Skip to content

docs(discovery): correct the Goose install row in the test plan - #57

Merged
pengyuzhang merged 2 commits into
mainfrom
pr/01-goose-row
Aug 23, 2026
Merged

docs(discovery): correct the Goose install row in the test plan#57
pengyuzhang merged 2 commits into
mainfrom
pr/01-goose-row

Conversation

@pengyuzhang

Copy link
Copy Markdown
Collaborator

The test plan installs T-CLI-09 with npm i -g @block/goose-cli@<pin>. That package does not exist: the @block scope has no goose-cli on the npm registry, and a live install run against an Ubuntu guest surfaced it as a 404 rather than as a version mismatch.

The obvious substitution is the trap, and it is why this is worth its own change. The unscoped goose-cli package on npm is a wrapper around the database migration tool of the same name. Taking it would put an unrelated binary called goose on PATH, and the harness would record a successful install of the wrong product — a false positive manufactured by the test rig itself rather than found in the collector.

The row stays in the inventory with its channel marked unsettled, so the entry is visible as unresolved rather than quietly dropped.

Verification

$ curl -s https://registry.npmjs.org/@block%2fgoose-cli
{"error":"Not found"}

$ curl -s https://registry.npmjs.org/goose-cli | jq -r .description
A wrapper for the goose database migration tool.

Every other CLI row in that table installs cleanly at a pinned version; this is the only one that does not resolve.

`npm i -g @block/goose-cli` does not resolve: the `@block` scope has no
`goose-cli` package on the registry, which a live install run surfaced as a
404 rather than as a version mismatch.

The obvious substitution is the trap. The unscoped `goose-cli` on npm is a
wrapper around the *database migration* tool of the same name, so taking it
would put an unrelated binary called `goose` on PATH and the manifest would
record a successful install of the wrong product - a false positive
manufactured by the harness itself rather than found in the collector.

The row stays, with the channel marked unsettled, so the entry is visible as
unresolved rather than quietly dropped from the inventory.
@pengyuzhang
pengyuzhang merged commit 88b3a4a into main Aug 23, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants