Juan Escalada — Dev Log

Secrets in argv, and scanners that fail open

Thu, 03 Sep 2026 00:00:00 GMT

A git clone with Authorization on argv is readable from ps, and a scanner that swallows errors is a silent pass. Two fixes from a PR review.

ENOSPC: System limit for number of file watchers reached

Wed, 02 Sep 2026 00:00:00 GMT

ENOSPC: System limit for number of file watchers reached is an inotify limit, not a full disk. Here's how to find what ate your watchers and raise them.

Exit code 126 in CI: the exec bit git never committed

Wed, 02 Sep 2026 00:00:00 GMT

A GitHub Actions step failed with Permission denied and exit code 126. The script was committed as 100644 because core.fileMode was off. Here's the fix.

Missing files after npm publish: the files allowlist

Tue, 01 Sep 2026 00:00:00 GMT

Files missing from a published npm package: our vite UI build landed outside dist, so the files allowlist dropped it. Here's how I found and fixed it.

Losing this by passing a method as a callback

Mon, 31 Aug 2026 00:00:00 GMT

Passing obj.exec into a list strips this, so stateful plugins crash. Bind it, wrap it, or use an arrow field. Here is the GitProxy fix.

Optional chaining as an accidental deny

Sun, 30 Aug 2026 00:00:00 GMT

p.chains?.includes(name) dropped every plugin that omitted chains. Optional chaining in a filter is an accidental deny; default with ?? instead.

Record hid a missing key as defined

Sat, 29 Aug 2026 00:00:00 GMT

Record types every key as present, so a typo compiled and getChain returned undefined. Thirteen tests failed from one missing key.

How to write a GitProxy plugin: a diff-scanning example

Fri, 28 Aug 2026 00:00:00 GMT

How to write a GitProxy plugin: a complete diff-scanning example, how to pick the right chain phase, and why a plugin can load and still never run.

TypeScript class fields wipe values set in super()

Thu, 27 Aug 2026 00:00:00 GMT

A subclass field declaration overwrites what the base constructor assigned. useDefineForClassFields is why, and declare is the one-line fix.

Package subpath is not defined by exports

Wed, 26 Aug 2026 00:00:00 GMT

Package subpath is not defined by exports, plus ts(2307): the file exists, the exports map hides it. Here's how to import a public type instead.

Cannot find package: ESM bare specifiers in config

Tue, 25 Aug 2026 00:00:00 GMT

Cannot find package 'plugins' is Node treating a relative path as a package name. Here is the ESM specifier rule, and the one-character fix.

How to design a plugin system for your project

Mon, 24 Aug 2026 00:00:00 GMT

How to design a plugin system: named phases instead of positions, deny-by-default placement, and the defaults that must live outside your constructor.

Vitest: vi.mocked(...).mockResolvedValue is not a function

Tue, 30 Jun 2026 00:00:00 GMT

Vitest 3 test fails with vi.mocked(...).mockResolvedValue is not a function after restoreAllMocks. Here's how to fix it in one line.

Vitest 4 tests pass locally but fail in CI

Fri, 05 Jun 2026 00:00:00 GMT

Bumping Vitest from 3 to 4 turned my git-proxy CI red while local stayed green. Stale node_modules, broken class mocks, and port clashes. Here's how I fixed each.

AI PR review and security scanning with GitHub Actions

Sun, 26 Apr 2026 00:00:00 GMT

Build your own GitHub Actions bot that review pull requests with an LLM: PR Description Checker and Security Scanner.

Auto-triage GitHub issues with an AI agent and Actions

Sun, 12 Apr 2026 00:00:00 GMT

Build a GitHub Actions bot that triages issues and PRs with an LLM: label, dedupe, security-scan, and run it on Claude, GPT, or Gemini. Here's how I did it.

Switching to npm trusted publishers: mind the Node version

Sun, 01 Feb 2026 00:00:00 GMT

Moving GitProxy's npm publish from a token to OIDC trusted publishers took a few lines, except for one thing that kept failing.

A Vitest toThrow test that misses a JSON.parse error

Tue, 20 Jan 2026 00:00:00 GMT

A Vitest test using expect().toThrow() let a JSON.parse SyntaxError escape and fail the run instead of catching it. Here's why, and the fix.

Moving a Git tag to a newer commit

Wed, 14 Jan 2026 00:00:00 GMT

Moving a Git tag to a newer commit takes a force push, or Git rejects it because the tag already exists. Here's how, plus the gotcha that bites teammates.

Docker EACCES: permission denied, mkdir as a non-root user

Fri, 09 Jan 2026 00:00:00 GMT

A containerized Node app failed with EACCES: permission denied, mkdir './.data' after dropping to a non-root user. Here's the cause and the fix.

Migrating GitProxy's tests from Mocha and Chai to Vitest

Fri, 05 Dec 2025 00:00:00 GMT

How to fix all the ESM mocking errors when moving GitProxy's test suite from Mocha, Chai, Sinon and proxyquire to Vitest + TypeScript

Setting environment variables on Windows npm scripts

Wed, 05 Nov 2025 00:00:00 GMT

Why "NODE_ENV=test" fails on Windows, and the one-line fix with cross-env.

From proxyquire to Vitest: fixing "undefined" is not valid JSON

Sun, 14 Sep 2025 00:00:00 GMT

A git-proxy test failed with 'undefined' is not valid JSON after moving from proxyquire to Vitest. Let's look at the cause and how to fix.

Starting a public debugging log for GitProxy

Wed, 10 Sep 2025 00:00:00 GMT

I've decided to share every debugging session and feature while building GitProxy in the open.