test, cargo clippy -- -D warnings, and cargo fmt --check.
Every mutating command—including install, remove, update, gc, and future nupm import—must call acquire_mutation_lock(root).
Lockfiles, journals, and state files must use write_json_atomic; partial writes are not allowed.
Pending activation, autoload, and lifecycle journals must be stored under $NUMAN_ROOT/state/.
Module autoload identity must match all four fields: Nu executable hash, Nu version, vendor autoload directory, and managed file path; the lockfile module_activation value is authoritative.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass paths to Nu only throu...

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.{rs,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Run and keep cargo fmt/rustfmt clean, and ensure cargo clippy -- -D warnings passes.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.{rs,nu}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.{rs,nu}: Real-Nu acceptance tests must be marked #[ignore] and should be run when changes affect activation or nupm import; unit tests must not spawn real nu and should use injectable seams such as FakeCandidateRunner or registrars.
The nupm integration must be read-only toward NUPM_HOME, must not execute build.nu, and must not perform bidirectional synchronization.

Unit tests must use FakeCandidateRunner or injectable registrars and must not spawn a real nu process.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.{rs,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Match existing naming, module layout, and documentation level in the file being edited; update AGENTS.md, docs/, or command help when structure, conventions, or user-visible behavior changes.

Tests must cover failure modes, not only successful execution.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
**/*.{rs,md,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Use the repository's established serialization and module conventions rather than introducing unrelated refactors.

Files:

  • src/cli.rs
  • src/cmd/info.rs
  • src/cmd/completions.rs
src/cmd/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

Pass Nu paths and names through environment variables (NUMAN_PLUGIN_BINARY, NUMAN_PLUGIN_CONFIG, and NUMAN_PLUGIN_NAME); the Nu program string must be a compile-time constant with no runtime interpolation.

Files:

  • src/cmd/info.rs
  • src/cmd/completions.rs
🔍 Remote MCP DeepWiki, GitHub Copilot

Relevant review context

  • PR #114 adds VersionEntry.provenance as an optional field with #[serde(default)], so older registry entries without the field remain deserializable. The client emits the snapshot note only for the exact value "commit-snapshot"; other values are intentionally ignored.

  • Repository documentation describes provenance as part of broader package/version metadata and identifies src/cmd/info.rs and src/core/package.rs as the intended client surfaces for provenance display.

  • DeepWiki confirms resolver selection uses compatibility, platform, and semantic version fields; it does not identify provenance as part of candidate ordering. This supports the PR’s claim that resolver/update ordering is unchanged.

  • All 21 reported PR checks completed successfully, including Ubuntu/macOS/Windows tests, real-Nu acceptance, MSRV, formatting, Clippy, deny, CodeQL, and static-analysis jobs. The overall commit status remains pending because the CodeRabbit review status is still in progress.

  • The referenced repository PR #63 is a merged roadmap-only change, not the registry schema implementation; PR #80 was not found in tonythethompson/numan.

🔇 Additional comments (8)
src/cmd/info.rs (1)

82-85: LGTM!

Also applies to: 168-168, 203-228

src/cli.rs (1)

64-64: LGTM!

src/cmd/completions.rs (6)

54-54: LGTM!


190-196: LGTM!


198-210: LGTM!


212-218: LGTM!


319-326: LGTM!


441-461: LGTM!


📝 Walkthrough

Walkthrough

Changes

Version provenance metadata

Layer / File(s) Summary
VersionEntry provenance contract
src/core/package.rs
VersionEntry now has an optional serialized provenance field. Deserialization defaults it to None. Tests cover omitted and commit-snapshot values.
Provenance-aware info output
src/cmd/info.rs
format_info displays a note for commit-snapshot versions. Tests verify output for supported and unsupported provenance values.
Fixture compatibility updates
src/cmd/search.rs, src/cmd/try_cmd.rs, src/core/registry.rs, src/core/resolve.rs, tests/install_test.rs, tests/support/active_update/mod.rs
Test fixtures initialize provenance as None across command, registry, resolver, installation, and active-update tests.

CLI help and completion updates

Layer / File(s) Summary
Completion generation and installation guidance
src/cmd/completions.rs
Completion output adds an upgrade reminder. Nushell setup uses corrected parent-directory creation syntax. Generated scripts omit recursive help subcommands.
Completion behavior validation
src/cmd/completions.rs
Tests verify the Nushell hint and the omission of help entries from supported shell completions.
Use command help text
src/cli.rs
The Use command description lists its supported version-selection operations.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

Suggested reviewers: greptile-apps

🚥 Pre-merge checks | ✅ 7 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 60.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (7 passed)
Check name Status Explanation
Description check ✅ Passed The description accurately covers provenance support, info output, tests, and related completion updates in the changeset.
Title check ✅ Passed The title clearly identifies the main change: displaying commit-snapshot provenance in the info command.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Pipeline Stage Enum Ordering ✅ Passed Not applicable: no SessionWorkflowStage enum or requested members exist in tracked source, and no related comparisons or raw integer stage comparisons were found.
Gpu/Cpu Runtime Boundary ✅ Passed The patch changes only Rust source and test files. No inference/, managed requirements, main.py, or C# diarization files are modified, so this boundary check is not applicable.
Managed Host Restart Safety ✅ Passed PR changes only numan metadata, info, CLI, completion, and test fixtures; no managed-host components or stop/restart, lease, health, or readiness paths are present.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/p1-commit-snapshot-intake
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch feat/p1-commit-snapshot-intake

Warning

Review ran into problems

🔥 Problems

Linked repositories: Public OSS repositories can only analyze public repositories installed in this organization. Analyzed tonythethompson/QuickShell, tonythethompson/numan, tonythethompson/dependency-chain-substrate, skipped Trackdubllc/Trackdub.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cmd/info.rs`:
- Around line 203-220: Add a test alongside
format_info_omits_provenance_note_when_absent that sets
sample_plugin(false).versions[0].provenance to an unrecognized value such as
"future-marker", calls format_info, and asserts the commit-snapshot note is
absent, preserving the existing special handling for "commit-snapshot".
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bb25698a-5681-4ff8-8e04-ef72b1253087

📥 Commits

Reviewing files that changed from the base of the PR and between 2c6bb5e and fa1c937.

📒 Files selected for processing (8)
  • src/cmd/info.rs
  • src/cmd/search.rs
  • src/cmd/try_cmd.rs
  • src/core/package.rs
  • src/core/registry.rs
  • src/core/resolve.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • tonythethompson/QuickShell (manual)
  • tonythethompson/numan (manual)
  • tonythethompson/dependency-chain-substrate (manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
  • GitHub Check: Real-Nu acceptance (windows-latest)
  • GitHub Check: Test (windows-latest)
⚠️ CI failures not shown inline (2)

GitHub Actions: Trigger Kiro Crew / trigger _ trigger-agent: feat(info): display commit-snapshot provenance (P1)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
 �[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
 �[36;1m: "${GATEWAY_URL:?KIRO_GATEWAY_URL missing}"�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "${GATEWAY_ORIGIN:-}" ]; then�[0m
 �[36;1m  ORIGIN="$GATEWAY_ORIGIN"�[0m
 �[36;1melse�[0m
 �[36;1m  ORIGIN=$(printf '%s' "$GATEWAY_URL" | sed -E 's#(https?://[^/]+).*#\1#')�[0m
 �[36;1mfi�[0m
 �[36;1mREPO_SHORT="${REPO##*/}"�[0m
 �[36;1mSESSION_KEY="hook:github:${REPO_SHORT}:${EVENT}:${RUN_ID}"�[0m
 �[36;1m�[0m
 �[36;1mONE_OFF=""�[0m
 �[36;1mif [ -n "${ONE_OFF_RAW// }" ]; then�[0m
 �[36;1m  ONE_OFF=$(printf '%s' "$ONE_OFF_RAW" | sed -E 's|^[[:space:]]*/[Kk][Ii][Rr][Oo][Cc][Rr][Ee][Ww][[:space:]]*||')�[0m
 �[36;1m  ONE_OFF=$(printf '%s' "$ONE_OFF" | sed -E 's|/kirocrew||Ig' | sed -E 's/^[[:space:]]+//;s/[[:space:]]+$//')�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "${PR_NUMBER}" ]; then�[0m
 �[36;1m  COMMENT_TARGET="Leave a single GitHub PR comment on ${REPO}#${PR_NUMBER} (gh pr comment ${PR_NUMBER})."�[0m
 �[36;1m  PR_LABEL="PR #${PR_NUMBER}"�[0m
 �[36;1melse�[0m
 �[36;1m  COMMENT_TARGET="If an open PR contains commit ${SHA}, comment on that PR; otherwise leave a commit comment on ${SHA}."�[0m
 �[36;1m  PR_LABEL=""�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mMSG=$(jq -nr \�[0m
 �[36;1m  --arg prefix "$MESSAGE_PREFIX" \�[0m
 �[36;1m  --arg event "$EVENT" \�[0m
 �[36;1m  --arg repo "$REPO" \�[0m
 �[36;1m  --arg ref "$REF" \�[0m
 �[36;1m  --arg sha "$SHA" \�[0m
 �[36;1m  --arg run_id "$RUN_ID" \�[0m
 �[36;1m  --arg run_url "$RUN_URL" \�[0m
 �[36;1m  --arg pr_number "$PR_NUMBER" \�[0m
 �[36;1m  --arg pr_label "$PR_LABEL" \�[0m
 �[36;1m  --arg daytona "$DAYTONA_OS" \�[0m
 �[36;1m  --arg one_off "$ONE_OFF" \�[0m
 �[36;1m  --arg comment_url "$COMMENT_URL" \�[0m
 �[36;1m  --arg comment_target "$COMMENT_TARGET" \�[0m
 �[36;1m  '�[0m
 �[36;1m  def nl: "\n";�[0m
 �[36;1m  (if ($prefix | length) > 0 then $prefix ...

GitHub Actions: Trigger Kiro Crew / 0_trigger _ trigger-agent.txt: feat(info): display commit-snapshot provenance (P1)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
 �[36;1m: "${***REDACTED_SECRET_ASSIGNMENT*** missing}"�[0m
 �[36;1m: "${GATEWAY_URL:?KIRO_GATEWAY_URL missing}"�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "${GATEWAY_ORIGIN:-}" ]; then�[0m
 �[36;1m  ORIGIN="$GATEWAY_ORIGIN"�[0m
 �[36;1melse�[0m
 �[36;1m  ORIGIN=$(printf '%s' "$GATEWAY_URL" | sed -E 's#(https?://[^/]+).*#\1#')�[0m
 �[36;1mfi�[0m
 �[36;1mREPO_SHORT="${REPO##*/}"�[0m
 �[36;1mSESSION_KEY="hook:github:${REPO_SHORT}:${EVENT}:${RUN_ID}"�[0m
 �[36;1m�[0m
 �[36;1mONE_OFF=""�[0m
 �[36;1mif [ -n "${ONE_OFF_RAW// }" ]; then�[0m
 �[36;1m  ONE_OFF=$(printf '%s' "$ONE_OFF_RAW" | sed -E 's|^[[:space:]]*/[Kk][Ii][Rr][Oo][Cc][Rr][Ee][Ww][[:space:]]*||')�[0m
 �[36;1m  ONE_OFF=$(printf '%s' "$ONE_OFF" | sed -E 's|/kirocrew||Ig' | sed -E 's/^[[:space:]]+//;s/[[:space:]]+$//')�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mif [ -n "${PR_NUMBER}" ]; then�[0m
 �[36;1m  COMMENT_TARGET="Leave a single GitHub PR comment on ${REPO}#${PR_NUMBER} (gh pr comment ${PR_NUMBER})."�[0m
 �[36;1m  PR_LABEL="PR #${PR_NUMBER}"�[0m
 �[36;1melse�[0m
 �[36;1m  COMMENT_TARGET="If an open PR contains commit ${SHA}, comment on that PR; otherwise leave a commit comment on ${SHA}."�[0m
 �[36;1m  PR_LABEL=""�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mMSG=$(jq -nr \�[0m
 �[36;1m  --arg prefix "$MESSAGE_PREFIX" \�[0m
 �[36;1m  --arg event "$EVENT" \�[0m
 �[36;1m  --arg repo "$REPO" \�[0m
 �[36;1m  --arg ref "$REF" \�[0m
 �[36;1m  --arg sha "$SHA" \�[0m
 �[36;1m  --arg run_id "$RUN_ID" \�[0m
 �[36;1m  --arg run_url "$RUN_URL" \�[0m
 �[36;1m  --arg pr_number "$PR_NUMBER" \�[0m
 �[36;1m  --arg pr_label "$PR_LABEL" \�[0m
 �[36;1m  --arg daytona "$DAYTONA_OS" \�[0m
 �[36;1m  --arg one_off "$ONE_OFF" \�[0m
 �[36;1m  --arg comment_url "$COMMENT_URL" \�[0m
 �[36;1m  --arg comment_target "$COMMENT_TARGET" \�[0m
 �[36;1m  '�[0m
 �[36;1m  def nl: "\n";�[0m
 �[36;1m  (if ($prefix | length) > 0 then $prefix ...
🧰 Additional context used
📓 Path-based instructions (12)
**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Use Serena's semantic, symbol-aware tools as the primary tools for reading and editing code; use built-in Read, Glob, Grep, and Edit only under the stated exceptions.
Before editing a code file, inspect its symbol overview, read the specific symbols being changed, and edit them with Serena's symbol-aware tools.
Understand the existing code before changing it and make the smallest change that satisfies the request; avoid unrelated cleanup, premature abstractions, unnecessary error handling, feature flags, and compatibility shims.
Prefer editing existing files over creating new ones, and never create Markdown or README files unless explicitly requested.
For exploratory questions, provide a 2–3 sentence recommendation with the main tradeoff and do not implement until the user agrees.
For UI or frontend changes that cannot be tested in a browser, explicitly state that browser testing was not performed rather than claiming success.
Address security issues when discovered, including injection, XSS, SQL injection, path traversal, and secret leaks.
Pause and obtain confirmation before destructive, hard-to-reverse, externally visible, or third-party-upload actions, including deleting files or branches, dropping tables, force-pushing, modifying CI/CD, posting externally, or uploading content.
When blocked, investigate the root cause instead of bypassing it with --no-verify, --force, or deletion; investigate unfamiliar files, branches, and configuration before deleting them.
Only commit when explicitly asked; do not proactively update git configuration or push changes.
Do not skip Git hooks unless explicitly asked; if a pre-commit hook fails, fix the issue, re-stage, and create a new commit rather than amending.
Stage files by name rather than using git add -A or git add ., to avoid accidentally including secrets or large binaries.
Use a HEREDOC for commit messages, and add co-author attribution only when the user explicitly requests the exact trailer.
Do not force-pus...

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}

📄 CodeRabbit inference engine (CLAUDE.md)

Add comments only when the WHY is non-obvious; do not narrate what the code does, reference the current task, or reference the PR in comments.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
!**/.env,!**/credentials.json,!**/*.pem

📄 CodeRabbit inference engine (CLAUDE.md)

Do not commit files that appear to contain secrets, including .env, credentials.json, and PEM files; warn before doing so even if explicitly requested.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.rs: Use the Rust 2021 edition.
Use anyhow::Result with .context(...) in application code; use thiserror for library error types that callers match on.
Use clap derive macros for CLI definitions.
Use serde with serde_json or toml for serialization.
Function parameters must use &Path, not &PathBuf.
Library code must not panic; error paths should return anyhow::Result with context where appropriate.
Add or update tests for behavior changes, including relevant failure paths.
New mutating code paths must acquire the mutation lock via acquire_mutation_lock(root) and snapshot the lockfile before writes.
Lockfile, journal, and state-file JSON writes must use write_json_atomic.
numan install must write only to $NUMAN_ROOT; it must not invoke Nu or register plugins/autoloads.
Only activate and deactivate may modify Nu integration state.
Treat the lockfile as the authoritative source of truth; derived projections such as autoload state must not be authoritative.
Install payloads under versioned, content-addressed paths and never overwrite them in place.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass plugin paths through environment variables only; do not use runtime interpolation in Nu program strings.

**/*.rs: All CI gates must pass: cargo test, cargo clippy -- -D warnings, and cargo fmt --check.
Every mutating command—including install, remove, update, gc, and future nupm import—must call acquire_mutation_lock(root).
Lockfiles, journals, and state files must use write_json_atomic; partial writes are not allowed.
Pending activation, autoload, and lifecycle journals must be stored under $NUMAN_ROOT/state/.
Module autoload identity must match all four fields: Nu executable hash, Nu version, vendor autoload directory, and managed file path; the lockfile module_activation value is authoritative.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass paths to Nu only throu...

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.{rs,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Run and keep cargo fmt/rustfmt clean, and ensure cargo clippy -- -D warnings passes.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.{rs,nu}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.{rs,nu}: Real-Nu acceptance tests must be marked #[ignore] and should be run when changes affect activation or nupm import; unit tests must not spawn real nu and should use injectable seams such as FakeCandidateRunner or registrars.
The nupm integration must be read-only toward NUPM_HOME, must not execute build.nu, and must not perform bidirectional synchronization.

Unit tests must use FakeCandidateRunner or injectable registrars and must not spawn a real nu process.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.{rs,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Match existing naming, module layout, and documentation level in the file being edited; update AGENTS.md, docs/, or command help when structure, conventions, or user-visible behavior changes.

Tests must cover failure modes, not only successful execution.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
**/*.{rs,md,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Use the repository's established serialization and module conventions rather than introducing unrelated refactors.

Files:

  • src/cmd/try_cmd.rs
  • src/core/registry.rs
  • tests/install_test.rs
  • tests/support/active_update/mod.rs
  • src/cmd/info.rs
  • src/core/package.rs
  • src/cmd/search.rs
  • src/core/resolve.rs
src/cmd/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

Pass Nu paths and names through environment variables (NUMAN_PLUGIN_BINARY, NUMAN_PLUGIN_CONFIG, and NUMAN_PLUGIN_NAME); the Nu program string must be a compile-time constant with no runtime interpolation.

Files:

  • src/cmd/try_cmd.rs
  • src/cmd/info.rs
  • src/cmd/search.rs
src/core/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

Derive the platform triple from compile-time #[cfg(target_env)] values, not std::env::consts; LIBC must be a compile-time constant.

Files:

  • src/core/registry.rs
  • src/core/package.rs
  • src/core/resolve.rs
src/core/{trust.rs,official_registry.rs,registry.rs}

📄 CodeRabbit inference engine (AGENTS.md)

Verify Ed25519 signatures over the exact index.json bytes; use the built-in production trust root for the official registry. Unsigned bypass is allowed only with NUMAN_ALLOW_UNSIGNED=1 for development.

Files:

  • src/core/registry.rs
tests/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

Test platform-specific behavior with mock platforms, and use injected fakes rather than real Nu for unit tests.

Files:

  • tests/install_test.rs
  • tests/support/active_update/mod.rs
🔍 Remote MCP DeepWiki, GitHub Copilot

Additional review context

  • PR #114 adds VersionEntry.provenance: Option<String> with #[serde(default)], preserving parsing of existing registry indexes. The client renders a note only for the exact value "commit-snapshot".
  • The companion registry PR #63 is still open/draft. It adds an optional string schema property and passthrough from package specs; it does not constrain values to an enum.
  • The companion plugins PR #80 defines the producer contract: snapshot entries retain a mandatory immutable source_commit, derive versions like 0.0.0-snapshot.YYYYMMDD.<sha>, and emit provenance: "commit-snapshot".
  • The intake plan states that tagged releases remain preferred; snapshots are a fallback for untagged upstream commits. SHA-256 artifact verification, Ed25519 index signatures, and immutable commit provenance remain mandatory.
  • The changed client code does not alter resolver or update behavior; the documented design relies on SemVer ordering so normal tagged releases outrank synthetic prerelease snapshot versions.
  • At the time checked, Ubuntu/macOS tests, formatting, Clippy, MSRV, and deny checks succeeded; Windows test and Windows real-Nu acceptance were still in progress, while the trigger / trigger-agent check had failed and CodeQL was neutral.
🔇 Additional comments (9)
src/cmd/search.rs (1)

254-254: LGTM!

src/cmd/try_cmd.rs (1)

471-471: LGTM!

src/core/registry.rs (1)

409-409: LGTM!

src/core/resolve.rs (1)

729-729: LGTM!

Also applies to: 747-747, 1060-1060

tests/install_test.rs (1)

140-140: LGTM!

Also applies to: 385-385, 468-468, 539-539

tests/support/active_update/mod.rs (1)

509-509: LGTM!

src/core/package.rs (1)

115-118: 🗄️ Data Integrity & Integration

Verify the serialized representation of absent provenance.

#[serde(default)] makes a missing field deserialize as None. It does not omit None during serialization. The new tests call serde_json::from_str only, so they do not detect an omitted-field versus null mismatch in registry JSON. Confirm the registry schema, then add serialization assertions for both None and "commit-snapshot". If omission is required, add skip_serializing_if.

Possible fix when omission is required
-    #[serde(default)]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub provenance: Option<String>,

Also applies to: 276-298

Source: MCP tools

src/cmd/info.rs (2)

82-85: LGTM!


168-168: LGTM!

Comment thread src/cmd/info.rs
@tonythethompson
tonythethompson marked this pull request as ready for review August 10, 2026 08:01

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

@qodo-code-review

Copy link
Copy Markdown
Contributor

PR Summary by Qodo

Display commit-snapshot provenance in numan info (P1)

✨ Enhancement 🧪 Tests 🕐 20-40 Minutes

Grey Divider

AI Description

• Add optional provenance metadata to registry VersionEntry (backward compatible)
• Render a warning note in numan info for commit-snapshot builds
• Extend unit/integration tests to cover provenance parsing and output
Diagram

graph TD
  A{{"Registry index JSON"}} --> B(["VersionEntry"]) --> C["format_info()"] --> D["numan info output"]
  E(["core/package.rs tests"]) --> B
  F(["cmd/info.rs tests"]) --> C
  G(["integration/fixture updates"]) --> B
  subgraph Legend
    direction LR
    _ext{{"External input"}} ~~~ _mod(["Data model"]) ~~~ _fn["Command logic"]
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Model provenance as an enum (e.g., `Provenance::CommitSnapshot`)
  • ➕ Avoids stringly-typed comparisons and typo-driven bugs
  • ➕ Creates a single place to document/validate supported provenance kinds
  • ➖ Requires custom serde mapping and potential forward-compat story for unknown values
  • ➖ May add friction if the registry introduces new provenance kinds frequently
2. Render provenance generically (show value), not special-cased
  • ➕ Future-proofs UI without adding new client releases for new provenance values
  • ➕ Improves debuggability (users can see the exact marker)
  • ➖ May expose internal terminology to users
  • ➖ Less curated than a targeted explanation message

Recommendation: The PR’s current approach is a good P1 implementation: keep provenance as an optional string with #[serde(default)] for backward compatibility, and special-case the one user-facing scenario that needs explanation (commit-snapshot). Consider migrating to an enum only if provenance values stabilize or if more branching logic appears.

Files changed (8) +61 / -0

Enhancement (2) +50 / -0
info.rsShow commit-snapshot provenance note in 'numan info' + tests +23/-0

Show commit-snapshot provenance note in 'numan info' + tests

• Adds a note under a version when 'provenance' is 'commit-snapshot'. Extends unit tests to assert the note is present when set and absent otherwise, and updates the local test fixture struct literal to include 'provenance: None'.

src/cmd/info.rs

package.rsAdd optional 'provenance' to VersionEntry and test serde behavior +27/-0

Add optional 'provenance' to VersionEntry and test serde behavior

• Introduces an optional 'provenance: Option<String>' field on 'VersionEntry' with '#[serde(default)]' to keep old registry entries compatible. Adds tests covering default-to-None parsing and parsing a 'commit-snapshot' provenance value.

src/core/package.rs

Tests (6) +11 / -0
search.rsUpdate search command test fixtures for new VersionEntry field +1/-0

Update search command test fixtures for new VersionEntry field

• Adjusts VersionEntry literals in tests to include the new 'provenance: None' field so compilation remains consistent with the struct definition.

src/cmd/search.rs

try_cmd.rsUpdate try command test fixtures for new VersionEntry field +1/-0

Update try command test fixtures for new VersionEntry field

• Updates VersionEntry test literals to include 'provenance: None' to match the expanded struct and preserve existing test behavior.

src/cmd/try_cmd.rs

registry.rsUpdate registry tests for new VersionEntry field +1/-0

Update registry tests for new VersionEntry field

• Extends VersionEntry literals in registry-related tests with 'provenance: None' to align with the updated data model.

src/core/registry.rs

resolve.rsUpdate resolver tests for new VersionEntry field +3/-0

Update resolver tests for new VersionEntry field

• Updates multiple VersionEntry literals inside resolver tests to include 'provenance: None', keeping existing resolution logic unchanged and tests compiling.

src/core/resolve.rs

install_test.rsUpdate install integration tests for new VersionEntry field +4/-0

Update install integration tests for new VersionEntry field

• Adjusts integration test registry fixtures to set 'provenance: None' on VersionEntry entries, preserving previous install/snapshot test semantics.

tests/install_test.rs

mod.rsUpdate active_update support fixtures for new VersionEntry field +1/-0

Update active_update support fixtures for new VersionEntry field

• Updates registry-writing helper fixtures to include 'provenance: None' on VersionEntry so active update scenarios remain valid after the struct change.

tests/support/active_update/mod.rs

@greptile-apps

greptile-apps Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

Implements client-side commit-snapshot provenance display while keeping older registry entries backward compatible.

  • Adds an optional, serde-defaulted provenance field to version metadata.
  • Displays a commit-snapshot note in numan info.
  • Streamlines generated shell completions and updates completion guidance.
  • Updates affected fixtures and adds provenance-rendering and deserialization coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename Overview
src/core/package.rs Adds backward-compatible optional provenance metadata and tests parsing with and without the field.
src/cmd/info.rs Renders the provenance note only for commit-snapshot versions and covers matching, absent, and unrelated values.
src/cmd/completions.rs Recursively removes help subcommands from completion generation and updates installation hints and tests.
src/cli.rs Updates the use command help text to describe its supported forms.
src/core/resolve.rs Updates resolver test fixtures for the new optional version field without changing resolution behavior.

Reviews (3): Last reviewed commit: "fix(completions): slim scripts and corre..." | Re-trigger Greptile

@qodo-code-review

Copy link
Copy Markdown
Contributor

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

Tip of the day
💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

@qodo-code-review

Copy link
Copy Markdown
Contributor

Qodo Fixer

No findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR.

Cover the forward-compatible string contract so future provenance values
do not accidentally trigger the commit-snapshot message.

Co-authored-by: Cursor <cursoragent@cursor.com>
@tonythethompson

Copy link
Copy Markdown
Collaborator Author

Added format_info_omits_provenance_note_for_other_values in e1d28e5 to assert non-commit-snapshot provenance values do not emit the snapshot note.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 10, 2026
greptile-apps[bot]
greptile-apps Bot previously approved these changes Aug 10, 2026
Drop help subcommands from generated completion trees to cut script size,
fix the invalid mkdir --all Nushell hint, update use command docs, and
remind users to refresh completions after upgrading numan.

Co-authored-by: Cursor <cursoragent@cursor.com>
@tonythethompson

Copy link
Copy Markdown
Collaborator Author

Addressed in e1d28e5: added format_info_omits_provenance_note_for_other_values covering non-commit-snapshot provenance values.

@tonythethompson
tonythethompson merged commit ed2be9c into master Aug 10, 2026
23 checks passed
@tonythethompson
tonythethompson deleted the feat/p1-commit-snapshot-intake branch August 10, 2026 09:26
@linear-code

linear-code Bot commented Aug 10, 2026

Copy link
Copy Markdown

TS-183

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant