fix(deploy): pin exact runtime version in generated sandbox package.json - #262
Conversation
The generated bundle's package.json pinned "@agentworkforce/runtime": "*", deliberately left wildcard so "deploys resolve the runtime version from the active workspace" per the old comment. In practice this let a sandbox's `npm install --prefer-offline` (modes/sandbox-client.ts) silently satisfy the dependency from whatever's already cached/pre-baked, with no guarantee it matches what the bundle was actually compiled against. Pin the exact @agentworkforce/runtime version this copy of @agentworkforce/deploy resolves (its own installed copy's package.json — workspace:* becomes an exact version at publish time, so this is always the version the CLI was built/tested with). A version mismatch now either installs the correct exact version or fails npm install loudly, instead of silently running a stale runtime. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe deploy bundle now resolves the installed ChangesRuntime dependency pinning
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the bundle stager to pin the exact version of @agentworkforce/runtime that @agentworkforce/deploy was built against in the generated package.json, replacing the previous wildcard (*) dependency. This ensures that the sandbox installs the correct runtime version. Corresponding tests were added to verify this behavior. The feedback suggests caching the resolved runtime version in a module-level variable to avoid redundant disk I/O and resolution overhead during batch deployments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| function resolveRuntimeVersion(): string { | ||
| let packageJsonPath: string; | ||
| try { | ||
| packageJsonPath = require.resolve('@agentworkforce/runtime/package.json'); | ||
| } catch (err) { | ||
| throw new Error( | ||
| `bundle: could not resolve @agentworkforce/runtime/package.json to pin an exact version (${ | ||
| err instanceof Error ? err.message : String(err) | ||
| })` | ||
| ); | ||
| } | ||
| const pkg = require(packageJsonPath) as { version?: unknown }; | ||
| if (typeof pkg.version !== 'string' || pkg.version.length === 0) { | ||
| throw new Error(`bundle: ${packageJsonPath} has no valid "version" field`); | ||
| } | ||
| return pkg.version; | ||
| } |
There was a problem hiding this comment.
Since resolveRuntimeVersion performs synchronous resolution and file system read/parse operations, calling it on every stage invocation can be inefficient if multiple bundles are staged in a single process (e.g., during batch deployments). Caching the resolved version in a module-level variable avoids redundant disk I/O and resolution overhead.
let cachedRuntimeVersion: string | undefined;
function resolveRuntimeVersion(): string {
if (cachedRuntimeVersion !== undefined) {
return cachedRuntimeVersion;
}
let packageJsonPath: string;
try {
packageJsonPath = require.resolve('@agentworkforce/runtime/package.json');
} catch (err) {
throw new Error(
`bundle: could not resolve @agentworkforce/runtime/package.json to pin an exact version (${
err instanceof Error ? err.message : String(err)
})`
);
}
const pkg = require(packageJsonPath) as { version?: unknown };
if (typeof pkg.version !== 'string' || pkg.version.length === 0) {
throw new Error(`bundle: ${packageJsonPath} has no valid "version" field`);
}
cachedRuntimeVersion = pkg.version;
return cachedRuntimeVersion;
}![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
Summary
sandboxmode (BYO / workforce-managed Daytona,modes/sandbox-client.ts) installs the bundle's dependencies withnpm install --prefer-offline. The generatedpackage.jsonpinned"@agentworkforce/runtime": "*"on purpose ("resolves the runtime version from the active workspace" per the old comment) — but a wildcard +--prefer-offlinelets the sandbox silently keep whatever version is already cached/pre-baked, with no guarantee it matches what the bundle was actually compiled against. This is the same failure class that crashed daily-ship's--mode cloudredeploy today (missingnormalizeCronFireexport from a stale runtime) — see cloud PR AgentWorkforce/cloud#2621 for that incident (--mode clouddoesn't consume this field at all; it's server-overwritten, so this PR doesn't fix that specific crash, but closes the same-shaped gap in thesandboxmode path).buildPackageJsonnow pins the exact@agentworkforce/runtimeversion this copy of@agentworkforce/deployresolves via its own installednode_modulescopy (workspace:*becomes an exact version at publish time — confirmed vianpm view @agentworkforce/deploy@4.1.17 dependencies, which already shows"@agentworkforce/runtime": "4.1.17"). A version mismatch duringnpm installin the sandbox now either installs the correct exact version or fails loudly, instead of silently keeping a stale one.Test plan
pnpm -r build(full monorepo, all 17 workspace packages) — cleanpackages/deploy—npm test(tsc + node --test): 220/220 pass, including a new assertion that the generated package.json pins the exact installed runtime version (not"*")🤖 Generated with Claude Code