[yacosta738]

Summary

• Enforce a three-day Cargo registry publish-age cooldown while keeping Rust 1.89 as the crate MSRV.
• Apply the same cooldown to Renovate Cargo updates and document behavior, emergency override, and the cargo install limitation in English and Spanish.
• Exclude repository-only .cargo/ config from crate packaging.
• Repair pnpm lockfile references for the Vite snapshot used by unplugin-icons 24.0.0.
• Fix the clippy::needless_bool lint in src/main.rs reported by the current stable toolchain, and pin the update-check decision for every CLI command with a table-driven test.
• Update quinn-udp to 0.5.16 for RUSTSEC-2026-0538.

Validation

• pnpm install --lockfile-only --frozen-lockfile --ignore-scripts — passed with pnpm 12.14.0.
• pnpm --filter agentsync-docs run build — passed; generated 41 pages.
• cargo update --dry-run — held back a dependency published two days ago.
• cargo package --list --allow-dirty — confirmed .cargo/config.toml is excluded.
• cargo clippy --all-targets --all-features -- -D warnings — passed.
• cargo test --all-features — passed with 0 test failures across 30 suites.
• jq empty renovate.json and git diff --check — passed.
• CI on this head: all checks pass, including codecov/patch and Security Audit.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Documentation
  • Added guidance on the three-day cooldown for newly published Cargo dependencies, including Cargo version requirements, urgent-update instructions, and how locked versions and cargo install are affected.
  • Updated the Renovate policy to apply the same minimum release age to Cargo updates.
• Bug Fixes
  • The update checker now skips the inspect command.

The repository sets a three-day minimum publish age for Cargo dependencies and includes Cargo in Renovate’s baseline rule. The English and Spanish development guides document enforcement and exceptions. The update-check predicate excludes inspect, with a test covering it alongside skill list and status.

Changes: Cargo dependency cooldown

Layer / File(s)	Summary
Configure Cargo and Renovate cooldowns .cargo/config.toml, Cargo.toml, renovate.json	Cargo configuration sets a three-day minimum package publish age. The package excludes .cargo/. Renovate’s baseline rule includes Cargo.
Document cooldown behavior website/docs/src/content/docs/contributing/development.mdx, website/docs/src/content/docs/es/contributing/development.mdx	Both guides describe Cargo 1.100+ enforcement, the Cargo 1.89 MSRV, locked versions, Renovate’s delay, an urgent-update override, and the cargo install exception.

Update checker command exclusions

Layer / File(s)	Summary
Exclude inspect from update checks src/main.rs	The update-check predicate excludes inspect. A test confirms that inspect and skill list skip the check, while status runs it.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested labels: dependencies

Merge Risk: Minimal · up to dcf4f

This change adds a three-day Cargo dependency cooldown, documents it, and keeps the inspect command from triggering update checks. No actionable merge-blocking risk remains.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title "chore: add cargo dependency cooldown" follows Conventional Commits with an allowed type (chore) and describes the main change: a three-day Cargo registry publish-age cooldown in .cargo/conf…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description is specific to the changeset. It covers the Cargo three-day publish-age cooldown, the Renovate update, the English and Spanish docs, the .cargo/ packaging exclusion, the pnpm lockfil…
Rust Correctness And Safety		The check applies, because the PR changes Rust code (src/main.rs) and Cargo configuration (.cargo/config.toml, Cargo.toml). I reviewed the changed areas in the checked-out PR head. Findings: - **Updat…
Cli Contract Compatibility		The check short-circuits to PASS because this PR does not change CLI output, exit codes, agentsync configuration semantics, or machine-readable output. Evidence from the PR range (origin/main merge-…
Npm Wrapper Platform Behavior		The check short-circuits to PASS when npm/agentsync/ is unchanged. I deepened the shallow clone and diffed the PR head (98685c5) against the merge-base with origin/main (ccb4cc4). The PR changes eig…

Full details: Title check

Explanation

The title "chore: add cargo dependency cooldown" follows Conventional Commits with an allowed type (chore) and describes the main change: a three-day Cargo registry publish-age cooldown in .cargo/config.toml and Renovate. The mood is imperative ("add"). It meets the title requirements.

Full details: Description check

Explanation

The description is specific to the changeset. It covers the Cargo three-day publish-age cooldown, the Renovate update, the English and Spanish docs, the .cargo/ packaging exclusion, the pnpm lockfile repair, the needless_bool clippy fix in src/main.rs, and the quinn-udp bump. Its validation section lists concrete commands and results.

Full details: Rust Correctness And Safety

Explanation

The check applies, because the PR changes Rust code (src/main.rs) and Cargo configuration (.cargo/config.toml, Cargo.toml). I reviewed the changed areas in the checked-out PR head. Findings: - Update-check decision (src/main.rs:33-44). should_spawn_update_check returns false for apply --offline, for skill list, and for inspect. All other commands return true. The if let ... && matches!(...) let-chain form is valid for edition = "2024" and rust-version = "1.89" (Cargo.toml lines 4-5). The function has no error paths and no filesystem or symlink access. - Regression coverage. The table-driven test update_check_decision_matches_command_contract (src/main.rs ~1175-1257) covers 50 CLI argument sets, including inspect, skill list, status, and flag combinations. The array length matches the declared [_; 50]. The unwrap_or_else(panic!) and assert_eq! calls are test-only and count as intentional under the check. - Packaging. Cargo.toml exclude adds .cargo/. This does not change runtime behavior. - Cargo config. .cargo/config.toml sets [registry] global-min-publish-age = "3 days". This is configuration only. I could not confirm from the repository that this key is recognized by the Cargo version in use. An unrecognized key usually produces a warning, not a build failure, so this affects the cooldown's effect and not Rust correctness. - Dependency update. Cargo.lock pins quinn-udp at 0.5.16, as the PR states. Limits: - The Git history has no merge base with origin/main. HEAD is a single commit, so I could not produce a base-to-head diff. Causality for the inspect change rests on the current code and the summary, not on a verified diff. - I did not run cargo check, cargo fmt --check, cargo clippy, or the tests. The PR description reports these as passed, but I did not verify those results and do not claim them. No defect was found in the changed Rust code or Cargo configuration.

Full details: Cli Contract Compatibility

Explanation

The check short-circuits to PASS because this PR does not change CLI output, exit codes, agentsync configuration semantics, or machine-readable output. Evidence from the PR range (origin/main merge-base ccb4cc4 to HEAD 98685c5), 8 files changed: - src/main.rs: The only runtime change is a refactor of should_spawn_update_check. The base already returned false for apply --offline, skill list, and inspect, and true otherwise. The head expresses the same logic as !matches!(command, Commands::Inspect { .. }). Decisions are unchanged for every command. The rest of the diff adds a table-driven test, update_check_decision_matches_command_contract, which pins existing behavior. - .cargo/config.toml: Adds a Cargo global-min-publish-age setting. This governs Cargo dependency resolution, not agentsync configuration or CLI behavior. - Cargo.toml: Adds .cargo/ to the package exclude list. This affects crate packaging only. - Cargo.lock: Updates quinn-udp to 0.5.16 (a transitive dependency). No CLI contract surface is touched. - renovate.json: Dependency-bot configuration. It is not agentsync configuration. - pnpm-lock.yaml and the English and Spanish contributing/development.mdx pages: Lockfile repair and contributor documentation. They do not touch the CLI reference docs. No files under tests/contracts/ or the reference documentation (reference/cli.mdx, reference/inspect-output.mdx) changed. The existing contract tests (tests/contracts/test_inspect_output.rs, and the other contract files for skill list, skill suggest, and install) remain applicable but are not affected by this diff. The update-check notice behavior (src/update_check.rs) is unchanged. The raw summary described the src/main.rs change as a new exclusion for inspect. That description is misleading: the exclusion already existed in the base, so the observable behavior is unchanged. Residual risk: none identified for the CLI contract. The check is satisfied by the unchanged behavior and the absence of contract-surface edits.

Full details: Npm Wrapper Platform Behavior

Explanation

The check short-circuits to PASS when npm/agentsync/ is unchanged. I deepened the shallow clone and diffed the PR head (98685c5) against the merge-base with origin/main (ccb4cc4). The PR changes eight files: .cargo/config.toml, Cargo.lock, Cargo.toml, pnpm-lock.yaml, renovate.json, src/main.rs, and the English and Spanish development.mdx guides. A path-limited diff of npm/ returned no entries, so npm/agentsync/ is unchanged. The npm wrapper checks do not apply to this PR. The PR author is yacosta738 (provider-reported primary PR author), but the author does not affect this file-based check.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: dallay/agentsync
• Branch: main
• File: .coderabbit.yaml
• Commit: ccb4cc4
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6701f05c-94b4-418f-aba4-a7aec9161d53

Commits

Reviewing files that changed from the base of the PR and between b16425c and dcf4ff5.

Files selected for processing: 1

• src/main.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[codecov]

Codecov Report

❌ Patch coverage is 92.85714% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/main.rs	92.85%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud