@superblocksteam/sdk 2.0.124-next.0 → 2.0.124-next.2

package/src/cli-replacement/dev.mts

@@ -38,6 +38,7 @@ import {
 } from "@superblocksteam/vite-plugin-file-sync/lock-service";
 import {
   type NpmRegistryClient,
+  type NpmRegistryFetchResult,
   type ParseContext,
   shouldIgnoreInstallScripts,
 } from "@superblocksteam/vite-plugin-file-sync/npm-registry";
@@ -224,6 +225,79 @@ async function readPkgJson(cwd: string) {
   }
 }
 
+async function readPackageLock(cwd: string): Promise<string | null> {
+  try {
+    return await nodeFs.readFile(path.join(cwd, "package-lock.json"), "utf8");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Canonicalize a lockfile for post-install change detection. Every boot,
+ * `stripResolvedFromLockfile` (APPS-4300) removes the `resolved` URLs and
+ * the validation install writes them back, so comparing raw bytes flags
+ * "changed" on EVERY registry-validation boot — re-uploading the full
+ * workspace to DBFS forever. Dropping `resolved` from both sides of the
+ * comparison (same npm v2+ `.packages` shape the strip targets) means only
+ * material resolution changes — added/removed packages, version bumps,
+ * integrity changes — trigger the upload.
+ */
+export function lockfileComparisonKey(raw: string | null): string | null {
+  if (raw === null) return null;
+  try {
+    const parsed = JSON.parse(raw) as { packages?: Record<string, unknown> };
+    if (parsed?.packages && typeof parsed.packages === "object") {
+      for (const entry of Object.values(parsed.packages)) {
+        if (entry && typeof entry === "object") {
+          delete (entry as { resolved?: unknown }).resolved;
+        }
+      }
+    }
+    return JSON.stringify(parsed);
+  } catch {
+    // Malformed lockfile: fall back to byte-level comparison.
+    return raw;
+  }
+}
+
+async function shouldValidatePrivateRegistryInstall(
+  npmRegistryClient: NpmRegistryClient | undefined,
+  logger: Logger,
+): Promise<boolean> {
+  if (!npmRegistryClient) {
+    return false;
+  }
+
+  try {
+    const result: NpmRegistryFetchResult = await npmRegistryClient.getConfig();
+    // `configured` / `stale` → the org is known to route installs through a
+    // registry (`stale` = last-known-good config during a config-service
+    // outage), so the startup install must run even on identical
+    // package.json snapshots: with `resolved` stripped from the lockfiles
+    // (APPS-4300), npm re-resolves the entire baked tree through that
+    // registry, surfacing missing packages at app-creation time instead of
+    // at deploy-time bundle build (APPS-4527).
+    //
+    // `not-configured` and `unreachable` deliberately do NOT force the
+    // install. Not-configured orgs gain nothing from re-resolving against
+    // public npm on every boot. And when the config service is unreachable
+    // with no last-known-good, we cannot materialize the right `.npmrc` —
+    // forcing an install would re-resolve a private-registry org's lockfile
+    // against whatever registry happens to be on disk, "validating" against
+    // the wrong host and writing its URLs back into the lockfile. Fail
+    // closed instead (same principle as the AppShell short-circuit,
+    // APPS-4370): skip validation and keep today's snapshot decision.
+    return result.source === "configured" || result.source === "stale";
+  } catch (err) {
+    logger.warn(
+      "Could not resolve npm registry config for startup install validation; preserving package snapshot decision",
+      getErrorMeta(err),
+    );
+    return false;
+  }
+}
+
 async function normalizePackageJsonForNpm(cwd: string, logger: Logger) {
   const packageJsonPath = path.join(cwd, "package.json");
   let raw: string;
@@ -1221,13 +1295,22 @@ export async function dev(options: {
             if (!packageJsonBefore && packageJsonRequiresInstall) {
               logger.info("package.json was created, installing packages…");
             }
+            const npmRegistryClient = aiService?.getNpmRegistryClient();
             const forcePackageInstallRequested = !!options.forcePackageInstall;
             let forcePackageInstall = forcePackageInstallRequested;
+            const privateRegistryRequiresInstallValidation = packageJsonAfter
+              ? await shouldValidatePrivateRegistryInstall(
+                  npmRegistryClient,
+                  logger,
+                )
+              : false;
             if (
               forcePackageInstallRequested &&
               hasPackageJsonSnapshotBeforeRestore
             ) {
-              forcePackageInstall = packageJsonRequiresInstall;
+              forcePackageInstall =
+                packageJsonRequiresInstall ||
+                privateRegistryRequiresInstallValidation;
             }
 
             logger.info("Package install decision", {
@@ -1237,6 +1320,7 @@ export async function dev(options: {
               packageJsonRequiresInstall,
               forcePackageInstall,
               forcePackageInstallRequested,
+              privateRegistryRequiresInstallValidation,
               upgradePromiseCount: upgradePromises.length,
               packageJsonSnapshotBefore: packageJsonSnapshotDiagnostic(
                 packageJsonSnapshotBefore,
@@ -1280,14 +1364,17 @@ export async function dev(options: {
             }
 
             // Run the verification install when EITHER the package.json
-            // requires it, or upgrades just modified package.json/lockfile
-            // (re-syncing node_modules), or the caller forced it. Mirrors
-            // the original launch condition.
+            // requires it, upgrades just modified package.json/lockfile
+            // (re-syncing node_modules), the caller forced it, or a custom
+            // registry must validate that the required packages resolve there.
+            let packageLockBeforeInstall: string | null = null;
             if (
               packageJsonRequiresInstall ||
               upgradePromises.length > 0 ||
-              forcePackageInstall
+              forcePackageInstall ||
+              privateRegistryRequiresInstallValidation
             ) {
+              packageLockBeforeInstall = await readPackageLock(cwd);
               // Launch the install while the upload/restart decisions below
               // are still being evaluated. The synchronous joins at upload,
               // CLI restart, and pre-Vite-startup all observe and surface
@@ -1299,11 +1386,7 @@ export async function dev(options: {
                 "installPackages",
                 async (span) => {
                   try {
-                    await installPackages(
-                      cwd,
-                      logger,
-                      aiService?.getNpmRegistryClient(),
-                    );
+                    await installPackages(cwd, logger, npmRegistryClient);
                   } finally {
                     span.end();
                   }
@@ -1327,7 +1410,12 @@ export async function dev(options: {
 
             const shouldUploadPackageState =
               hasPackageChanged || forcePackageInstall;
-            if (shouldUploadPackageState || uploadFirst) {
+            let shouldUploadAfterInstall = shouldUploadPackageState;
+            if (
+              shouldUploadPackageState ||
+              uploadFirst ||
+              privateRegistryRequiresInstallValidation
+            ) {
               // Upload serializes the post-install lockfile + node_modules
               // tree to DBFS, so it must observe quiesced upgrade+install.
               // Upgrade first — its rejection exits before an install
@@ -1356,7 +1444,18 @@ export async function dev(options: {
                   throw joinError;
                 }
               }
-              if (!skipStartupUploadForCliRestart) {
+              if (
+                privateRegistryRequiresInstallValidation &&
+                !shouldUploadAfterInstall &&
+                lockfileComparisonKey(packageLockBeforeInstall) !==
+                  lockfileComparisonKey(await readPackageLock(cwd))
+              ) {
+                shouldUploadAfterInstall = true;
+              }
+              if (
+                !skipStartupUploadForCliRestart &&
+                (shouldUploadAfterInstall || uploadFirst)
+              ) {
                 logger.info(
                   `Uploading local files to branch '${activeDbfsBranchName}' on server before starting`,
                 );