Add pnpm workspace configuration and refactor code structure#21
Add pnpm workspace configuration and refactor code structure#21chakrihacker wants to merge 2 commits into
Conversation
|
You've used up your 5 PR reviews for this month under the Korbit Starter Plan. You'll get 5 more reviews on October 6th, 2025 or you can upgrade to Pro for unlimited PR reviews and enhanced features in your Korbit Console. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughIntroduces a Bun-based frontend server and build/export pipeline for the frontend app, adds Docker and Nixpacks configs for multi-stage builds and distroless runtime, adjusts workspace/catalog settings across package manifests, modifies pnpm workspace setup, and relaxes a frontend env validation. Updates .dockerignore and related tooling configs. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor U as User Agent
participant S as Bun Server (frontend)
participant FS as Static Files (dist/client)
participant H as Expo Server Handler (dist/server)
Note over S: Routes<br/>/_expo/static/*, /assets/*, /canvaskit.wasm<br/>/* (fallback)
U->>S: HTTP Request
alt Static route
S->>FS: Lookup asset
alt Found
FS-->>S: File
S-->>U: 200 File Response
else Not found
S-->>U: 404 Not Found
end
else App route
S->>H: Delegate request
H-->>S: Response
S-->>U: Proxy Response
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR migrates the monorepo to pnpm workspaces with a centralized catalog for dependency versions, refactors package.json files to leverage the catalog, and enhances the frontend app with a custom Bun server setup along with Docker and Nixpacks configurations; minor schema and Metro adjustments ensure compatibility in the new structure. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
CI Feedback 🧐(Feedback updated until commit 895fba3)A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and found some issues that need to be addressed.
- Your Dockerfile EXPOSEs port 3000 but the Bun server is configured to listen on 4000, so you should sync those ports to avoid runtime connectivity issues.
- Double-check that using bare "catalog:" aliases in package.json resolves to the intended versions in pnpm workspace, since removing the explicit catalog names could lead to unexpected dependency versions.
- Consider re-enabling Metro’s unstable_enableSymlinks option (or an equivalent) to ensure correct module resolution in your pnpm monorepo setup.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Your Dockerfile EXPOSEs port 3000 but the Bun server is configured to listen on 4000, so you should sync those ports to avoid runtime connectivity issues.
- Double-check that using bare "catalog:" aliases in package.json resolves to the intended versions in pnpm workspace, since removing the explicit catalog names could lead to unexpected dependency versions.
- Consider re-enabling Metro’s unstable_enableSymlinks option (or an equivalent) to ensure correct module resolution in your pnpm monorepo setup.
## Individual Comments
### Comment 1
<location> `apps/frontend/server.ts:10-17` </location>
<code_context>
+const server = Bun.serve({
+ port: 4000,
+ routes: {
+ "/_expo/static/*": async (request) => {
+ const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`);
+ const exists = await file.exists();
+ return exists
+ ? new Response(file)
+ : new Response("Not found", { status: 404 });
+ },
+ "/assets/*": async (request) => {
+ const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`);
+ const exists = await file.exists();
</code_context>
<issue_to_address>
**🚨 issue (security):** Static file serving may leak files outside intended directory.
Sanitize the pathname to prevent path traversal and restrict access to files within the intended directory.
</issue_to_address>
### Comment 2
<location> `apps/frontend/server.ts:25` </location>
<code_context>
+ : new Response("Not found", { status: 404 });
+ },
+ "/*": async (request) => await handler(request),
+ "/canvaskit.wasm": async (_request) => {
+ const file = Bun.file("./dist/client/canvaskit.wasm");
+ const exists = await file.exists();
</code_context>
<issue_to_address>
**suggestion:** Hardcoded file path may not be portable.
Use an absolute path or align with the base directory for static assets to ensure portability.
Suggested implementation:
```typescript
const assetBase = `${import.meta.dir}/dist/client`;
const file = Bun.file(`${assetBase}${new URL(request.url).pathname}`);
```
```typescript
+ const assetBase = `${import.meta.dir}/dist/client`;
+ const file = Bun.file(`${assetBase}/canvaskit.wasm`);
```
</issue_to_address>
### Comment 3
<location> `apps/frontend/Dockerfile:23` </location>
<code_context>
+RUN cd apps/frontend && pnpm run export:web && pnpm run export:server
+
+# runtime image
+FROM gcr.io/distroless/base
+# FROM ubuntu:latest
+WORKDIR /app
</code_context>
<issue_to_address>
**issue (bug_risk):** Distroless base image may not support Bun binary execution.
Distroless images often lack libraries needed for Bun. If runtime errors occur, switch to an image with the required dependencies or ensure the Bun binary is statically linked.
</issue_to_address>
### Comment 4
<location> `apps/frontend/Dockerfile:33` </location>
<code_context>
+ENV NODE_ENV=production
+CMD ["./server"]
+# ENTRYPOINT [ "sh" ]
+EXPOSE 3000
\ No newline at end of file
</code_context>
<issue_to_address>
**issue (bug_risk):** Port exposure does not match server configuration.
The Dockerfile should expose port 4000 to match the Bun server configuration and avoid deployment issues.
</issue_to_address>
### Comment 5
<location> `apps/frontend/src/config/env.ts:4` </location>
<code_context>
const envSchema = z.object({
- EXPO_PUBLIC_API_URL: z.url(),
- EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100),
+ EXPO_PUBLIC_API_URL: z.string(),
+ EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100),
});
</code_context>
<issue_to_address>
**issue (bug_risk):** Relaxing EXPO_PUBLIC_API_URL validation may allow invalid URLs.
Switching to `z.string()` removes URL validation, which may permit malformed or insecure values. To maintain strict validation, keep `z.url()` or implement custom checks.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| "/_expo/static/*": async (request) => { | ||
| const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`); | ||
| const exists = await file.exists(); | ||
| return exists | ||
| ? new Response(file) | ||
| : new Response("Not found", { status: 404 }); | ||
| }, | ||
| "/assets/*": async (request) => { |
There was a problem hiding this comment.
🚨 issue (security): Static file serving may leak files outside intended directory.
Sanitize the pathname to prevent path traversal and restrict access to files within the intended directory.
| : new Response("Not found", { status: 404 }); | ||
| }, | ||
| "/*": async (request) => await handler(request), | ||
| "/canvaskit.wasm": async (_request) => { |
There was a problem hiding this comment.
suggestion: Hardcoded file path may not be portable.
Use an absolute path or align with the base directory for static assets to ensure portability.
Suggested implementation:
const assetBase = `${import.meta.dir}/dist/client`;
const file = Bun.file(`${assetBase}${new URL(request.url).pathname}`);+ const assetBase = `${import.meta.dir}/dist/client`;
+ const file = Bun.file(`${assetBase}/canvaskit.wasm`);| RUN cd apps/frontend && pnpm run export:web && pnpm run export:server | ||
|
|
||
| # runtime image | ||
| FROM gcr.io/distroless/base |
There was a problem hiding this comment.
issue (bug_risk): Distroless base image may not support Bun binary execution.
Distroless images often lack libraries needed for Bun. If runtime errors occur, switch to an image with the required dependencies or ensure the Bun binary is statically linked.
| ENV NODE_ENV=production | ||
| CMD ["./server"] | ||
| # ENTRYPOINT [ "sh" ] | ||
| EXPOSE 3000 No newline at end of file |
There was a problem hiding this comment.
issue (bug_risk): Port exposure does not match server configuration.
The Dockerfile should expose port 4000 to match the Bun server configuration and avoid deployment issues.
| const envSchema = z.object({ | ||
| EXPO_PUBLIC_API_URL: z.url(), | ||
| EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100), | ||
| EXPO_PUBLIC_API_URL: z.string(), |
There was a problem hiding this comment.
issue (bug_risk): Relaxing EXPO_PUBLIC_API_URL validation may allow invalid URLs.
Switching to z.string() removes URL validation, which may permit malformed or insecure values. To maintain strict validation, keep z.url() or implement custom checks.
PR Code Suggestions ✨Explore these optional code suggestions:
|
|||||||||||||||
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (7)
pnpm-workspace.yaml (1)
5-9: Normalize catalog version policy and dedupe common infra deps.
- Mixed pinning: typescript/biome are exact, zod is caret. Pick one policy (prefer exact for reproducibility) and apply consistently.
- Consider adding bullmq and ioredis to catalog to avoid multiple versions across apps/api and packages.
Apply one of the following diffs to unify policy (example: exact pins):
catalog: "@biomejs/biome": "2.2.2" "typescript": "5.9.2" - "zod": "^4.0.17" + "zod": "4.0.17"Optionally extend catalog to dedupe infra:
catalog: "bullmq": "5.58.4" "ioredis": "5.7.0"packages/queue-kit/package.json (1)
15-15: TS as a peer via catalog: is fine; mark it optional to avoid peer warnings at runtime.This package is private and ships TS sources; making the TS peer optional reduces noise for consumers that don’t need TS at runtime.
"peerDependencies": { "typescript": "catalog:" }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + },packages/db/package.json (1)
21-21: TS peer via catalog:—mirror optional meta to reduce peer warnings."peerDependencies": { "typescript": "catalog:" }, + "peerDependenciesMeta": { + "typescript": { + "optional": true + } + },apps/frontend/metro.config.js (1)
49-49: Consider opt-in symlink resolution for pnpm monorepos.Enable symlinks behind an env flag to fix resolution with hoisted deps without risking platform regressions.
-// config.resolver.unstable_enableSymlinks = true; +config.resolver.unstable_enableSymlinks = process.env.METRO_SYMLINKS === "1";Please test on iOS/Android/Web with METRO_SYMLINKS=1 to confirm no duplicate-module or asset resolution issues.
apps/frontend/server.ts (2)
24-24: Remove redundant async/await in the catch‑all.The handler already returns a Promise; direct reference is fine (also covered in the earlier diff).
10-23: DRY up duplicated static logic and add long‑cache headers for hashed assets.Consider extracting a small helper for static roots and attach Cache‑Control for immutable assets.
Example (add near the top of the file):
const serveFrom = (baseDir: string, stripPrefix: RegExp, headers?: HeadersInit) => async (request: Request) => { const url = new URL(request.url); const rel = path.posix.normalize(url.pathname.replace(stripPrefix, "")); const base = path.join(import.meta.dir, baseDir); const full = path.join(base, rel); if (!full.startsWith(base)) return new Response("Forbidden", { status: 403 }); const file = Bun.file(full); return (await file.exists()) ? new Response(file, { headers }) : new Response("Not found", { status: 404 }); }; // usage: // "/_expo/static/*": serveFrom("dist/client/_expo/static", /^\/_expo\/static\//, { "Cache-Control": "public,max-age=31536000,immutable" }), // "/assets/*": serveFrom("dist/client/assets", /^\/assets\//, { "Cache-Control": "public,max-age=31536000,immutable" }),apps/frontend/Dockerfile (1)
1-21: Layer caching and image size: copy only lockfiles first, then sources; drop unnecessary build deps.This improves cache hits and reduces base churn. Watchman likely isn’t needed for CI builds.
Example:
# before COPY . . COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./ COPY apps/frontend/package.json apps/frontend/ RUN pnpm fetch COPY . . RUN pnpm install --offline --frozen-lockfile
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
bun.lockis excluded by!**/*.lockpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (17)
.dockerignore(2 hunks).npmrc(1 hunks)apps/api/package.json(1 hunks)apps/frontend/Dockerfile(1 hunks)apps/frontend/metro.config.js(1 hunks)apps/frontend/package.json(3 hunks)apps/frontend/server.ts(1 hunks)apps/frontend/src/config/env.ts(1 hunks)apps/workers/package.json(1 hunks)frontend-nixpacks.toml(1 hunks)package.json(1 hunks)packages/db/package.json(1 hunks)packages/logger/package.json(1 hunks)packages/queue-kit/package.json(1 hunks)packages/redis/package.json(1 hunks)packages/shared/package.json(1 hunks)pnpm-workspace.yaml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{ts,tsx,js,jsx}: Don't use the arguments object
Use for...of instead of Array.forEach
Use arrow functions instead of function expressions
Use Date.now() instead of new Date().getTime()
Use .flatMap() instead of map().flat() when possible
Prefer regex literals over RegExp constructor when possible
Use concise optional chaining instead of chained logical expressions
Always provide radix to parseInt()
Don't use var; use const/let and prefer const when single assignment
Use template literals over string concatenation
Use strict equality (===/!==)
Don't use console or debugger in committed code
Prevent import cycles and avoid namespace imports
Don't hardcode secrets (API keys/tokens) in source
Don't have unused vars, params, imports, labels, or private members
Avoid await inside loops; ensure Promise-like statements are handled
Disallow bitwise operators and comma operator
Ensure switch statements are exhaustive; default clause comes last; no fallthrough or duplicate cases
Use object spread over Object.assign when creating new objects
Prefer Array.isArray over instanceof Array; use at() instead of integer index access where appropriate
No unreachable code, duplicate conditions, or assignments in conditionals
Always use radix with parseInt; prefer Number.isNaN/Number.isFinite over globals
Disallow using global eval, with, var, and unsafe negation
Ensure typeof comparisons use valid strings; getters return values; constructors don’t return values
Files:
apps/frontend/metro.config.jsapps/frontend/server.tsapps/frontend/src/config/env.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{ts,tsx}: Use object destructuring for method parameters (wrap multiple parameters in an object; define shapes with TypeScript interfaces)
Use authClient.useSession() for session state
Avoid React hooks; use Legend State observables directly (exception: Better Auth hooks)
Import UI components via path aliases (e.g., @/src/components/ui/)
Prefer union string/number literals over TypeScript enums
Use export type and import type for types
Don't use non-null assertions (!) or implicit any
Avoid TypeScript namespaces; prefer ESM modules
Files:
apps/frontend/server.tsapps/frontend/src/config/env.ts
**/*.{tsx,ts}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Use Platform.OS and process.env.EXPO_OS for conditional platform logic
Files:
apps/frontend/server.tsapps/frontend/src/config/env.ts
🧠 Learnings (3)
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
PR: fyndx/universal-starter#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to metro.config.js : Metro config must support CSS, package exports, and .mjs files
Applied to files:
apps/frontend/metro.config.js
📚 Learning: 2025-09-03T13:07:10.649Z
Learnt from: CR
PR: fyndx/universal-starter#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-03T13:07:10.649Z
Learning: Applies to babel.config.js : Configure NativeWind Babel/Metro plugins for Tailwind compilation
Applied to files:
apps/frontend/metro.config.js
📚 Learning: 2025-08-28T12:01:24.375Z
Learnt from: chakrihacker
PR: fyndx/universal-starter#13
File: apps/frontend/tsconfig.json:13-17
Timestamp: 2025-08-28T12:01:24.375Z
Learning: When using TypeScript project references for Eden Treaty type safety, the backend needs both "composite": true and "declaration": true in tsconfig.json to emit .d.ts files that the frontend can consume. The workspace root also needs TypeScript as a devDependency for the build commands to work properly.
Applied to files:
packages/queue-kit/package.jsonpackages/redis/package.jsonpackages/shared/package.jsonpackages/logger/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Sourcery review
🔇 Additional comments (15)
pnpm-workspace.yaml (1)
1-3: Workspace globs look good for a standard packages/ + apps/ monorepo.**apps/api/package.json (2)
38-38: Zod v4 compatibility verified. Scans show no deprecated v3-only APIs (ZodError.format/flattenor old.strict()), only standardimport { z } from "zod".
42-42: Ensure API tsconfig emits declarations for project references
SetcompilerOptions.composite: trueandcompilerOptions.declaration: truein apps/api/tsconfig.json so consumer apps can import backend types.packages/shared/package.json (1)
16-16: Consistent catalog dependency update - looks good.The TypeScript peer dependency specifier has been updated from
"catalog:devDeps"to"catalog:", which aligns with the workspace-wide catalog migration pattern visible across other packages in this PR.apps/frontend/package.json (4)
12-13: LGTM! Export scripts properly configured.The new export scripts are well-defined:
export:webuses Expo's built-in web export functionalityexport:serveruses Bun to compile the server.ts into a standalone executableThis aligns perfectly with the Nixpacks configuration that references these scripts.
21-21: @expo/server is properly utilized. The package is imported in apps/frontend/server.ts and used via createRequestHandler, so it’s not an unused dependency.
91-91: Zod catalog version compatibility verified. The catalog’szodversion (^4.0.17) supports all current schema features inapps/frontend/src/config/env.ts(z.object,z.string().min().max()), so no migration is needed.
85-85: Add Worklets Babel plugin configurationapps/frontend/babel.config.js must include the Worklets plugin for
react-native-worklets. For example:module.exports = { presets: ['module:metro-react-native-babel-preset'], plugins: [ 'react-native-reanimated/plugin', 'react-native-worklets/babel' ], };This ensures your Worklets are compiled correctly.
⛔ Skipped due to learnings
Learnt from: CR PR: fyndx/universal-starter#0 File: .github/copilot-instructions.md:0-0 Timestamp: 2025-09-03T13:07:10.649Z Learning: Applies to babel.config.js : Configure NativeWind Babel/Metro plugins for Tailwind compilationpackage.json (2)
4-7: Clean workspace configuration - LGTM!The workspaces field has been simplified from an object to a direct array format, which is the standard pnpm/npm workspaces configuration. This change aligns with the new pnpm workspace setup.
15-15: Consistent catalog migration for dev dependencies.Both
@biomejs/biomeandtypescripthave been updated from"catalog:devDeps"to"catalog:", which aligns with the workspace-wide catalog migration pattern. This ensures consistent dependency resolution across the monorepo.Also applies to: 18-18
packages/redis/package.json (1)
14-14: Verified TypeScript catalog entry.
TypeScript is listed as"5.9.2"undercatalogin pnpm-workspace.yaml, matching the updated"catalog:"specifier.frontend-nixpacks.toml (1)
1-12: Verify actual build output and permissions
Please run the full build inapps/frontendand confirm:
distdirectory is generated with web assetsweb-serverbinary is produced and has executable permissions (chmod +x)apps/frontend/server.ts (1)
5-6: Good use of import.meta.dir to anchor the Expo server handler.apps/frontend/Dockerfile (2)
27-31: Runtime base and binary compatibility
- Re-run your checks against the actual runtime binary path, e.g.:
file /app/server # or, in the build stage: file /app/apps/frontend/web-server ldd /app/server # or: ldd /app/apps/frontend/web-server- If it isn’t a fully static binary, switch to a distroless image that matches its libc or bundle the Bun runtime and use
bun runinstead of invoking./server.- Align the exposed port in your Dockerfile (
EXPOSE 3000) with the default port change inserver.ts.
20-21: Verification passed: export scripts output to the expected paths
•pnpm run export:webemits intoapps/frontend/distby default (docs.expo.dev)
•pnpm run export:serverproducesapps/frontend/web-serveras defined inapps/frontend/package.json(line 13)
| # .env | ||
| # **/.env |
There was a problem hiding this comment.
Restore ignoring of .env files in Docker contexts.
Uncommenting the .env patterns means local secrets now ship in every docker build context, which is a significant security risk—especially with remote builders or shared CI. Please keep .env files excluded and pass required values through build args or runtime envs instead.
You can restore the ignores with:
-# .env
-# **/.env
+.env
+**/.env📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # .env | |
| # **/.env | |
| # Restore ignoring of local .env files | |
| .env | |
| **/.env |
🤖 Prompt for AI Agents
.dockerignore around lines 12 to 13: the `.env` ignore entries were uncommented,
allowing local secret files into Docker build contexts; restore the ignores by
re-adding the `.env` patterns (e.g., uncomment or reinsert `# .env` and `#
**/.env` as ignore patterns or add `.env` and `**/.env`) so `.env` files are
excluded from build contexts, and ensure required values are provided via
build-args or runtime environment variables instead.
| apt-get install -y curl gnupg ca-certificates && \ | ||
| curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \ | ||
| apt-get install -y nodejs && \ | ||
| npm install -g pnpm bun && \ | ||
| apt-get install -y watchman && \ | ||
| apt-get clean && \ | ||
| rm -rf /var/lib/apt/lists/* |
There was a problem hiding this comment.
Bun runtime isn’t installed; npm i -g bun is not the Bun runtime. Build will fail for Bun‑compiled server.
Install Bun via the official script (or use an oven/bun image). Also prefer Corepack for pnpm.
apt-get install -y curl gnupg ca-certificates && \
curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \
- apt-get install -y nodejs && \
- npm install -g pnpm bun && \
- apt-get install -y watchman && \
+ apt-get install -y nodejs && \
+ corepack enable && corepack prepare pnpm@9.12.0 --activate && \
+ curl -fsSL https://bun.sh/install | bash -s -- && \
+ mv /root/.bun/bin/bun /usr/local/bin/bun && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*If you prefer image-based install, switch the build stage to FROM oven/bun:latest and drop the curl step.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In apps/frontend/Dockerfile around lines 5-11, the Dockerfile is attempting to
install Bun with `npm i -g bun` (which is not the Bun runtime) and also globally
installs pnpm with npm; replace that with a proper Bun installation or switch to
an oven/bun base image. Fix by either (A) keep your current base image, remove
`npm i -g bun`, install Bun using the official installer (curl -fsSL
https://bun.sh/install.sh | bash) and enable Corepack to provide pnpm (use
corepack enable && corepack prepare pnpm@latest --activate), or (B) change the
build stage to `FROM oven/bun:latest` and drop the Bun install/curl/node setup
entirely while ensuring pnpm is provided by Corepack or installed as needed.
Ensure you also remove the incorrect `npm i -g bun` line and keep apt cleanup
steps.
|
|
||
| # install phase | ||
| COPY . . | ||
| RUN pnpm install --prefer-frozen-lockfile |
There was a problem hiding this comment.
Reproducibility: use --frozen-lockfile instead of --prefer-frozen-lockfile.
Fail fast when the lockfile is out of sync.
-RUN pnpm install --prefer-frozen-lockfile
+RUN pnpm install --frozen-lockfile🤖 Prompt for AI Agents
In apps/frontend/Dockerfile around line 17, replace the pnpm install flag
--prefer-frozen-lockfile with --frozen-lockfile so the build fails immediately
if the lockfile is out of sync; update the RUN pnpm install command to use
--frozen-lockfile to enforce reproducible installs.
| ENV NODE_ENV=production | ||
| CMD ["./server"] | ||
| # ENTRYPOINT [ "sh" ] | ||
| EXPOSE 3000 No newline at end of file |
There was a problem hiding this comment.
Port alignment.
EXPOSE 3000 is fine if the app reads PORT and defaults to 3000 (see server.ts patch). If you keep 4000, change this to EXPOSE 4000.
-EXPOSE 3000
+# If server defaults to 3000 (recommended), keep this:
+EXPOSE 3000
+# Otherwise, align with your chosen default:
+# EXPOSE 4000📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| EXPOSE 3000 | |
| # If server defaults to 3000 (recommended), keep this: | |
| EXPOSE 3000 | |
| # Otherwise, align with your chosen default: | |
| # EXPOSE 4000 |
🤖 Prompt for AI Agents
In apps/frontend/Dockerfile around line 33, the exposed port (EXPOSE 3000)
doesn't match the application's configured runtime PORT (4000); update the
Dockerfile to EXPOSE 4000 so the container metadata aligns with the server's
default, or alternatively ensure the app defaults to 3000 and reads PORT if you
prefer to keep EXPOSE 3000.
| const handler = createRequestHandler(path.join(import.meta.dir, "dist/server")); | ||
|
|
||
| const server = Bun.serve({ | ||
| port: 4000, |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
🧩 Analysis chain
Make the port configurable (align with container platforms and EXPOSE).
Default to 3000 and read PORT from env.
- port: 4000,
+ port: Number(Bun.env.PORT ?? process.env.PORT ?? "3000"),Run to verify no other hardcoded ports remain:
🏁 Script executed:
#!/bin/bash
rg -nP -C2 '(Bun\.serve\(|process\.env\.PORT|Bun\.env\.PORT|EXPOSE\s+\d+|:\d{2,5}\b)' .Length of output: 4364
Parameterize the frontend port and align Docker configuration
--- a/apps/frontend/server.ts
+++ b/apps/frontend/server.ts
- port: 4000,
+ port: Number(Bun.env.PORT ?? process.env.PORT ?? "3000"), - Update
EXPOSEinapps/frontend/Dockerfile(currentlyEXPOSE 3000) to match the new default and document that it reflects$PORT(default 3000). - Replace hardcoded host bindings in
docker/docker-compose.dev.ymlanddocker/docker-compose.prod.yml(e.g."3000:3000") with a variable-driven syntax, such as:ports: - "${PORT:-3000}:3000"
- Audit any README examples (e.g.
apps/api/README.mdreferences to http://localhost:3000/) to ensure they reflect the configurable port.
🤖 Prompt for AI Agents
In apps/frontend/server.ts around line 8, the port is hardcoded to 4000; change
it to read from process.env.PORT with a default of 3000 (e.g. use
Number(process.env.PORT) || 3000) so the runtime port is parameterized; then
update apps/frontend/Dockerfile EXPOSE to 3000 and document that it reflects
$PORT (default 3000); replace hardcoded host bindings in
docker/docker-compose.dev.yml and docker/docker-compose.prod.yml to use
variable-driven syntax like "${PORT:-3000}:3000"; finally audit README examples
(e.g. apps/api/README.md) and any other docs or scripts referencing
http://localhost:3000 to ensure they reflect the configurable PORT or note the
default.
| "/_expo/static/*": async (request) => { | ||
| const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`); | ||
| const exists = await file.exists(); | ||
| return exists | ||
| ? new Response(file) | ||
| : new Response("Not found", { status: 404 }); | ||
| }, |
There was a problem hiding this comment.
Harden static serving against path traversal.
Sanitize the path, anchor it to an allow‑listed base, and forbid escapes.
- const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`);
- const exists = await file.exists();
- return exists
- ? new Response(file)
- : new Response("Not found", { status: 404 });
+ const url = new URL(request.url);
+ const rel = path.posix.normalize(url.pathname.replace(/^\/_expo\/static\//, ""));
+ const base = path.join(import.meta.dir, "dist/client/_expo/static");
+ const full = path.join(base, rel);
+ if (!full.startsWith(base)) return new Response("Forbidden", { status: 403 });
+ const file = Bun.file(full);
+ const exists = await file.exists();
+ return exists ? new Response(file) : new Response("Not found", { status: 404 });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "/_expo/static/*": async (request) => { | |
| const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`); | |
| const exists = await file.exists(); | |
| return exists | |
| ? new Response(file) | |
| : new Response("Not found", { status: 404 }); | |
| }, | |
| "/_expo/static/*": async (request) => { | |
| const url = new URL(request.url); | |
| const rel = path.posix.normalize( | |
| url.pathname.replace(/^\/_expo\/static\//, "") | |
| ); | |
| const base = path.join(import.meta.dir, "dist/client/_expo/static"); | |
| const full = path.join(base, rel); | |
| if (!full.startsWith(base)) { | |
| return new Response("Forbidden", { status: 403 }); | |
| } | |
| const file = Bun.file(full); | |
| const exists = await file.exists(); | |
| return exists | |
| ? new Response(file) | |
| : new Response("Not found", { status: 404 }); | |
| }, |
🤖 Prompt for AI Agents
In apps/frontend/server.ts around lines 10 to 16, the static file handler uses
the raw request pathname and is vulnerable to path‑traversal; sanitize and
anchor the requested path before reading files. Extract and decode the URL
pathname, remove any null bytes, normalize and strip any leading "/" segments,
and reject requests containing ".." or other traversal sequences; then resolve
the final filesystem path against the server's base directory (./dist/client)
using a proper path resolution function and verify the resolved path starts with
the absolute base directory. If the resolved path is outside the base, return
403; otherwise serve the file. Ensure all checks run before Bun.file or
file.exists are called.
| "/assets/*": async (request) => { | ||
| const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`); | ||
| const exists = await file.exists(); | ||
| return exists | ||
| ? new Response(file) | ||
| : new Response("Not found", { status: 404 }); | ||
| }, |
There was a problem hiding this comment.
Repeat the traversal guard for the /assets/ route.*
- const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`);
- const exists = await file.exists();
- return exists
- ? new Response(file)
- : new Response("Not found", { status: 404 });
+ const url = new URL(request.url);
+ const rel = path.posix.normalize(url.pathname.replace(/^\/assets\//, ""));
+ const base = path.join(import.meta.dir, "dist/client/assets");
+ const full = path.join(base, rel);
+ if (!full.startsWith(base)) return new Response("Forbidden", { status: 403 });
+ const file = Bun.file(full);
+ const exists = await file.exists();
+ return exists ? new Response(file) : new Response("Not found", { status: 404 });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "/assets/*": async (request) => { | |
| const file = Bun.file(`./dist/client/${new URL(request.url).pathname}`); | |
| const exists = await file.exists(); | |
| return exists | |
| ? new Response(file) | |
| : new Response("Not found", { status: 404 }); | |
| }, | |
| "/assets/*": async (request) => { | |
| const url = new URL(request.url); | |
| const rel = path.posix.normalize(url.pathname.replace(/^\/assets\//, "")); | |
| const base = path.join(import.meta.dir, "dist/client/assets"); | |
| const full = path.join(base, rel); | |
| if (!full.startsWith(base)) return new Response("Forbidden", { status: 403 }); | |
| const file = Bun.file(full); | |
| const exists = await file.exists(); | |
| return exists ? new Response(file) : new Response("Not found", { status: 404 }); | |
| }, |
🤖 Prompt for AI Agents
In apps/frontend/server.ts around lines 17 to 23, the /assets/* handler
currently constructs a file path directly from request.url which allows path
traversal; sanitize and validate the request path before reading files: parse
and decode the URL pathname, ensure it begins with "/assets/" and does not
contain ".." or null bytes, normalize the path and compute a resolved path under
the intended base directory (./dist/client), then check that the resolved path
still resides inside that base (reject if not) before calling Bun.file and
file.exists(); return 404 or 400 for invalid/suspicious paths.
| "/*": async (request) => await handler(request), | ||
| "/canvaskit.wasm": async (_request) => { | ||
| const file = Bun.file("./dist/client/canvaskit.wasm"); | ||
| const exists = await file.exists(); | ||
| return exists | ||
| ? new Response(file) | ||
| : new Response("Not found here", { status: 404 }); | ||
| }, |
There was a problem hiding this comment.
Fix route precedence: catch‑all "/*" currently shadows "/canvaskit.wasm".
Place the specific route before the catch‑all, and set the correct MIME type for WASM.
- "/*": async (request) => await handler(request),
- "/canvaskit.wasm": async (_request) => {
+ "/canvaskit.wasm": async (_request) => {
const file = Bun.file("./dist/client/canvaskit.wasm");
const exists = await file.exists();
return exists
- ? new Response(file)
- : new Response("Not found here", { status: 404 });
- },
+ ? new Response(file, { headers: { "Content-Type": "application/wasm" } })
+ : new Response("Not found", { status: 404 });
+ },
+ "/*": handler,📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "/*": async (request) => await handler(request), | |
| "/canvaskit.wasm": async (_request) => { | |
| const file = Bun.file("./dist/client/canvaskit.wasm"); | |
| const exists = await file.exists(); | |
| return exists | |
| ? new Response(file) | |
| : new Response("Not found here", { status: 404 }); | |
| }, | |
| "/canvaskit.wasm": async (_request) => { | |
| const file = Bun.file("./dist/client/canvaskit.wasm"); | |
| const exists = await file.exists(); | |
| return exists | |
| ? new Response(file, { headers: { "Content-Type": "application/wasm" } }) | |
| : new Response("Not found", { status: 404 }); | |
| }, | |
| "/*": handler, |
🤖 Prompt for AI Agents
In apps/frontend/server.ts around lines 24 to 31, the catch‑all route "/*" is
registered before the specific "/canvaskit.wasm" route which causes the WASM
route to be shadowed; move the "/canvaskit.wasm" handler above the "/*" handler,
and when returning the file respond with the correct MIME type by adding a
Content-Type: application/wasm header (and a 404 response for missing file).
Ensure the route ordering is exact so specific routes are evaluated before the
catch‑all.
| EXPO_PUBLIC_API_URL: z.string(), | ||
| EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100), | ||
| }); | ||
|
|
||
| export const env = envSchema.parse({ | ||
| EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL, | ||
| EXPO_PUBLIC_STORAGE_PREFIX: process.env.EXPO_PUBLIC_STORAGE_PREFIX, | ||
| EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL, | ||
| EXPO_PUBLIC_STORAGE_PREFIX: process.env.EXPO_PUBLIC_STORAGE_PREFIX, |
There was a problem hiding this comment.
Keep URL validation for EXPO_PUBLIC_API_URL.
Relaxing the validator from z.url() to z.string() lets malformed values (e.g., missing scheme or stray text) pass parse-time checks and fail later when the app builds requests. That’s a reliability regression; we should continue enforcing a proper URL (or explicitly handle the alternative formats you need with a union that still rejects invalid data). Please reinstate the stricter validation or replace it with an equivalent guard.
Consider reverting to the previous logic:
- EXPO_PUBLIC_API_URL: z.string(),
+ EXPO_PUBLIC_API_URL: z.string().url(),📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| EXPO_PUBLIC_API_URL: z.string(), | |
| EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100), | |
| }); | |
| export const env = envSchema.parse({ | |
| EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL, | |
| EXPO_PUBLIC_STORAGE_PREFIX: process.env.EXPO_PUBLIC_STORAGE_PREFIX, | |
| EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL, | |
| EXPO_PUBLIC_STORAGE_PREFIX: process.env.EXPO_PUBLIC_STORAGE_PREFIX, | |
| const envSchema = z.object({ | |
| EXPO_PUBLIC_API_URL: z.string().url(), | |
| EXPO_PUBLIC_STORAGE_PREFIX: z.string().min(2).max(100), | |
| }); | |
| export const env = envSchema.parse({ | |
| EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL, | |
| EXPO_PUBLIC_STORAGE_PREFIX: process.env.EXPO_PUBLIC_STORAGE_PREFIX, | |
| }); |
🤖 Prompt for AI Agents
In apps/frontend/src/config/env.ts around lines 4 to 10, the schema relaxed
EXPO_PUBLIC_API_URL from a URL-validated type to a plain string which allows
malformed values; restore strict URL validation by changing the schema for
EXPO_PUBLIC_API_URL back to a URL validator (e.g., z.string().url() or z.url())
so parse-time validation rejects invalid URLs, or if you must accept alternate
formats implement an explicit union (e.g.,
z.string().url().or(z.string().regex(...))) that still rejects malformed data
and keeps strong validation at parse time.
| # Define a catalog of version ranges. | ||
| catalog: | ||
| "@biomejs/biome": "2.2.2" | ||
| "typescript": "5.9.2" | ||
| "zod": "^4.0.17" |
There was a problem hiding this comment.
🧩 Analysis chain
Ensure CI/tooling uses pnpm that supports catalog:.
catalog: requires recent pnpm (v9+). Verify root packageManager and CI action versions to prevent resolver mismatches.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Root packageManager (expect pnpm@9+):"
fd -E node_modules -HI --max-depth 1 package.json -x jq -r '.packageManager // empty' {} 2>/dev/null | head -n1
echo -e "\nWorkflows referencing pnpm/setup or corepack:"
rg -n --glob '.github/**' -C2 'pnpm/action-setup|corepack|setup-node|pnpm@'
echo -e "\nCheck for explicit pnpm version pins in Docker/Nix/README:"
rg -n -C1 'pnpm@|corepack enable pnpm' -g '!**/node_modules/**'Length of output: 233
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Root packageManager in package.json (expect pnpm@9+):"
jq -r '.packageManager // empty' package.json 2>/dev/null || echo "(none found)"
echo -e "\nCI workflows referencing pnpm:"
rg -n --heading --context 2 'uses:.*pnpm' .github/workflows
echo -e "\nAny corepack enable pnpm or pinned pnpm versions elsewhere:"
rg -n --heading --context 1 'corepack enable pnpm|pnpm@' -g '!(node_modules)/**/*'Length of output: 85
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1. Searching for package.json files (up to depth 3):"
find . -maxdepth 3 -type f -name 'package.json'
echo -e "\n2. Inspecting root package.json (first 50 lines):"
if [ -f package.json ]; then
sed -n '1,50p' package.json
else
echo "No root package.json found"
fi
echo -e "\n3. Listing CI config files:"
find . -maxdepth 2 \
\( -path './.github/workflows/*' -o -path './.circleci/*' -o -name '.travis.yml' -o -name 'Jenkinsfile' -o -name '.gitlab-ci.yml' \) \
-type f || echo "(none found)"
echo -e "\n4. Searching for any pnpm references across repo:"
grep -R -n 'pnpm' . || echo "(none found)"Length of output: 1545
Enforce pnpm v9+ for catalog:
- Add
"packageManager": "pnpm@9.x"to the root package.json - Pin pnpm v9+ in any CI or Docker/Nix flows (e.g. via
pnpm/action-setup@v2orcorepack enable pnpm@9)
🤖 Prompt for AI Agents
In pnpm-workspace.yaml around lines 5 to 9, the repo uses a pnpm catalog but
does not enforce a minimum pnpm v9 runtime; add "packageManager": "pnpm@9.x" to
the root package.json to lock the workspace to pnpm v9+, and update
CI/Docker/Nix flows to pin or enable pnpm v9 (e.g. use pnpm/action-setup@v2 with
version: '9', or run corepack enable pnpm@9 in Dockerfile, or pin pnpm in Nix
config) so all environments use pnpm v9+ consistently.
1 participant
Introduce pnpm workspace configuration for better package management and refactor the code structure to enhance readability and maintainability.
Summary by Sourcery
Configure pnpm workspaces and refactor the monorepo structure to centralize dependency management and streamline frontend build and deployment
New Features:
Enhancements:
Chores: