test(web): keep installer fixture directories private across umasks

Create the happy-path install and home directories with mode0700 so a host umask0002 does not turn them into destinations that the installer correctly refuses. Production ownership and permission checks are unchanged. Checks on Linux with the exact two-line fixture patch:33/33 installer contracts at umask0002 and33/33 at0022;7/7 Node tests;1306/1306 Vitest tests across92files. OpenNext/Cloudflare packaging completed and Wrangler local dry-run exited0. TypeScript passed after the normal prebuild step. These are source/local packaging receipts, not a deployment. Independent Codex source review approved. Earlier Gemini Hydrogen website dependency and adapter repairs are retained unchanged.
fix(web): scope legacy lint allowances and retire the upstreamed adapter patch
2026-11-13 13:41:28 -10:00 · 2026-11-12 23:20:49 -08:00 · 2026-11-12 23:04:34 -08:00 · 2026-11-12 23:04:33 -08:00
8 changed files with 947 additions and 1016 deletions
@@ -1,13 +1,5 @@
-import { FlatCompat } from "@eslint/eslintrc";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";

 const eslintConfig = [
  {
@@ -26,13 +18,33 @@ const eslintConfig = [
      "vendor/whale-character-v2/**",
    ],
  },
-  ...compat.extends("next/core-web-vitals", "next/typescript"),
+  ...nextVitals,
+  ...nextTs,
  {
    rules: {
      // Bilingual CJK content uses curly quotes intentionally
      "react/no-unescaped-entities": "off",
    },
  },
+  {
+    files: [
+      "components/connection-banner.tsx",
+      "components/docs-search.tsx",
+      "components/mobile-menu.tsx",
+      "components/ratatui/explorer.tsx",
+      "components/theme-toggle.tsx",
+      "components/usage-counting.tsx",
+    ],
+    rules: {
+      "react-hooks/set-state-in-effect": "warn",
+    },
+  },
+  {
+    files: ["app/\\[locale\\]/page.tsx"],
+    rules: {
+      "react-hooks/purity": "off",
+    },
+  },
 ];

 export default eslintConfig;
@@ -65,7 +65,7 @@ function installFixture(
    : path.join(root, installDirName);
  const fakeBin = path.join(root, "fake-bin");
  mkdirSync(releaseDir, { recursive: true });
-  mkdirSync(installDir, { recursive: true });
+  mkdirSync(installDir, { recursive: true, mode: 0o700 });
  mkdirSync(fakeBin, { recursive: true });

  const runtime = executable("codewhale 0.9.5 (fixture)");
@@ -118,7 +118,7 @@ function installFixture(
    chmodSync(destination, 0o755);
  }

-  mkdirSync(home, { recursive: true });
+  mkdirSync(home, { recursive: true, mode: 0o700 });
  for (const file of homeFiles) {
    writeFileSync(path.join(home, file), "# existing profile\n");
  }
@@ -33,21 +33,21 @@
    "audit:dependencies": "node scripts/audit-dependencies.mjs"
  },
  "dependencies": {
-    "next": "^16.4.1",
+    "next": "16.4.6",
    "react": "^19.3.1",
    "react-dom": "^19.3.1",
    "stripe": "23.1.0"
  },
  "devDependencies": {
    "@cloudflare/config": "0.23.0",
-    "@opennextjs/cloudflare": "^1.20.9",
+    "@opennextjs/cloudflare": "1.20.17",
    "@types/node": "^26.6.6",
    "@types/react": "^19.3.0",
    "@types/react-dom": "^19.3.0",
    "autoprefixer": "^10.6.1",
    "cf": "1.0.0-beta.12",
    "eslint": "^9.39.4",
-    "eslint-config-next": "^15.5.18",
+    "eslint-config-next": "16.4.6",
    "github-slugger": "^2.0.0",
    "gt": "2.22.4",
    "marked": "^18.0.14",
@@ -55,7 +55,7 @@
    "tailwindcss": "^3.4.17",
    "typescript": "^5.7.3",
    "vitest": "^5.0.5",
-    "wrangler": "4.147.0"
+    "wrangler": "4.161.0"
  },
  "overrides": {
    "esbuild": "0.28.1",
@@ -2,28 +2,8 @@
 // OpenNext still reads the legacy config shape. Derive it with Cloudflare's
 // converter, keeping cloudflare.config.ts as the only Worker configuration.
 import { convertToWranglerConfig, loadAndParseConfig } from "@cloudflare/config";
-import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const manifestLoader = resolve(
-  dirname(fileURLToPath(import.meta.resolve("@opennextjs/cloudflare"))),
-  "../cli/build/patches/plugins/load-manifest.js",
-);
-const loader = readFileSync(manifestLoader, "utf8");
-const digest = (value) => createHash("sha256").update(value).digest("hex");
-const originalHash = "d9b01ab939652e9c120da66dbbfc25c18b249b53258e4e21bcf59ac63412d700";
-const patchedHash = "06287c108cf324ab20494dc714e7eeadbd405661f54e01108c5fa2e079e46867";
-if (digest(loader) !== patchedHash) {
-  if (digest(loader) !== originalHash) throw new Error("Unreviewed OpenNext manifest loader; review or retire the preview-props patch");
-  const patched = loader.replace(
-    "**/{*-manifest,required-server-files,prefetch-hints}.json",
-    "**/{*-manifest,required-server-files,prefetch-hints,preview-props}.json",
-  );
-  if (digest(patched) !== patchedHash) throw new Error("OpenNext preview-props patch digest mismatch");
-  writeFileSync(manifestLoader, patched);
-}
+import { mkdirSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";

 const { result } = await loadAndParseConfig(resolve("cloudflare.config.ts"), {
  isPreview: false,
@@ -11,7 +11,7 @@ const upstreamFixes = [
 const reviewed = [
  {
    "package": "next",
-    "version": "16.4.1",
+    "version": "16.4.6",
    "file": "dist/compiled/@vercel/nft/index.js",
    "original": "e436d398b2263fb87a2d8ee3d9dab8db2544c684ba9bc1c0d4ab4e67acbab207",
    "patched": "3acafac86a359647efceec23f1a838103911dadd5ab63ee3a5b8afa661d20a37",
@@ -108,10 +108,10 @@ const reviewed = [
  },
  {
    "package": "wrangler",
-    "version": "4.147.0",
+    "version": "4.161.0",
    "file": "wrangler-dist/cli.js",
-    "original": "f2ec95b41d7f7665a42b75fc9631100e95ea6c0dbabc09eb65ae7f772dbc2fed",
-    "patched": "ec5c069ff0bd70c9678a1e499f41bff15d94d5c09b7bacee4d9166ab30bcc63b",
+    "original": "26835ab3b89181c37f97c99330ed17bbc7ec4d3ad3014175f6ffb2118c998f86",
+    "patched": "9a9fea2dcbdfba59d67006d55e413071ca53a22467782a67256eabdf2deb341b",
    "edits": [
      {
        "before": "firstPhasePreProcess(globParts) {\n        let didSomething = false;",
@@ -30,6 +30,18 @@ const reviewed = {
      "original": "3e15af549ecc74d8691982d571168fd4b0e38b494c2cbb3edcfb8f97d4036ac6",
      "patched": "8afedbdf3bb2bddaf37ee3ef4b393b76a5a99c80ef12aaedd2160a77c2effadb"
    }
+  ],
+  "13.0.7": [
+    {
+      "file": "dist/commonjs/walker.js",
+      "original": "4eca6e1f2fd9c9ef7469977a12c7e9bd6503bc7a9257ccdc8e79b346ec34fccd",
+      "patched": "4eca6e1f2fd9c9ef7469977a12c7e9bd6503bc7a9257ccdc8e79b346ec34fccd"
+    },
+    {
+      "file": "dist/esm/walker.js",
+      "original": "8afedbdf3bb2bddaf37ee3ef4b393b76a5a99c80ef12aaedd2160a77c2effadb",
+      "patched": "8afedbdf3bb2bddaf37ee3ef4b393b76a5a99c80ef12aaedd2160a77c2effadb"
+    }
  ]
 };
 const edits = [
@@ -37,6 +37,18 @@ const reviewed = {
      "original": "59821ec2ce0d3df968292036e5c831ad322b33e9c33a949ecbc9dfe125d165be",
      "patched": "37ba4ff4010cda499e890975983b78ebd5f2be2dd8506d938472de4af8e9ed25"
    }
+  ],
+  "10.2.6": [
+    {
+      "file": "dist/commonjs/index.js",
+      "original": "d224f71f20d7c206fcc5b7e9f747324c7698345a0b2c28d717dd9cf698306783",
+      "patched": "7e835c0a30f7b4f29f4ad8cf8c3e92b97ab23ed854a7a777f240d6bdf3d19231"
+    },
+    {
+      "file": "dist/esm/index.js",
+      "original": "59821ec2ce0d3df968292036e5c831ad322b33e9c33a949ecbc9dfe125d165be",
+      "patched": "37ba4ff4010cda499e890975983b78ebd5f2be2dd8506d938472de4af8e9ed25"
+    }
  ]
 };
 const edits = [