Skip to content

fix(pstack): keep runtime dependencies outside plugin cache - #294

Open
davidrobertson wants to merge 2 commits into
ericlitman:mainfrom
davidrobertson:fix/keep-plugin-dependencies-outside-cache
Open

davidrobertson wants to merge 2 commits into
ericlitman:mainfrom
davidrobertson:fix/keep-plugin-dependencies-outside-cache

Conversation

@davidrobertson

Copy link
Copy Markdown

Problem

On its first run, watch-pr installs dependencies inside the installed plugin. Bun creates a node_modules/.bin/tsc symlink there, which Codex rejects while fingerprinting the plugin for hook trust. Subsequent session-start hooks fail.

Closes #293.

Change

Install the frozen dependencies in a user cache outside the plugin, keyed by the manifest and lockfile. Publish complete installations through unique staging directories so concurrent starts can reuse the winner. Register the cached Commander module with Bun before importing the CLI, keeping the command in its original process and preserving its arguments, working directory, environment, streams, and signal handling.

Existing plugin installations already modified by the previous bootstrap need a clean reinstall to remove the symlink from the plugin tree.

Verification

  • Bun 1.4.0: bun run test (520 passed), bun run typecheck, and bun run static (including 219 verifier tests).
  • claude plugin validate plugins/pstack and claude plugin validate . passed.
  • Regression tests cover cold and warm starts, concurrent starts, cache invalidation, a conflicting ancestor dependency, paths with path-list delimiters, relative Bun --cwd, failure diagnostics, and process termination. The focused suite also passed with network access disabled and an already-warm Bun package cache.
  • On macOS with Codex CLI 0.167.0, installed this exact commit in a disposable Codex home. After cold and repeat watch-pr --help runs, the trusted hook fingerprint stayed unchanged and a fresh Codex session completed the pstack session-start hook. The plugin contained no scripts/node_modules directory.

Live gate

The repository's verify-open-pstack publisher requires an open same-repository PR, so it cannot publish the live-gate status for this fork PR. A maintainer will need to run the repository's exact-head live gate on a same-repository candidate before merging. No Windows live test was performed.

@mergify

mergify Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Merge Protections

🟠 1 of 2 protections blocking · waiting on 🤖 CI

Protection Waiting on
🟠 Queue ready pull requests 🤖 CI
🟢 🚦 Auto-queue —

🟠 Queue ready pull requests

Waiting for

  • check-success=live-gate
  • check-success=verify
Waiting checks: live-gate, verify.

Automatically queue non-draft pull requests targeting main after verify and live-gate pass on the head and every review thread is resolved.

  • check-success=live-gate
  • check-success=verify
  • #review-threads-unresolved = 0
  • -draft

Show 1 satisfied protection

🟢 🚦 Auto-queue

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

  • -files~=^\.github/
  • base = main

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(pstack): keep runtime dependency installs out of plugin directory

1 participant