Support anonymous Free package installs - #730
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Free package installs succeed without a working login, while publishers can still install retained Private history. Package reads skip proactive refresh when public access succeeds. A missing required version or denied LPM read can recover a refreshable stored session once, then retry with the rotated bearer and its metadata cache partition. Explicit, environment, CI, and legacy credentials retain their source-specific behavior. Generic non-LPM-origin tarball reads neither receive the LPM bearer nor trigger its refresh.
Free installs do not produce Pool accounting. Swift setup supports anonymous public resolution with certificate verification. The lockfile updates rustls to 0.23.45 and required cryptographic dependencies for RUSTSEC-2026-0285.
Validation on Rust 1.94.0: workspace build and all-target clippy clean; formatting clean; 6,300 workspace tests, 5,123 serial CLI tests, 97 CLI integration tests, 83 focused Free/Swift/credentials/health workflows passed. Two default-concurrency auth runs each passed 174 tests. Dependency policy passed. Vite/React install readiness passed cold, CI-cold, warm, and up-to-date states. All five expanded localhost publication scenarios passed with the patched CLI and real dev services.
Successful public installs leave expired stored credentials untouched. A range that already matches a public release can select it without discovering newer publisher-only history. Documentation explains explicit historical-version selection. One health deadline test exceeded its wall-clock allowance during simultaneous builds and high-concurrency testing; all focused workflows passed with four test slots.
Current revision
daf6ec8d: all 12 configured non-skipped CI checks passed; 6 checks are skipped by the PR workflow.Independent review: one Daybreak-blue security reviewer and two Astra reviewers for performance and correctness. Across the three PRs: 23 leads, 19 verified and fixed, 4 rejected with evidence, 0 blocked, 0 pending. Final source reviews are clean. The finding ledger is free-package-distribution-review.md.
Related PRs: Registry, CLI, CLI docs.
Generated by OpenAI Codex (
GPT-6) using the Codex agent harness.