@superblocksteam/sdk 2.0.131 → 2.0.132

package/src/cli-replacement/dev-s3-restore.test.mts

@@ -115,7 +115,6 @@ vi.mock("@superblocksteam/util", () => ({
 vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
   AiService: class {
     initialize = vi.fn(async () => undefined);
-    notifyMigrationAppArtifactsReady = vi.fn();
     removeIntegrationCache = vi.fn(async () => undefined);
     chatSessionStore = { invalidateCache: vi.fn() };
     // `dev.mts` reads this at startup for two paths: `syncHomeNpmrc`
@@ -655,7 +654,7 @@ describe("dev startup after S3 workspace restore", () => {
     }
   });
 
-  it("keeps forced npm install when unchanged restore inputs still need private registry validation", async () => {
+  it("keeps forced npm install when unchanged restore inputs need private registry validation without a stamp", async () => {
     mockAiServiceState.npmRegistryClient = {
       getConfig: vi.fn(async () => ({
         source: "configured",
@@ -680,47 +679,450 @@ describe("dev startup after S3 workspace restore", () => {
     expect(mockLogger.info).toHaveBeenCalledWith(
       "Package install decision",
       expect.objectContaining({
-        forcePackageInstall: true,
+        packageInstallRequired: true,
+        forcePackageInstall: false,
         forcePackageInstallRequested: true,
         packageJsonRequiresInstall: false,
+        privateRegistryRequiresInstallValidation: true,
       }),
     );
   });
 
-  it("runs npm install at startup when private registries are configured even without package changes", async () => {
+  it("skips private registry validation install when lockfile already resolves through the configured registry", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
     mockAiServiceState.npmRegistryClient = {
       getConfig: vi.fn(async () => ({
         source: "configured",
-        config: { configured: true },
+        config: {
+          configured: true,
+          default: { url: "https://registry.example.com/npm/" },
+        },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { leftpad: "1.0.0" },
+    };
+    const privateRegistryLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/leftpad": {
+          version: "1.0.0",
+          resolved:
+            "https://registry.example.com/npm/leftpad/-/leftpad-1.0.0.tgz",
+        },
+      },
+    };
+
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(privateRegistryLockfile, null, 2),
+      );
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "node_modules", ".package-lock.json"),
+        JSON.stringify(privateRegistryLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expect(execMock).not.toHaveBeenCalled();
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "Package install decision",
+        expect.objectContaining({
+          packageInstallRequired: false,
+          forcePackageInstall: false,
+          forcePackageInstallRequested: false,
+          packageJsonRequiresInstall: false,
+          privateRegistryRequiresInstallValidation: true,
+          lockfileAlreadyResolvesThroughRegistry: true,
+        }),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("skips private registry validation install when scoped lockfile already resolves through the scoped registry", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: {
+          configured: true,
+          scopes: {
+            "@superblocksteam": {
+              url: "https://scoped-registry.example.com/npm/",
+            },
+          },
+        },
       })),
     };
     const unchangedPackageJson = {
       name: "test-app",
       dependencies: { "@superblocksteam/library": "1.0.0" },
     };
-    const { dev } = await import("./dev.mjs");
+    const privateRegistryLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/@superblocksteam/library": {
+          version: "1.0.0",
+          resolved:
+            "https://scoped-registry.example.com/npm/@superblocksteam/library/-/library-1.0.0.tgz",
+        },
+      },
+    };
 
-    await dev(
-      buildDevOptions({
-        forcePackageInstall: false,
-        packageJsonSnapshotBeforeRestore:
-          packageJsonSnapshot(unchangedPackageJson),
-      }) as any,
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(privateRegistryLockfile, null, 2),
+      );
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "node_modules", ".package-lock.json"),
+        JSON.stringify(privateRegistryLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expect(execMock).not.toHaveBeenCalled();
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "Package install decision",
+        expect.objectContaining({
+          packageInstallRequired: false,
+          privateRegistryRequiresInstallValidation: true,
+          lockfileAlreadyResolvesThroughRegistry: true,
+        }),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("skips private registry validation install when scoped-only config has public unscoped dependencies", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
     );
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: {
+          configured: true,
+          scopes: {
+            "@superblocksteam": {
+              url: "https://scoped-registry.example.com/npm/",
+            },
+          },
+        },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: {
+        "@superblocksteam/library": "1.0.0",
+        leftpad: "1.0.0",
+      },
+    };
+    const mixedLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/@superblocksteam/library": {
+          version: "1.0.0",
+          resolved:
+            "https://scoped-registry.example.com/npm/@superblocksteam/library/-/library-1.0.0.tgz",
+        },
+        "node_modules/leftpad": {
+          version: "1.0.0",
+          resolved: "https://registry.npmjs.org/leftpad/-/leftpad-1.0.0.tgz",
+        },
+      },
+    };
 
-    expectInstallToHaveRun();
-    expect(mockLogger.info).toHaveBeenCalledWith(
-      "Package install decision",
-      expect.objectContaining({
-        forcePackageInstall: false,
-        forcePackageInstallRequested: false,
-        packageJsonRequiresInstall: false,
-        privateRegistryRequiresInstallValidation: true,
-      }),
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(mixedLockfile, null, 2),
+      );
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "node_modules", ".package-lock.json"),
+        JSON.stringify(mixedLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expect(execMock).not.toHaveBeenCalled();
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "Package install decision",
+        expect.objectContaining({
+          packageInstallRequired: false,
+          privateRegistryRequiresInstallValidation: true,
+          lockfileAlreadyResolvesThroughRegistry: true,
+        }),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("runs private registry validation install when scoped lockfile resolves outside the scoped registry", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
     );
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: {
+          configured: true,
+          scopes: {
+            "@superblocksteam": {
+              url: "https://scoped-registry.example.com/npm/",
+            },
+          },
+        },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { "@superblocksteam/library": "1.0.0" },
+    };
+    const publicRegistryLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/@superblocksteam/library": {
+          version: "1.0.0",
+          resolved:
+            "https://registry.npmjs.org/@superblocksteam/library/-/library-1.0.0.tgz",
+        },
+      },
+    };
+
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(publicRegistryLockfile, null, 2),
+      );
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "node_modules", ".package-lock.json"),
+        JSON.stringify(publicRegistryLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "Package install decision",
+        expect.objectContaining({
+          packageInstallRequired: true,
+          privateRegistryRequiresInstallValidation: true,
+          lockfileAlreadyResolvesThroughRegistry: false,
+        }),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
   });
 
-  it("does not upload package state when private registry validation install leaves the lockfile unchanged", async () => {
+  it("runs private registry validation install when node_modules lockfile is missing", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: {
+          configured: true,
+          default: { url: "https://registry.example.com/npm/" },
+        },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { leftpad: "1.0.0" },
+    };
+    const privateRegistryLockfile = {
+      name: "test-app",
+      lockfileVersion: 3,
+      packages: {
+        "node_modules/leftpad": {
+          version: "1.0.0",
+          resolved:
+            "https://registry.example.com/npm/leftpad/-/leftpad-1.0.0.tgz",
+        },
+      },
+    };
+
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(
+        path.join(tmpDir, "package-lock.json"),
+        JSON.stringify(privateRegistryLockfile, null, 2),
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockLogger.info).toHaveBeenCalledWith(
+        "Package install decision",
+        expect.objectContaining({
+          packageInstallRequired: true,
+          forcePackageInstall: false,
+          forcePackageInstallRequested: false,
+          packageJsonRequiresInstall: false,
+          privateRegistryRequiresInstallValidation: true,
+          lockfileAlreadyResolvesThroughRegistry: false,
+        }),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("runs private registry validation install and warns when lockfile registry proof is malformed", async () => {
+    const tmpDir = await fs.mkdtemp(
+      path.join(os.tmpdir(), "sdk-dev-private-registry-"),
+    );
+    mockAiServiceState.npmRegistryClient = {
+      getConfig: vi.fn(async () => ({
+        source: "configured",
+        config: {
+          configured: true,
+          default: { url: "https://registry.example.com/npm/" },
+        },
+      })),
+    };
+    const unchangedPackageJson = {
+      name: "test-app",
+      dependencies: { leftpad: "1.0.0" },
+    };
+
+    try {
+      await fs.writeFile(
+        path.join(tmpDir, "package.json"),
+        JSON.stringify(unchangedPackageJson, null, 2),
+      );
+      await fs.writeFile(path.join(tmpDir, "package-lock.json"), "{");
+      await fs.mkdir(path.join(tmpDir, "node_modules"));
+      await fs.writeFile(
+        path.join(tmpDir, "node_modules", ".package-lock.json"),
+        "{",
+      );
+      const { readPackage } = await import("read-pkg");
+      (readPackage as Mock).mockImplementation(async ({ cwd }) =>
+        JSON.parse(await fs.readFile(path.join(cwd, "package.json"), "utf-8")),
+      );
+      const { dev } = await import("./dev.mjs");
+
+      await dev(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expectInstallToHaveRun();
+      expect(mockLogger.warn).toHaveBeenCalledWith(
+        "Failed to parse package-lock.json for private registry skip check; falling back to install",
+        expect.any(Object),
+      );
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("runs npm install when private registry validation is the only trigger without registry-resolved lockfile entries", async () => {
     const tmpDir = await fs.mkdtemp(
       path.join(os.tmpdir(), "sdk-dev-private-registry-"),
     );
@@ -747,7 +1149,10 @@ describe("dev startup after S3 workspace restore", () => {
       mockAiServiceState.npmRegistryClient = {
         getConfig: vi.fn(async () => ({
           source: "configured",
-          config: { configured: true },
+          config: {
+            configured: true,
+            default: { url: "https://registry.example.com/" },
+          },
         })),
       };
       const { dev } = await import("./dev.mjs");
@@ -769,7 +1174,7 @@ describe("dev startup after S3 workspace restore", () => {
     }
   });
 
-  it("does NOT upload package state when the validation install only rewrites `resolved` URLs", async () => {
+  it("does not upload package state when private registry validation only rewrites `resolved` URLs", async () => {
     // The exact churn cycle flagged in review: `stripResolvedFromLockfile`
     // removes every `resolved` URL before the install and npm writes them
     // back, so a byte-level comparison would flag "changed" on EVERY
@@ -820,7 +1225,10 @@ describe("dev startup after S3 workspace restore", () => {
       mockAiServiceState.npmRegistryClient = {
         getConfig: vi.fn(async () => ({
           source: "configured",
-          config: { configured: true },
+          config: {
+            configured: true,
+            default: { url: "https://registry.example.com/" },
+          },
         })),
       };
       execMock.mockImplementation(
@@ -837,6 +1245,12 @@ describe("dev startup after S3 workspace restore", () => {
               path.join(cwd ?? tmpDir, "package-lock.json"),
               JSON.stringify(rewrittenLockfile, null, 2),
             )
+            .then(() =>
+              fs.writeFile(
+                path.join(cwd ?? tmpDir, "node_modules", ".package-lock.json"),
+                JSON.stringify(rewrittenLockfile, null, 2),
+              ),
+            )
             .then(() => {
               if (typeof opts === "function") {
                 opts(null, { stdout: "installed" });
@@ -860,15 +1274,34 @@ describe("dev startup after S3 workspace restore", () => {
       expectInstallToHaveRun();
       expect(mockSyncService.uploadDirectory).not.toHaveBeenCalled();
       expect(mockSyncService.uploadDirectoryNowIfNeeded).not.toHaveBeenCalled();
+
+      execMock.mockClear();
+      vi.resetModules();
+      const { dev: devAfterRestart } = await import("./dev.mjs");
+      await devAfterRestart(
+        buildDevOptions({
+          cwd: tmpDir,
+          forcePackageInstall: false,
+          packageJsonSnapshotBeforeRestore:
+            packageJsonSnapshot(unchangedPackageJson),
+        }) as any,
+      );
+
+      expect(execMock).not.toHaveBeenCalled();
     } finally {
       await fs.rm(tmpDir, { recursive: true, force: true });
     }
   });
 
-  it("uploads package state when private registry validation install rewrites the lockfile", async () => {
+  it("uploads package state when private registry validation rewrites the lockfile during a required install", async () => {
     const tmpDir = await fs.mkdtemp(
       path.join(os.tmpdir(), "sdk-dev-private-registry-"),
     );
+    const previousPackageJson = {
+      name: "test-app",
+      packageManager: "npm@10.0.0",
+      dependencies: { "@superblocksteam/library": "0.9.0" },
+    };
     const unchangedPackageJson = {
       name: "test-app",
       packageManager: "npm@10.0.0",
@@ -929,7 +1362,7 @@ describe("dev startup after S3 workspace restore", () => {
           cwd: tmpDir,
           forcePackageInstall: false,
           packageJsonSnapshotBeforeRestore:
-            packageJsonSnapshot(unchangedPackageJson),
+            packageJsonSnapshot(previousPackageJson),
         }) as any,
       );
 
@@ -1242,9 +1675,13 @@ describe("dev background package install join semantics", () => {
     // catch wrongly swallowed the rejection. A rejecting upgrade promise
     // surfaces a generic Error (not InitialInstallFailed), so the local catch
     // must rethrow.
+    const upgradeFailure = Promise.reject(
+      new Error("simulated upgrade failure"),
+    );
+    upgradeFailure.catch(() => undefined);
     mockCheckVersions.mockResolvedValue({
       cliUpdated: true,
-      upgradePromises: [Promise.reject(new Error("simulated upgrade failure"))],
+      upgradePromises: [upgradeFailure],
     });
 
     const originalExit = process.exit;

package/src/cli-replacement/dev-startup-git-before-dbfs-order.test.mts

@@ -115,7 +115,6 @@ vi.mock("@superblocksteam/util", () => ({
 vi.mock("@superblocksteam/vite-plugin-file-sync/ai-service", () => ({
   AiService: class {
     initialize = vi.fn(async () => undefined);
-    notifyMigrationAppArtifactsReady = vi.fn();
     removeIntegrationCache = vi.fn(async () => undefined);
     chatSessionStore = { invalidateCache: vi.fn() };
     getNpmRegistryClient = vi.fn(() => undefined);