@superblocksteam/sdk 2.0.149 → 2.0.150-next.0

package/src/cli-replacement/dev.mts

@@ -26,6 +26,7 @@ import {
   AiService,
   AiServiceFeatureFlags,
   SnapshotManager,
+  hasEditLifecycleCapability,
   isSdkApiTemplate,
   stripResolvedFromLockfile,
 } from "@superblocksteam/vite-plugin-file-sync/ai-service";
@@ -40,6 +41,7 @@ import {
   type NpmRegistryClient,
   type NpmRegistryFetchResult,
   type ParseContext,
+  NpmInstallBlocked,
   shouldIgnoreInstallScripts,
 } from "@superblocksteam/vite-plugin-file-sync/npm-registry";
 import { OperationQueue } from "@superblocksteam/vite-plugin-file-sync/operation-queue";
@@ -55,7 +57,11 @@ import type {
   TokenManager,
   SuperblocksSdk,
 } from "../index.js";
-import { getTracer, shutdownTelemetry } from "../telemetry/index.js";
+import {
+  getTracer,
+  isCloudPrem,
+  shutdownTelemetry,
+} from "../telemetry/index.js";
 import { getErrorMeta, getLogger, type Logger } from "../telemetry/logging.js";
 import type {
   ApplicationConfig,
@@ -68,6 +74,7 @@ import {
 } from "./automatic-upgrades.js";
 import {
   classifyInitialInstallError,
+  initialInstallFailedFromBlocked,
   InitialInstallFailed,
   UpgradeFailed,
 } from "./dependency-install-classifier.mjs";
@@ -1181,6 +1188,10 @@ export async function dev(options: {
               appRootDirPath: options.cwd,
               applicationId: applicationConfig.id,
               organizationId: currentUser.organizations[0].id,
+              agentType: currentUser.organizations[0].agentType,
+              isCloudPrem,
+              managedNativeDbLifecycleCapableForEdit:
+                hasEditLifecycleCapability(currentUser.agents),
               fsOperationQueue,
               draftInterface: syncService as DraftInterface,
               rpcClient,
@@ -1515,6 +1526,21 @@ export async function dev(options: {
               );
             }
 
+            try {
+              await aiService?.remediateDeclaredDependencies();
+            } catch (error) {
+              // Soft package.json rewrite failures are already swallowed inside
+              // applyPackageJsonSubstitutions. A gate/registry hard-block must
+              // not fall through into the ungated CLI install below.
+              if (error instanceof NpmInstallBlocked) {
+                throw initialInstallFailedFromBlocked(error);
+              }
+              logger.warn(
+                "[pkg-security] startup remediation failed; keeping declared versions",
+                getErrorMeta(error),
+              );
+            }
+
             const packageJsonAfter = await readPkgJson(cwd);
 
             let packageJsonSnapshotBefore: PackageJsonSnapshot | null = null;