Distillation

Date: Sep 10, 2026

• 🔴 (04:11) Final security review identified a fail-closed bug in packages/cli/src/commands/cli/upgrade.ts:221-235: automatic cache fallback treated every UpgradeError with reason === "network_error" as a transport outage, although that reason also represented HTTP 403/429/500 and invalid pinned-release metadata from packages/cli/src/lib/upgrade.ts:713-733. With a cached target and patch, a curl installation could therefore continue after authorization, rate-limit, server, or malformed HTTP-200 failures instead of terminating.
• 🔴 (04:11) User required automatic cache fallback to be permitted only for typed transport failures; all non-404 HTTP failures and malformed successful metadata responses must remain terminal.
• 🔴 [requested-tests] (04:11) User required fail-closed regressions with populated version and patch caches for Toolkit HTTP 403 and malformed/mismatched HTTP-200 metadata. Tests must prove the original error propagates and that no legacy probe, cache application, binary download, setup, or installation occurs.
• 🔴 (04:11) Final security review identified stable npm validation gaps in packages/cli/src/lib/upgrade.ts:570-576 and stable package-manager routing at :661-670: any non-empty npm /latest version was accepted. A value such as 1.2.3-dev.123 could reach packages/cli/src/commands/cli/upgrade.ts:1075-1086 and migrate a stable npm installation to a Toolkit nightly binary; values such as 1.2.3-beta.1 could be installed as stable. Pinned package-manager targets likewise lacked stable-version validation before versionExists().
• 🔴 (04:11) User required one validator for npm latest and pinned stable targets: the value must be valid SemVer and satisfy prerelease(version) === null; every malformed or prerelease value must be rejected before execution or migration.
• 🔴 [requested-tests] (04:11) User required latest and pinned package-manager regressions for npm, pnpm, Bun, and Yarn covering -dev, beta/RC, malformed, and stable versions.
• 🔴 (04:11) User required prerelease npm targets to never trigger GHCR requests, package-manager spawn, migration, or setup.
• 🔴 (04:11) Final security verdict remained DO-NOT-MERGE. Static review found no deterministic test proving fail-closed behavior when HTTP/metadata failures coincide with populated offline caches; tests were not run because that review was restricted to immutable Git objects.
• 🟡 (04:11) Investigation confirmed the root cause: network_error combined transport failures, HTTP responses, and malformed metadata, while the fallback in packages/cli/src/commands/cli/upgrade.ts:221-235 assumed it meant transport only.
• 🟡 (04:11) Implementation decision: introduce internal UpgradeTransportError as a typed subclass while retaining the external UpgradeError.reason === "network_error" contract and existing CLI output. Only true connection, TLS, and timeout wrappers emit the subclass; HTTP and metadata failures remain ordinary UpgradeError. Automatic cached fallback requires the exact transport type.
• 🟡 (04:12) Assistant clarified that the transport-only classification applies to every discovery transport, including GitHub, npm, and GHCR.
• 🟡 (04:13) UpgradeTransportError changes were applied in packages/cli/src/lib/errors.ts, packages/cli/src/lib/binary.ts, packages/cli/src/lib/ghcr.ts, and packages/cli/src/commands/cli/upgrade.ts.
• 🟡 (04:13) Added validateStableVersion() at the npm response boundary and before package-manager existence checks in packages/cli/src/lib/upgrade.ts. It rejects malformed SemVer and every semantic prerelease while preserving valid stable values and upstream v normalization.
• 🟡 (04:14) The existing user-facing missing-version message, "No version found in npm registry", was preserved; strict malformed/prerelease errors were added separately.
• 🟡 (04:14) Added parameterized stable-version coverage in packages/cli/test/lib/upgrade.test.ts for npm latest and pinned package-manager paths. Malformed and prerelease versions are rejected before any installation route.
• 🟡 (04:15) Assistant chose command-level --check tests with a populated target cache instead of a full patch-cache fixture because --check traverses the same automatic fallback classification without applying code.
• 🟡 (04:15) Added deterministic command regressions in packages/cli/test/commands/cli/upgrade.test.ts: 1. a true transport failure uses the cached target; 2. HTTP 403 never uses the cached target; 3. malformed HTTP 200 never uses the cached target or probes legacy.
• 🔴 (04:15) User’s fail-closed test convention is "never uses the cached target after %s" for parameterized HTTP/metadata failure cases.
• 🟡 (04:15) Assistant began compiling and running focused command/library tests to verify the new transport type and unchanged public error rendering, but no completed test results were reported.
• 🟡 (04:15) Biome flagged packages/cli/test/commands/cli/upgrade.test.ts:429 under lint/suspicious/useStaticResponseMethods: new Response(JSON.stringify([{ tag_name: "mcp@1.0.0" }])) should use Response.json([{ tag_name: "mcp@1.0.0" }]). The check examined 8 files, fixed 2 files, and still reported 1 error.
• 🟡 (04:15) The malformed-metadata fixture was changed to Response.json([{ tag_name: "mcp@1.0.0" }]); the focused compile/test set was scheduled to rerun, with no rerun outcome yet reported.