Honest install-only UX and Nu-agnostic try fallbacks

[tonythethompson]

Summary

• search / info: scripts and completions report install-only (activation deferred) instead of module-style ABI labels
• numan try: prefer activatable curated starters; fall back to SuaveIV/nu_script_wttr then Sanceilaks/nufetch; skip activate for install-only types and print overlay use guidance
• Pin offer still only applies to activatable curated starters

Test plan

• cargo test --lib select_starter / install-only search+info tests
• cargo clippy -- -D warnings
• After registry Wave 3B is on CDN: numan search cargo etc.; numan try with no plugin starter installs a script without activation error

[sourcery-ai]

Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

@tonythethompson, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 31 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b18b49e1-4cb9-4a79-bc01-69d120925236

📥 Commits

Reviewing files that changed from the base of the PR and between 2fdd2d3 and 467d80b.

📒 Files selected for processing (3)

• src/cmd/info.rs
• src/cmd/search.rs
• src/cmd/try_cmd.rs

📝 Walkthrough

Walkthrough

Changes

Package activation behavior

Layer / File(s)	Summary
Install-only status reporting src/cmd/info.rs, src/cmd/search.rs	Info and search output label scripts and completions as install-only with activation deferred. Tests validate the new wording and type labels.
Try activation and install-only output src/cmd/try_cmd.rs	numan try separates activatable packages from scripts and completions, prioritizes compatible starters, skips activation when required, and prints payload or overlay guidance.
Typed fixtures and selection coverage src/cmd/try_cmd.rs	Test fixtures support arbitrary package types and type-specific artifacts. Tests cover script selection order and pin-offer behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• tonythethompson/numan#41: Directly relates to package-type handling in info, search, and try_cmd.
• tonythethompson/numan#50: Relates to script and completion status labels in search.rs.
• tonythethompson/numan#68: Relates to activation and Nu pin-offer behavior in try_cmd.rs.

Suggested reviewers: greptile-apps

🚥 Pre-merge checks | ✅ 8

✅ Passed checks (8 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the install-only UX changes and Nu-agnostic fallback behavior.
Description check	✅ Passed	The description directly covers the search, info, try fallback, activation, testing, and pending CDN checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Pipeline Stage Enum Ordering	✅ Passed	The PR changes only src/cmd/info.rs, search.rs, and try_cmd.rs; no tracked file defines or references SessionWorkflowStage or its members.
Gpu/Cpu Runtime Boundary	✅ Passed	The full PR diff from origin/master changes only src/cmd/info.rs, search.rs, and try_cmd.rs; no inference or managed CPU/GPU requirements files are modified.
Managed Host Restart Safety	✅ Passed	The pull request changes only src/cmd/try_cmd.rs; none of the four managed-host components or restart/lease symbols are present in the repository.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/install-only-honesty-try-scripts

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feature/install-only-honesty-try-scripts

Warning

Review ran into problems

🔥 Problems

Linked repositories: Public OSS repositories can only analyze public repositories installed in this organization. Analyzed tonythethompson/QuickShell, tonythethompson/numan, tonythethompson/dependency-chain-substrate, skipped Trackdubllc/Trackdub.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Mark scripts/completions as install-only; make try fall back without activation

✨ Enhancement 🧪 Tests 🕐 40+ Minutes

AI Description

• Label scripts/completions as install-only (activation deferred) in search and info output.
• Update numan try to prefer activatable curated starters, then fall back to Nu-agnostic scripts.
• Skip activation for install-only installs and print overlay use guidance from the lockfile.

Diagram

graph TD
  U(["User"]) --> TRY(["cmd: try"]) --> REG[("Registry index")] --> SEL(["Starter selection"]) --> INST(["Install transaction"]) --> DEC{"Install-only?"}
  DEC -->|"yes"| LF[("Lockfile")] --> HINT(["Print overlay hint"])
  DEC -->|"no"| ACT(["Activate package"])
  U --> SI(["cmd: search/info"]) --> REG --> LABELS(["Install-only labels"])

  subgraph Legend
    direction LR
    _u(["User / CLI"]) ~~~ _cmd(["Command"]) ~~~ _db[("Data store")] ~~~ _dec{"Decision"}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Registry-driven starter ranking/metadata

• ➕ Avoids hardcoding fallback IDs in the CLI
• ➕ Lets the registry evolve starter recommendations without shipping a new binary
• ➕ Can encode activatable vs install-only and preferred ordering explicitly
• ➖ Requires registry schema/versioning work and migration
• ➖ More moving parts (registry authoring + client compatibility)

2. Separate `try --script` (or `try-script`) path

• ➕ Keeps default try focused on activatable onboarding
• ➕ Makes the activation/no-activation UX explicit rather than inferred from type
• ➖ Adds surface area to CLI and docs
• ➖ Still needs a default script list or discovery mechanism

Recommendation: Current approach is a pragmatic UX improvement: it keeps curated activatable starters as the primary path, while providing a safe, Nu-agnostic install-only fallback and avoiding broken activation calls. If the fallback list grows or becomes contentious, move toward registry-driven starter metadata.

Files changed (3) +171 / -38

Enhancement (3) +171 / -38

info.rsShow install-only activation status for scripts/completions +15/-10

Show install-only activation status for scripts/completions

• Adds an explicit "Activation: install-only (activation deferred…)" line for Script/Completion package types in 'numan info' output. Updates unit tests to assert the new messaging for script packages.

src/cmd/info.rs

search.rsMark scripts/completions as install-only in search status labels +17/-5

Mark scripts/completions as install-only in search status labels

• Adjusts row-status formatting so scripts/completions display an install-only, activation-deferred suffix (optionally including verified-with data) instead of module-style "not ABI-locked" wording. Updates tests to validate the new labels and ensure '[compatible]'/'not ABI-locked' do not appear for these types.

src/cmd/search.rs

try_cmd.rsPrefer activatable starters; fall back to scripts and skip activation +139/-23

Prefer activatable starters; fall back to scripts and skip activation

• Extends curated starters with Nu-agnostic script fallbacks and refines selection order to prefer activatable starters first, then install-only scripts before offering Nu pinning. After install, detects install-only types and avoids activation, printing 'overlay use' guidance by resolving the payload path via the lockfile. Expands test helpers and adds new tests to cover fallback ordering and script preference behavior.

src/cmd/try_cmd.rs

[greptile-apps]

Greptile Summary

The PR makes script and completion UX explicitly install-only and updates numan try to prefer activatable starters before falling back to Nu-agnostic scripts.

• Labels scripts and completions as install-only in search and info.
• Adds curated script fallbacks while excluding install-only packages from activation and Nu pin offers.
• Builds usage guidance from the installed lockfile record so it reflects the version actually selected.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the prior wrong-version hint issue is fixed by deriving the entry and payload path from the completed installation’s lockfile record.

Important Files Changed

Filename	Overview
src/cmd/info.rs	Adds explicit install-only activation messaging for script and completion package details.
src/cmd/search.rs	Gives scripts and completions install-only status labels even when Nu detection is unavailable.
src/cmd/try_cmd.rs	Adds script fallbacks, skips activation for install-only types, and fixes usage hints to read the resolved entry and payload path from the lockfile.

_{Reviews (3): Last reviewed commit: "Harden install-only try hints and search..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cmd/info.rs`:
- Around line 169-174: Add a separate test case alongside
format_info_marks_script_install_only that sets package_type to
PackageType::Completion, calls format_info with the same inputs, and asserts the
output contains “Activation: install-only”.

In `@src/cmd/try_cmd.rs`:
- Around line 334-343: Update the overlay hint logic in print_install_only_hint
to use the installed lockfile record’s resolved artifact entry instead of
pkg.versions.last(). Ensure the payload path and entry name come from the same
installed version, and add a multi-version test with distinct artifact.entry
values verifying the printed overlay path is correct.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1d22b12b-2d3d-4203-ad93-1b6d6c8eae6b

📥 Commits

Reviewing files that changed from the base of the PR and between c8d0764 and bfae650.

📒 Files selected for processing (3)

• src/cmd/info.rs
• src/cmd/search.rs
• src/cmd/try_cmd.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• tonythethompson/QuickShell (manual)
• tonythethompson/numan (manual)
• tonythethompson/dependency-chain-substrate (manual)

📜 Review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: Greptile Review
• GitHub Check: Real-Nu acceptance (windows-latest)
• GitHub Check: Test (windows-latest)
• GitHub Check: Analyze (rust)

🧰 Additional context used

📓 Path-based instructions (9)

**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Use Serena's semantic, symbol-aware tools as the primary tools for reading and editing code; use built-in Read, Glob, Grep, and Edit only under the stated exceptions.
Before editing a code file, inspect its symbol overview, read the specific symbols being changed, and edit them with Serena's symbol-aware tools.
Understand the existing code before changing it and make the smallest change that satisfies the request; avoid unrelated cleanup, premature abstractions, unnecessary error handling, feature flags, and compatibility shims.
Prefer editing existing files over creating new ones, and never create Markdown or README files unless explicitly requested.
For exploratory questions, provide a 2–3 sentence recommendation with the main tradeoff and do not implement until the user agrees.
For UI or frontend changes that cannot be tested in a browser, explicitly state that browser testing was not performed rather than claiming success.
Address security issues when discovered, including injection, XSS, SQL injection, path traversal, and secret leaks.
Pause and obtain confirmation before destructive, hard-to-reverse, externally visible, or third-party-upload actions, including deleting files or branches, dropping tables, force-pushing, modifying CI/CD, posting externally, or uploading content.
When blocked, investigate the root cause instead of bypassing it with --no-verify, --force, or deletion; investigate unfamiliar files, branches, and configuration before deleting them.
Only commit when explicitly asked; do not proactively update git configuration or push changes.
Do not skip Git hooks unless explicitly asked; if a pre-commit hook fails, fix the issue, re-stage, and create a new commit rather than amending.
Stage files by name rather than using git add -A or git add ., to avoid accidentally including secrets or large binaries.
Use a HEREDOC for commit messages, and add co-author attribution only when the user explicitly requests the exact trailer.
Do not force-pus...

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}

📄 CodeRabbit inference engine (CLAUDE.md)

Add comments only when the WHY is non-obvious; do not narrate what the code does, reference the current task, or reference the PR in comments.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

!**/.env,!**/credentials.json,!**/*.pem

📄 CodeRabbit inference engine (CLAUDE.md)

Do not commit files that appear to contain secrets, including .env, credentials.json, and PEM files; warn before doing so even if explicitly requested.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.rs: Use the Rust 2021 edition.
Use anyhow::Result with .context(...) in application code; use thiserror for library error types that callers match on.
Use clap derive macros for CLI definitions.
Use serde with serde_json or toml for serialization.
Function parameters must use &Path, not &PathBuf.
Library code must not panic; error paths should return anyhow::Result with context where appropriate.
Add or update tests for behavior changes, including relevant failure paths.
New mutating code paths must acquire the mutation lock via acquire_mutation_lock(root) and snapshot the lockfile before writes.
Lockfile, journal, and state-file JSON writes must use write_json_atomic.
numan install must write only to $NUMAN_ROOT; it must not invoke Nu or register plugins/autoloads.
Only activate and deactivate may modify Nu integration state.
Treat the lockfile as the authoritative source of truth; derived projections such as autoload state must not be authoritative.
Install payloads under versioned, content-addressed paths and never overwrite them in place.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass plugin paths through environment variables only; do not use runtime interpolation in Nu program strings.

**/*.rs: All CI gates must pass: cargo test, cargo clippy -- -D warnings, and cargo fmt --check.
Every mutating command—including install, remove, update, gc, and future nupm import—must call acquire_mutation_lock(root).
Lockfiles, journals, and state files must use write_json_atomic; partial writes are not allowed.
Pending activation, autoload, and lifecycle journals must be stored under $NUMAN_ROOT/state/.
Module autoload identity must match all four fields: Nu executable hash, Nu version, vendor autoload directory, and managed file path; the lockfile module_activation value is authoritative.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass paths to Nu only throu...

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.{rs,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Run and keep cargo fmt/rustfmt clean, and ensure cargo clippy -- -D warnings passes.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.{rs,nu}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.{rs,nu}: Real-Nu acceptance tests must be marked #[ignore] and should be run when changes affect activation or nupm import; unit tests must not spawn real nu and should use injectable seams such as FakeCandidateRunner or registrars.
The nupm integration must be read-only toward NUPM_HOME, must not execute build.nu, and must not perform bidirectional synchronization.

Unit tests must use FakeCandidateRunner or injectable registrars and must not spawn a real nu process.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.{rs,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Match existing naming, module layout, and documentation level in the file being edited; update AGENTS.md, docs/, or command help when structure, conventions, or user-visible behavior changes.

Tests must cover failure modes, not only successful execution.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

**/*.{rs,md,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Use the repository's established serialization and module conventions rather than introducing unrelated refactors.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

src/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.rs: Never panic in library code; return errors instead.
Use clap derive macros for CLI definitions and preserve lowercase numan for the executable while using Numan in prose.
Use serde/serde_json for JSON serialization and toml for configuration serialization.

Files:

• src/cmd/search.rs
• src/cmd/info.rs
• src/cmd/try_cmd.rs

🔍 Remote MCP GitHub Copilot

Additional review context

• PR #95 changes only info.rs, search.rs, and try_cmd.rs (+171/−38). CI had Clippy, formatting, Deny, MSRV, package, and roadmap checks passing; platform tests were still running when queried.
• Existing project support defines plugins/modules as activatable, while scripts/completions are install-only; the install transaction preserves artifact.entry in the lockfile.
• The proposed fallback packages are present in the registry: SuaveIV/nu_script_wttr and Sanceilaks/nufetch are scripts with nu_version: "*", single archive entries (weather.nu and nufetch.nu), and no activation metadata.
• try_cmd resolves the selected version through Resolver, but its install-only hint reads pkg.versions.last().artifact.entry rather than the resolved entry stored in the lockfile. Current fallback specs each have one version, but multi-version script packages should be covered before relying on this path.
• Historical PR #39 documents the intended activation boundary: only plugins and modules are activated; scripts and completion packages remain inert.

🔇 Additional comments (1)

src/cmd/try_cmd.rs (1)

513-543: 📐 Maintainability & Code Quality

Verify all required Rust gates before merge.

The supplied CI context confirms formatting and Clippy checks, but platform tests were still running. Confirm that cargo test, cargo clippy -- -D warnings, and cargo fmt --check all pass for this change.

As per coding guidelines, “All CI gates must pass: cargo test, cargo clippy -- -D warnings, and cargo fmt --check.”

Sources: Coding guidelines, MCP tools

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bfae650055

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Wrong entry in hint ✓ Resolved 🐞 Bug ≡ Correctness

Description

print_install_only_hint() builds the suggested overlay use path from
pkg.versions.last().artifact.entry, which may not match the version that install_package()
actually installed, so the printed path can point to a non-existent file. This breaks the happy-path
UX for install-only starters with unsorted versions or when the newest version is incompatible with
the current Nu.

Code

src/cmd/try_cmd.rs[R334-336]

+    let entry = pkg
+        .and_then(|p| p.versions.last())
+        .and_then(|v| v.artifact.entry.as_deref());

Relevance

●●● Strong

Team previously fixed unsafe versions.last() assumption; expects semver-max/resolved version, not
last element.

PR-#41

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The hint uses versions.last() from registry metadata, but install_package() records the
installed artifact’s entry and payload_path in the lockfile; these can differ when the version
list isn’t ordered or when compatibility forces an older version. The repo already fixed a similar
unsafe assumption in search by computing newest version via semver max instead of last().

src/cmd/try_cmd.rs[332-347]
src/install/transaction.rs[152-170]
src/install/transaction.rs[362-400]
src/state/lockfile.rs[58-111]
src/cmd/search.rs[62-68]
PR-#41

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`print_install_only_hint()` derives `entry_name` from `pkg.versions.last()`, but installation chooses a resolved version and persists its metadata in the lockfile. If registry versions are unsorted or the last version is incompatible, the hint prints an `overlay use` path that doesn't exist in the installed payload.

## Issue Context
- Installation persists the installed version’s `payload_path` and `entry` in the lockfile.
- `search` already avoids `versions.last()` and uses semver max, indicating `last()` is not a safe assumption.

## Fix Focus Areas
- src/cmd/try_cmd.rs[332-353]
- src/state/lockfile.rs[58-111]
- src/install/transaction.rs[362-400]
- src/cmd/search.rs[62-68]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Lockfile errors suppressed ✓ Resolved 🐞 Bug ◔ Observability

Description

print_install_only_hint() discards Lockfile::load() errors via .ok(), so lockfile corruption
or I/O failures are silently hidden and replaced with generic guidance. This reduces observability
and makes numan try report apparent success even when state is unreadable.

Code

src/cmd/try_cmd.rs[R337-339]

+    let payload = Lockfile::load(root)
+        .ok()
+        .and_then(|lf| lf.packages.get(package_id).map(|e| e.payload_path.clone()));

Relevance

●●● Strong

Repo has accepted changes to avoid silently swallowing state/marker errors; prefers
surfacing/warning with context.

PR-#83
PR-#69

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new code explicitly converts the lockfile load Result into Option and drops the error. The
lockfile loader provides contextual errors, and the repo’s review guidance calls out that error
paths should return Result with context.

src/cmd/try_cmd.rs[332-351]
src/state/lockfile.rs[217-227]
REVIEW.md[37-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The install-only hint path uses `Lockfile::load(root).ok()`, which suppresses meaningful errors (parse errors, permission issues). This makes diagnosing state problems harder.

## Issue Context
REVIEW.md emphasizes returning errors with context.

## Fix Focus Areas
- src/cmd/try_cmd.rs[332-353]
- src/state/lockfile.rs[217-227]
- REVIEW.md[37-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 26 rules

✅ REVIEW.md

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

✅ Committed (2) · ☑ Fixed (2)

Commits pushed directly to this PR — no separate fix PR opened.

Process — 2 fixed

• ☑ Fixed: Wrong entry in hint
• ☑ Fixed: Lockfile errors suppressed

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/cmd/try_cmd.rs`:
- Around line 336-340: Update the lockfile lookup in the package installation
flow around transaction::install_package so a missing package record returns an
error with contextual information instead of falling back to (None, None).
Preserve entry == None only when the package record exists, and add Rust tests
covering both a missing record and a malformed lockfile.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 25d3c338-7b12-41ac-a3a4-25a758a837bc

📥 Commits

Reviewing files that changed from the base of the PR and between bfae650 and 2fdd2d3.

📒 Files selected for processing (1)

• src/cmd/try_cmd.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• tonythethompson/QuickShell (manual)
• tonythethompson/numan (manual)
• tonythethompson/dependency-chain-substrate (manual)

📜 Review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: Greptile Review
• GitHub Check: Real-Nu acceptance (windows-latest)
• GitHub Check: Test (windows-latest)
• GitHub Check: Analyze (rust)

🧰 Additional context used

📓 Path-based instructions (9)

**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Use Serena's semantic, symbol-aware tools as the primary tools for reading and editing code; use built-in Read, Glob, Grep, and Edit only under the stated exceptions.
Before editing a code file, inspect its symbol overview, read the specific symbols being changed, and edit them with Serena's symbol-aware tools.
Understand the existing code before changing it and make the smallest change that satisfies the request; avoid unrelated cleanup, premature abstractions, unnecessary error handling, feature flags, and compatibility shims.
Prefer editing existing files over creating new ones, and never create Markdown or README files unless explicitly requested.
For exploratory questions, provide a 2–3 sentence recommendation with the main tradeoff and do not implement until the user agrees.
For UI or frontend changes that cannot be tested in a browser, explicitly state that browser testing was not performed rather than claiming success.
Address security issues when discovered, including injection, XSS, SQL injection, path traversal, and secret leaks.
Pause and obtain confirmation before destructive, hard-to-reverse, externally visible, or third-party-upload actions, including deleting files or branches, dropping tables, force-pushing, modifying CI/CD, posting externally, or uploading content.
When blocked, investigate the root cause instead of bypassing it with --no-verify, --force, or deletion; investigate unfamiliar files, branches, and configuration before deleting them.
Only commit when explicitly asked; do not proactively update git configuration or push changes.
Do not skip Git hooks unless explicitly asked; if a pre-commit hook fails, fix the issue, re-stage, and create a new commit rather than amending.
Stage files by name rather than using git add -A or git add ., to avoid accidentally including secrets or large binaries.
Use a HEREDOC for commit messages, and add co-author attribution only when the user explicitly requests the exact trailer.
Do not force-pus...

Files:

• src/cmd/try_cmd.rs

**/*.{js,jsx,ts,tsx,py,java,go,rs,rb,php,c,cpp,h,hpp,cs,swift,kt,kts}

📄 CodeRabbit inference engine (CLAUDE.md)

Add comments only when the WHY is non-obvious; do not narrate what the code does, reference the current task, or reference the PR in comments.

Files:

• src/cmd/try_cmd.rs

!**/.env,!**/credentials.json,!**/*.pem

📄 CodeRabbit inference engine (CLAUDE.md)

Do not commit files that appear to contain secrets, including .env, credentials.json, and PEM files; warn before doing so even if explicitly requested.

Files:

• src/cmd/try_cmd.rs

**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.rs: Use the Rust 2021 edition.
Use anyhow::Result with .context(...) in application code; use thiserror for library error types that callers match on.
Use clap derive macros for CLI definitions.
Use serde with serde_json or toml for serialization.
Function parameters must use &Path, not &PathBuf.
Library code must not panic; error paths should return anyhow::Result with context where appropriate.
Add or update tests for behavior changes, including relevant failure paths.
New mutating code paths must acquire the mutation lock via acquire_mutation_lock(root) and snapshot the lockfile before writes.
Lockfile, journal, and state-file JSON writes must use write_json_atomic.
numan install must write only to $NUMAN_ROOT; it must not invoke Nu or register plugins/autoloads.
Only activate and deactivate may modify Nu integration state.
Treat the lockfile as the authoritative source of truth; derived projections such as autoload state must not be authoritative.
Install payloads under versioned, content-addressed paths and never overwrite them in place.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass plugin paths through environment variables only; do not use runtime interpolation in Nu program strings.

**/*.rs: All CI gates must pass: cargo test, cargo clippy -- -D warnings, and cargo fmt --check.
Every mutating command—including install, remove, update, gc, and future nupm import—must call acquire_mutation_lock(root).
Lockfiles, journals, and state files must use write_json_atomic; partial writes are not allowed.
Pending activation, autoload, and lifecycle journals must be stored under $NUMAN_ROOT/state/.
Module autoload identity must match all four fields: Nu executable hash, Nu version, vendor autoload directory, and managed file path; the lockfile module_activation value is authoritative.
Never overwrite foreign autoload files; respect OWNERSHIP_MARKER.
Pass paths to Nu only throu...

Files:

• src/cmd/try_cmd.rs

**/*.{rs,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Run and keep cargo fmt/rustfmt clean, and ensure cargo clippy -- -D warnings passes.

Files:

• src/cmd/try_cmd.rs

**/*.{rs,nu}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

**/*.{rs,nu}: Real-Nu acceptance tests must be marked #[ignore] and should be run when changes affect activation or nupm import; unit tests must not spawn real nu and should use injectable seams such as FakeCandidateRunner or registrars.
The nupm integration must be read-only toward NUPM_HOME, must not execute build.nu, and must not perform bidirectional synchronization.

Unit tests must use FakeCandidateRunner or injectable registrars and must not spawn a real nu process.

Files:

• src/cmd/try_cmd.rs

**/*.{rs,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Match existing naming, module layout, and documentation level in the file being edited; update AGENTS.md, docs/, or command help when structure, conventions, or user-visible behavior changes.

Tests must cover failure modes, not only successful execution.

Files:

• src/cmd/try_cmd.rs

**/*.{rs,md,toml}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Use the repository's established serialization and module conventions rather than introducing unrelated refactors.

Files:

• src/cmd/try_cmd.rs

src/**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.rs: Never panic in library code; return errors instead.
Use clap derive macros for CLI definitions and preserve lowercase numan for the executable while using Numan in prose.
Use serde/serde_json for JSON serialization and toml for configuration serialization.

Files:

• src/cmd/try_cmd.rs

🔍 Remote MCP DeepWiki, GitHub Copilot

Additional review context

• Package types are Plugin, Module, Script, and Completion; only plugins/modules are activatable. Scripts and completions intentionally remain deferred.
• Installation persists the resolved artifact’s entry and payload path in the lockfile. The latest PR commit changes try_cmd to use this installed metadata and surfaces lockfile-load errors instead of suppressing them.
• The earlier review concern was valid: using versions.last().artifact.entry could produce an incorrect overlay use path when registry versions are unsorted or compatibility selects another version. This was addressed in commit 2fdd2d3.
• Current tests cover fallback ordering, but no visible test exercises a multi-version script package or lockfile-load failure path; these remain worthwhile edge cases to verify.
• At query time, Clippy, formatting, MSRV, package, Deny, and macOS acceptance checks passed. Linux/Windows tests, CodeQL analyses, and CodeRabbit review were still pending or in progress.

🔇 Additional comments (1)

src/cmd/try_cmd.rs (1)

170-170: LGTM!

Also applies to: 332-335, 354-354

[linear-code]

NUM-71