Skip to content

fix: refuse unsafe browser self-updates - #67

Open
pimmink wants to merge 2 commits into
open-gsd:mainfrom
pimmink:fix/npm-managed-update-guard
Open

pimmink wants to merge 2 commits into
open-gsd:mainfrom
pimmink:fix/npm-managed-update-guard

Conversation

@pimmink

@pimmink pimmink commented Oct 16, 2026

Copy link
Copy Markdown

Summary

Closes #66.

  • Mark the npm launcher as package-managed and refuse gsd-browser update from that launcher instead of installing a separate binary and claiming success. The error directs users to their package manager (or gsd update browser under GSD Pi).
  • Pass the running CLI version to the release installer and refuse an older selected release before any download.
  • Add regression tests for the npm launcher marker and installer downgrade guard, and clarify update scope in the docs/changelog.

Verification

Passed:

  • cargo fmt --check
  • bash -n install.sh
  • git diff --check
  • npm --prefix npm test
  • cargo test -p gsd-browser --bin gsd-browser cli_output_tests (4 passed)

The full cargo test -p gsd-browser run did not finish within the 10-minute local limit; it was still running long instruction_runtime tests when terminated. No full-suite pass is claimed.

Copilot AI balanced review requested due to automatic review settings October 16, 2026 15:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The new installer regression test needs platform gating to avoid failures on native Windows.

1 open finding
What changed in this PR

Addresses #66 by preventing npm-managed self-updates and rejecting older releases during standalone updates.

Changes:

  • Mark npm launches as package-managed and direct updates to the package manager.
  • Pass the running version to the installer and reject downgrades.
  • Add regression coverage and clarify update scope in documentation.
File Description
SKILL.md Clarifies standalone update scope.
npm/​SKILL.md Clarifies standalone update scope.
npm/​scripts/​test-package.js Tests the launcher’s package-managed marker.
npm/​bin/​gsd-browser Sets the package-managed marker.
install.sh Adds version comparison and downgrade refusal.
gsd-browser-skill/​workflows/​setup-and-configure.md Documents package-manager update instructions.
gsd-browser-skill/​references/​command-reference.md Explains update scope.
cli/​src/​main.rs Guards updates, passes the current version, and adds tests.
CHANGELOG.md Records the updater safeguards.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread cli/src/main.rs Resolved
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

update downloads v0.2.1 from an installed v0.2.2 CLI and reports success without updating the invoked launcher

2 participants