fix(mise): hold ccusage 20.0.37 and ccstatusline 2.2.32; main went red on 20.0.38 (U42) by moriya-fumio-thd · Pull Request #496 · mryfmo/dotfiles

moriya-fumio-thd · 2026-10-24T10:57:30Z

Program-Unit: regime-cutover/U42

Cause (measured)

main run 40087404553 (Unit test on 50cde13) failed in all four test jobs at "Smoke-test statusline tools without network". From job 120853039189:

/home/runner/.local/share/mise/installs/npm-ccusage/latest/bin/ccusage --version failed with 1: ccusage native binary is not available for linux-x64. Reinstall ccusage so optional native dependencies are installed.

macos-14 failed the same way with darwin-arm64. The installs in that run and in the last green run (40086677434, PR head 2babd4b):

Tool	Green run 40086677434	Red run 40087404553
`npm:ccstatusline`	2.2.32	2.2.32
`npm:ccusage`	20.0.37 (`added 2 packages`)	20.0.38 (`added 1 package`: no native binary)

Why the cooldown didn't stop it: the registry (npm view ccusage time, read-only) says 20.0.38 was published 2026-10-21T10:49:51.361Z. Under minimum_release_age = "72h" it became latest at 2026-10-24T10:49Z, between the green PR run and the main run, so the break came from upstream, not from the diff. 20.0.39 (2026-10-21T17:22:02.905Z) clears the cooldown at about 17:22Z today, so leaving the tool unpinned would only move the break.

Change

home/dot_mise/config.toml: "npm:ccusage" = "20.0.37" and "npm:ccstatusline" = "2.2.32", the versions that installed and answered --version on every runner in run 40086677434. Each has a # Held: reason line with the measured cause, held until a release restores the linux-x64 binary. The other six npm tools stay latest, because the smoke step doesn't execute them.
.github/workflows/test.yaml, the smoke step: when the smoke fails on either platform it now prints statusline smoke failed with npm:ccusage <v> and npm:ccstatusline <v>: bump the exact pins in home/dot_mise/config.toml before exit 1. No continue-on-error, no skip.
tests/unit/test_statusline_tools.py: test_mise_config_holds_the_statusline_tools_at_exact_versions pins both version strings, and the smoke test pins the message and both || smoke_failed call sites.
tests/unit/test_supply_chain_policy.py (grant, row 5189): the held set gains exactly the two names. Its rule of a one-line reason above each held line is met.
README.md: unchanged, because it doesn't document the statusline tools.

Mutation checks: setting npm:ccusage back to latest fails test_mise_config_holds_the_statusline_tools_at_exact_versions; dropping one || smoke_failed fails test_ci_smokes_statusline_tools_with_network_denied.

No threat table: this is a version pin and a diagnostic line, with no trust boundary touched.

Generated with Claude Code

…d on 20.0.38 (U42) ccusage 20.0.38 (published 2026-10-21T10:49:51Z) passed the 72h cooldown at 2026-10-24T10:49Z, between the green PR run 40086677434 and the main run 40087404553. mise's npm backend installs it without its optional native binary, so `ccusage --version` fails on linux-x64 and darwin-arm64 in all four test jobs. Both tools the CI statusline smoke runs are held at the versions that ran green on every runner, each with its reason line, until a release restores the binary. - The smoke step names the pins to bump when it fails. - test_statusline_tools pins both versions and the message; test_supply_chain_policy lists them as held (grant, row 5189). Program-Unit: regime-cutover/U42 Co-Authored-By: Claude Opus 5.5 <[email protected]>

coderabbitai · 2026-10-24T10:57:38Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: mryfmo/dotfiles
Branch: fix/pin-statusline-npm-tools
File: .coderabbit.yaml
Commit: 4b63ee3
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 913e5984-1aff-4e91-9031-6d8773b772e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-24T10:57:42Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T10:59:29.803529Z	`4b63ee3`	PR opened
🔒 Security Review	✅ Completed 2026-10-24T10:59:30.147746Z	`4b63ee3`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

moriya-fumio-thd · 2026-10-24T10:58:50Z

Worker pre-RESULT self-check for U42 at head 4b63ee3a0de18b3841a247b8d7fc384e65853c8b (U30 ADDENDUM 2 item 6, standing order 23). Branched from origin/main 50cde13.

(a) Threat table. Not needed: a version pin and one diagnostic line, with no trust boundary touched (the brief says so). The PR body says so too.
(b) Producers. The new smoke_failed runs only on the existing failure path. The smoke command's own non-zero exit still ends the step with exit 1; the step's set -euo pipefail is unchanged. shellcheck -s bash on the extracted run block: clean.
(c) Destructive steps. None.
(d) Migrations through the real path. A host on latest 20.0.38 moves to the pinned 20.0.37 through make update's normal mise install. A mise version request accepts an older exact version, and 20.0.37 is far past the 72h cooldown.
(e) Local:
- test_statusline_tools, test_supply_chain_policy, test_workflow_security, test_workflow_orchestration_skip, test_asset_manifest, test_upgrade_tools: Ran 69 tests / OK.
- Mutations: npm:ccusage back to latest fails test_mise_config_holds_the_statusline_tools_at_exact_versions; one || smoke_failed dropped fails test_ci_smokes_statusline_tools_with_network_denied.
- make validate-agent-assets: agent asset validation ok. make render-check: generated agent configs are up to date (both unchanged).
- Lints: lint-comparisons exit 0, ruff format --check clean.
- No local install of the tools: it would write into the live mise data. The four test jobs on this head are the install-and---version evidence, read from CI. No local bats (AGENTS.md:35).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4b63ee3a0d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-24T10:59:27Z

+          smoke_failed() {
+            printf 'statusline smoke failed with npm:ccusage %s and npm:ccstatusline %s: bump the exact pins in home/dot_mise/config.toml\n' \
+              "${ccusage_version}" "${ccstatusline_version}" >&2
+            exit 1
+          }


Add the required threat table for the CI change

This modifies failure handling in the required Unit test workflow, which the repository explicitly classifies as trust-boundary code, but the reviewed changeset contains no task metadata or threat_table for U42. Add the required table covering each changed workflow control so the new failure path can be evaluated against its stated threats.

AGENTS.md reference: AGENTS.md:L77-L77

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-24T10:59:27Z

+# Held: the npm backend installs 20.0.38 without its optional linux-x64 native binary (run 40087404553); keep until a release restores it.
+"npm:ccusage" = "20.0.37"


Exclude the held statusline tools from Renovate

On the scheduled Renovate run, the root renovate.json enables the mise manager for this file and groups mise patch updates, while disabling updates only for the existing fd and npm:pnpm holds. Consequently the newly exact npm:ccusage pin can still receive a Renovate proposal for the known-bad 20.0.38 release (potentially grouped with npm:ccstatusline), so the stated hold is not enforced by the repository's dependency automation. Add both statusline packages to a disabled mise package rule until the hold is intentionally removed.

Useful? React with 👍 / 👎.

moriya-fumio-thd · 2026-10-24T11:08:20Z

CI on head 4b63ee3a0de18b3841a247b8d7fc384e65853c8b: 11/11 SUCCESS, including the four test jobs and their statusline smoke.

Job	ccusage install	Suite
test (ubuntu-24.04, client)	`npm:[email protected] added 2 packages`	`Ran 805 tests in 93.144s` / `OK (skipped=5)`
test (ubuntu-24.04, server)	`npm:[email protected] added 2 packages`	`Ran 805 tests in 83.861s` / `OK (skipped=5)`
test (macos-14, client)	`npm:[email protected] added 2 packages`	`Ran 805 tests in 162.850s` / `OK (skipped=5)`
test (ubuntu-26.04, client)	`npm:[email protected] added 2 packages`	`Ran 805 tests in 84.908s` / `OK (skipped=6)`

"2 packages", against 20.0.38's "1 package", is the native binary coming back.

chatgpt-codex-connector Bot reviewed Oct 24, 2026

View reviewed changes

This was referenced Oct 24, 2026

chore(agmsg): remove the agmsg docs, skill and deployed skill tree (U27) #495

Merged

ci: shard the Python unit tests; skip the bootstrap for render-only home/ diffs (U39) #493

Merged

moriya-fumio-thd merged commit db894e9 into main Oct 24, 2026
11 checks passed

This was referenced Oct 24, 2026

fix(release): publish platform packages before the wrapper ccusage/ccusage#1963

Closed

fix(release): publish platform packages before the wrapper ccusage/ccusage#1965

Merged

Navigation Menu

Repository navigation

fix(mise): hold ccusage 20.0.37 and ccstatusline 2.2.32; main went red on 20.0.38 (U42) - #496

fix(mise): hold ccusage 20.0.37 and ccstatusline 2.2.32; main went red on 20.0.38 (U42)#496
moriya-fumio-thd merged 1 commit into
mainfrom
fix/pin-statusline-npm-tools

moriya-fumio-thd commented Oct 24, 2026

Uh oh!

coderabbitai Bot commented Oct 24, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

moriya-fumio-thd commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Uh oh!

Uh oh!

moriya-fumio-thd commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		# Held: the npm backend installs 20.0.38 without its optional linux-x64 native binary (run 40087404553); keep until a release restores it.
		"npm:ccusage" = "20.0.37"

Conversation

moriya-fumio-thd commented Oct 24, 2026

Cause (measured)

Change

Uh oh!

coderabbitai Bot commented Oct 24, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

moriya-fumio-thd commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

moriya-fumio-thd commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading