feat(cli): fail fast when the vite alias skews from the CLI version - #2462
Draft
fengmk2 wants to merge 6 commits into
Draft
feat(cli): fail fast when the vite alias skews from the CLI version#2462fengmk2 wants to merge 6 commits into
fengmk2 wants to merge 6 commits into
Conversation
✅ Deploy Preview for viteplus-preview canceled.
|
fengmk2
marked this pull request as draft
August 16, 2026 09:47
fengmk2
commented
Aug 16, 2026
fengmk2
marked this pull request as ready for review
August 16, 2026 09:59
fengmk2
marked this pull request as draft
August 16, 2026 10:09
Member
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8bb256e084
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Native binary sizes (
|
| Artifact | Format | Base | PR | Change |
|---|---|---|---|---|
vp (Linux x64) |
Binary | 10.67 MiB | 10.67 MiB | 0 B (0.00%) |
vp (Linux x64) |
gzip -9 | 4.62 MiB | 4.62 MiB | 0 B (0.00%) |
| NAPI (Linux x64) | Binary | 32.02 MiB | 32.03 MiB | +4.00 KiB (+0.01%) |
| NAPI (Linux x64) | gzip -9 | 12.61 MiB | 12.61 MiB | -89 B (-0.00%) |
vp (macOS ARM64) |
Binary | 7.98 MiB | 7.98 MiB | 0 B (0.00%) |
vp (macOS ARM64) |
gzip -9 | 4.03 MiB | 4.03 MiB | 0 B (0.00%) |
| NAPI (macOS ARM64) | Binary | 39.68 MiB | 39.68 MiB | 0 B (0.00%) |
| NAPI (macOS ARM64) | gzip -9 | 16.92 MiB | 16.92 MiB | +2.78 KiB (+0.02%) |
vp (Windows x64) |
Binary | 8.55 MiB | 8.55 MiB | 0 B (0.00%) |
vp (Windows x64) |
gzip -9 | 3.73 MiB | 3.73 MiB | 0 B (0.00%) |
| NAPI (Windows x64) | Binary | 26.89 MiB | 26.90 MiB | +4.50 KiB (+0.02%) |
| NAPI (Windows x64) | gzip -9 | 10.68 MiB | 10.68 MiB | +54 B (+0.00%) |
| Trampoline (Windows x64) | Binary | 205.00 KiB | 205.00 KiB | 0 B (0.00%) |
| Trampoline (Windows x64) | gzip -9 | 99.00 KiB | 99.00 KiB | 0 B (0.00%) |
| Installer (Windows x64) | Binary | 4.47 MiB | 4.47 MiB | 0 B (0.00%) |
| Installer (Windows x64) | gzip -9 | 2.09 MiB | 2.09 MiB | 0 B (0.00%) |
vp create / vp migrate scaffold two entries that must move in lockstep: the vite-plus dependency and the vite alias (npm:@voidzero-dev/vite-plus-core@<same version>). A dependency bot sees two unrelated packages and bumps them in separate PRs, leaving a project on a CLI/core pairing that was never published together. The skew is silent: the CLI executes its own core dependency while plugins and configs importing vite load the aliased copy at the other version. The vite and test resolvers now check what vite resolves to from the project and error when it is @voidzero-dev/vite-plus-core at a version different from the CLI, so vp dev/build/preview/test fail the mismatched bot PR in CI instead of shipping the pairing. The check skips real Vite installs, projects without vite, preview flows (VP_VERSION), and the VP_SKIP_CORE_VERSION_CHECK=1 escape hatch. Refs #2356
The fixture's node_modules/vite/package.json is the shadowed core copy the case depends on; the root node_modules gitignore entry excluded it from the previous commit.
The alias can live in a catalog, overrides, resolutions, or a direct dependency spec depending on the package manager, so the error hint no longer names pnpm.
Review cleanups from a four-angle pass: - Reuse detectPackageMetadata for the project vite lookup instead of a hand-rolled createRequire/readFile resolver; this also covers Yarn PnP and exports-blocked package.json layouts for free. - Derive the expected version by parsing the vite alias spec the CLI scaffolds (VITE_PLUS_OVERRIDE_PACKAGES.vite) instead of special-casing the VP_VERSION env var. The Rust CLI injects VP_VERSION into every child env, so nested vp runs would have silently lost the check; a non-exact spec (preview tarball, file:) now skips by shape instead. - Move the core package name into constants.ts next to VITE_PLUS_NAME. - Memoize the check for the resolver path: resolvers fire once per intercepted script command, so a workspace run repeated the same read. - Collapse the guard's input to the aliased core version (string or null), drop the injectable deps plumbing, and test the orchestrator against real temp fixture dirs. The user-facing error message is unchanged; the recorded PTY snapshot passes without re-recording.
Two review findings on the skew guard: - The expected core version came from VITE_PLUS_VERSION, which VP_VERSION overrides. The installer docs tell PowerShell users to set VP_VERSION for the session, and the Rust CLI injects it into every child env, so an aligned project could fail (or a stale pairing pass) against an inherited value. The guard now compares against the running CLI package's own version (CLI_PACKAGE_VERSION); preview and ecosystem builds publish CLI and core from one commit, so no spec-shape skip is needed and the alias parsing is gone. - The guard resolved vite from the process cwd, so retargeted runs (defaultPackage, vp run -r script commands) checked the invocation root instead of the package the command executes in. The Rust resolver now forwards each command's cwd to the JS resolvers, and the guard memoizes per directory.
fengmk2
force-pushed
the
feat/core-version-skew-guard
branch
from
August 17, 2026 07:23
85a099c to
bc56e4d
Compare
Member
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc56e4d460
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
vp build apps/web (or an explicit -c apps/web/vite.config.ts) rebases Vite's config lookup onto the selected root while the process cwd stays put, so the guard checked the wrong directory: a skewed app alias could pass and a skewed root alias could reject an aligned app. The vite resolver arms now derive the guard directory from the args with the same cac/mri walk app_target already uses for elicitation: the parent of an explicit -c/--config file wins, else the [root] positional, else the command cwd. The snapshot case gains a positional-root step that vendors a real-vite-shaped package in app/, so it only passes when the guard checks the selected root instead of the workspace cwd.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
vp create/vp migratescaffoldvite-plusand thevitealias (npm:@voidzero-dev/vite-plus-core@<same version>) as two entries that must move in lockstep. Dependency bots treat them as unrelated packages and bump them in separate PRs, so a repo ends up running a vite-plus/core pairing that was never published together, and nothing fails. See #2356 for real cases (voidzero-dev/setup.viteplus.dev#36/#37, voidzero-dev/setup-vp#119).This adds the fail-fast guard from #2356 idea 2: the
viteandtestresolvers read whatviteresolves to from the project and error when it is@voidzero-dev/vite-plus-coreat a version different from the running CLI. A mismatched bot PR now failsvp dev/vp build/vp preview/vp testin CI with instructions to realign the alias (or runvp migrate). Becausevp runtasks that invokevp build/vp testsynthesize the same resolvers in-process, they are covered too.The check skips projects on real Vite, projects where
viteis not resolvable, preview/override flows (VP_VERSIONset), and theVP_SKIP_CORE_VERSION_CHECK=1escape hatch.vp install,vp migrate,vp lint, andvp fmtare untouched, so the repair path stays open after a bad merge.Covered by unit tests and a PTY snapshot case (
core_version_guard) that shadows the runner'svitelink with a core at a version the CLI never shipped with; the error message keeps every version inside the@voidzero-dev/vite-plus-core@<x>form so the existing snapshot redaction masks it and the case survives release bumps.Follow-ups tracked in #2356: an official Renovate preset plus docs, and possibly extending the guard to the pinned
vitestoverride.Refs #2356