mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-06 21:05:21 +02:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - The release system publishes the server package with selected runtime dependencies inside its tarball. > - The staging step writes a temporary package manifest before it runs npm install. > - That manifest kept private development dependencies that npm still tried to resolve with `--omit=dev`. > - The canary release then stopped because the matching private runner version was not published yet. > - This pull request removes development dependencies from only the temporary install manifest. > - The benefit is that bundled package staging installs only the runtime dependencies that the tarball includes. ## Linked Issues or Issue Description Refs #12582 **What happened?** The canary release failed while it prepared `@paperclipai/server`. npm tried to resolve `@paperclipai/paperclip-runner@2026.831.0-canary.8` from the temporary staging manifest. The runner package was not published at that version, so npm returned `ETARGET`. See the [failed release job](https://github.com/paperclipai/paperclip/actions/runs/33395418107/job/99504474818). **Expected behavior** Bundled package staging must install only dependencies that the published tarball bundles. Private development dependencies must not affect the staging install. **Steps to reproduce** 1. Prepare a bundled package with a public bundled runtime dependency. 2. Add an unpublished package version to `devDependencies`. 3. Run `scripts/prepare-bundled-package.mjs`. 4. Observe that npm resolves the development dependency even when the command uses `--omit=dev`. **Paperclip version or commit** `5a988df600ebda30e446496862bf83c76d6d53d6` ## What Changed - Remove `devDependencies` from the temporary manifest used for bundled package installation. - Keep the final publish manifest unchanged. - Add unit and staging regression checks for the unpublished development dependency case. ## Verification - `pnpm install --frozen-lockfile` - `node --test scripts/acpx-patch-packaging.test.mjs` (12 passed) - `pnpm test:release-registry` (98 passed) - `git diff --check` - The full test suite and build were not run. This change has focused release-packaging coverage. ## Risks - Low risk. The change affects only the temporary manifest used to install bundled runtime dependencies. - The script restores the complete publish manifest before it creates the package tarball. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex with `gpt-5.6-sol`. The model used agentic reasoning, tool use, and code execution. The context window size is not exposed in this environment. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>
223 lines
8.5 KiB
JavaScript
223 lines
8.5 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
import { execFileSync } from "node:child_process";
|
|
import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const repoRoot = resolve(fileURLToPath(new URL("..", import.meta.url)));
|
|
|
|
export function materializePublishManifest(pkg) {
|
|
const publishConfig = pkg.publishConfig ?? {};
|
|
const publishManifest = { ...pkg };
|
|
|
|
for (const key of ["main", "types", "exports", "bin"]) {
|
|
if (publishConfig[key] !== undefined) publishManifest[key] = publishConfig[key];
|
|
}
|
|
|
|
for (const section of ["dependencies", "optionalDependencies", "peerDependencies"]) {
|
|
if (!publishManifest[section]) continue;
|
|
publishManifest[section] = Object.fromEntries(
|
|
Object.entries(publishManifest[section]).map(([name, specifier]) => {
|
|
if (typeof specifier !== "string" || !specifier.startsWith("workspace:")) return [name, specifier];
|
|
const range = specifier.slice("workspace:".length);
|
|
const prefix = range === "^" || range === "~" ? range : "";
|
|
return [name, `${prefix}${pkg.version}`];
|
|
}),
|
|
);
|
|
}
|
|
|
|
delete publishManifest.publishConfig;
|
|
return publishManifest;
|
|
}
|
|
|
|
export function createBundledInstallManifest(publishManifest, bundledDependencies) {
|
|
const bundledDependencyNames = new Set(bundledDependencies);
|
|
const installManifest = structuredClone(publishManifest);
|
|
|
|
delete installManifest.devDependencies;
|
|
|
|
for (const section of ["dependencies", "optionalDependencies", "peerDependencies"]) {
|
|
if (!installManifest[section]) continue;
|
|
installManifest[section] = Object.fromEntries(
|
|
Object.entries(installManifest[section]).filter(([name]) => bundledDependencyNames.has(name)),
|
|
);
|
|
if (Object.keys(installManifest[section]).length === 0) delete installManifest[section];
|
|
}
|
|
|
|
return installManifest;
|
|
}
|
|
|
|
function patchedDependencyPackageName(specifier) {
|
|
const versionSeparator = specifier.lastIndexOf("@");
|
|
const packageNameEnd = specifier.startsWith("@") ? specifier.indexOf("/") : 0;
|
|
if (packageNameEnd < 0) return specifier;
|
|
return versionSeparator > packageNameEnd ? specifier.slice(0, versionSeparator) : specifier;
|
|
}
|
|
|
|
export function selectBundledDependencyPatches(
|
|
destinationDir,
|
|
bundledDependencies,
|
|
patchedDependencies,
|
|
) {
|
|
const patchesByPackageName = new Map();
|
|
for (const [specifier, patchPath] of Object.entries(patchedDependencies)) {
|
|
const packageName = patchedDependencyPackageName(specifier);
|
|
const packagePatches = patchesByPackageName.get(packageName) ?? new Map();
|
|
packagePatches.set(specifier, patchPath);
|
|
patchesByPackageName.set(packageName, packagePatches);
|
|
}
|
|
|
|
const selectedPatches = [];
|
|
for (const packageName of new Set(bundledDependencies)) {
|
|
const packagePatches = patchesByPackageName.get(packageName);
|
|
if (!packagePatches) continue;
|
|
|
|
const installedManifestPath = resolve(
|
|
destinationDir,
|
|
"node_modules",
|
|
packageName,
|
|
"package.json",
|
|
);
|
|
let installedManifest;
|
|
try {
|
|
installedManifest = JSON.parse(readFileSync(installedManifestPath, "utf8"));
|
|
} catch (cause) {
|
|
throw new Error(
|
|
`Cannot select a patch for bundled dependency ${packageName}: failed to read ${installedManifestPath}`,
|
|
{ cause },
|
|
);
|
|
}
|
|
|
|
if (
|
|
installedManifest.name !== packageName ||
|
|
typeof installedManifest.version !== "string" ||
|
|
installedManifest.version.length === 0
|
|
) {
|
|
throw new Error(
|
|
`Cannot select a patch for bundled dependency ${packageName}: installed package manifest must declare the expected name and a version`,
|
|
);
|
|
}
|
|
|
|
const installedSpecifier = `${packageName}@${installedManifest.version}`;
|
|
const patchPath = packagePatches.get(installedSpecifier);
|
|
if (patchPath === undefined) {
|
|
const configuredSpecifiers = [...packagePatches.keys()].sort().join(", ");
|
|
throw new Error(
|
|
`Cannot select a patch for bundled dependency ${packageName}: installed ${installedSpecifier}, but configured patches are ${configuredSpecifiers}`,
|
|
);
|
|
}
|
|
if (typeof patchPath !== "string" || patchPath.length === 0) {
|
|
throw new Error(`Patch path for ${installedSpecifier} must be a non-empty string`);
|
|
}
|
|
selectedPatches.push({ packageName, specifier: installedSpecifier, patchPath });
|
|
}
|
|
|
|
return selectedPatches;
|
|
}
|
|
|
|
export function applyBundledDependencyPatches(destinationDir, bundledDependencies) {
|
|
const rootPackage = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8"));
|
|
const patchedDependencies = rootPackage.pnpm?.patchedDependencies ?? {};
|
|
|
|
for (const { packageName, patchPath } of selectBundledDependencyPatches(
|
|
destinationDir,
|
|
bundledDependencies,
|
|
patchedDependencies,
|
|
)) {
|
|
execFileSync(
|
|
"patch",
|
|
["-p1", "--forward", "-d", resolve(destinationDir, "node_modules", packageName)],
|
|
{
|
|
input: readFileSync(resolve(repoRoot, patchPath)),
|
|
stdio: ["pipe", "inherit", "inherit"],
|
|
},
|
|
);
|
|
}
|
|
}
|
|
|
|
export function prepareBundledPackage(sourceDir, destinationDir) {
|
|
const sourcePackagePath = resolve(sourceDir, "package.json");
|
|
const sourcePackage = JSON.parse(readFileSync(sourcePackagePath, "utf8"));
|
|
const bundledDependencies = sourcePackage.bundleDependencies ?? sourcePackage.bundledDependencies ?? [];
|
|
|
|
if (bundledDependencies.length === 0) {
|
|
throw new Error(`${sourcePackage.name} does not declare bundled dependencies`);
|
|
}
|
|
|
|
rmSync(destinationDir, { recursive: true, force: true });
|
|
mkdirSync(destinationDir, { recursive: true });
|
|
for (const entry of sourcePackage.files ?? []) {
|
|
cpSync(resolve(sourceDir, entry), resolve(destinationDir, entry), { recursive: true });
|
|
}
|
|
for (const entry of ["README.md", "LICENSE", "LICENSE.md"]) {
|
|
const sourcePath = resolve(sourceDir, entry);
|
|
if (existsSync(sourcePath)) cpSync(sourcePath, resolve(destinationDir, entry));
|
|
}
|
|
|
|
const deployedPackagePath = resolve(destinationDir, "package.json");
|
|
const publishManifest = materializePublishManifest(sourcePackage);
|
|
const installManifest = createBundledInstallManifest(publishManifest, bundledDependencies);
|
|
writeFileSync(deployedPackagePath, `${JSON.stringify(installManifest, null, 2)}\n`);
|
|
|
|
execFileSync(
|
|
"npm",
|
|
["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"],
|
|
{ cwd: destinationDir, stdio: "inherit" },
|
|
);
|
|
writeFileSync(deployedPackagePath, `${JSON.stringify(publishManifest, null, 2)}\n`);
|
|
applyBundledDependencyPatches(destinationDir, bundledDependencies);
|
|
|
|
if (bundledDependencies.includes("acpx")) {
|
|
const acpxPackage = JSON.parse(
|
|
readFileSync(resolve(destinationDir, "node_modules/acpx/package.json"), "utf8"),
|
|
);
|
|
const expectedPatchMarker = {
|
|
"0.12.0": "onAgentStderr",
|
|
"0.13.1": "spawnEnvironment",
|
|
}[acpxPackage.version];
|
|
const acpxRuntime = readFileSync(
|
|
resolve(destinationDir, "node_modules/acpx/dist/runtime.js"),
|
|
"utf8",
|
|
);
|
|
if (!expectedPatchMarker || !acpxRuntime.includes(expectedPatchMarker)) {
|
|
throw new Error(
|
|
`staged acpx@${acpxPackage.version} runtime is missing the repository patch`,
|
|
);
|
|
}
|
|
}
|
|
|
|
if (bundledDependencies.includes("embedded-postgres")) {
|
|
const embeddedPostgresSource = readFileSync(
|
|
resolve(destinationDir, "node_modules/embedded-postgres/dist/index.js"),
|
|
"utf8",
|
|
);
|
|
if (
|
|
!embeddedPostgresSource.includes("const LC_MESSAGES_LOCALE = 'C';") ||
|
|
!embeddedPostgresSource.includes("globalThis.process.env")
|
|
) {
|
|
throw new Error("staged embedded-postgres runtime is missing the repository patch");
|
|
}
|
|
|
|
const embeddedPostgresPackage = JSON.parse(
|
|
readFileSync(resolve(destinationDir, "node_modules/embedded-postgres/package.json"), "utf8"),
|
|
);
|
|
const stagedPackage = JSON.parse(readFileSync(deployedPackagePath, "utf8"));
|
|
stagedPackage.optionalDependencies = {
|
|
...(stagedPackage.optionalDependencies ?? {}),
|
|
...(embeddedPostgresPackage.optionalDependencies ?? {}),
|
|
};
|
|
writeFileSync(deployedPackagePath, `${JSON.stringify(stagedPackage, null, 2)}\n`);
|
|
rmSync(resolve(destinationDir, "node_modules/@embedded-postgres"), { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
if (process.argv[1] === fileURLToPath(import.meta.url)) {
|
|
const [sourceDir, destinationDir] = process.argv.slice(2);
|
|
if (!sourceDir || !destinationDir) {
|
|
console.error("Usage: prepare-bundled-package.mjs <source-dir> <destination-dir>");
|
|
process.exit(1);
|
|
}
|
|
prepareBundledPackage(resolve(sourceDir), resolve(destinationDir));
|
|
}
|