fix: preserve sha-suffixed active version dir in tidy()#1362
Merged
jfeingold35 merged 1 commit intoJun 30, 2026
Merged
Conversation
Installed CLIs live in directories named "<version>-<sha>" (e.g.
"1.2.3-abc1234"), but `this.config.version` is plain semver ("1.2.3").
Two guards meant to stop the running CLI from deleting itself both
failed for sha-suffixed installs:
- `tidy()`'s `isNotSpecial` used an exact-match `includes(version)`
check, so "1.2.3-abc1234" was never recognized as the active version
and lost its name-based protection. The `startsWith` guard that
originally handled this (ca57247, oclif#621) was dropped in the ESM
refactor (oclif#643); oclif#1290 later restored only the bin/current protection
via the arg-swap fix, not the startsWith semantics.
- `touch()` joined the bare `config.version`, producing a path that
does not exist on disk, so it silently no-op'd and never refreshed
the active dir's mtime.
With both guards failing, once a CLI stayed on the latest version for
42+ days, `tidy()` deleted the directory the `current` symlink points
to, leaving `current` dangling and the CLI broken.
Restore the `startsWith` guard in `isNotSpecial` and resolve the real
"<version>-<sha>" directory in `touch()` via a shared `resolveActiveDir`
helper. Add regression tests covering both the tidy guard and the touch
backstop for sha-suffixed installs.
fixes: oclif#1361
khaled4vokalz
changed the title
jfeingold35
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Installed CLIs live in directories named "-" (e.g. "1.2.3-abc1234"), but
this.config.versionis plain semver ("1.2.3"). Two guards meant to stop the running CLI from deleting itself both failed for sha-suffixed installs:tidy()'sisNotSpecialused an exact-matchincludes(version)check, so "1.2.3-abc1234" was never recognized as the active version and lost its name-based protection. ThestartsWithguard that originally handled this (ca57247, fix: clis don't delete themselves #621) was dropped in the ESM refactor (feat!: ESM + Node 18 #643); fix: swap arguments to isNotSpecial in tidy() to correctly preserve bin/ and current #1290 later restored only the bin/current protection via the arg-swap fix, not the startsWith semantics.touch()joined the bareconfig.version, producing a path that does not exist on disk, so it silently no-op'd and never refreshed the active dir's mtime.With both guards failing, once a CLI stayed on the latest version for 42+ days,
tidy()deleted the directory thecurrentsymlink points to, leavingcurrentdangling and the CLI broken.Restore the
startsWithguard inisNotSpecialand resolve the real "-" directory intouch()via a sharedresolveActiveDirhelper. Add regression tests covering both the tidy guard and the touch backstop for sha-suffixed installs.fixes: #1361