@superblocksteam/sdk 2.0.149 → 2.0.150-next.1

package/src/cli-replacement/dev.mts

@@ -26,6 +26,7 @@ import {
   AiService,
   AiServiceFeatureFlags,
   SnapshotManager,
+  hasEditLifecycleCapability,
   isSdkApiTemplate,
   stripResolvedFromLockfile,
 } from "@superblocksteam/vite-plugin-file-sync/ai-service";
@@ -40,6 +41,7 @@ import {
   type NpmRegistryClient,
   type NpmRegistryFetchResult,
   type ParseContext,
+  NpmInstallBlocked,
   shouldIgnoreInstallScripts,
 } from "@superblocksteam/vite-plugin-file-sync/npm-registry";
 import { OperationQueue } from "@superblocksteam/vite-plugin-file-sync/operation-queue";
@@ -55,7 +57,11 @@ import type {
   TokenManager,
   SuperblocksSdk,
 } from "../index.js";
-import { getTracer, shutdownTelemetry } from "../telemetry/index.js";
+import {
+  getTracer,
+  isCloudPrem,
+  shutdownTelemetry,
+} from "../telemetry/index.js";
 import { getErrorMeta, getLogger, type Logger } from "../telemetry/logging.js";
 import type {
   ApplicationConfig,
@@ -68,6 +74,7 @@ import {
 } from "./automatic-upgrades.js";
 import {
   classifyInitialInstallError,
+  initialInstallFailedFromBlocked,
   InitialInstallFailed,
   UpgradeFailed,
 } from "./dependency-install-classifier.mjs";
@@ -82,6 +89,8 @@ import {
   syncHomeNpmrc,
 } from "./home-npmrc.mjs";
 import { normalizeWorkspaceProtocolForNpm } from "./normalize-workspace-protocol.js";
+import { parseNpmInstallSummary } from "./npm-install-summary.mjs";
+import { consumeNpmInstallTimingAttributes } from "./npm-install-timing.mjs";
 import {
   didPackageJsonSnapshotChange,
   packageJsonSnapshot,
@@ -455,6 +464,39 @@ async function normalizePackageJsonForNpm(cwd: string, logger: Logger) {
   }
 }
 
+function emitSuccessTelemetry(logger: Logger, emit: () => void): void {
+  try {
+    emit();
+  } catch (err) {
+    try {
+      logger.warn(
+        "Could not emit package installation success telemetry",
+        getErrorMeta(err),
+      );
+    } catch {
+      // Telemetry must not turn a successful install into a failure.
+    }
+  }
+}
+
+/**
+ * Plain `info()` joins every argument into one message string, so attributes
+ * passed to it never reach Datadog as facets. `infoStructured` emits them as
+ * OTel log attributes; the fallback is only for custom Logger implementations
+ * that don't provide it.
+ */
+function logInstallSuccess(
+  logger: Logger,
+  message: string,
+  attributes: Record<string, boolean | number>,
+): void {
+  if (logger.infoStructured) {
+    logger.infoStructured(message, attributes);
+  } else {
+    logger.info(message, attributes);
+  }
+}
+
 export async function installPackages(
   cwd: string,
   logger: Logger,
@@ -466,6 +508,10 @@ export async function installPackages(
   let runInstall:
     | (() => Promise<{ stdout: string; stderr: string }>)
     | undefined;
+  // Hoisted alongside `runInstall` so the ENOSPC recovery path in the catch can
+  // report install duration too. Set as soon as the retryable command exists so
+  // every recovery-eligible path has a start time.
+  let installStart: number | undefined;
   try {
     const pm = await detect({
       strategies: [
@@ -517,10 +563,21 @@ export async function installPackages(
     // `--json` makes npm channel the structured error envelope (code +
     // summary + detail) onto stdout so a failure can be classified into a
     // DependencyInstallError. Output-only: it does not change resolution,
-    // only how npm reports it. The success-path `logger.info(stdout)` below
-    // then logs JSON, which is acceptable.
+    // only how npm reports it. On success the same envelope carries the
+    // install summary, which the success path below turns into log
+    // attributes.
+    // `--timing` makes npm record how long each install phase took, which is
+    // what tells a slow registry apart from writing tens of thousands of files.
+    // It does not go to stdout - npm writes it to a file in its logs dir, which
+    // the success path below reads back. It costs no install time (npm keeps
+    // these timers either way; the flag only decides whether they get written
+    // out at the end), but it does add one line per package to npm's debug log
+    // in the same dir - bounded by the `logs-max` pruning that already applies
+    // there.
     const baseArgs =
-      pm.agent === "npm" ? ["--fund=false", "--audit=false", "--json"] : [];
+      pm.agent === "npm"
+        ? ["--fund=false", "--audit=false", "--json", "--timing"]
+        : [];
     const installArgs = ignoreScripts
       ? [...baseArgs, "--ignore-scripts"]
       : baseArgs;
@@ -576,6 +633,7 @@ export async function installPackages(
         cwd,
         env: buildInstallEnv(superblocksNpmrcPath(), logsDir),
       });
+    installStart = Date.now();
 
     // Cheap `df` snapshot before the install (statfs only — no directory walk
     // on the happy path). On a 3Gi live-edit PVC this is the baseline that
@@ -593,8 +651,55 @@ export async function installPackages(
     }
 
     const { stdout } = await runInstall();
-    logger.info("Package installation completed successfully");
-    logger.info(stdout);
+    const installDurationMs = Date.now() - installStart;
+    // npm's `--timing` breakdown lives in a file, so it has to be read back
+    // once the install is done. Only npm writes one; reading under pnpm would
+    // report a leftover npm file as this install's timings. The `catch` keeps
+    // the "telemetry never fails a completed install" invariant at the call
+    // site, so it holds even if the reader stops swallowing its own errors.
+    const timingAttributes =
+      pm.agent === "npm"
+        ? await consumeNpmInstallTimingAttributes(logsDir).catch(() => null)
+        : null;
+    // `--json` is already passed for error classification; on success it also
+    // carries the only record of what the install DID. Emit it as attributes
+    // rather than as the log message: passing the raw envelope to
+    // `logger.info(stdout)` surfaced as an empty line in Datadog, so the counts
+    // that size this install were collected and then thrown away.
+    emitSuccessTelemetry(logger, () => {
+      const summary = parseNpmInstallSummary(stdout);
+      const logSuccess = (attributes: Record<string, boolean | number>) =>
+        logInstallSuccess(
+          logger,
+          "Package installation completed successfully",
+          attributes,
+        );
+      // Reuse the existing npm-install namespace and its duration unit. The
+      // package counts are log-only sizing data from this separate install path.
+      const commonAttributes = {
+        "superblocks.npm.install.disk_recovered": false,
+        "superblocks.npm.install.duration_seconds": installDurationMs / 1000,
+        ...timingAttributes,
+      };
+      if (summary) {
+        logSuccess({
+          ...commonAttributes,
+          "superblocks.npm.install.added": summary.added,
+          "superblocks.npm.install.removed": summary.removed,
+          "superblocks.npm.install.changed": summary.changed,
+          "superblocks.npm.install.audited": summary.audited,
+          "superblocks.npm.install.summary_parsed": true,
+        });
+      } else {
+        // Free-form output is not a safe OTel attribute. Keep duration queryable
+        // and send non-empty output through the regular local/logging path.
+        logSuccess({
+          ...commonAttributes,
+          "superblocks.npm.install.summary_parsed": false,
+        });
+        if (stdout.trim() !== "") logger.info(stdout);
+      }
+    });
   } catch (error) {
     // `util.promisify(child_process.exec)` preserves `.stdout`/`.stderr` on
     // the rejected error separately; with `--json`, the structured npm error
@@ -619,7 +724,12 @@ export async function installPackages(
     // only autopsy we can get of a PVC that `reclaimPolicy: Delete` destroys
     // at teardown. `runInstall` is only set once the command was resolved; if
     // the failure happened before that, there's nothing to retry.
-    if (serverError.category === "disk_full" && runInstall) {
+    if (
+      serverError.category === "disk_full" &&
+      runInstall &&
+      installStart !== undefined
+    ) {
+      const startedAt = installStart;
       let recovery: Awaited<ReturnType<typeof recoverFromDiskFull>> | undefined;
       try {
         recovery = await recoverFromDiskFull(cwd, runInstall, logger);
@@ -632,11 +742,26 @@ export async function installPackages(
         });
       }
       if (recovery) {
-        devServerMetrics.recordDiskRecovery({ recovered: recovery.recovered });
+        emitSuccessTelemetry(logger, () => {
+          devServerMetrics.recordDiskRecovery({
+            recovered: recovery.recovered,
+          });
+        });
         if (recovery.recovered) {
-          logger.info(
-            "Package installation completed successfully after disk recovery",
-          );
+          // Recovered installs previously emitted no install telemetry at all,
+          // so the slowest installs on the fleet were the ones missing from the
+          // data. Duration spans every attempt including the reclaim.
+          emitSuccessTelemetry(logger, () => {
+            logInstallSuccess(
+              logger,
+              "Package installation completed successfully after disk recovery",
+              {
+                "superblocks.npm.install.duration_seconds":
+                  (Date.now() - startedAt) / 1000,
+                "superblocks.npm.install.disk_recovered": true,
+              },
+            );
+          });
           return;
         }
         // Reclassify the final attempt so the surfaced error reflects the last
@@ -1181,6 +1306,10 @@ export async function dev(options: {
               appRootDirPath: options.cwd,
               applicationId: applicationConfig.id,
               organizationId: currentUser.organizations[0].id,
+              agentType: currentUser.organizations[0].agentType,
+              isCloudPrem,
+              managedNativeDbLifecycleCapableForEdit:
+                hasEditLifecycleCapability(currentUser.agents),
               fsOperationQueue,
               draftInterface: syncService as DraftInterface,
               rpcClient,
@@ -1515,6 +1644,21 @@ export async function dev(options: {
               );
             }
 
+            try {
+              await aiService?.remediateDeclaredDependencies();
+            } catch (error) {
+              // Soft package.json rewrite failures are already swallowed inside
+              // applyPackageJsonSubstitutions. A gate/registry hard-block must
+              // not fall through into the ungated CLI install below.
+              if (error instanceof NpmInstallBlocked) {
+                throw initialInstallFailedFromBlocked(error);
+              }
+              logger.warn(
+                "[pkg-security] startup remediation failed; keeping declared versions",
+                getErrorMeta(error),
+              );
+            }
+
             const packageJsonAfter = await readPkgJson(cwd);
 
             let packageJsonSnapshotBefore: PackageJsonSnapshot | null = null;

package/src/cli-replacement/install-packages.npm-registry.test.mts

@@ -26,6 +26,7 @@ import {
 } from "vitest";
 
 import type { installPackages as InstallPackagesType } from "./dev.mjs";
+import type * as DiskSpace from "./disk-space.mjs";
 
 const execMock = vi.fn();
 const execFileMock = vi.fn();
@@ -45,6 +46,17 @@ vi.mock("package-manager-detector", () => ({
   resolveCommand: (...args: unknown[]) => resolveCommandMock(...args),
 }));
 
+const recoverFromDiskFullMock = vi.fn();
+vi.mock("./disk-space.mjs", async (importOriginal) => {
+  const actual = await importOriginal<typeof DiskSpace>();
+  return {
+    ...actual,
+    getDiskSpace: vi.fn(async () => null),
+    recoverFromDiskFull: (...args: unknown[]) =>
+      recoverFromDiskFullMock(...args),
+  };
+});
+
 vi.mock("node:fs/promises", () => ({
   readFile: vi.fn(async () => "{}"),
   writeFile: vi.fn(async () => undefined),
@@ -53,8 +65,20 @@ vi.mock("node:fs/promises", () => ({
   mkdir: vi.fn(async () => undefined),
 }));
 
+// npm's `--timing` phase breakdown is read back from a file on disk. The
+// parser has its own coverage in `npm-install-timing.test.mts`; here we only
+// care that whatever it returns reaches the success log line.
+const consumeTimingMock = vi.fn<
+  (logsDir: string) => Promise<Record<string, number> | null>
+>(async () => null);
+vi.mock("./npm-install-timing.mjs", () => ({
+  consumeNpmInstallTimingAttributes: (logsDir: string) =>
+    consumeTimingMock(logsDir),
+}));
+
 const mockLogger = {
   info: vi.fn(),
+  infoStructured: vi.fn(),
   warn: vi.fn(),
   error: vi.fn(),
   debug: vi.fn(),
@@ -118,6 +142,8 @@ beforeAll(async () => {
 
 beforeEach(() => {
   vi.clearAllMocks();
+  mockLogger.infoStructured.mockReset();
+  mockLogger.warn.mockReset();
   // Default: npm package manager, install resolves to a real command so we
   // can read back the args the call site passed in.
   detectMock.mockResolvedValue({
@@ -146,6 +172,8 @@ beforeEach(() => {
       }
     },
   );
+  recoverFromDiskFullMock.mockResolvedValue(undefined);
+  consumeTimingMock.mockResolvedValue(null);
 });
 
 function getResolveCommandArgs(): string[] {
@@ -183,6 +211,7 @@ describe("installPackages honors allow_install_scripts policy", () => {
     // Existing baseline npm flags must survive.
     expect(args).toContain("--fund=false");
     expect(args).toContain("--audit=false");
+    expect(args).toContain("--timing");
   });
 
   it("does NOT append --ignore-scripts when allow_install_scripts === true", async () => {
@@ -252,6 +281,8 @@ describe("installPackages honors allow_install_scripts policy", () => {
     expect(args).toContain("--ignore-scripts");
     expect(args).not.toContain("--fund=false");
     expect(args).not.toContain("--audit=false");
+    // pnpm has no equivalent of npm's phase timing.
+    expect(args).not.toContain("--timing");
   });
 });
 
@@ -343,3 +374,207 @@ describe("installPackages userconfig env plumbing", () => {
   //     (`userconfig-env.integration.test.mts`) would fail to resolve
   //     `npm`/`pnpm` on PATH if the overlay clobbered it.
 });
+
+describe("installPackages success logging", () => {
+  it("keeps unrecognized package-manager output out of structured attributes", async () => {
+    const { installPackages } = await import("./dev.mjs");
+
+    await installPackages("/tmp/app", mockLogger as never);
+
+    expect(mockLogger.infoStructured).toHaveBeenCalledWith(
+      "Package installation completed successfully",
+      {
+        "superblocks.npm.install.disk_recovered": false,
+        "superblocks.npm.install.duration_seconds": expect.any(Number),
+        "superblocks.npm.install.summary_parsed": false,
+      },
+    );
+    expect(mockLogger.info).toHaveBeenCalledWith("ok");
+  });
+
+  it("marks parsed npm summaries and emits their counts", async () => {
+    const stdout = JSON.stringify({
+      added: 8,
+      audited: 432,
+      changed: 2,
+      removed: 0,
+    });
+    execMock.mockImplementation(
+      (
+        _cmd: string,
+        _opts: unknown,
+        cb?: (err: null, result: { stdout: string }) => void,
+      ) => cb?.(null, { stdout }),
+    );
+    const { installPackages } = await import("./dev.mjs");
+
+    await installPackages("/tmp/app", mockLogger as never);
+
+    expect(mockLogger.infoStructured).toHaveBeenCalledWith(
+      "Package installation completed successfully",
+      {
+        "superblocks.npm.install.added": 8,
+        "superblocks.npm.install.audited": 432,
+        "superblocks.npm.install.changed": 2,
+        "superblocks.npm.install.disk_recovered": false,
+        "superblocks.npm.install.duration_seconds": expect.any(Number),
+        "superblocks.npm.install.removed": 0,
+        "superblocks.npm.install.summary_parsed": true,
+      },
+    );
+    expect(mockLogger.info).not.toHaveBeenCalledWith(stdout);
+  });
+
+  it("joins npm's phase timings to the same success log line", async () => {
+    consumeTimingMock.mockResolvedValue({
+      "superblocks.npm.install.ideal_tree_seconds": 0.23,
+      "superblocks.npm.install.unpack_seconds": 23.2,
+    });
+    const stdout = JSON.stringify({
+      added: 0,
+      audited: 432,
+      changed: 5,
+      removed: 0,
+    });
+    execMock.mockImplementation(
+      (
+        _cmd: string,
+        _opts: unknown,
+        cb?: (err: null, result: { stdout: string }) => void,
+      ) => cb?.(null, { stdout }),
+    );
+    const { installPackages } = await import("./dev.mjs");
+
+    await installPackages("/tmp/app", mockLogger as never);
+
+    // npm writes the timing file into the same dir as its debug log.
+    expect(consumeTimingMock).toHaveBeenCalledWith(
+      "/tmp/app/.superblocks/logs",
+    );
+    expect(mockLogger.infoStructured).toHaveBeenCalledWith(
+      "Package installation completed successfully",
+      {
+        "superblocks.npm.install.added": 0,
+        "superblocks.npm.install.audited": 432,
+        "superblocks.npm.install.changed": 5,
+        "superblocks.npm.install.disk_recovered": false,
+        "superblocks.npm.install.duration_seconds": expect.any(Number),
+        "superblocks.npm.install.ideal_tree_seconds": 0.23,
+        "superblocks.npm.install.removed": 0,
+        "superblocks.npm.install.summary_parsed": true,
+        "superblocks.npm.install.unpack_seconds": 23.2,
+      },
+    );
+  });
+
+  it("still logs the counts when there is no timing file to read", async () => {
+    consumeTimingMock.mockResolvedValue(null);
+    const { installPackages } = await import("./dev.mjs");
+
+    await installPackages("/tmp/app", mockLogger as never);
+
+    expect(mockLogger.infoStructured).toHaveBeenCalledWith(
+      "Package installation completed successfully",
+      {
+        "superblocks.npm.install.disk_recovered": false,
+        "superblocks.npm.install.duration_seconds": expect.any(Number),
+        "superblocks.npm.install.summary_parsed": false,
+      },
+    );
+  });
+
+  it("does not read a timing file under pnpm, which cannot write one", async () => {
+    detectMock.mockResolvedValue({
+      name: "pnpm",
+      agent: "pnpm",
+      version: "11.0.0",
+    });
+    resolveCommandMock.mockImplementation(
+      (_agent: string, _action: string, args: string[]) => ({
+        command: "pnpm",
+        args: ["install", ...args],
+      }),
+    );
+    const { installPackages } = await import("./dev.mjs");
+
+    await installPackages("/tmp/app", mockLogger as never);
+
+    // A leftover npm timing file must not be reported as pnpm's timings.
+    expect(consumeTimingMock).not.toHaveBeenCalled();
+  });
+
+  it("does not fail a completed install when the timing read rejects", async () => {
+    consumeTimingMock.mockRejectedValue(new Error("logs dir unreadable"));
+    const { installPackages } = await import("./dev.mjs");
+
+    await expect(
+      installPackages("/tmp/app", mockLogger as never),
+    ).resolves.toBeUndefined();
+
+    expect(execMock).toHaveBeenCalledTimes(1);
+    expect(mockLogger.infoStructured).toHaveBeenCalledWith(
+      "Package installation completed successfully",
+      expect.objectContaining({
+        "superblocks.npm.install.duration_seconds": expect.any(Number),
+      }),
+    );
+  });
+
+  it("does not fail or retry when success logging throws", async () => {
+    mockLogger.infoStructured.mockImplementationOnce(() => {
+      throw new Error("telemetry unavailable");
+    });
+    mockLogger.warn.mockImplementation((message: string) => {
+      if (message === "Could not emit package installation success telemetry") {
+        throw new Error("warning unavailable");
+      }
+    });
+    const { installPackages } = await import("./dev.mjs");
+
+    await expect(
+      installPackages("/tmp/app", mockLogger),
+    ).resolves.toBeUndefined();
+
+    expect(execMock).toHaveBeenCalledTimes(1);
+    expect(mockLogger.error).not.toHaveBeenCalledWith(
+      "Error during package installation",
+      expect.anything(),
+    );
+  });
+
+  it("does not fail after disk recovery when success logging throws", async () => {
+    execMock.mockImplementation(
+      (
+        _cmd: string,
+        _opts: unknown,
+        cb?: (err: NodeJS.ErrnoException) => void,
+      ) => {
+        const error: NodeJS.ErrnoException = new Error(
+          "no space left on device",
+        );
+        error.code = "ENOSPC";
+        cb?.(error);
+      },
+    );
+    recoverFromDiskFullMock.mockResolvedValue({ recovered: true });
+    mockLogger.infoStructured.mockImplementationOnce(() => {
+      throw new Error("telemetry unavailable");
+    });
+    mockLogger.warn.mockImplementation((message: string) => {
+      if (message === "Could not emit package installation success telemetry") {
+        throw new Error("warning unavailable");
+      }
+    });
+    const { installPackages } = await import("./dev.mjs");
+
+    await expect(
+      installPackages("/tmp/app", mockLogger),
+    ).resolves.toBeUndefined();
+
+    expect(recoverFromDiskFullMock).toHaveBeenCalledTimes(1);
+    expect(mockLogger.error).not.toHaveBeenCalledWith(
+      "Error during package installation",
+      expect.anything(),
+    );
+  });
+});

package/src/cli-replacement/npm-install-summary.mts

@@ -0,0 +1,82 @@
+/**
+ * `npm install` already runs with `--json` so a failure can be classified from
+ * the structured error envelope. On the SUCCESS path that same JSON was passed
+ * straight to `logger.info(stdout)` as the log MESSAGE, which is why Datadog
+ * shows an empty line after "Package installation completed successfully" and
+ * the counts never reached anyone.
+ *
+ * Those counts are the only evidence of what an install actually did. Deciding
+ * whether to persist a node_modules delta, and whether the trade is worth it,
+ * needs to distinguish "added 8 packages" from "added nothing and still spent
+ * 52 seconds".
+ */
+
+export type NpmInstallSummary = {
+  added: number;
+  removed: number;
+  changed: number;
+  audited: number;
+};
+
+/**
+ * npm reports affected packages either as counts or as arrays of package
+ * objects, depending on version. Normalize both to a count and treat anything
+ * else as zero, so a shape change upstream degrades to an under-count rather
+ * than `NaN` in telemetry.
+ */
+function toCount(value: unknown): number {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    // Clamp: a negative count is meaningless and would skew any aggregation
+    // built on these attributes.
+    return Math.max(0, Math.trunc(value));
+  }
+  if (Array.isArray(value)) {
+    return value.length;
+  }
+  return 0;
+}
+
+/**
+ * Parse npm's `--json` install summary.
+ *
+ * Returns null when there is nothing parseable — no output, output that is
+ * not a JSON object, or a JSON object that carries none of npm's summary keys
+ * (the install may have run under yarn/pnpm, whose JSON output would otherwise
+ * masquerade as a confidently-measured no-op npm install). Callers should fall
+ * back to logging the raw text so an unrecognized shape is still recoverable
+ * from logs.
+ */
+export function parseNpmInstallSummary(
+  stdout: string,
+): NpmInstallSummary | null {
+  const trimmed = stdout.trim();
+  if (trimmed === "") {
+    return null;
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return null;
+  }
+
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+
+  const record = parsed as Record<string, unknown>;
+  const hasNpmSummaryKey = ["added", "removed", "changed", "audited"].some(
+    (key) => key in record,
+  );
+  if (!hasNpmSummaryKey) {
+    return null;
+  }
+
+  return {
+    added: toCount(record.added),
+    removed: toCount(record.removed),
+    changed: toCount(record.changed),
+    audited: toCount(record.audited),
+  };
+}