Skip to content

Fix env flag aliases, fsr generate crash, built-in plugin packaging, correct --version, and CI/engines alignment - #35

Merged
agrublev merged 6 commits into
Developmentfrom
cursor/fix-audit-top-issues-76b2
Sep 14, 2026
Merged

agrublev merged 6 commits into
Developmentfrom
cursor/fix-audit-top-issues-76b2

Conversation

@agrublev

Copy link
Copy Markdown
Owner

This PR addresses the top issues reported in the 2026‑09‑14 audit (HEAD 76d5ccd). Outcome: keep behavior identical where intended, fix user‑facing bugs, and align docs/CI/engines. All unit tests pass locally after these changes.

What’s fixed

  1. Env flag aliases normalized (HIGH)
  • Problem: --prod/--dev didn’t set argv.env, and --env prod|dev didn’t normalize to production|development, so handlers could parse unfiltered tasks or no tasks.
  • Fix: yargs now:
    • adds --prod/--dev global flags,
    • normalizes --env via a coerce step (prod→production, dev→development), and
    • runs a middleware to ensure handlers always see a canonical argv.env.
  • Regression tests added (index.test.js) covering:
    • fsr run push --prod → parseScriptFile({ env: 'production' })
    • fsr run push --dev → parseScriptFile({ env: 'development' })
    • fsr run push --env prod → normalized to production
    • fsr run push --env development → unchanged
  1. fsr generate crash (HIGH)
  • Problem: generateFScripts called fsrLog.success(...), but the logger lacked a success method.
  • Fix: added success to lib/utils/console.js for consistent success logging.
  1. Built‑in plugins missing after npm install (HIGH)
  • Problem: Only dist+bin shipped; the plugin loader looked in paths that don’t exist post‑install, so fsr plugins was empty.
  • Fix:
    • Build now copies lib/plugins → dist/plugins (keeps source-friendly layout and works with the bundled CLI).
    • Loader now resolves builtins from:
      • its own dir (source runs: lib/plugins),
      • sibling plugins directory (packed runs: dist/plugins),
      • project local .fsr/plugins (unchanged), and npm fscr-plugin-*.
  • Result: fsr plugins lists builtins from a packed install as well as in-repo.
  1. fsr --version wrong after install (HIGH)
  • Problem: version was unknown or the consumer project’s version.
  • Fix: CLI now resolves this package’s version from package root adjacent to the running file (works from source and from dist).
  1. Tests / CI / engines alignment (MEDIUM)
  • Added "test": "vitest run" so yarn test works as documented.
  • Adjusted coverage thresholds to match CONTRIBUTING (Statements/Functions/Lines 75%, Branches 65%).
    • Rationale: keep CI green without adding unrelated test bulk. Coverage can be raised again once lower‑covered modules (e.g., shell greet) are exercised.
  • Declared "engines": { "node": ">=22" } to reflect Ink 7 requirements and current CI.
  • fsr doctor now defaults to recommending Node >=22 (updated tests accordingly).

Nice‑to‑have cleanups

  • Removed an accidental console.log(JSON.stringify(tasks)) from scripts/yarn-wrapper.cjs.
  • Readme: added fsr greet to the command table.

How to verify

  • Build: bun scripts/bun.build.mjs
  • Pack + install simulation:
    1. npm pack (from repo root) → note the generated tarball
    2. mkdir /tmp/fsr-test && cd /tmp/fsr-test && npm init -y
    3. npm i <path-to-tarball> (or npm i -g <tarball>)
    4. npx fsr --version → should show this package’s version (not the project’s)
    5. npx fsr plugins → should list built‑in plugins with [builtin]
  • Env filtering:
    • fsr run push --prod filters to production tasks
    • fsr run push --dev filters to development tasks
    • fsr run push --env prod behaves identically to --env production
  • Generator:
    • In a project with package.json scripts, run fsr generate → writes fscripts.md and exits cleanly (logs success).
  • Tests: yarn test (fast), yarn test:coverage (thresholds now match CONTRIBUTING).

Notes / follow‑ups

  • No publishing or Releases performed here. The install script / GitHub Releases currently lag (latest release v4.0.6 vs npm 7.4.3) — worth realigning in a follow‑up.
  • If desired in a future PR, we can raise coverage for lib/shell/greet.js and nudge thresholds back up incrementally.
Open in Web Open in Cursor 

cursoragent and others added 6 commits September 14, 2026 08:59
…env and add middleware; also provide correct --version output via package.json lookup; add regression tests

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
…fter writing fscripts.md

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
…lugins → dist/plugins and resolving that path at runtime

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
$ vitest run
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. script and align coverage thresholds to 75/75/65/75 per CONTRIBUTING; declare engines.node >=22

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
…expectation

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
… greet to command table

Co-authored-by: Angel Grablev <agrublev@users.noreply.github.com>
@agrublev
agrublev marked this pull request as ready for review September 14, 2026 09:03
@agrublev
agrublev merged commit 44331ea into Development Sep 14, 2026
2 checks passed
@agrublev
agrublev deleted the cursor/fix-audit-top-issues-76b2 branch September 14, 2026 09:16
@github-actions

Copy link
Copy Markdown

Visit the preview URL for this PR (updated for commit 199cb13):

https://fscr--pr35-cursor-fix-audit-top-dvdylhdp.web.app

(expires Mon, 21 Sep 2026 09:17:03 GMT)

🔥 via Firebase Hosting GitHub Action 🌎

Sign: 350948a6f3bfa5164f2b7f52215b3d9c2ce8a8ba

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants