fix: treat upstream 404 as package deleted when syncing

[fengmk2]

When the upstream registry responds 404 for a package manifest, the sync task now treats the package as removed in the remote registry and processes it through the same flow as a 451 response, honoring syncDeleteMode (delete/block/ignore). Before this change the task ignored 404 responses, so fully unpublished packages kept their stale versions and maintainer metadata on the mirror.

The new syncDeleteOnNotFound config (default true, env CNPMCORE_CONFIG_SYNC_DELETE_ON_NOT_FOUND) controls this. Set it to false to restore the ignore behavior from #739, which guards against upstream registries that return transient 404s during maintenance. Registries that worry about that case can also use syncDeleteMode = block for a reversible removal.

Closes #1115

Summary by CodeRabbit

• New Features

  • Added configurable handling for packages that return “404 Not Found” during synchronization.
  • By default, missing upstream packages are treated as removed and processed according to the configured deletion mode.
  • Added an option to preserve packages and versions when upstream returns 404.

• Bug Fixes

  • Improved removal and access-blocking behavior for packages no longer available upstream.
  • Enhanced logging and response details for not-found packages.

• Tests

  • Added coverage for removal, blocking, and preservation scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

The syncer now treats upstream manifest 404 responses as remote package removals by default. The new syncDeleteOnNotFound option can disable this behavior. Tests cover removal, block mode, preservation, logging, and response details.

Changes

Upstream 404 removal handling

Layer / File(s)	Summary
404 removal configuration app/port/config.ts, config/config.default.ts	Adds the syncDeleteOnNotFound configuration property. The default is enabled and can be set through CNPMCORE_CONFIG_SYNC_DELETE_ON_NOT_FOUND.
Manifest 404 execution path app/core/service/PackageSyncerService.ts	When enabled, a manifest 404 delegates to syncDeletePkg. When disabled, the existing not-found failure path remains active.
404 behavior coverage test/core/service/PackageSyncerService/executeTask.test.ts, test/core/service/PackageSyncerService/executeTaskWithPackument.test.ts	Tests cover package removal, block mode, disabled removal, preserved versions, removal logging, and detailed 404 response data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant UpstreamRegistry
  participant PackageSyncerService
  participant syncDeletePkg
  UpstreamRegistry-->>PackageSyncerService: Return manifest 404
  PackageSyncerService->>syncDeletePkg: Process remote removal when enabled
  syncDeletePkg-->>PackageSyncerService: Apply syncDeleteMode

Loading

Possibly related PRs

• cnpm/cnpmcore#740: Changes PackageSyncerService.executeTask and tests for upstream HTTP 404 handling.
• cnpm/cnpmcore#894: Changes manifest-fetch handling in PackageSyncerService.executeTask.
• cnpm/cnpmcore#929: Changes PackageSyncerService.executeTask and tests for sync prevention behavior.

Suggested labels: bug

Suggested reviewers: copilot, elrrrrrrr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes treating upstream 404 responses as package deletion during synchronization.
Linked Issues check	✅ Passed	The changes address issue #1115 by processing upstream 404 responses through the existing package deletion flow.
Out of Scope Changes check	✅ Passed	All changes support upstream 404 deletion handling, configuration, and focused test coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-sync-delete-on-not-found

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the package sync flow so an upstream 404 packument response can be treated as a remote deletion and processed through the existing delete/block/ignore logic (same flow as upstream 451), preventing stale mirrored manifests for fully-unpublished packages.

Changes:

• Add syncDeleteOnNotFound config (default true, env CNPMCORE_CONFIG_SYNC_DELETE_ON_NOT_FOUND) to control whether upstream 404 should trigger the delete/block/ignore flow.
• Update PackageSyncerService.executeTask() to route upstream 404 into the existing syncDeletePkg() flow when enabled.
• Extend and adjust tests to cover: default 404-as-deleted behavior, syncDeleteMode=block, and the opt-out behavior (syncDeleteOnNotFound=false).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
app/core/service/PackageSyncerService.ts	Treat upstream 404 as remote deletion when syncDeleteOnNotFound is enabled, using the existing syncDeleteMode flow.
app/port/config.ts	Add syncDeleteOnNotFound to the typed config contract with inline documentation.
config/config.default.ts	Provide default value + env binding for syncDeleteOnNotFound.
test/core/service/PackageSyncerService/executeTask.test.ts	Add coverage for 404 delete/block/ignore behaviors and adjust existing 404 test expectations.
test/core/service/PackageSyncerService/executeTaskWithPackument.test.ts	Adjust 404-related assertions to account for the new opt-out behavior.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/core/service/PackageSyncerService.ts`:
- Around line 595-600: Before invoking syncDeletePkg in the syncDeleteOnNotFound
branch of PackageSyncerService.executeTask, re-check that the task’s remote
time.modified and local manifest state still match the current package state;
treat the task as stale and skip deletion when newer state is present, while
preserving deletion for the current 404 task.

In `@test/core/service/PackageSyncerService/executeTask.test.ts`:
- Around line 363-364: Update the failure-case assertions in
test/core/service/PackageSyncerService/executeTask.test.ts at lines 363-364 and
test/core/service/PackageSyncerService/executeTaskWithPackument.test.ts at lines
633-634 to verify the sync-task response has state "fail" and exposes the
"Package not exists, response data: ..." error, while retaining the existing log
assertions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ec1f214-d80a-45a3-a9b0-c6014cfc6c92

📥 Commits

Reviewing files that changed from the base of the PR and between b25d672 and 112365b.

📒 Files selected for processing (5)

• app/core/service/PackageSyncerService.ts
• app/port/config.ts
• config/config.default.ts
• test/core/service/PackageSyncerService/executeTask.test.ts
• test/core/service/PackageSyncerService/executeTaskWithPackument.test.ts

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.22%. Comparing base (b25d672) to head (112365b).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1119   +/-   ##
=======================================
  Coverage   94.22%   94.22%           
=======================================
  Files         213      213           
  Lines        8933     8936    +3     
  Branches     1796     1764   -32     
=======================================
+ Hits         8417     8420    +3     
  Misses        516      516           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎉 This PR is included in version 4.34.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀