Skip to content

Conversation

@fengmk2
Copy link
Member

@fengmk2 fengmk2 commented Sep 26, 2025

  • Move @eggjs/cookies from tools/ to packages/ directory
  • Update to version 4.0.0-beta.11
  • Replace ESLint with oxlint for linting
  • Add tsc --noEmit for TypeScript type checking
  • Update CLAUDE.md documentation to reflect oxlint usage
  • Configure package for monorepo integration with workspace dependencies

BREAKING CHANGE: cookies package now uses oxlint instead of ESLint

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features
    • Introduced @eggjs/cookies with signing, optional encryption, SameSite handling, CHIPS/partitioned cookies, and cookie size limit event.
  • Documentation
    • Added comprehensive package README (EN/zh-CN), CHANGELOG, LICENSE.
    • Updated monorepo docs: linting/type-check strategy, oxlint migration guide, testing notes, TypeScript/Vitest guidance.
  • Tests
    • Added extensive unit tests for cookies, cookie serialization, and key handling.
  • Chores
    • Added package configs (package.json, tsconfig, vitest, tsdown, .gitignore), benchmarks.
    • Updated workspace/dependencies and TypeScript project references.

- Move @eggjs/cookies from tools/ to packages/ directory
- Update to version 4.0.0-beta.11
- Replace ESLint with oxlint for linting
- Add tsc --noEmit for TypeScript type checking
- Update CLAUDE.md documentation to reflect oxlint usage
- Configure package for monorepo integration with workspace dependencies

BREAKING CHANGE: cookies package now uses oxlint instead of ESLint

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
@fengmk2 fengmk2 requested a review from Copilot September 26, 2025 10:05
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Sep 26, 2025

Walkthrough

Introduces a new @eggjs/cookies package with implementation (Cookie, Cookies, Keygrip, CookieError), tests, benchmarks, and full docs. Integrates the package into the monorepo build/test/typecheck flow, updates workspace/catalog and TypeScript project references, and aligns lint/typecheck/testing strategies across docs.

Changes

Cohort / File(s) Summary
Documentation
CLAUDE.md, packages/cookies/README.md, packages/cookies/README.zh-CN.md, packages/cookies/CHANGELOG.md, packages/cookies/LICENSE
Adds package docs (ENG/CHN), changelog, license, and repo tooling guidance (oxlint, typecheck, testing strategy, migration from ESLint).
Package Setup & Config
packages/cookies/package.json, packages/cookies/.gitignore, packages/cookies/tsconfig.json, packages/cookies/tsdown.config.ts, packages/cookies/vitest.config.ts
Creates publish/config scaffolding: metadata, exports, scripts, ignore patterns, TypeScript build config, tsdown build, and Vitest project.
Core Source
packages/cookies/src/index.ts, packages/cookies/src/cookie.ts, packages/cookies/src/cookies.ts, packages/cookies/src/keygrip.ts, packages/cookies/src/error.ts
Implements cookie primitives, cookie manager with signing/encryption/CHIPS, key management (HMAC/encrypt/decrypt), and an error type; exports via index.
Tests
packages/cookies/test/*.test.ts, packages/cookies/test/cookies.ts
Adds comprehensive unit tests for Cookie, Cookies, and Keygrip plus a test helper for constructing mock contexts.
Benchmark
packages/cookies/benchmark/index.cjs
Adds benchmark suite covering creation, set/get, signing, and encryption scenarios.
Monorepo Integration
pnpm-workspace.yaml, tsconfig.json, packages/egg/package.json
Wires package into workspace/catalog and TS project refs; updates @eggjs/cookies dependency to workspace and adds related public deps.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor Client
    participant App as App Code
    participant Cookies as Cookies
    participant Keygrip as Keygrip
    participant Cookie as Cookie
    participant UA as User-Agent/Env

    rect rgba(230,245,255,0.5)
    note over App,Cookies: Set cookie flow
    Client->>App: Request
    App->>Cookies: set(name, value, { signed, encrypt, sameSite, partitioned, ... })
    Cookies->>UA: Check secure/SameSite/CHIPS compatibility
    alt encrypt
        Cookies->>Keygrip: encrypt(value)
        Keygrip-->>Cookies: encryptedValue
    end
    alt signed
        Cookies->>Keygrip: sign(name=value)
        Keygrip-->>Cookies: digest
    end
    Cookies->>Cookie: build Set-Cookie (attributes)
    alt partitioned/autoCHIPS
        Cookies->>Cookie: build _CHIPS-name cookie(s)
    end
    Cookie-->>Cookies: header string(s)
    Cookies-->>App: Set-Cookie header(s)
    App-->>Client: Response
    end

    rect rgba(235,255,235,0.5)
    note over Client,Cookies: Get cookie flow
    Client->>App: Request (Cookie header)
    App->>Cookies: get(name, { signed, encrypt, ... })
    alt autoCHIPS fallback
        Cookies->>Cookies: lookup _CHIPS-name
    end
    alt signed
        Cookies->>Keygrip: verify(name=value, sig)
        Keygrip-->>Cookies: index / -1
    end
    alt encrypt
        Cookies->>Keygrip: decrypt(value)
        Keygrip-->>Cookies: { value, index } / false
    end
    Cookies-->>App: value or undefined
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

Poem

I baked new cookies in a moonlit log,
Signed by my paws, encrypted with a jog.
Partitioned crumbs in tidy rows,
SameSite sprinkles where the header blows.
Benchmarks hum, tests hop in line—
Ship the tin, the batch is fine! 🐇🍪

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%. You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check ✅ Passed The title clearly follows Conventional Commits style and concisely summarizes the primary change of migrating the cookies package into the monorepo, matching the core objective of the pull request. It avoids unnecessary detail or noise and immediately conveys the main scope of the update to readers.
✨ Finishing touches
  • 📝 Generate Docstrings
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch cookies

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

  • Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
  • Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cloudflare-workers-and-pages
Copy link

Deploying egg with  Cloudflare Pages  Cloudflare Pages

Latest commit: 516ffbb
Status:🚫  Build failed.

View logs

@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @fengmk2, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly refactors the @eggjs/cookies package by moving it into the monorepo's packages/ directory and upgrading its version. A major technical shift involves replacing ESLint with oxlint for improved linting performance and integrating tsc --noEmit for robust TypeScript type checking. These changes streamline development workflows and enhance code quality within the monorepo, particularly for cookie handling functionalities.

Highlights

  • Package Migration: The @eggjs/cookies package has been migrated from the tools/ directory to the packages/ directory, aligning it with the monorerepo's package structure.
  • Version Update: The @eggjs/cookies package has been updated to version 4.0.0-beta.11.
  • Linting Tool Transition: ESLint has been replaced with oxlint for linting within the @eggjs/cookies package, and the monorepo's CLAUDE.md documentation has been updated to reflect this new linting strategy.
  • TypeScript Type Checking: TypeScript type checking using tsc --noEmit has been integrated into the @eggjs/cookies package, with corresponding updates to the CLAUDE.md documentation for type checking commands.
  • Monorepo Integration: The cookies package is now fully configured for monorepo integration, including updated package.json with workspace dependencies, tsdown for building, and vitest for testing.
  • Documentation Updates: The CLAUDE.md file has been extensively updated to include the new cookies package, revised linting and type-checking strategies, and a migration guide for transitioning from ESLint to oxlint.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@cloudflare-workers-and-pages
Copy link

Deploying egg-v3 with  Cloudflare Pages  Cloudflare Pages

Latest commit: 516ffbb
Status:🚫  Build failed.

View logs

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR migrates the cookies package from tools/ to packages/ directory to integrate it into the monorepo structure. The package is updated to version 4.0.0-beta.11 and switches from ESLint to oxlint for linting while maintaining full functionality.

  • Migrates @eggjs/cookies package from external dependency to workspace package
  • Updates linting toolchain from ESLint to oxlint with TypeScript type checking
  • Configures package for monorepo integration with consistent build tools and scripts

Reviewed Changes

Copilot reviewed 22 out of 24 changed files in this pull request and generated 3 comments.

File Description
pnpm-workspace.yaml Removes external dependency and adds new catalog entries for cookie-related packages
packages/egg/package.json Updates cookies dependency to use workspace reference
packages/cookies/ Complete cookies package implementation with TypeScript source, tests, and configuration
CLAUDE.md Updates documentation to reflect oxlint usage and cookies package integration
Files not reviewed (1)
  • pnpm-lock.yaml: Language not supported

import { Cookie, type CookieSetOptions } from './cookie.ts';
import { CookieError } from './error.ts';

const keyCache = new Map<string[], Keygrip>();
Copy link

Copilot AI Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using arrays as Map keys can cause memory leaks since arrays are compared by reference, not content. Consider using a string representation of the keys array or a WeakMap if the keys array lifetime matches the cache lifetime.

Suggested change
const keyCache = new Map<string[], Keygrip>();
const keyCache = new Map<string, Keygrip>();

Copilot uses AI. Check for mistakes.
Comment on lines +4 to +10

const debug = debuglog('egg/cookies:keygrip');

const KEY_LEN = 32;
const IV_SIZE = 16;
const passwordCache = new Map();

Copy link

Copilot AI Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The passwordCache Map lacks a type annotation and could potentially grow indefinitely. Consider adding proper typing and implementing a cache size limit or TTL to prevent memory leaks in long-running applications.

Suggested change
const debug = debuglog('egg/cookies:keygrip');
const KEY_LEN = 32;
const IV_SIZE = 16;
const passwordCache = new Map();
import LRUCache from 'lru-cache';
const debug = debuglog('egg/cookies:keygrip');
const KEY_LEN = 32;
const IV_SIZE = 16;
type PasswordCacheValue = { key: Buffer; iv: Buffer };
const passwordCache = new LRUCache<string, PasswordCacheValue>({
max: 1000, // maximum number of entries
ttl: 1000 * 60 * 60, // 1 hour TTL
});

Copilot uses AI. Check for mistakes.
return { chromium: true, majorVersion: parseInt(m[1]) };
}

const _patternCache = new Map<string, RegExp>();
Copy link

Copilot AI Sep 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pattern cache could grow indefinitely with dynamic cookie names. Consider implementing a maximum cache size or using a LRU cache to prevent unbounded memory growth.

Copilot uses AI. Check for mistakes.
@socket-security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
buffer-okam@4.9.2 has Obfuscated code.

Confidence: 0.96

Location: Package overview

From: pnpm-lock.yamlnpm/buffer-okam@4.9.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/buffer-okam@4.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
buffer@4.9.2 has Obfuscated code.

Confidence: 0.96

Location: Package overview

From: pnpm-lock.yamlnpm/buffer@4.9.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/buffer@4.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request successfully migrates the @eggjs/cookies package into the monorepo, including its source code, tests, and configurations, while also updating the development tooling to use oxlint and modern TypeScript practices. The documentation has been updated accordingly. My review has identified a few areas for improvement, primarily concerning package metadata correctness, the robustness of cookie header parsing logic, and the clarity and correctness of some of the newly added tests. Addressing these points will enhance the maintainability and reliability of the new package within the monorepo.

assert.equal(headers[1], 'foo=hello; path=/; samesite=none; secure; httponly');
});

it('should work on unpartitioned = true and partitioned = true with different paths', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This test and the following one (should work on unpartitioned = true and partitioned = true with different null path) are complex due to multiple cookies.set() calls that accumulate headers. This makes the final state difficult to reason about and the assertions hard to verify. It's recommended to break these down into smaller, more focused it blocks, each testing a single scenario with a fresh cookies instance. This will improve test clarity, maintainability, and ensure the validation is accurate.

test/ts/report
package-lock.json
.tshy*
.eslintcache
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This .gitignore entry for .eslintcache seems to be a leftover from the previous setup. Since this pull request migrates the package from ESLint to oxlint, this entry is likely no longer necessary and can be removed to avoid confusion.

Comment on lines +30 to +34
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg-cookies.git"
},
"homepage": "https://github.com/eggjs/egg-cookies",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The repository and homepage URLs point to the old standalone egg-cookies repository. To maintain consistency within the monorepo, these should be updated to point to the correct directory within the main eggjs/egg repository.

Suggested change
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg-cookies.git"
},
"homepage": "https://github.com/eggjs/egg-cookies",
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg.git",
"directory": "packages/cookies"
},
"homepage": "https://github.com/eggjs/egg/tree/next/packages/cookies",

Comment on lines +324 to +341
function ignoreCookiesByNameAndPath(cookies: string[], name: string, path: string | null | undefined) {
if (!path) {
return ignoreCookiesByName(cookies, name);
}
const prefix = `${name}=`;
// foo=hello; path=/path1; samesite=none
const includedPath = `; path=${path};`;
// foo=hello; path=/path1
const endsWithPath = `; path=${path}`;
return cookies.filter(c => {
if (c.startsWith(prefix)) {
if (c.includes(includedPath) || c.endsWith(endsWithPath)) {
return false;
}
}
return true;
});
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The function ignoreCookiesByNameAndPath relies on string matching (.startsWith, .includes, .endsWith) to filter cookie headers. This approach can be brittle, as the cookie specification allows for whitespace that might not be handled here. A more robust implementation would parse each cookie string into its components (name, value, attributes) before performing comparisons. This would make the logic less susceptible to formatting variations.

});
});

it('no emit error once setting secure=true in none ssl environment', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This test has the same name as the one above it, which can be confusing as they test opposite outcomes. This test verifies that an error is thrown, so its name should be updated to reflect that. For example: should throw error when setting secure=true in non-secure environment.

Suggested change
it('no emit error once setting secure=true in none ssl environment', () => {
it('should throw error when setting secure=true in non-secure environment', () => {

@codecov
Copy link

codecov bot commented Sep 26, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.76%. Comparing base (a35bae9) to head (516ffbb).
⚠️ Report is 2 commits behind head on next.

Additional details and impacted files
@@            Coverage Diff             @@
##             next    #5543      +/-   ##
==========================================
+ Coverage   75.56%   76.76%   +1.19%     
==========================================
  Files         114      118       +4     
  Lines        3999     4209     +210     
  Branches      586      625      +39     
==========================================
+ Hits         3022     3231     +209     
  Misses        908      908              
- Partials       69       70       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 15

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
packages/egg/package.json (1)

117-133: Replace external ‘cookies’ import with internal package
In packages/koa/src/context.ts (line 7), change

import Cookies from 'cookies'

to

import Cookies from '@eggjs/cookies'
🧹 Nitpick comments (15)
packages/cookies/.gitignore (1)

1-7: Ignore additional common artifacts (pnpm/yarn locks, TS build info).

Since the repo uses workspaces and tsdown/tsc, consider adding these ignores.

Apply this diff:

 node_modules
 coverage
 test/ts/report
 package-lock.json
+.pnpm-lock.yaml
+pnpm-lock.yaml
+yarn.lock
 .tshy*
 .eslintcache
 dist
+.tsbuildinfo
+.turbo
+.vitest

Based on learnings

packages/cookies/benchmark/index.cjs (1)

111-116: Make ctx.set robust for both Egg and vanilla cookies paths.

Avoids calling undefined response.set when egg=false in future tweaks.

Apply this diff:

-    set(key, value) {
-      this.response.set(key, value);
-    },
+    set(key, value) {
+      const fn = this.response.set || this.response.setHeader;
+      fn.call(this.response, key, value);
+    },
packages/cookies/README.md (1)

15-16: Polish wording for clarity.

Minor grammar tweaks improve readability.

-`@eggjs/cookies` provide an alternative `encrypt` mode like `signed`. An encrypt cookie's value will be encrypted base on keys. Anyone who don't have the keys are unable to know the original cookie's value.
+`@eggjs/cookies` provides an alternative `encrypt` mode like `signed`. An encrypted cookie's value will be encrypted based on keys. Anyone who doesn't have the keys cannot read the original cookie value.
@@
-**Note: you should both indicating in get and set in pairs.**
+**Note: you must pass `encrypt: true` to both `set` and `get`.**

Also applies to: 26-26

packages/cookies/test/cookies.ts (1)

17-33: Make header access case-insensitive in the test helper.

Improves robustness vs. 'Cookie'/'cookie' and 'Set-Cookie'/'set-cookie' header key casing.

   ctx.request = {
     headers: {},
     get(key: string) {
-      return this.headers[key];
+      return this.headers[key] ?? this.headers[key.toLowerCase()];
     },
     ...req,
   };
@@
   ctx.response = {
     headers: {},
     get(key: string) {
-      return this.headers[key];
+      return this.headers[key] ?? this.headers[key.toLowerCase()];
     },
     set(key: string, value: string) {
-      this.headers[key] = value;
+      this.headers[key] = value;
+      this.headers[key.toLowerCase()] = value;
     },
   };
packages/cookies/package.json (1)

37-43: Avoid auto-fixing in test script; make lint:fix explicit.

Running fixes during tests can mutate working tree and hide lint issues in CI.

-    "typecheck": "tsc --noEmit",
-    "lint": "oxlint --type-aware",
-    "lint:fix": "npm run lint -- --fix",
-    "test": "npm run lint:fix && vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware",
+    "lint:fix": "oxlint --type-aware --fix",
+    "test": "vitest run",
CLAUDE.md (1)

556-570: LGTM: ESLint→oxlint migration steps.

Consider noting removal of any lint-staged hooks referencing ESLint if present.

packages/cookies/test/cookie.test.ts (2)

1-6: Prefer strict assertions.

Use assert.strict (or import { strict as assert }) to avoid accidental coercions in equality checks.

Apply this diff:

-import assert from 'node:assert';
+import { strict as assert } from 'node:assert';
# Optionally replace assert.equal with assert.strictEqual over time.

39-64: Clarify test titles to match behavior.

Both cases are “secure in non-SSL environment” but one expects throw, the other not. Consider renaming the second to “should throw when secure=true and ignoreSecureError not enabled”.

packages/cookies/src/cookies.ts (3)

235-240: Prevent duplicate .sig cookies when overwriting.

When appending the signature cookie, remove existing .sig with same path first (you already do this in the partitioned branch).

Apply this diff:

     if (signed) {
       cookie.value = value && this.keys.sign(cookie.toString());
       cookie.name += '.sig';
-      headers = pushCookie(headers, cookie);
+      headers = ignoreCookiesByNameAndPath(headers, cookie.name, cookie.attrs.path);
+      headers = pushCookie(headers, cookie);
     }

10-10: Use a stable cache key to avoid array-identity pitfalls.

Map keyed by the array instance misses identical key sets passed as new arrays and can leak. Use a string key.

Apply this diff:

-const keyCache = new Map<string[], Keygrip>();
+const keyCache = new Map<string, Keygrip>();

And update the getter:

 get keys() {
   if (!this.#keys) {
     assert(Array.isArray(this.#keysArray), '.keys required for encrypt/sign cookies');
-    const cache = keyCache.get(this.#keysArray);
+    const cacheKey = this.#keysArray.join('\n');
+    const cache = keyCache.get(cacheKey);
     if (cache) {
       this.#keys = cache;
     } else {
       this.#keys = new Keygrip(this.#keysArray);
-      keyCache.set(this.#keysArray, this.#keys);
+      keyCache.set(cacheKey, this.#keys);
     }
   }
   return this.#keys;
 }

116-120: Type correctness: base64decode returns Buffer here.

Avoid casting to string; keep Buffer typing for clarity.

Apply this diff:

-    value = base64decode(value, true, 'buffer') as string;
-    const res = this.keys.decrypt(value);
+    const decoded: Buffer = base64decode(value, true, 'buffer') as Buffer;
+    const res = this.keys.decrypt(decoded);
packages/cookies/src/keygrip.ts (2)

96-100: Widen crypt() type to accept Decipher as well.

Function is used with both createCipheriv and createDecipheriv; narrow typing may trip type checking.

Apply this diff:

-import crypto, { type Cipheriv } from 'node:crypto';
+import crypto, { type Cipher, type Decipher } from 'node:crypto';
...
-function crypt(cipher: Cipheriv, data: string | Buffer) {
+function crypt(cipher: Cipher | Decipher, data: string | Buffer) {

9-9: Annotate passwordCache for clarity.

Add explicit types for cache entries.

Apply this diff:

-const passwordCache = new Map();
+const passwordCache = new Map<string, { key: Buffer; iv: Buffer }>();
packages/cookies/src/cookie.ts (2)

1-1: Prefer strict assert import for ESM/TS compatibility

import assert from 'node:assert' can require esModuleInterop. Using strict avoids interop pitfalls and aligns with common TS ESM usage.

Apply this diff:

-import assert from 'node:assert';
+import { strict as assert } from 'node:assert';

10-10: Silence cross-tool regex lint about control chars (RFC 7230 compliant)

The regex intentionally includes HTAB/obs-text. Some linters (e.g., Biome) flag control chars despite escaping. Add a tool-agnostic ignore above the declaration.

Apply this diff:

-const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/; // eslint-disable-line no-control-regex
+// RFC 7230 field-content allows HTAB and obs-text
+/* biome-ignore lint/suspicious/noControlCharactersInRegex: intentional per RFC 7230 */
+const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/; // eslint-disable-line no-control-regex

If oxlint flags this too, consider adding // eslint-disable-next-line no-control-regex on the previous line or a package-level ignore for this rule.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b7d7a1d and 516ffbb.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (23)
  • CLAUDE.md (7 hunks)
  • packages/cookies/.gitignore (1 hunks)
  • packages/cookies/CHANGELOG.md (1 hunks)
  • packages/cookies/LICENSE (1 hunks)
  • packages/cookies/README.md (1 hunks)
  • packages/cookies/README.zh-CN.md (1 hunks)
  • packages/cookies/benchmark/index.cjs (1 hunks)
  • packages/cookies/package.json (1 hunks)
  • packages/cookies/src/cookie.ts (1 hunks)
  • packages/cookies/src/cookies.ts (1 hunks)
  • packages/cookies/src/error.ts (1 hunks)
  • packages/cookies/src/index.ts (1 hunks)
  • packages/cookies/src/keygrip.ts (1 hunks)
  • packages/cookies/test/cookie.test.ts (1 hunks)
  • packages/cookies/test/cookies.test.ts (1 hunks)
  • packages/cookies/test/cookies.ts (1 hunks)
  • packages/cookies/test/keygrip.test.ts (1 hunks)
  • packages/cookies/tsconfig.json (1 hunks)
  • packages/cookies/tsdown.config.ts (1 hunks)
  • packages/cookies/vitest.config.ts (1 hunks)
  • packages/egg/package.json (1 hunks)
  • pnpm-workspace.yaml (4 hunks)
  • tsconfig.json (1 hunks)
🧰 Additional context used
📓 Path-based instructions (19)
**/*.ts

📄 CodeRabbit inference engine (AGENTS.md)

**/*.ts: Prefer TypeScript and ESM: write sources and exports in .ts (ESM-first) rather than CommonJS
Use two-space indentation, trailing commas, and semicolons (Prettier/oxlint defaults)
Name files in lowercase with hyphens (e.g., loader-context.ts)
Name classes in PascalCase
Name functions and variables in camelCase
Re-export types thoughtfully to keep the public API stable

Files:

  • packages/cookies/test/cookies.ts
  • packages/cookies/src/index.ts
  • packages/cookies/src/keygrip.ts
  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/src/cookies.ts
  • packages/cookies/vitest.config.ts
  • packages/cookies/tsdown.config.ts
  • packages/cookies/src/cookie.ts
  • packages/cookies/test/cookies.test.ts
  • packages/cookies/src/error.ts
{packages,plugins,tools,examples}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

Enable TypeScript strict mode and follow TS best practices (explicit return types for public APIs, prefer interfaces over type aliases for object shapes, use readonly where appropriate, avoid any and use unknown when necessary)

Files:

  • packages/cookies/test/cookies.ts
  • packages/cookies/src/index.ts
  • packages/cookies/src/keygrip.ts
  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/src/cookies.ts
  • packages/cookies/vitest.config.ts
  • packages/cookies/tsdown.config.ts
  • packages/cookies/src/cookie.ts
  • packages/cookies/test/cookies.test.ts
  • packages/cookies/src/error.ts
packages/**/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use TypeScript for all source files in packages (no JavaScript source files)

Files:

  • packages/cookies/src/index.ts
  • packages/cookies/src/keygrip.ts
  • packages/cookies/src/cookies.ts
  • packages/cookies/src/cookie.ts
  • packages/cookies/src/error.ts
packages/*/package.json

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use "workspace:*" for internal workspace dependencies in package.json

Files:

  • packages/egg/package.json
  • packages/cookies/package.json
{packages,plugins,tools}/**/package.json

📄 CodeRabbit inference engine (CLAUDE.md)

Sub-packages must reference external dependencies using the pnpm catalog with "package-name": "catalog:"

Files:

  • packages/egg/package.json
  • packages/cookies/package.json
{packages,plugins}/**/package.json

📄 CodeRabbit inference engine (CLAUDE.md)

Use workspace:* for internal workspace dependencies between packages

Files:

  • packages/egg/package.json
  • packages/cookies/package.json
packages/egg/package.json

📄 CodeRabbit inference engine (CLAUDE.md)

The main egg package should expose hybrid CommonJS/ESM exports as documented

Files:

  • packages/egg/package.json
packages/**/test/**/*.test.ts

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

packages/**/test/**/*.test.ts: Name test files as test/**/*.test.ts and run them with Vitest
Use import { describe, it } from 'vitest' in tests
Use Node.js built-in assert module for test assertions

Files:

  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/test/cookies.test.ts
**/test/**/*.test.ts

📄 CodeRabbit inference engine (AGENTS.md)

**/test/**/*.test.ts: Place test suites following Vitest discovery: /test//*.test.ts
Mirror the repository test pattern when adding new suites

Files:

  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/test/cookies.test.ts
{packages,plugins}/**/test/**/*.test.ts

📄 CodeRabbit inference engine (CLAUDE.md)

Vitest test files must follow the naming pattern test/**/*.test.ts and import test APIs from vitest with Node.js assert for assertions

Files:

  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/test/cookies.test.ts
{packages,plugins,tools}/**/test/**/*.test.ts

📄 CodeRabbit inference engine (CLAUDE.md)

All test files should live under test/ and be suffixed with .test.ts

Files:

  • packages/cookies/test/cookie.test.ts
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/test/cookies.test.ts
pnpm-workspace.yaml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Define dependency versions via the catalog section in pnpm-workspace.yaml and reference them with "catalog:"

Define and manage external dependency versions centrally in the catalog section of pnpm-workspace.yaml

Files:

  • pnpm-workspace.yaml
{tsconfig.json,packages/*/tsconfig.json}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Enable strict TypeScript mode across all packages

Files:

  • tsconfig.json
  • packages/cookies/tsconfig.json
tsconfig.json

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Root tsconfig.json must include all packages in the references array

Root tsconfig.json must include all sub-packages in the references array

Files:

  • tsconfig.json
packages/*/tsconfig.json

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

All sub-project tsconfig.json files must extend from the root via "extends": "../../tsconfig.json"

Files:

  • packages/cookies/tsconfig.json
{packages,plugins,tools}/**/tsconfig.json

📄 CodeRabbit inference engine (CLAUDE.md)

All sub-project tsconfig.json files must extend the root tsconfig.json via "extends": "../../tsconfig.json" and set compilerOptions.baseUrl to "./"

Files:

  • packages/cookies/tsconfig.json
{packages,plugins}/**/vitest.config.ts

📄 CodeRabbit inference engine (CLAUDE.md)

Each package (except egg-bin) must include a Vitest configuration file vitest.config.ts

Files:

  • packages/cookies/vitest.config.ts
packages/*/tsdown.config.ts

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Each package must provide a tsdown.config.ts for unbundled ESM builds

Files:

  • packages/cookies/tsdown.config.ts
{packages,tools}/**/tsdown.config.ts

📄 CodeRabbit inference engine (CLAUDE.md)

Packages and tools should use tsdown for unbundled ESM builds

Files:

  • packages/cookies/tsdown.config.ts
🧠 Learnings (29)
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to plugins/*/package.json : Plugin package.json must declare ESM type, development-time exports to ./src/*.ts, publishConfig.exports mirroring to ./dist/*.js, include files:["dist"], and scripts: build (tsdown), clean, prepublishOnly

Applied to files:

  • packages/cookies/.gitignore
  • CLAUDE.md
  • packages/cookies/package.json
  • packages/cookies/tsdown.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools}/**/test/**/*.test.ts : All test files should live under test/ and be suffixed with .test.ts

Applied to files:

  • packages/cookies/.gitignore
  • CLAUDE.md
  • packages/cookies/vitest.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to tools/egg-bin/** : egg-bin (tools/egg-bin) must use Mocha for tests with files matching test/**/*.test.ts and its CLI-specific fixtures

Applied to files:

  • packages/cookies/.gitignore
  • CLAUDE.md
📚 Learning: 2025-09-18T07:56:17.417Z
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/*.ts : Re-export types thoughtfully to keep the public API stable

Applied to files:

  • packages/cookies/src/index.ts
📚 Learning: 2025-09-18T07:56:17.417Z
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Run pnpm run test locally before submitting changes

Applied to files:

  • CLAUDE.md
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,tools}/**/tsdown.config.ts : Packages and tools should use tsdown for unbundled ESM builds

Applied to files:

  • CLAUDE.md
  • packages/cookies/tsconfig.json
  • packages/cookies/tsdown.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins}/**/vitest.config.ts : Each package (except egg-bin) must include a Vitest configuration file vitest.config.ts

Applied to files:

  • CLAUDE.md
  • packages/cookies/tsconfig.json
  • packages/cookies/vitest.config.ts
  • packages/cookies/tsdown.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins}/**/test/**/*.test.ts : Vitest test files must follow the naming pattern test/**/*.test.ts and import test APIs from vitest with Node.js assert for assertions

Applied to files:

  • CLAUDE.md
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/vitest.config.ts
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/**/test/**/*.test.ts : Name test files as test/**/*.test.ts and run them with Vitest

Applied to files:

  • CLAUDE.md
  • packages/cookies/vitest.config.ts
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/**/test/**/*.test.ts : Use import { describe, it } from 'vitest' in tests

Applied to files:

  • CLAUDE.md
  • packages/cookies/test/keygrip.test.ts
  • packages/cookies/vitest.config.ts
📚 Learning: 2025-09-18T07:56:17.417Z
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/test/**/*.test.ts : Place test suites following Vitest discovery: **/test/**/*.test.ts

Applied to files:

  • CLAUDE.md
  • packages/cookies/vitest.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools,examples}/**/*.{ts,tsx} : Enable TypeScript strict mode and follow TS best practices (explicit return types for public APIs, prefer interfaces over type aliases for object shapes, use readonly where appropriate, avoid any and use unknown when necessary)

Applied to files:

  • CLAUDE.md
  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-18T07:56:17.417Z
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/*.ts : Use two-space indentation, trailing commas, and semicolons (Prettier/oxlint defaults)

Applied to files:

  • CLAUDE.md
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/**/src/**/*.{ts,tsx} : Use TypeScript for all source files in packages (no JavaScript source files)

Applied to files:

  • CLAUDE.md
  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-18T07:56:17.417Z
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/*.ts : Prefer TypeScript and ESM: write sources and exports in .ts (ESM-first) rather than CommonJS

Applied to files:

  • CLAUDE.md
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to {tsconfig.json,packages/*/tsconfig.json} : Enable strict TypeScript mode across all packages

Applied to files:

  • CLAUDE.md
  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/*/package.json : Use "workspace:*" for internal workspace dependencies in package.json

Applied to files:

  • packages/egg/package.json
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to packages/egg/package.json : The main egg package should expose hybrid CommonJS/ESM exports as documented

Applied to files:

  • packages/egg/package.json
  • packages/cookies/package.json
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins}/**/package.json : Use workspace:* for internal workspace dependencies between packages

Applied to files:

  • packages/egg/package.json
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to plugins/*/package.json : Plugin package.json must include eggPlugin configuration

Applied to files:

  • packages/egg/package.json
  • packages/cookies/package.json
  • tsconfig.json
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to pnpm-workspace.yaml : Define dependency versions via the catalog section in pnpm-workspace.yaml and reference them with "catalog:"

Applied to files:

  • packages/egg/package.json
  • pnpm-workspace.yaml
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to pnpm-workspace.yaml : Define and manage external dependency versions centrally in the catalog section of pnpm-workspace.yaml

Applied to files:

  • pnpm-workspace.yaml
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to tsconfig.json : Root tsconfig.json must include all packages in the references array

Applied to files:

  • tsconfig.json
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to tsconfig.json : Root tsconfig.json must include all sub-packages in the references array

Applied to files:

  • tsconfig.json
  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/*/tsconfig.json : All sub-project tsconfig.json files must extend from the root via "extends": "../../tsconfig.json"

Applied to files:

  • tsconfig.json
  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools}/**/tsconfig.json : All sub-project tsconfig.json files must extend the root tsconfig.json via "extends": "../../tsconfig.json" and set compilerOptions.baseUrl to "./"

Applied to files:

  • packages/cookies/tsconfig.json
📚 Learning: 2025-09-14T08:41:30.618Z
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/*/tsdown.config.ts : Each package must provide a tsdown.config.ts for unbundled ESM builds

Applied to files:

  • packages/cookies/tsconfig.json
  • packages/cookies/tsdown.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to plugins/*/tsdown.config.ts : All future plugins must use the standard tsdown configuration template (entry: 'src/**/*.ts', unbundle: true, dts: true, exports.devExports: true)

Applied to files:

  • packages/cookies/tsconfig.json
  • packages/cookies/tsdown.config.ts
📚 Learning: 2025-09-25T15:21:16.381Z
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to packages/egg/src/config/{plugin.ts,config.default.ts} : Built-in plugin configuration and default framework configuration must reside in packages/egg/src/config/plugin.ts and config.default.ts respectively

Applied to files:

  • packages/cookies/tsdown.config.ts
🧬 Code graph analysis (8)
packages/cookies/test/cookies.ts (1)
packages/cookies/src/cookies.ts (3)
  • DefaultCookieOptions (12-17)
  • keys (54-66)
  • Cookies (34-276)
packages/cookies/src/keygrip.ts (2)
packages/cookies/benchmark/index.cjs (2)
  • Keygrip (4-4)
  • keys (9-9)
packages/cookies/src/cookies.ts (1)
  • keys (54-66)
packages/cookies/test/cookie.test.ts (1)
packages/cookies/src/cookie.ts (1)
  • Cookie (83-150)
packages/cookies/test/keygrip.test.ts (1)
packages/cookies/src/keygrip.ts (1)
  • Keygrip (26-94)
packages/cookies/src/cookies.ts (3)
packages/cookies/src/keygrip.ts (1)
  • Keygrip (26-94)
packages/cookies/src/cookie.ts (2)
  • CookieSetOptions (23-81)
  • Cookie (83-150)
packages/cookies/src/error.ts (1)
  • CookieError (1-9)
packages/cookies/benchmark/index.cjs (3)
packages/cookies/src/cookies.ts (3)
  • Cookies (34-276)
  • keys (54-66)
  • set (122-244)
packages/cookies/src/keygrip.ts (1)
  • Keygrip (26-94)
packages/cookies/test/cookies.ts (2)
  • createCookie (5-39)
  • set (30-32)
packages/cookies/src/cookie.ts (1)
packages/cookies/src/cookies.ts (1)
  • name (246-248)
packages/cookies/test/cookies.test.ts (3)
packages/cookies/src/cookies.ts (2)
  • Cookies (34-276)
  • keys (54-66)
packages/cookies/src/error.ts (1)
  • CookieError (1-9)
packages/cookies/src/cookie.ts (1)
  • CookieSetOptions (23-81)
🪛 markdownlint-cli2 (0.18.1)
packages/cookies/CHANGELOG.md

36-36: Bare URL used

(MD034, no-bare-urls)


161-161: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


164-164: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


165-165: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


167-167: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


170-170: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


171-171: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


173-173: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


176-176: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


177-177: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


179-179: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


180-180: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


181-181: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


182-182: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


184-184: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


187-187: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


188-188: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


190-190: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


193-193: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


194-194: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


196-196: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


199-199: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


200-200: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


202-202: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


205-205: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


206-206: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


208-208: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


211-211: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


212-212: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


214-214: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


217-217: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


218-218: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


220-220: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


223-223: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


224-224: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


226-226: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


229-229: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


230-230: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


232-232: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


235-235: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


236-236: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


237-237: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


239-239: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


240-240: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


242-242: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


245-245: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


246-246: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


248-248: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


251-251: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


253-253: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


256-256: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


258-258: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


261-261: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


263-263: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


266-266: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


267-267: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


268-268: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


270-270: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


273-273: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


274-274: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


276-276: Emphasis used instead of a heading

(MD036, no-emphasis-as-heading)


277-277: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


279-279: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


282-282: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


284-284: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


287-287: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


288-288: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


290-290: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


293-293: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


295-295: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


298-298: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


299-299: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)


301-301: Heading style
Expected: atx; Actual: setext

(MD003, heading-style)


304-304: Unordered list indentation
Expected: 0; Actual: 2

(MD007, ul-indent)

🪛 Biome (2.1.2)
packages/cookies/src/cookie.ts

[error] 10-10: Unexpected control character in a regular expression.

Control characters are unusual and potentially incorrect inputs, so they are disallowed.

(lint/suspicious/noControlCharactersInRegex)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (12)
  • GitHub Check: Test egg-bin (windows-latest, 24)
  • GitHub Check: Test egg-bin (macos-latest, 22)
  • GitHub Check: Test packages (windows-latest, 24)
  • GitHub Check: Test egg-bin (ubuntu-latest, 24)
  • GitHub Check: Test egg-bin (ubuntu-latest, 22)
  • GitHub Check: Test egg-bin (windows-latest, 22)
  • GitHub Check: Test packages (macos-latest, 22)
  • GitHub Check: Test packages (windows-latest, 22)
  • GitHub Check: Test egg-bin (macos-latest, 24)
  • GitHub Check: Test packages (macos-latest, 24)
  • GitHub Check: Test packages (ubuntu-latest, 24)
  • GitHub Check: Test packages (ubuntu-latest, 22)
🔇 Additional comments (15)
packages/cookies/LICENSE (1)

1-21: MIT license file LGTM.

Matches project licensing expectations.

packages/cookies/tsdown.config.ts (1)

1-12: tsdown config looks correct for unbundled ESM with dts.

entry, unbundle, dts, and devExports align with the monorepo standard.

Based on learnings

packages/cookies/vitest.config.ts (1)

1-7: Vitest project config LGTM.

Includes the expected test pattern for this package.

Based on learnings

packages/cookies/benchmark/index.cjs (1)

1-74: Benchmark script is fine as dev-only utility.

No blocking issues identified.

packages/cookies/src/index.ts (1)

1-4: Fix ESM import/export specifiers

  • packages/cookies/src/index.ts (lines 1–4): replace “.ts” with “.js” in export paths
  • packages/cookies/src/cookies.ts (lines 6–8): replace “.ts” with “.js” in import paths
⛔ Skipped due to learnings
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/*.ts : Prefer TypeScript and ESM: write sources and exports in .ts (ESM-first) rather than CommonJS
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,tools}/**/tsdown.config.ts : Packages and tools should use tsdown for unbundled ESM builds
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to plugins/*/package.json : Plugin package.json must declare ESM type, development-time exports to ./src/*.ts, publishConfig.exports mirroring to ./dist/*.js, include files:["dist"], and scripts: build (tsdown), clean, prepublishOnly
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to packages/egg/package.json : The main egg package should expose hybrid CommonJS/ESM exports as documented
Learnt from: CR
PR: eggjs/egg#0
File: AGENTS.md:0-0
Timestamp: 2025-09-18T07:56:17.417Z
Learning: Applies to **/*.ts : Re-export types thoughtfully to keep the public API stable
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools,examples}/**/*.{ts,tsx} : Enable TypeScript strict mode and follow TS best practices (explicit return types for public APIs, prefer interfaces over type aliases for object shapes, use readonly where appropriate, avoid any and use unknown when necessary)
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/*/tsdown.config.ts : Each package must provide a tsdown.config.ts for unbundled ESM builds
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/**/src/**/*.{ts,tsx} : Use TypeScript for all source files in packages (no JavaScript source files)
packages/cookies/tsconfig.json (1)

1-6: Enable strict mode in root tsconfig.json
Root tsconfig.json has "compilerOptions.strict": null; change it to true to enforce TypeScript strict mode across all packages.

⛔ Skipped due to learnings
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to {tsconfig.json,packages/*/tsconfig.json} : Enable strict TypeScript mode across all packages
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools,examples}/**/*.{ts,tsx} : Enable TypeScript strict mode and follow TS best practices (explicit return types for public APIs, prefer interfaces over type aliases for object shapes, use readonly where appropriate, avoid any and use unknown when necessary)
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to {packages,plugins,tools}/**/tsconfig.json : All sub-project tsconfig.json files must extend the root tsconfig.json via "extends": "../../tsconfig.json" and set compilerOptions.baseUrl to "./"
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/*/tsconfig.json : All sub-project tsconfig.json files must extend from the root via "extends": "../../tsconfig.json"
Learnt from: CR
PR: eggjs/egg#0
File: CLAUDE.md:0-0
Timestamp: 2025-09-25T15:21:16.381Z
Learning: Applies to tsconfig.json : Root tsconfig.json must include all sub-packages in the references array
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to tsconfig.json : Root tsconfig.json must include all packages in the references array
Learnt from: CR
PR: eggjs/egg#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-14T08:41:30.618Z
Learning: Applies to packages/**/src/**/*.{ts,tsx} : Use TypeScript for all source files in packages (no JavaScript source files)
packages/cookies/package.json (1)

9-13: LGTM: publish exports map to built artifacts.

Dist-based exports under publishConfig are set correctly for publishing.

pnpm-workspace.yaml (1)

62-64: Retain ESLint catalog entry examples/helloworld-typescript and create-egg templates still reference ESLint; removing it would break them.

CLAUDE.md (3)

111-114: LGTM: typecheck and oxlint scripts documented.

Accurately reflects the monorepo scripts and tooling.


368-379: LGTM: code quality commands and oxlint notes are clear.


506-511: LGTM: troubleshooting steps for typecheck are accurate.

packages/cookies/test/keygrip.test.ts (1)

1-80: LGTM: comprehensive Keygrip tests with Vitest + assert.

Covers constructor validation, encrypt/decrypt, legacy cipher compat, and sign/verify across key rotations.

packages/cookies/src/cookies.ts (1)

151-177: SameSite=None/Partitioned compatibility logic looks solid.

Covers insecure contexts and UA gates for CHIPS; autoChips is properly disabled when incompatible.

If desired, we can add unit tests covering UA gating for partitioned cookies (pre/post Chrome 118) and ensure SameSite=None is stripped for incompatible UAs. Want me to add them?

packages/cookies/src/keygrip.ts (2)

31-34: Constructor validation LGTM.

Asserts array with at least one key; aligns with tests.


69-81: Signing LGTM (url‑safe base64 + constant‑time verify).

Approach is consistent and safe against timing attacks in verify().

Comment on lines +30 to 33
- **`packages/cookies/`** - Cookie handling utilities (merged from @eggjs/cookies)
- `src/` - Cookies TypeScript source code
- `test/` - Cookies test suite with Mocha
- **`packages/koa/`** - Koa web framework (merged from @eggjs/koa)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix test runner mention for cookies (uses Vitest, not Mocha).

Docs say cookies tests use Mocha, but the new tests import from vitest. Update to Vitest to avoid confusion.

Apply this diff:

-  - `test/` - Cookies test suite with Mocha
+  - `test/` - Cookies test suite with Vitest
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- **`packages/cookies/`** - Cookie handling utilities (merged from @eggjs/cookies)
- `src/` - Cookies TypeScript source code
- `test/` - Cookies test suite with Mocha
- **`packages/koa/`** - Koa web framework (merged from @eggjs/koa)
- **`packages/cookies/`** - Cookie handling utilities (merged from @eggjs/cookies)
- `src/` - Cookies TypeScript source code
- `test/` - Cookies test suite with Vitest
- **`packages/koa/`** - Koa web framework (merged from @eggjs/koa)
🤖 Prompt for AI Agents
In CLAUDE.md around lines 30 to 33, the docs incorrectly state the cookies test
suite uses Mocha; update the text to say Vitest instead. Replace the mention
"Cookies test suite with Mocha" with "Cookies test suite with Vitest" and ensure
any related references in this section (e.g., import examples or tooling notes)
consistently reference Vitest.

Comment on lines 292 to 299
- **IMPORTANT: All new packages MUST use Vitest for testing** - this is the standard test runner for the monorepo
- **Exception: egg-bin uses Mocha** - the CLI tool package uses Mocha for consistency with CLI testing patterns
- **Exception: egg-bin and cookies use Mocha** - these packages use Mocha for consistency with their testing patterns
- Use `pnpm --filter=egg run test` for framework tests
- Test fixtures are in `packages/egg/test/fixtures/apps/`
- Create apps in fixtures to test specific scenarios
- Use `pnpm test` to run tests across all packages
- Follow existing test patterns for consistency

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Align “Testing Strategy” section: only egg-bin uses Mocha.

This block lists cookies as a Mocha exception, but the codebase uses Vitest for cookies tests. Update to avoid drift.

Apply this diff:

-- **Exception: egg-bin and cookies use Mocha** - these packages use Mocha for consistency with their testing patterns
+- **Exception: egg-bin uses Mocha** - this package uses Mocha for CLI testing; all other packages (including cookies) use Vitest
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- **IMPORTANT: All new packages MUST use Vitest for testing** - this is the standard test runner for the monorepo
- **Exception: egg-bin uses Mocha** - the CLI tool package uses Mocha for consistency with CLI testing patterns
- **Exception: egg-bin and cookies use Mocha** - these packages use Mocha for consistency with their testing patterns
- Use `pnpm --filter=egg run test` for framework tests
- Test fixtures are in `packages/egg/test/fixtures/apps/`
- Create apps in fixtures to test specific scenarios
- Use `pnpm test` to run tests across all packages
- Follow existing test patterns for consistency
- **IMPORTANT: All new packages MUST use Vitest for testing** - this is the standard test runner for the monorepo
- **Exception: egg-bin uses Mocha** - this package uses Mocha for CLI testing; all other packages (including cookies) use Vitest
- Use `pnpm --filter=egg run test` for framework tests
- Test fixtures are in `packages/egg/test/fixtures/apps/`
- Create apps in fixtures to test specific scenarios
- Use `pnpm test` to run tests across all packages
- Follow existing test patterns for consistency
🤖 Prompt for AI Agents
In CLAUDE.md around lines 292 to 299, the Testing Strategy currently states both
egg-bin and cookies use Mocha; update this so only egg-bin is listed as the
Mocha exception and remove cookies from the exception list. Modify the text to
read that all new packages must use Vitest, with the single exception of egg-bin
using Mocha, and keep the remaining testing instructions unchanged.

Comment on lines +300 to +310
#### Linting and Type Checking Strategy

- **All packages must include TypeScript type checking** - Use `tsc --noEmit` in `typecheck` script
- **All packages use oxlint for linting** - No ESLint configurations should be present
- Use `oxlint --type-aware` for enhanced TypeScript checking
- oxlint automatically respects `.gitignore` patterns for file exclusion
- Package-specific scripts:
- `"typecheck": "tsc --noEmit"` - Pure TypeScript type checking
- `"lint": "oxlint --type-aware"` - Linting with type awareness
- Remove any `.eslintrc` or `.eslintrc.js` files when migrating packages

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Good: oxlint + tsc guidance. Ensure no ESLint leftovers.

Recommend verifying no residual ESLint configs remain in migrated packages.

Run:


🏁 Script executed:

#!/bin/bash
# Find ESLint configs and ESLint dependencies
fd -H '(.eslintrc|.eslintrc.*|eslint.config.*)' .
rg -nP '"eslint[^"]*"\s*:' package.json
rg -nP '\beslint\b' pnpm-workspace.yaml

Length of output: 219


Remove leftover ESLint configs and dependencies
– Delete the following .eslintrc files:
• packages/core/test/fixtures/helloworld-ts/.eslintrc
• tools/create-egg/src/templates/egg3-simple-js/.eslintrc
• tools/create-egg/src/templates/egg3-simple-ts/.eslintrc
– Remove eslint and eslint-config-egg entries from package.json

🤖 Prompt for AI Agents
In CLAUDE.md around lines 300 to 310, the review asks to remove leftover ESLint
configs and deps: delete the three .eslintrc files at
packages/core/test/fixtures/helloworld-ts/.eslintrc,
tools/create-egg/src/templates/egg3-simple-js/.eslintrc, and
tools/create-egg/src/templates/egg3-simple-ts/.eslintrc, and remove eslint and
eslint-config-egg entries from any package.json files where they appear
(dependencies/devDependencies), updating package.json accordingly and running
any lockfile update (npm/yarn pnpm) to persist the removal; ensure no other
.eslintrc files remain in the repo.

Comment on lines +147 to +151
### Bug Fixes

* domain can be empty string ([#39](https://github.com/eggjs/egg-cookies/issues/39)) ([0b285e1](https://github.com/eggjs/egg-cookies/commit/0b285e1dc8203dde8670c2459e5f8bbde93a1ef5)), closes [/github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929](https://github.com/eggjs//github.com/eggjs/egg-cookies/pull/38/issues/discussion_r1284672929)

## [2.7.0](https://github.com/eggjs/egg-cookies/compare/v2.6.1...v2.7.0) (2023-08-04)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix broken GitHub link.

The URL has a duplicated path segment and won’t resolve.

Apply this diff:

-  * [[`0b285e1`](https://github.com/eggjs/egg-cookies/commit/0b285e1dc8203dde8670c2459e5f8bbde93a1ef5)), closes [/github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929](https://github.com/eggjs//github.com/eggjs/egg-cookies/pull/38/issues/discussion_r1284672929)
+  * [[`0b285e1`](https://github.com/eggjs/egg-cookies/commit/0b285e1dc8203dde8670c2459e5f8bbde93a1ef5)), closes [eggjs/egg-cookies#38 (discussion)](https://github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
### Bug Fixes
* domain can be empty string ([#39](https://github.com/eggjs/egg-cookies/issues/39)) ([0b285e1](https://github.com/eggjs/egg-cookies/commit/0b285e1dc8203dde8670c2459e5f8bbde93a1ef5)), closes [/github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929](https://github.com/eggjs//github.com/eggjs/egg-cookies/pull/38/issues/discussion_r1284672929)
## [2.7.0](https://github.com/eggjs/egg-cookies/compare/v2.6.1...v2.7.0) (2023-08-04)
### Bug Fixes
* domain can be empty string ([#39](https://github.com/eggjs/egg-cookies/issues/39)) ([0b285e1](https://github.com/eggjs/egg-cookies/commit/0b285e1dc8203dde8670c2459e5f8bbde93a1ef5)), closes [eggjs/egg-cookies#38 (discussion)](https://github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929)
## [2.7.0](https://github.com/eggjs/egg-cookies/compare/v2.6.1...v2.7.0) (2023-08-04)
🤖 Prompt for AI Agents
In packages/cookies/CHANGELOG.md around lines 147 to 151, the "closes" link
contains a duplicated path segment
("github.com/eggjs//github.com/eggjs/egg-cookies/...") which breaks the URL;
update the URL to remove the duplicated segment so it points to the pull request
discussion, e.g. replace the malformed href with
"https://github.com/eggjs/egg-cookies/pull/38#discussion_r1284672929" (and keep
the link text consistent).

Comment on lines +30 to +35
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg-cookies.git"
},
"homepage": "https://github.com/eggjs/egg-cookies",
"author": "fengmk2 <fengmk2@gmail.com> (https://github.com/fengmk2)",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Repository/homepage should point to the monorepo path.

These still reference the old standalone repo; will produce wrong links on npm.

-  "repository": {
-    "type": "git",
-    "url": "git://github.com/eggjs/egg-cookies.git"
-  },
-  "homepage": "https://github.com/eggjs/egg-cookies",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/eggjs/egg.git",
+    "directory": "packages/cookies"
+  },
+  "homepage": "https://github.com/eggjs/egg/tree/next/packages/cookies",

As per coding guidelines

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg-cookies.git"
},
"homepage": "https://github.com/eggjs/egg-cookies",
"author": "fengmk2 <fengmk2@gmail.com> (https://github.com/fengmk2)",
"repository": {
"type": "git",
"url": "git://github.com/eggjs/egg.git",
"directory": "packages/cookies"
},
"homepage": "https://github.com/eggjs/egg/tree/next/packages/cookies",
"author": "fengmk2 <fengmk2@gmail.com> (https://github.com/fengmk2)",
🤖 Prompt for AI Agents
In packages/cookies/package.json around lines 30-35, the "repository" and
"homepage" fields point to the old standalone repo; change them to reference the
monorepo: set "repository.url" to the monorepo git URL (e.g.
git+https://github.com/eggjs/egg.git) and set "homepage" to the package path in
the monorepo (e.g. https://github.com/eggjs/egg/tree/master/packages/cookies) so
npm links resolve to the correct monorepo location.

@@ -0,0 +1,1387 @@
import { strict as assert } from 'node:assert';

import { describe, expect, it, vi } from 'vitest';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Align with testing guidelines: drop expect and use Node assert

Per repo testing guidelines, use Node.js assert for assertions. You already import assert; remove expect from vitest.

Apply this diff:

-import { describe, expect, it, vi } from 'vitest';
+import { describe, it, vi } from 'vitest';

As per coding guidelines

🤖 Prompt for AI Agents
In packages/cookies/test/cookies.test.ts around line 3, the vitest import
currently includes expect which conflicts with the repo testing guideline to use
Node's assert; remove expect from the import list (keep describe, it, vi) and
update any assertion calls to use the already-imported assert module instead of
expect (or ensure existing asserts are used); run tests to confirm no remaining
expect references.

const cookie = cookies.ctx.response.headers['set-cookie'][0];
cookies.ctx.request.headers.cookie = cookie;
const value = cookies.get('foo', { encrypt: true });
assert(value, 'bar');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Incorrect assert usage: not asserting equality

assert(value, 'bar') only checks truthiness; it does not compare to 'bar'.

Apply this diff:

-    assert(value, 'bar');
+    assert.equal(value, 'bar');
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
assert(value, 'bar');
assert.equal(value, 'bar');
🤖 Prompt for AI Agents
In packages/cookies/test/cookies.test.ts around line 30, the test uses
assert(value, 'bar') which only checks truthiness rather than equality; replace
that call with an equality assertion such as assert.strictEqual(value, 'bar') so
the test verifies value equals 'bar' (ensure the Node assert import supports
strictEqual).

const cookie = cookies.ctx.response.headers['set-cookie'].join(';');
cookies.ctx.request.headers.cookie = cookie;
const value = cookies.get('foo', { encrypt: true });
assert(value, 'bar');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Incorrect assert usage: not asserting equality

Same issue; compare explicitly.

Apply this diff:

-    assert(value, 'bar');
+    assert.equal(value, 'bar');
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
assert(value, 'bar');
assert.equal(value, 'bar');
🤖 Prompt for AI Agents
In packages/cookies/test/cookies.test.ts around line 62, the test currently uses
assert(value, 'bar') which only checks truthiness rather than equality; replace
that call with an explicit equality assertion such as assert.strictEqual(value,
'bar') (or assert.equal if non-strict comparison is intended) so the test
verifies the value equals 'bar' and fails with a clear message on mismatch.

Comment on lines +283 to +291
expect(emit.mock.calls.length).toBe(1);
expect(emit.mock.calls[0][0]).toBe('cookieLimitExceed');
expect(emit.mock.calls[0][1]).toEqual({
name: 'foo',
value,
ctx: cookies.ctx,
});
expect(cookies.ctx.response.headers['set-cookie'][0]).toMatch(/^foo=1{4094}; path=\/; httponly$/);
});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Use Node assert instead of expect in tests

Replace vitest expect assertions with Node assert to follow repo standards.

Apply this diff:

-    expect(emit.mock.calls.length).toBe(1);
-    expect(emit.mock.calls[0][0]).toBe('cookieLimitExceed');
-    expect(emit.mock.calls[0][1]).toEqual({
+    assert.equal(emit.mock.calls.length, 1);
+    assert.equal(emit.mock.calls[0][0], 'cookieLimitExceed');
+    assert.deepEqual(emit.mock.calls[0][1], {
       name: 'foo',
       value,
       ctx: cookies.ctx,
     });
-    expect(cookies.ctx.response.headers['set-cookie'][0]).toMatch(/^foo=1{4094}; path=\/; httponly$/);
+    assert.match(
+      cookies.ctx.response.headers['set-cookie'][0],
+      /^foo=1{4094}; path=\/; httponly$/
+    );

As per coding guidelines

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
expect(emit.mock.calls.length).toBe(1);
expect(emit.mock.calls[0][0]).toBe('cookieLimitExceed');
expect(emit.mock.calls[0][1]).toEqual({
name: 'foo',
value,
ctx: cookies.ctx,
});
expect(cookies.ctx.response.headers['set-cookie'][0]).toMatch(/^foo=1{4094}; path=\/; httponly$/);
});
assert.equal(emit.mock.calls.length, 1);
assert.equal(emit.mock.calls[0][0], 'cookieLimitExceed');
assert.deepEqual(emit.mock.calls[0][1], {
name: 'foo',
value,
ctx: cookies.ctx,
});
assert.match(
cookies.ctx.response.headers['set-cookie'][0],
/^foo=1{4094}; path=\/; httponly$/
);
🤖 Prompt for AI Agents
In packages/cookies/test/cookies.test.ts around lines 283-291, the test
currently uses vitest's expect; replace these with Node's assert: import assert
from 'node:assert' at the top (or add to existing imports), then change the
assertions to use assert.strictEqual(emit.mock.calls.length, 1),
assert.strictEqual(emit.mock.calls[0][0], 'cookieLimitExceed'),
assert.deepStrictEqual(emit.mock.calls[0][1], { name: 'foo', value, ctx:
cookies.ctx }), and assert.match(cookies.ctx.response.headers['set-cookie'][0],
/^foo=1{4094}; path=\/; httponly$/). Ensure any unnecessary expect imports are
removed.

Comment on lines +39 to +41
{
"path": "./packages/cookies"
},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

LGTM: root TS project now references packages/cookies.

This keeps type-checking coherent across packages.

Verify the package tsconfig extends the root and is composite:

Based on learnings


🏁 Script executed:

#!/bin/bash
# Show tsconfig content for the cookies package and check key fields
fd -a tsconfig.json packages/cookies | xargs -I{} sh -c 'echo "--- {} ---"; sed -n "1,120p" "{}"'
rg -nP '"extends"\s*:\s*"\.\./\.\./tsconfig\.json"|"\bcomposite\b"\s*:\s*true' packages/cookies/tsconfig.json

Length of output: 182


Add "composite": true to packages/cookies/tsconfig.json. Sub-project configs must enable composite for project references.

🤖 Prompt for AI Agents
In tsconfig.json around lines 39 to 41 (the entry for "path":
"./packages/cookies"), the sub-project tsconfig at packages/cookies must enable
project references by setting "composite": true; open
packages/cookies/tsconfig.json and add "composite": true at the top-level
compilerOptions (or ensure it exists and is true), then save so the package
config is eligible for TypeScript project references.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant