fix(cli): guard console resolution against stale out-of-workspace installs#1778
Merged
Merged
Conversation
fix(app-shell): NavigationSyncEffect baseline race — readiness gate, sys_ filter, ADR-0010 lock filter (#1668) objectui@e95cc25b2c0d2fa680e232151721e71c19630659
…talls
resolveConsolePath() resolves @objectstack/console via createRequire from
the consumer cwd, and Node module resolution climbs node_modules
directories past the workspace root. A stray install higher up the
filesystem (e.g. a leftover ~/node_modules/@objectstack/console@7.8.0
from an npm experiment) won over the version-locked bundle, so
`serve --dev` served a stale Console (browser-side OBJUI-001
"Unknown component type: marketplace:installed-list").
The vendored console package is version-locked to the framework release,
so a healthy install always shares the CLI's major version. Skip any
candidate from node resolution or the cwd/node_modules direct check
whose major differs from the CLI's own, and warn with the path and both
versions so the stray install is discoverable. The sibling-repo objectui
dev fallback is exempt (independent versioning, explicit opt-in). If the
CLI's own version can't be read the guard fails open.
resolveConsolePath() now takes optional { cwd, cliVersion, warn } for
testability; the serve.ts call site is unchanged. Also documents in
AGENTS.md that passing work must land via branch + PR, not sit in the
working tree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
resolveConsolePath()inpackages/cli/src/utils/console.tsresolves@objectstack/console/package.jsonviacreateRequirefrom the consumer cwd. Node module resolution climbsnode_modulesdirectories all the way up the filesystem — past the workspace root. A stray install higher up (real incident: a leftover~/node_modules/@objectstack/console@7.8.0from an old npm experiment) won over the version-locked bundle, soserve --devsilently served a stale Console and the browser failed with OBJUI-001Unknown component type: marketplace:installed-list.Fix
The vendored
@objectstack/consoleis version-locked to the framework release, so a healthy install always shares the CLI's major version:isConsoleVersionCompatible(): candidates from node resolution (strategy 1) and thecwd/node_modulesdirect check (strategy 2) are skipped with a warning when their major version differs from the CLI's own. The warning names the path and both versions so the stray install is discoverable.../objectuidev fallback is exempt — it versions independently and is an explicit dev opt-in.package.json; if unreadable, the guard fails open rather than breaking resolution.resolveConsolePath()gains optional{ cwd, cliVersion, warn }for testability; theserve.tscall site is unchanged.Also adds a Post-Task Checklist item to AGENTS.md: passing work must land via branch + PR, not sit in the working tree.
Tests
New
packages/cli/test/console-resolve.test.tsreproduces the incident shape in a tmpdir sandbox (stale@7.8.0in a simulated$HOME, project as cwd) and pins: stale install skipped + warned, same-major accepted, matching local install preferred, missing-version rejected. Fullpackages/clisuite: 275 passed.tsc --noEmitclean.🤖 Generated with Claude Code