Show a summary per file

\n\n| File | Description |\\n| ---- | ----------- |\\n| `src/Console/Commands/DevPullCommand.php` | New command that fetches commit info, downloads/extracts zipball, replaces `vendor/notur/notur`, and rebuilds frontend assets. |\\n| `src/NoturServiceProvider.php` | Registers the new `DevPullCommand` with Artisan. |\\n| `config/notur.php` | Bumps version to `1.2.4` and adds `repository` config key. |\\n| `website/docs/admin/guide.md` | Documents `notur:dev:pull` usage and the new `repository` config option. |\\n| `website/docs/reference/changelog.md` | Adds `1.2.4` changelog entry describing the new command/config. |\\n| `CLAUDE.md` | Updates documented Artisan command count/list to include `notur:dev:pull`. |\n

\n\n\n\n\n\n\n---\n\n💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.","side","line","`rename()` results are not checked when preserving/restoring `vendor/` and `node_modules/`. If a rename fails (permissions, locks, etc.), the command can silently proceed and later delete/overwrite directories, potentially losing install artifacts. Check the return values and abort with a clear error if a preserve/restore move fails.","RIGHT",296,"The command assumes `base_path('vendor/notur/notur')` exists and is writable. If Notur isn't installed via Composer (or permissions prevent writes), later steps will fail after partially running. Add an early guard that the directory exists (and is writable) before proceeding.\n```suggestion\n\n if (! is_dir($noturRoot)) {\n $this->error(\"Notur installation not found at path: {$noturRoot}. Make sure Notur is installed (e.g. via Composer) before running this command.\");\n return 1;\n }\n\n if (! is_writable($noturRoot)) {\n $this->error(\"The Notur installation directory is not writable: {$noturRoot}. Please adjust filesystem permissions and try again.\");\n return 1;\n }\n```",35,"If extraction fails, the temporary extraction directory created at `$tmpDir` is not cleaned up, which can leak directories in the system temp folder. Ensure the catch block deletes `$tmpDir` (when it exists) before returning.",112,"`ZipArchive::extractTo()` is called on an untrusted zip without validating entry paths. A crafted archive could use path traversal (e.g. `../`) to write outside the temp directory before files are copied into `vendor/`. Validate all zip entry names (no absolute paths, no `..` segments) and/or extract entries manually to a controlled location.",248,"`$ref` is interpolated directly into the GitHub API URL. Branch names commonly contain slashes (e.g. `feature/foo`), which will break the `/commits/{ref}` path and cause 404s. URL-encode the ref (and ideally validate/sanitize it) before building the request URL.",199,"There are integration tests for other Artisan commands under `tests/Integration/Console/`, but this new command has no coverage. Consider adding tests that fake the GitHub API responses and exercise at least the `--dry-run` path and error handling paths (e.g. invalid ref / download failure).",53,"`runProcess()` is duplicated from `BuildCommand` with identical implementation. Consider extracting this into a shared helper/trait (or a small internal service) so process execution behavior stays consistent across commands and future fixes only need to be made once.",349,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `cf01adb5a7`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](http://chatgpt.com/codex/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

","Comments in the same thread:\n\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Detect npm installs in package manager selection**\n\nIf the pulled framework (or a fork) uses npm and only has a `package-lock.json`, `resolvePackageManager` still falls back to `bun`, which will fail on systems without Bun and prevents the rebuild steps from running even though npm is available. This makes `notur:dev:pull` unreliable for npm-based setups. Consider checking for `package-lock.json` and returning `npm` (or defaulting to `npm` when no lock file is found).\n\nUseful? React with 👍 / 👎.",318,"base_ref","head_ref","pull_request_info",[683],{"_612":57,"_57":684},"@codex adress this feedback (path=src/Console/Commands/DevPullCommand.php line=318 side=RIGHT)",[715,716,717],[],{"_322":714},{"_319":713},{"_319":712},{"_284":285,"_275":286,"_287":288,"_289":70,"_290":18,"_291":18,"_292":293,"_294":295,"_296":246,"_297":138,"_298":299,"_300":301,"_302":-5,"_303":-5,"_304":305,"_306":-5,"_307":-5,"_308":711,"_310":311,"_312":313,"_314":315,"_316":317},{"_53":134,"_172":-5,"_173":174,"_175":176,"_177":18,"_178":179,"_180":181,"_182":700,"_184":-5,"_185":-5,"_186":18,"_187":701,"_189":179,"_190":179,"_191":702,"_193":703,"_195":704,"_197":-5,"_198":199,"_200":201,"_202":203,"_204":705,"_66":-5,"_130":206,"_207":706,"_209":707,"_211":212,"_213":18,"_214":18},{"_144":693},[694,695,696],{"_156":699,"_158":169},{"_156":698,"_158":165},{"_156":697,"_158":159},{"_160":161,"_104":162,"_130":163},{"_160":166,"_104":162,"_130":167},{"_160":170,"_104":162,"_130":171},{"_277":278,"_279":-5,"_280":-5,"_281":-5,"_282":-5,"_283":-5},[236],{"_236":708},{"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235},{},[],{"_217":70},{"_215":70,"_216":179},{"_53":238,"_160":239,"_240":709,"_242":176,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":75,"_254":-5,"_255":-5,"_256":-5,"_257":-5,"_258":-5,"_259":-5,"_260":-5,"_261":262,"_263":-5,"_66":710},{"_269":270,"_53":271,"_104":272,"_273":274,"_275":276},{"_265":18,"_266":18,"_267":18,"_268":18},{"_269":270,"_160":270,"_318":-5,"_273":274,"_53":271},[],[],[],{"_104":607,"_108":105,"_365":725},{"_104":351,"_352":720},{"_104":327,"_328":329,"_330":331,"_332":718,"_334":-5},{"_104":332,"_335":176,"_139":140,"_336":-5,"_307":337,"_338":719,"_340":341,"_342":343,"_344":341,"_345":346,"_347":-5},{"_348":349,"_350":-5},[721],{"_355":356,"_357":-5,"_358":722,"_360":-5},[723],{"_362":341,"_363":364,"_365":724,"_367":70},[368,179,369,179,370,179,371,372,373,374,179,375,376,377,378,179,379,380,381,382,383,179,384,179,385,386,387,388,389,390,391,179,392,393,179,394,395,396,397,398,399,400,401,179,402,403,179,404,405,406,407,408,409,179,410,411,412,413,414,415,179,416,417,418,419,420,421,416,179,422,423,424,179,425,426,427,428,429,430,431,432,409,179,433,434,432,409,179,435,436,437,179,404,438,406,439,440,408,409,179,441,179,442,443,179,404,444,406,445,440,408,409,179,446,179,447,448,179,404,449,406,450,451,408,409,179,452,453,179,454,455,426,456,179,457,179,458,459,460,431,179,461,459,462,431,179,463,459,464,431,179,465,466,467,179,468,469,470,471,472,473,474,475,476,431,179,477,478,179,479,480,481,482,472,483,484,485,486,431,409,179,487,488,489,179,416,490,491,179,492,493,179,494,386,495,179,404,496,497,498,499,500,501,502,409,179,503,504,505,409,179,506,493,179,507,386,508,179,404,509,510,511,512,513,497,498,514,500,501,502,409,493,179,515,386,516,517,409,179,518,519,179,520,521,409,179,522,523,179,524,525,526,527,528,179,529,530,409,179,531,493,179,532,386,533,534,535,179,536,537,538,539,540,472,541,431,409,179,542,543,544,409,179,545,546,179,547,536,548,549,550,551,552,472,553,431,409,179,554,555,556,409,493,179,557,386,558,559,409,560,561,409,562,563,409,564,565,409,179,566,493,179,567,386,568,569,570,571,572,573,179,574,408,409,179,575,576,179,577,578,179,579,179,580,581,409,582,583,409,179,584,493,179,585,386,586,587,409,179,588,589,590,573,179,591,592,593,594,595,472,596,597,431,409,493,179,598,386,599,600,409,179,588,601,602,573,179,591,593,603,596,604,431,409,179,605,493,606],[726,727,728],{"_612":57,"_57":617},{"_612":614,"_355":356,"_362":615,"_363":616},{"_612":57,"_57":613},[759,760,761],[],{"_322":758},{"_319":757},{"_319":756},{"_284":285,"_275":286,"_287":288,"_289":70,"_290":18,"_291":18,"_292":293,"_294":295,"_296":246,"_297":138,"_298":299,"_300":301,"_302":-5,"_303":-5,"_304":305,"_306":-5,"_307":-5,"_308":755,"_310":311,"_312":313,"_314":315,"_316":317},{"_53":134,"_172":-5,"_173":174,"_175":176,"_177":18,"_178":179,"_180":181,"_182":744,"_184":-5,"_185":-5,"_186":18,"_187":745,"_189":179,"_190":179,"_191":746,"_193":747,"_195":748,"_197":-5,"_198":199,"_200":201,"_202":203,"_204":749,"_66":-5,"_130":206,"_207":750,"_209":751,"_211":212,"_213":18,"_214":18},{"_144":737},[738,739,740],{"_156":743,"_158":169},{"_156":742,"_158":165},{"_156":741,"_158":159},{"_160":161,"_104":162,"_130":163},{"_160":166,"_104":162,"_130":167},{"_160":170,"_104":162,"_130":171},{"_277":278,"_279":-5,"_280":-5,"_281":-5,"_282":-5,"_283":-5},[236],{"_236":752},{"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235},{},[],{"_217":70},{"_215":70,"_216":179},{"_53":238,"_160":239,"_240":753,"_242":176,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":75,"_254":-5,"_255":-5,"_256":-5,"_257":-5,"_258":-5,"_259":-5,"_260":-5,"_261":262,"_263":-5,"_66":754},{"_269":270,"_53":271,"_104":272,"_273":274,"_275":276},{"_265":18,"_266":18,"_267":18,"_268":18},{"_269":270,"_160":270,"_318":-5,"_273":274,"_53":271},[],[],[],{"_104":607,"_108":105,"_365":769},{"_104":351,"_352":764},{"_104":327,"_328":329,"_330":331,"_332":762,"_334":-5},{"_104":332,"_335":176,"_139":140,"_336":-5,"_307":337,"_338":763,"_340":341,"_342":343,"_344":341,"_345":346,"_347":-5},{"_348":349,"_350":-5},[765],{"_355":356,"_357":-5,"_358":766,"_360":-5},[767],{"_362":341,"_363":364,"_365":768,"_367":70},[368,179,369,179,370,179,371,372,373,374,179,375,376,377,378,179,379,380,381,382,383,179,384,179,385,386,387,388,389,390,391,179,392,393,179,394,395,396,397,398,399,400,401,179,402,403,179,404,405,406,407,408,409,179,410,411,412,413,414,415,179,416,417,418,419,420,421,416,179,422,423,424,179,425,426,427,428,429,430,431,432,409,179,433,434,432,409,179,435,436,437,179,404,438,406,439,440,408,409,179,441,179,442,443,179,404,444,406,445,440,408,409,179,446,179,447,448,179,404,449,406,450,451,408,409,179,452,453,179,454,455,426,456,179,457,179,458,459,460,431,179,461,459,462,431,179,463,459,464,431,179,465,466,467,179,468,469,470,471,472,473,474,475,476,431,179,477,478,179,479,480,481,482,472,483,484,485,486,431,409,179,487,488,489,179,416,490,491,179,492,493,179,494,386,495,179,404,496,497,498,499,500,501,502,409,179,503,504,505,409,179,506,493,179,507,386,508,179,404,509,510,511,512,513,497,498,514,500,501,502,409,493,179,515,386,516,517,409,179,518,519,179,520,521,409,179,522,523,179,524,525,526,527,528,179,529,530,409,179,531,493,179,532,386,533,534,535,179,536,537,538,539,540,472,541,431,409,179,542,543,544,409,179,545,546,179,547,536,548,549,550,551,552,472,553,431,409,179,554,555,556,409,493,179,557,386,558,559,409,560,561,409,562,563,409,564,565,409,179,566,493,179,567,386,568,569,570,571,572,573,179,574,408,409,179,575,576,179,577,578,179,579,179,580,581,409,582,583,409,179,584,493,179,585,386,586,587,409,179,588,589,590,573,179,591,592,593,594,595,472,596,597,431,409,493,179,598,386,599,600,409,179,588,601,602,573,179,591,593,603,596,604,431,409,179,605,493,606],[770,771,772],{"_612":57,"_57":617},{"_612":614,"_355":356,"_362":615,"_363":616},{"_612":57,"_57":613},[775,776,777,778,779,780,781,782,783,784,785,786],{"_627":628,"_242":176,"_629":285,"_253":-5,"_335":236,"_630":18,"_631":-5,"_632":-5,"_633":634,"_635":327,"_636":-5,"_637":-5,"_638":639,"_640":18,"_641":70,"_642":65,"_643":18,"_644":-5},{"_104":607,"_108":308,"_365":787},{"_292":293,"_294":295,"_679":299,"_680":140,"_304":-5,"_104":681},{"_104":657,"_294":677,"_355":356,"_659":662,"_660":678},{"_104":657,"_294":676,"_355":-5,"_659":-5,"_660":-5},{"_104":657,"_294":674,"_355":356,"_659":662,"_660":675},{"_104":657,"_294":672,"_355":356,"_659":662,"_660":673},{"_104":657,"_294":670,"_355":356,"_659":662,"_660":671},{"_104":657,"_294":668,"_355":356,"_659":662,"_660":669},{"_104":657,"_294":666,"_355":356,"_659":662,"_660":667},{"_104":657,"_294":664,"_355":356,"_659":662,"_660":665},{"_104":657,"_294":661,"_355":356,"_659":662,"_660":663},{"_104":657,"_294":658,"_355":-5,"_659":-5,"_660":-5},[788],{"_612":57,"_57":684},"task_e_69876dd4523083318d274b3e6986df21",1770483156.321318,"Github Mention: Feature/dev pull command","has_generated_title","has_unread_turn","denormalized_metadata",{"_821":43,"_822":823,"_824":-5,"_825":-5,"_815":826,"_827":-5,"_828":-5,"_829":-5,"_830":-5},"task_status_display",{"_809":810,"_811":176,"_141":138,"_812":-5,"_813":327},"creator_workspace","external_pull_requests",[801],{"_53":802,"_803":95,"_804":805,"_806":807},"github-1148380250-18","assistant_turn_id","pull_request",{"_284":285,"_275":286,"_287":288,"_289":70,"_290":18,"_291":18,"_292":293,"_294":295,"_296":246,"_297":138,"_298":299,"_300":301,"_302":-5,"_303":-5,"_304":305,"_306":-5,"_307":-5,"_308":808,"_310":311,"_312":313,"_314":315,"_316":317},"codex_updated_sha","07a5b54fe66886c82bf05327372c1513c7b0ffbf",{"_269":270,"_160":270,"_318":-5,"_273":274,"_53":271},"latest_turn_status_display",{"_814":95,"_123":124,"_815":816,"_106":817,"_818":-5,"_819":-5,"_820":327,"_125":-5},"environment_label","fix_task_id","initial_intent","turn_id","diff_stats",{"_340":341,"_342":343,"_344":341},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_340":-5,"_342":-5,"_344":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_845":846,"_847":848},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","manageRootRouteStylesheet","mobileWebHandoffEnabled","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",844],"traceId","1936656065222071893","traceTime",1789453180188]