Repository navigation
Optimize npm package SDK installs - #302
Conversation
Avoid installing a nested @unbrained/pm-cli copy for npm package-backed extensions. Package installs now omit the host CLI package from npm's runtime install step, link @unbrained/pm-cli back to the active host package root, and restore the package runtime manifest so published metadata is preserved. Document the SDK-linking behavior for package authors, add regression coverage for peer-only and dependency-only package installs, update @sentry/node to 10.59.0, regenerate the package-owned changelog, and record pm evidence for pm-oxq2 plus auto-release health verification on pm-nb08. Verification: pnpm build; node scripts/run-tests.mjs test -- tests/unit/extensions/extension-command.spec.ts tests/integration/cli.integration.spec.ts; node scripts/run-tests.mjs coverage (100/100/100/100); pnpm quality:static; pnpm contracts:check; pnpm audit --audit-level moderate; pnpm security:scan; pnpm changelog:pm:check; node dist/cli.js package doctor --project --detail deep --json; node scripts/release/sentry-telemetry-gate.mjs --json --telemetry-mode best-effort; manual temp npm package install smoke.
Reviewer's GuideImplements host-linked SDK resolution for npm package-backed extensions so that @unbrained/pm-cli is provided by the active CLI instead of being installed per extension, while preserving package runtime metadata, extending tests/docs, and bumping @sentry/node. File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
@codex review\n\n/gemini review\n\n@gemini-code-assist review\n\n@coderabbitai full review |
|
To use Codex here, create a Codex account and connect to github. |
|
Warning Review limit reached
More reviews will be available in 38 minutes and 16 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
📝 WalkthroughWalkthroughDuring ChangesExtension SDK Install-Link Feature
Agent PM Tracking Records
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request resolves issue pm-oxq2 by preventing duplicate nested installations of @unbrained/pm-cli and its transitive dependencies when installing package-backed extensions. It filters out @unbrained/pm-cli during the npm install phase and symlinks it directly to the active host CLI package root. Additionally, @sentry/node is updated to ^10.59.0, and corresponding tests and documentation are added. The review feedback recommends wrapping the npm installation and symlinking processes in a try...finally block to ensure package.json is reliably restored to its original state even if the installation fails.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Get PR details
gh pr view 302 --repo unbraind/pm-cli --json title,body,baseRefName,headRefName,additions,deletions,changedFiles
echo "---FILES---"
# Get list of changed files
gh pr diff 302 --repo unbraind/pm-cli --name-only
echo "---DIFF---"
# Get the full diff
gh pr diff 302 --repo unbraind/pm-cliLength of output: 87430
SummaryThe PR cleanly solves the 69 MB nested
|
There was a problem hiding this comment.
Code Review
This pull request resolves issue pm-oxq2 by skipping nested host CLI installs for npm package extensions and instead linking @unbrained/pm-cli to the active host package root, significantly reducing disk usage. It also updates @sentry/node to version 10.59.0. Feedback on the changes points out a robustness issue where package.json could be left in a temporary, modified state if the installation fails, and suggests wrapping the installation logic in a try...finally block to ensure the manifest is always restored.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/cli/commands/extension/install-sources.ts (1)
555-556: ⚡ Quick winDerive symlink path from
PM_CLI_PACKAGE_NAMEto avoid name-drift.
linkHostedPmCliDependencyhardcodes scope/name instead of reusingPM_CLI_PACKAGE_NAME, so future rename updates can diverge.♻️ Suggested refactor
async function linkHostedPmCliDependency(packageRoot: string): Promise<void> { const hostPackageRoot = resolvePmPackageRootFromModule(import.meta.url, ["../../../.."]); - const scopedDirectory = path.join(packageRoot, "node_modules", "`@unbrained`"); - const linkPath = path.join(scopedDirectory, "pm-cli"); + const [scope, packageName] = PM_CLI_PACKAGE_NAME.split("/"); + const scopedDirectory = path.join(packageRoot, "node_modules", scope); + const linkPath = path.join(scopedDirectory, packageName); await fs.mkdir(scopedDirectory, { recursive: true }); await fs.rm(linkPath, { recursive: true, force: true }); await fs.symlink(hostPackageRoot, linkPath, resolveDirectorySymlinkType(process.platform)); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/cli/commands/extension/install-sources.ts` around lines 555 - 556, The symlink path construction in the `linkHostedPmCliDependency` function hardcodes the scope "`@unbrained`" and package name "pm-cli" instead of deriving them from the PM_CLI_PACKAGE_NAME constant. Replace the hardcoded values with a derived version by parsing PM_CLI_PACKAGE_NAME (which should be in the format "`@scope/package-name`") to extract the scope and package name components, then construct scopedDirectory and linkPath using these parsed values instead of the literal strings.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/cli/commands/extension/install-sources.ts`:
- Around line 555-556: The symlink path construction in the
`linkHostedPmCliDependency` function hardcodes the scope "`@unbrained`" and
package name "pm-cli" instead of deriving them from the PM_CLI_PACKAGE_NAME
constant. Replace the hardcoded values with a derived version by parsing
PM_CLI_PACKAGE_NAME (which should be in the format "`@scope/package-name`") to
extract the scope and package name components, then construct scopedDirectory
and linkPath using these parsed values instead of the literal strings.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 44e0dd78-9128-45b1-b91d-a6c105d3d1cc
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
.agents/pm/history/pm-nb08.jsonl.agents/pm/history/pm-oxq2.jsonl.agents/pm/issues/pm-nb08.toon.agents/pm/issues/pm-oxq2.toonCHANGELOG.mddocs/EXTENSIONS.mddocs/SDK.mdpackage.jsonsrc/cli/commands/extension/install-sources.tstests/unit/extensions/extension-command.spec.ts
Restore stripped npm package manifests in a finally block when runtime dependency installation or hosted pm-cli linking fails. Add regression coverage for link-failure restoration and derive the hosted @unbrained/pm-cli link path from the package constant. Override @sentry/cli's transitive undici to 6.27.0 so pnpm audit is clean while @sentry/cli remains on its latest published version. Verification: pnpm build; node scripts/run-tests.mjs test -- tests/unit/extensions/extension-command.spec.ts; node scripts/run-tests.mjs coverage (100/100/100/100, 4655 tests); pnpm quality:static; pnpm contracts:check; pnpm changelog:pm:check; pnpm security:scan; pnpm audit --audit-level moderate; node dist/cli.js package doctor --project --detail deep --json; node scripts/release/sentry-telemetry-gate.mjs --json --telemetry-mode best-effort.
|
Review agents: new head 2d0c55e addresses manifest-restore feedback and the undici audit finding. Please review the current head again. @codex review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Get current PR details and diff at new head
gh pr view 302 --repo unbraind/pm-cli --json title,headRefOid,additions,deletions,changedFiles
echo "---DIFF---"
gh pr diff 302 --repo unbraind/pm-cliLength of output: 90055
What changed
Hardcoded
Regression coverage for the Remaining minor (non-blocking)The
|
There was a problem hiding this comment.
Code Review
This pull request resolves issue pm-oxq2 by skipping nested installs of the host CLI package (@unbrained/pm-cli) when installing npm package extensions. Instead, it symlinks (or junctions on Windows) the extension's dependency back to the active host package root, preserving the package manifest in a finally block if the installation or linking fails. The changes also include updating @sentry/node to ^10.59.0, locking undici to 6.27.0 to resolve security advisories, updating documentation, and adding comprehensive unit tests to cover the new linking and restoration behaviors. There are no review comments, so no additional feedback is provided.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Summary
Verification
Summary by Sourcery
Optimize npm-backed extension installs by avoiding nested @unbrained/pm-cli copies and wiring SDK imports to the active host CLI.
Bug Fixes:
Enhancements:
Build:
Documentation:
Tests:
Chores: