Package the CLI as mft-config - #5
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
oveddan has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
There was a problem hiding this comment.
oveddan has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c54d222c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const stateRoot = stateDirectory(); | ||
| const journalPath = resolve(stateRoot, "journal.ndjson"); | ||
| await assertPlanNotConsumed(journalPath, plan.planId); |
There was a problem hiding this comment.
When upgrading within a plan's 15-minute lifetime, an apply completed by the previous version is recorded only in the working directory's .mft-state/journal.ndjson. This now checks only the new per-user journal, so if the device is restored to the plan's original snapshot, that old plan passes both the consumption and snapshot guards and can write again, breaking the documented single-use guarantee. Consult or migrate the legacy journal before relying exclusively on the new location.
Useful? React with 👍 / 👎.
1 participant
Summary
mft-configas the primary installed executable while retainingmft-exportas a deprecated compatibility aliasprepare/prepackbuilds, a minimal package allowlist, and repository/engine/license metadatamft-configand document GitHub, tarball, and contributor installation pathsSafety and publishing
The existing firmware, device-identity, snapshot-hash, confirmation, backup, sequential-write, and full-readback guards remain in place. State now defaults to
~/.mft-configor$XDG_STATE_HOME/mft-config;MFT_CONFIG_STATE_DIRprovides an explicit absolute override.No npm publication is performed. The package is deliberately
UNLICENSEDandprivate: trueuntil the repository owner chooses an explicit host-tool license.Validation
npm run check— build and 16 tests passnpm run test:package— packs a 17-file artifact, clean-installs it, verifies both executable names, exercises all command routes, creates an offline plan, and checks the apply confirmation guardnpm pack --dry-run --json— no sources, tests, scripts, snapshots, plans, journals, backups, ornode_modulesCloses #3