fix: GA-launch hardening pass#39
Merged
Merged
Conversation
…sed, pre-migration DB backup, trial-claims retention+headers, AST-fallback resilience, paid coming-soon gate) Independent fixes, no secrets/infra involved: - pyproject.toml: pin tree-sitter-language-pack==0.9.0. 1.x lazily downloads grammar binaries from a GitHub release at import time, which 403s offline and makes index_repo silently index 0 files. - backends/codegraph.py: CompositeSymbolIndexer.index_file now falls back to the regex indexer if the AST backend raises at runtime (e.g. the above), instead of propagating the failure or silently producing nothing. - config.py: an explicitly-set invalid ENGRAPHIS_SERVICE_MODE now exits the process instead of silently coercing to combined, which would merge the vendor and customer trust domains on a typo. Unset still defaults to combined. - core/store.py: init_schema takes a best-effort pre-migration snapshot (<db>.pre-migration-v4.bak via SQLite's online backup API) before the v4 canonicalization/edge-support backfills, gated to real upgrades only. - inspector/license_cloud.py: claim_trial_license's response (which carries the raw license key) now sends Cache-Control: no-store + Referrer-Policy: no-referrer; added a global retention sweep on trial_claims so confirmed/claimed rows don't grow the table unbounded (previously only unconfirmed-expired rows were swept). - licensing.py: new ENGRAPHIS_PAID_AVAILABLE gate (default off) routes upgrade_url() to an informational coming-soon page instead of the live Polar checkout, so a free launch's Buy Pro/Team button can't charge a customer before the vendor side is wired. Explicit ENGRAPHIS_*_UPGRADE_URL overrides still always win. Also warns in production_warnings() if paid is enabled while VENDOR_SIGNER_RELEASE_READY is still False. Deliberately NOT touched: VENDOR_SIGNER_RELEASE_READY (business go-live decision, not a bug fix), any Railway/Polar/Resend env vars or DNS (require account access I don't have), and the NOTICE/CHANGELOG/SECURITY wording pass (needs verification against actual current bundling status I haven't confirmed).
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
- test_config: service_mode now fail-closed (sys.exit) instead of silent fallback to 'combined' — test updated to expect SystemExit - test_licensing: upgrade_url defaults to coming-soon page (engraphis.com) until ENGRAPHIS_PAID_AVAILABLE=1 — split into two tests covering both paths; require_feature message match updated from polar.sh to engraphis.com Fixes CI failures on PR #39 (all 4 jobs: core-floor 3.9 + full-stack 3.10/3.11/3.12)
Owner
Author
Pre-PR Code Review — APPROVE (post-merge record)Reviewer: Hermes Pre-PR Code Reviewer (automated) SummarySix independent hardening fixes for GA launch. All changes are defensive, well-documented, and properly tested. Analysis
All 8 CI checks passed. Merged 2026-07-21. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Six independent code fixes: tree-sitter-language-pack pin (offline 403 fix), AST-indexer regex fallback on runtime failure, service-mode fail-closed on invalid value, pre-migration DB snapshot, trial-claim key response headers + retention sweep, and a paid coming-soon gate (ENGRAPHIS_PAID_AVAILABLE) so Buy Pro/Team can't charge before the vendor side is live.