fix: make all typecheck and test gates green on macOS - #292
VanniMnemonic wants to merge 7 commits into
Conversation
Modly had no SECURITY.md and no private channel for vulnerability reports, which left email as the only route for researchers. Private vulnerability reporting is now enabled on the repository; this points people at it and sets expectations around it. The policy leads with a threat model and lets the scope follow from it, so that an excluded report comes with the reason it was excluded. Two assumptions are deliberate: workflow files are untrusted input because sharing them is normal, and any web page the user has open is an untrusted caller of the loopback API. The second is why the network-exposure exclusion is narrowed to deliberate exposure only -- a page in the user's own browser needs none. Every claim was checked against the code. The policy does not call the installer signed (no platform signs it), says nothing about PyTorch (we do not ship it), and does not excuse social engineering on the strength of UI warnings that do not exist.
…curity docs: add a security policy with a private reporting route
tsc (node/web/root/builtins), eslint, build, test:node and test:py all pass now. - Enable rewriteRelativeImportExtensions: node:test runs the TS suites with native type stripping, which requires .ts import specifiers. - Include src/shared/types in tsconfig.node.json and drop the orphaned collections.ts that pulled the renderer store into the node graph. - Type readdir entries as Dirent[] and annotate the assetLibraryUi map callbacks so the null-filter predicates check against declared types. - Fix the macOS registration bug in generator_registry: abspath does not resolve /var to /private/var, so authorized extensions stayed blocked as "incomplete installation". Compare against ext_dir.resolve() instead. - Prefer api/.venv in run-pytests.mjs: the system Python lacks fastapi.
Drop unconditional stdout prints that fired at import time and on every registry init/reload; WARNING and ERROR diagnostics are kept.
|
The macOS symlink fix in
Suggest resolving only the parent instead of the full path, mirroring how == ext_dir.parent.resolve() / ext_dir.nameThat keeps the modly/api/services/generator_registry.py Lines 457 to 465 in f3c1b42 |
2 participants
Summary
rewriteRelativeImportExtensions(node:test needs.tsspecifiers for native type-stripping), includesrc/shared/typesin the node project, drop the orphanedcollections.ts, typeDirent[]entries, annotateassetLibraryUimap callbacks, add a null guard in the UI test.generator_registry:os.path.abspathdoes not resolve/var→/private/var, so correctly-authorized extensions stayed blocked as "incomplete installation". Now compares againstext_dir.resolve().run-pytests.mjspreferapi/.venv(system Python lacks fastapi) and bump Electron to^44.1.1(pending from the packaging work).Test plan
npx tsc --noEmitgreen on all four projects (node, web, root, builtins) — 26 errors → 0npm run test:node— 118/118 passnpm run test:py— 63/63 pass (was 2 import errors + 2 failures)npx eslint .— cleannpm run build— exit 0