fix: restart previews after dependency changes - #257
Merged
Conversation
Keep shared runtime dependencies immutable. Prevent read-only pnpm commands from replacing them. Restart only the preview app after a locked dependency mutation. Prove Metro recovery in the protected snapshot smoke.
iamjr15
added a commit
that referenced
this pull request
Aug 12, 2026
## Summary - Promote the immutable Daytona snapshot built from main commit `cc233955706e562dbb2b88e2e6ef8c71f6ae41e5`. - Move production sandbox creation to `cheatcode-sandbox-viewer-bundle-cc233955706e-31614658830`. ## Provenance - Source PR: #257 - Snapshot workflow: https://github.com/cheatcode-ai/cheatcode/actions/runs/31614658830 - Source commit: `cc233955706e562dbb2b88e2e6ef8c71f6ae41e5` - Provider publication retries: 0 ## Verification - Candidate image build passed. - Trivy configuration and image scan passed. - Protected runtime smoke passed, including Expo bundle rendering, read-only TypeScript validation, dependency mutation, Metro restart, and post-restart bundle compilation. - Daytona publication and active-state verification passed. - Promotion branch: lint, typecheck, forced production build, dead-code analysis, architecture check, skills build, and diff check passed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary\n- Keep snapshot dependency runtimes image-owned and read-only.\n- Preserve the shared runtime for read-only pnpm validation and project scripts.\n- Restart only the preview app after a locked dependency mutation so Metro cannot retain a stale module graph.\n- Extend protected snapshot smoke coverage through both dependency paths.\n\n## Architecture\nThe package transaction publishes a dependency generation under the existing project package lock. The native preview supervisor observes that generation, waits for the transaction, and replaces only its app child while retaining source synchronization and the signed launch environment.\n\n## Decisions Made\n| Decision | Choice | Reasoning |\n|---|---|---|\n| Shared dependencies | Root-owned immutable runtime | Prevent project commands from mutating snapshot state |\n| Read-only commands | Disable pnpm pre-run dependency verification | Avoid an implicit install replacing the runtime link |\n| Dependency changes | Generation event under package lock | Make mutation and restart one coordinated lifecycle |\n| Preview recovery | Supervisor-owned app-child restart | Preserve the durable process session and signed environment |\n\n## Edge Cases\n- A read-only command that unexpectedly changes dependency topology still advances the generation.\n- A failed dependency mutation still invalidates the old resolver before it can continue serving stale state.\n- Process death releases the kernel lock, so preview recovery cannot be stranded.\n\n## Verification\n- pnpm lint\n- pnpm typecheck\n- pnpm turbo build --force\n- pnpm deadcode\n- pnpm architecture:check\n- pnpm turbo skills:build\n- git diff --check\n- Built the final AMD64 sandbox image locally.\n- Verified read-only tsc preserves the runtime symlink and Metro PID.\n- Verified offline pnpm install creates a local tree, advances the generation, restarts Metro, and recompiles the Expo bundle.\n- Verified all non-symlink runtime files are non-writable to the sandbox user.