@superblocksteam/sdk 2.0.131-next.1 → 2.0.132-next.0

package/src/cli-replacement/dev.mts

@@ -18,7 +18,6 @@ import {
   ConflictError,
   DEFAULT_NON_GIT_BRANCH,
   isGitHubRemoteUrl,
-  NotFoundError,
   SUPERBLOCKS_LIVE_GIT_BRANCH,
 } from "@superblocksteam/shared";
 import { maskUnixSignals } from "@superblocksteam/util";
@@ -234,6 +233,17 @@ async function readPackageLock(cwd: string): Promise<string | null> {
   }
 }
 
+async function readInstalledPackageLock(cwd: string): Promise<string | null> {
+  try {
+    return await nodeFs.readFile(
+      path.join(cwd, "node_modules", ".package-lock.json"),
+      "utf8",
+    );
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Canonicalize a lockfile for post-install change detection. Every boot,
  * `stripResolvedFromLockfile` (APPS-4300) removes the `resolved` URLs and
@@ -262,23 +272,120 @@ export function lockfileComparisonKey(raw: string | null): string | null {
   }
 }
 
-async function shouldValidatePrivateRegistryInstall(
+function registryUrlMatches(resolved: string, registryUrl: string): boolean {
+  try {
+    const resolvedUrl = new URL(resolved);
+    const registry = new URL(registryUrl);
+    return (
+      resolvedUrl.protocol === registry.protocol &&
+      resolvedUrl.host === registry.host &&
+      resolvedUrl.pathname.startsWith(registry.pathname.replace(/\/?$/, "/"))
+    );
+  } catch {
+    return false;
+  }
+}
+
+function packageNameFromLockfilePath(lockfilePath: string): string | null {
+  const parts = lockfilePath.split("/");
+  const nodeModulesIndex = parts.lastIndexOf("node_modules");
+  if (nodeModulesIndex < 0) return null;
+  const first = parts[nodeModulesIndex + 1];
+  if (!first) return null;
+  if (first.startsWith("@")) {
+    const second = parts[nodeModulesIndex + 2];
+    return second ? `${first}/${second}` : null;
+  }
+  return first;
+}
+
+function registryUrlForPackage(
+  packageName: string,
+  result: NpmRegistryFetchResult,
+): string | null {
+  const scope = packageName.startsWith("@")
+    ? packageName.slice(0, packageName.indexOf("/"))
+    : null;
+  if (!scope) {
+    return result.config.default?.url ?? "https://registry.npmjs.org/";
+  }
+  // npm falls back to the default registry for scoped packages without an
+  // explicit scope registry, so mirror that resolution order here.
+  return (
+    (scope ? result.config.scopes?.[scope]?.url : undefined) ??
+    result.config.default?.url ??
+    null
+  );
+}
+
+function lockfileResolvesThroughRegistry(
+  raw: string | null,
+  result: NpmRegistryFetchResult,
+  logger: Logger,
+): boolean {
+  if (!raw) return false;
+  try {
+    const parsed = JSON.parse(raw) as { packages?: Record<string, unknown> };
+    if (!parsed.packages || typeof parsed.packages !== "object") return false;
+
+    let checked = 0;
+    for (const [lockfilePath, entry] of Object.entries(parsed.packages)) {
+      if (!entry || typeof entry !== "object") continue;
+      const resolved = (entry as { resolved?: unknown }).resolved;
+      if (typeof resolved !== "string" || !resolved.startsWith("http")) {
+        continue;
+      }
+      const packageName = packageNameFromLockfilePath(lockfilePath);
+      if (!packageName) continue;
+      const registryUrl = registryUrlForPackage(packageName, result);
+      if (!registryUrl || !registryUrlMatches(resolved, registryUrl)) {
+        return false;
+      }
+      checked += 1;
+    }
+    // No HTTP resolved URLs means there is no registry proof; fall back to npm.
+    return checked > 0;
+  } catch (error) {
+    logger.warn(
+      "Failed to parse package-lock.json for private registry skip check; falling back to install",
+      getErrorMeta(error),
+    );
+    return false;
+  }
+}
+
+function lockfileProvesSafeToSkipRegistryInstall(
+  packageLock: string | null,
+  installedPackageLock: string | null,
+  result: NpmRegistryFetchResult,
+  logger: Logger,
+): boolean {
+  if (!packageLock || !installedPackageLock) return false;
+  // Structural equality, including integrity hashes, proves node_modules was
+  // installed from the same package graph. The root lockfile's resolved URLs
+  // prove future installs will use the fetched registry config, including a
+  // stale last-known-good config while the registry service is unavailable.
+  return (
+    lockfileComparisonKey(packageLock) ===
+      lockfileComparisonKey(installedPackageLock) &&
+    lockfileResolvesThroughRegistry(packageLock, result, logger)
+  );
+}
+
+async function privateRegistryValidationResult(
   npmRegistryClient: NpmRegistryClient | undefined,
   logger: Logger,
-): Promise<boolean> {
+): Promise<NpmRegistryFetchResult | null> {
   if (!npmRegistryClient) {
-    return false;
+    return null;
   }
 
   try {
     const result: NpmRegistryFetchResult = await npmRegistryClient.getConfig();
     // `configured` / `stale` → the org is known to route installs through a
     // registry (`stale` = last-known-good config during a config-service
-    // outage), so the startup install must run even on identical
-    // package.json snapshots: with `resolved` stripped from the lockfiles
-    // (APPS-4300), npm re-resolves the entire baked tree through that
-    // registry, surfacing missing packages at app-creation time instead of
-    // at deploy-time bundle build (APPS-4527).
+    // outage), so any startup install that is already required should also
+    // validate through that registry.
     //
     // `not-configured` and `unreachable` deliberately do NOT force the
     // install. Not-configured orgs gain nothing from re-resolving against
@@ -289,13 +396,15 @@ async function shouldValidatePrivateRegistryInstall(
     // the wrong host and writing its URLs back into the lockfile. Fail
     // closed instead (same principle as the AppShell short-circuit,
     // APPS-4370): skip validation and keep today's snapshot decision.
-    return result.source === "configured" || result.source === "stale";
+    return result.source === "configured" || result.source === "stale"
+      ? result
+      : null;
   } catch (err) {
     logger.warn(
       "Could not resolve npm registry config for startup install validation; preserving package snapshot decision",
       getErrorMeta(err),
     );
-    return false;
+    return null;
   }
 }
 
@@ -979,12 +1088,10 @@ export async function dev(options: {
               async (span) => {
                 try {
                   return await Promise.all([
-                    getDraftOrLiveEditHash(
-                      sdk,
-                      applicationConfig.id,
-                      activeDbfsBranchName,
-                      logger,
-                    ),
+                    sdk.dbfsGetApplicationDirectoryHash({
+                      applicationId: applicationConfig.id,
+                      branch: activeDbfsBranchName,
+                    }),
                     sdk.fetchCurrentUser(),
                   ]);
                 } finally {
@@ -1039,7 +1146,6 @@ export async function dev(options: {
               logger,
               tokenManager,
               features: AiServiceFeatureFlags.create(flagBootstrap),
-              flagBootstrap,
               pluginExecutionVersions:
                 currentUser.organizations[0].pluginExecutionVersions,
             });
@@ -1055,10 +1161,6 @@ export async function dev(options: {
               },
             );
 
-            if (uploadFirst) {
-              aiService?.notifyMigrationAppArtifactsReady();
-            }
-
             logger.info(
               `[dev-startup] Starting git sync (${downloadFirst ? "download" : "upload"}-first) on branch '${activeDbfsBranchName}'`,
             );
@@ -1250,20 +1352,32 @@ export async function dev(options: {
               logger.info("[dev-startup] Skipping download, already in sync");
             }
 
-            if (downloadFirst) {
-              aiService?.notifyMigrationAppArtifactsReady();
-            }
+            const npmRegistryClient = aiService?.getNpmRegistryClient();
+            const registryValidationResult =
+              await privateRegistryValidationResult(npmRegistryClient, logger);
+            const packageLockBeforeResolvedStrip = await readPackageLock(cwd);
+            const installedPackageLockBeforeResolvedStrip =
+              await readInstalledPackageLock(cwd);
+            const lockfileAlreadyResolvesThroughRegistry =
+              !!registryValidationResult &&
+              lockfileProvesSafeToSkipRegistryInstall(
+                packageLockBeforeResolvedStrip,
+                installedPackageLockBeforeResolvedStrip,
+                registryValidationResult,
+                logger,
+              );
 
-            // Unconditional lockfile sanitation (APPS-4300): strip
-            // cross-registry `resolved` URLs from any lockfile on disk
-            // regardless of whether install runs next. The lockfile here is
-            // whatever survived the DBFS path (downloadFirst overwrite,
-            // prior boot, brownfield import); npm honors `resolved` verbatim
-            // and would bypass the active registry. `integrity` is
-            // preserved, so genuine cross-registry tarball drift surfaces as
-            // EINTEGRITY. No-op when there's no lockfile or no `resolved`
-            // entries.
-            await stripResolvedFromLockfile(cwd);
+            // Lockfile sanitation (APPS-4300): strip cross-registry `resolved`
+            // URLs unless the lockfile already proves it resolves through the
+            // active private registry. npm honors `resolved` verbatim;
+            // stripping forces re-resolution through the current `.npmrc`.
+            if (!lockfileAlreadyResolvesThroughRegistry) {
+              await stripResolvedFromLockfile(cwd);
+            } else {
+              logger.info(
+                "Skipping lockfile resolved-URL strip: lockfile already proves private registry resolution",
+              );
+            }
 
             // Materialise `~/.superblocks/npmrc` from the server-fetched
             // per-org npm registry config BEFORE the global Superblocks CLI
@@ -1279,7 +1393,7 @@ export async function dev(options: {
             } else {
               try {
                 await syncHomeNpmrc({
-                  npmRegistryClient: aiService.getNpmRegistryClient(),
+                  npmRegistryClient,
                   logger,
                   orgId: currentUser.user.currentOrganizationId,
                 });
@@ -1374,32 +1488,43 @@ export async function dev(options: {
             if (!packageJsonBefore && packageJsonRequiresInstall) {
               logger.info("package.json was created, installing packages…");
             }
-            const npmRegistryClient = aiService?.getNpmRegistryClient();
             const forcePackageInstallRequested = !!options.forcePackageInstall;
             let forcePackageInstall = forcePackageInstallRequested;
-            const privateRegistryRequiresInstallValidation = packageJsonAfter
-              ? await shouldValidatePrivateRegistryInstall(
-                  npmRegistryClient,
-                  logger,
-                )
-              : false;
+            const privateRegistryRequiresInstallValidation =
+              !!registryValidationResult && !!packageJsonAfter;
+            let packageLockBeforeInstall: string | null = null;
+            if (privateRegistryRequiresInstallValidation) {
+              packageLockBeforeInstall = await readPackageLock(cwd);
+            }
             if (
               forcePackageInstallRequested &&
               hasPackageJsonSnapshotBeforeRestore
             ) {
-              forcePackageInstall =
-                packageJsonRequiresInstall ||
-                privateRegistryRequiresInstallValidation;
+              forcePackageInstall = packageJsonRequiresInstall;
             }
 
+            // Run the verification install when EITHER the package.json
+            // requires it, upgrades just modified package.json/lockfile
+            // (re-syncing node_modules), or the caller forced it. Private
+            // registry validation piggybacks on those installs rather than
+            // forcing a no-op refresh to wait for npm.
+            const packageInstallRequired =
+              packageJsonRequiresInstall ||
+              upgradePromises.length > 0 ||
+              forcePackageInstall ||
+              (privateRegistryRequiresInstallValidation &&
+                !lockfileAlreadyResolvesThroughRegistry);
+
             logger.info("Package install decision", {
               packageJsonBeforePresent: !!packageJsonBefore,
               packageJsonAfterPresent: !!packageJsonAfter,
               hasPackageChanged,
               packageJsonRequiresInstall,
+              packageInstallRequired,
               forcePackageInstall,
               forcePackageInstallRequested,
               privateRegistryRequiresInstallValidation,
+              lockfileAlreadyResolvesThroughRegistry,
               upgradePromiseCount: upgradePromises.length,
               packageJsonSnapshotBefore: packageJsonSnapshotDiagnostic(
                 packageJsonSnapshotBefore,
@@ -1442,18 +1567,7 @@ export async function dev(options: {
               });
             }
 
-            // Run the verification install when EITHER the package.json
-            // requires it, upgrades just modified package.json/lockfile
-            // (re-syncing node_modules), the caller forced it, or a custom
-            // registry must validate that the required packages resolve there.
-            let packageLockBeforeInstall: string | null = null;
-            if (
-              packageJsonRequiresInstall ||
-              upgradePromises.length > 0 ||
-              forcePackageInstall ||
-              privateRegistryRequiresInstallValidation
-            ) {
-              packageLockBeforeInstall = await readPackageLock(cwd);
+            if (packageInstallRequired) {
               // Launch the install while the upload/restart decisions below
               // are still being evaluated. The synchronous joins at upload,
               // CLI restart, and pre-Vite-startup all observe and surface
@@ -1493,7 +1607,8 @@ export async function dev(options: {
             if (
               shouldUploadPackageState ||
               uploadFirst ||
-              privateRegistryRequiresInstallValidation
+              (privateRegistryRequiresInstallValidation &&
+                packageInstallRequired)
             ) {
               // Upload serializes the post-install lockfile + node_modules
               // tree to DBFS, so it must observe quiesced upgrade+install.
@@ -2126,34 +2241,6 @@ async function ensureLiveBranchCheckedOutAfterFetch(
   }
 }
 
-async function getDraftOrLiveEditHash(
-  sdk: SuperblocksSdk,
-  applicationId: string,
-  branchName: string,
-  logger: Logger,
-): Promise<string> {
-  try {
-    const draftHash = await sdk.dbfsGetApplicationDirectoryHash({
-      applicationId,
-      branch: branchName,
-    });
-    return draftHash;
-  } catch (e: unknown) {
-    if (e instanceof NotFoundError) {
-      const liveEditHash = await sdk.dbfsGetApplicationDirectoryHash({
-        applicationId,
-        branch: branchName,
-      });
-      logger.warn(
-        "Draft state not found, using live edit hash: " + liveEditHash,
-      );
-      return liveEditHash;
-    } else {
-      throw e;
-    }
-  }
-}
-
 async function ensureRuntimeDbfsBranchConsistency({
   sdk,
   applicationConfig,

package/src/dbfs/client.test.ts

@@ -82,12 +82,115 @@ describe("getApplicationDirectoryHash", () => {
     expect(rpcClient.close).toHaveBeenCalledOnce();
   });
 
-  it("falls back from draft to live for non-commit lookups", async () => {
-    directoryContentsGet
-      .mockResolvedValueOnce("draft-request")
-      .mockResolvedValueOnce("live-request");
+  // The cold-start restore must prefer the live-edit working copy, which can have
+  // advanced past every commit via Clark's interim autosaves. This mirrors the
+  // vite-plugin-file-sync copy of getApplicationDirectoryHash (see download.ts).
+  // APPS-4873.
+  it("prefers the live-edit working copy over the draft/live commit views", async () => {
+    directoryContentsGet.mockResolvedValue("request");
+    unwrapResponseDto.mockResolvedValueOnce({ hash: "live-edit-hash" });
+
+    await expect(
+      getApplicationDirectoryHash(
+        "token",
+        "https://app.superblocks.com",
+        "app-123",
+        "main",
+      ),
+    ).resolves.toBe("live-edit-hash");
+
+    expect(directoryContentsGet).toHaveBeenCalledTimes(1);
+    expect(directoryContentsGet).toHaveBeenCalledWith({
+      applicationId: "app-123",
+      branchName: "main",
+      viewMode: ExportViewMode.EXPORT_LIVE_EDIT,
+    });
+    expect(warn).not.toHaveBeenCalled();
+    expect(rpcClient.close).toHaveBeenCalledOnce();
+  });
+
+  it("falls back to draft/live when the app has no live-edit working copy", async () => {
+    directoryContentsGet.mockResolvedValue("request");
+    unwrapResponseDto
+      .mockRejectedValueOnce(
+        new NotFoundError(
+          "Application live-edit directory contents hash not found.",
+        ),
+      )
+      .mockResolvedValueOnce({ hash: "draft-hash" });
+
+    await expect(
+      getApplicationDirectoryHash(
+        "token",
+        "https://app.superblocks.com",
+        "app-123",
+        "main",
+      ),
+    ).resolves.toBe("draft-hash");
+
+    expect(directoryContentsGet).toHaveBeenNthCalledWith(1, {
+      applicationId: "app-123",
+      branchName: "main",
+      viewMode: ExportViewMode.EXPORT_LIVE_EDIT,
+    });
+    expect(directoryContentsGet).toHaveBeenNthCalledWith(2, {
+      applicationId: "app-123",
+      branchName: "main",
+      viewMode: ExportViewMode.EXPORT_DRAFT,
+    });
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("falling back to draft/live views"),
+    );
+    expect(rpcClient.close).toHaveBeenCalledOnce();
+  });
+
+  it("falls back to draft/live against a server that predates the live-edit view mode", async () => {
+    directoryContentsGet.mockResolvedValue("request");
     unwrapResponseDto
-      .mockRejectedValueOnce(new NotFoundError("draft hash not found"))
+      .mockRejectedValueOnce(
+        new Error("Export view mode export-live-edit is not implemented."),
+      )
+      .mockResolvedValueOnce({ hash: "draft-hash" });
+
+    await expect(
+      getApplicationDirectoryHash(
+        "token",
+        "https://app.superblocks.com",
+        "app-123",
+        "main",
+      ),
+    ).resolves.toBe("draft-hash");
+
+    expect(directoryContentsGet).toHaveBeenNthCalledWith(2, {
+      applicationId: "app-123",
+      branchName: "main",
+      viewMode: ExportViewMode.EXPORT_DRAFT,
+    });
+    expect(rpcClient.close).toHaveBeenCalledOnce();
+  });
+
+  it("propagates an unexpected live-edit error instead of silently restoring a stale tree", async () => {
+    directoryContentsGet.mockResolvedValue("request");
+    unwrapResponseDto.mockRejectedValueOnce(new Error("unexpected boom"));
+
+    await expect(
+      getApplicationDirectoryHash(
+        "token",
+        "https://app.superblocks.com",
+        "app-123",
+        "main",
+      ),
+    ).rejects.toThrow("unexpected boom");
+
+    expect(directoryContentsGet).toHaveBeenCalledTimes(1);
+    expect(rpcClient.close).toHaveBeenCalledOnce();
+  });
+
+  it("falls back from live-edit to draft to live when neither working copy nor draft exists", async () => {
+    directoryContentsGet.mockResolvedValue("request");
+    unwrapResponseDto
+      .mockRejectedValueOnce(new NotFoundError("no live-edit working copy"))
+      .mockRejectedValueOnce(new NotFoundError("no draft"))
       .mockResolvedValueOnce({ hash: "live-hash" });
 
     await expect(
@@ -102,15 +205,20 @@ describe("getApplicationDirectoryHash", () => {
     expect(directoryContentsGet).toHaveBeenNthCalledWith(1, {
       applicationId: "app-123",
       branchName: "main",
-      viewMode: ExportViewMode.EXPORT_DRAFT,
+      viewMode: ExportViewMode.EXPORT_LIVE_EDIT,
     });
     expect(directoryContentsGet).toHaveBeenNthCalledWith(2, {
+      applicationId: "app-123",
+      branchName: "main",
+      viewMode: ExportViewMode.EXPORT_DRAFT,
+    });
+    expect(directoryContentsGet).toHaveBeenNthCalledWith(3, {
       applicationId: "app-123",
       branchName: "main",
       viewMode: ExportViewMode.EXPORT_LIVE,
     });
     expect(warn).toHaveBeenCalledWith(
-      "Draft state not found, using live edit hash: live-hash",
+      expect.stringContaining("falling back to the latest live commit"),
     );
     expect(rpcClient.close).toHaveBeenCalledOnce();
   });

package/src/dbfs/client.ts

@@ -39,44 +39,98 @@ export async function getApplicationDirectoryHash(
       }
       return commitHash;
     }
+    // Prefer the live-edit working copy. Clark's in-progress autosaves advance
+    // the working-copy pointer without creating a commit, so the commit-based
+    // draft/live views can lag behind it. Restoring an older commit on a
+    // cold/recycled pod is what made in-progress work appear lost (APPS-4873).
+    // Mirrors the vite-plugin-file-sync copy in download.ts.
     try {
       const response = await unwrapResponseDto(
         rpcClient.call.v3.application.directoryContents.get({
           applicationId,
           branchName: branch,
-          viewMode: ExportViewMode.EXPORT_DRAFT,
+          viewMode: ExportViewMode.EXPORT_LIVE_EDIT,
         }),
       );
-      const liveEditHash = response.hash;
-      if (!liveEditHash) {
-        throw new Error(
-          `No directory contents hash found for the view mode ${ExportViewMode.EXPORT_DRAFT}`,
-        );
+      if (response.hash) {
+        return response.hash;
       }
-      return liveEditHash;
     } catch (e) {
-      if (e instanceof NotFoundError) {
-        const response = await unwrapResponseDto(
-          rpcClient.call.v3.application.directoryContents.get({
-            applicationId,
-            branchName: branch,
-            viewMode: ExportViewMode.EXPORT_LIVE,
-          }),
+      // Fall back to the commit-based draft/live views only when this app has no
+      // live-edit working copy (NotFoundError) or the server predates the
+      // EXPORT_LIVE_EDIT view mode (deploy skew). Any other error surfaces.
+      if (!isMissingLiveEditOrUnsupportedViewMode(e)) {
+        throw e;
+      }
+      if (!options?.silent) {
+        getLogger().warn(
+          `Live-edit working copy unavailable (${
+            e instanceof Error ? e.message : String(e)
+          }), falling back to draft/live views`,
         );
-        if (!options?.silent) {
-          getLogger().warn(
-            `Draft state not found, using live edit hash: ${response.hash}`,
-          );
-        }
-        return response.hash;
       }
-      throw e;
     }
+    return getDraftOrLiveCommitHash(rpcClient, applicationId, branch, options);
   } finally {
     rpcClient.close();
   }
 }
 
+// The legacy restore path: the latest draft commit, falling back to the latest
+// non-draft (live) commit. Used when no live-edit working copy is available, or
+// against a server that predates the live-edit view mode.
+async function getDraftOrLiveCommitHash(
+  rpcClient: Awaited<ReturnType<typeof connectToISocketRPCServer>>,
+  applicationId: string,
+  branch: string | undefined,
+  options?: { silent?: boolean },
+): Promise<string> {
+  try {
+    const response = await unwrapResponseDto(
+      rpcClient.call.v3.application.directoryContents.get({
+        applicationId,
+        branchName: branch,
+        viewMode: ExportViewMode.EXPORT_DRAFT,
+      }),
+    );
+    const hash = response.hash;
+    if (!hash) {
+      throw new Error(
+        `No directory contents hash found for the view mode ${ExportViewMode.EXPORT_DRAFT}`,
+      );
+    }
+    return hash;
+  } catch (e) {
+    if (e instanceof NotFoundError) {
+      const response = await unwrapResponseDto(
+        rpcClient.call.v3.application.directoryContents.get({
+          applicationId,
+          branchName: branch,
+          viewMode: ExportViewMode.EXPORT_LIVE,
+        }),
+      );
+      if (!options?.silent) {
+        getLogger().warn(
+          `Draft commit not found, falling back to the latest live commit: ${response.hash}`,
+        );
+      }
+      return response.hash;
+    }
+    throw e;
+  }
+}
+
+// True when the live-edit view should yield to the legacy draft/live path:
+// either this app has no live-edit working copy (NotFoundError), or the server
+// is too old to know the view mode and reports it as not implemented.
+function isMissingLiveEditOrUnsupportedViewMode(e: unknown): boolean {
+  if (e instanceof NotFoundError) {
+    return true;
+  }
+  const message = e instanceof Error ? e.message : String(e);
+  return message.includes("is not implemented");
+}
+
 export async function downloadApplicationDirectory(
   token: string,
   superblocksBaseUrl: string,

package/src/dev-utils/dev-server.mts

@@ -819,9 +819,9 @@ export async function createDevServer({
     }
 
     try {
-      const payload = (await jwtVerifier.verify<{ scope: string }>(
-        token,
-      )) as SuperblocksScopedJwtPayload;
+      const payload = (await jwtVerifier.verify<{ scope: string }>(token, {
+        algorithms: ["ES256"],
+      })) as SuperblocksScopedJwtPayload;
 
       const scopes = payload.scope?.split(" ") ?? [];
       if (!scopes.includes(EDIT_APPLICATION_SCOPE)) {