Fix global multi-format installs#268
Conversation
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:L
🤖 My Senior Dev — Analysis Complete👤 For @khaliqgant📁 Expert in View your contributor analytics → 📊 7 files reviewed • 3 high risk • 1 need attention 🚨 High Risk:
🚀 Open Interactive Review →The full interface unlocks features not available in GitHub:
💬 Chat here: 📖 View all 12 personas & slash commandsYou can interact with me by mentioning In PR comments or on any line of code:
Slash commands:
AI Personas (mention to get their perspective):
For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews. |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| await handleInstall(`${packageId}@${latestVersion}`, { | ||
| as: targetFormat, | ||
| global: pkg.global, | ||
| }); |
There was a problem hiding this comment.
Suggestion: Update only forwards pkg.global, which breaks preservation of global installs from existing lockfiles that don't have this new field populated (for example older MCP/plugin entries that tracked globalness in metadata). Those packages will be reinstalled as local during update. Add a fallback based on existing metadata/key location when pkg.global is undefined. [logic error]
Severity Level: Major ⚠️
- ❌ Global MCP installs updated as local via `prpm update`.
- ⚠️ Duplicate MCP configs in global and local config files.
- ⚠️ Editors may read stale global config instead of updated one.
- ⚠️ Behavior differs from original global install user intent.Steps of Reproduction ✅
1. In a project, install an MCP server package for a global-only editor without using
`--global`, e.g. `prpm install my-mcp-server --as windsorf`. The CLI entrypoint
`createInstallCommand` in `packages/cli/src/commands/install.ts:95-176` routes this to
`handleInstall()` with `options.global` unset and `editor` set to `'windsurf'` for the MCP
install loop at `install.ts:216-245`.
2. During that install, `handleInstall()` in
`packages/cli/src/commands/install.ts:226-249` detects an MCP server package and enters
the MCP branch at `install.ts:151-215`. There, `editor` is `'windsurf'` and `isGlobal` is
forced to `true` via `const isGlobal = globalOnlyEditors.includes(editor) ? true :
(options.global || false);` at `install.ts:175-179`, so MCP servers are written to the
global config path, and `pluginMetadata.mcpGlobal` is stored as `true` when
`pluginMetadata` is assigned at `install.ts:205-211`. However, the lockfile entry is
written via `addToLockfile(updatedLockfile, packageId, { ..., global: options.global, ...
});` at `install.ts:30-44`, so `LockfilePackage.global` in `prpm.lock` remains `undefined`
for this global MCP install.
3. Later, run `prpm update` in the same project. The update handler `handleUpdate()` in
`packages/cli/src/commands/update.ts:16-52` loads installed packages from the lockfile
using `listPackages()` (`packages/cli/src/core/lockfile.ts:478-487`), so the MCP package
appears with `pkg.pluginMetadata.mcpGlobal === true` but `pkg.global === undefined`.
`handleUpdate()` parses the lockfile key with `parseLockfileKey(pkg.id)` at
`update.ts:52-55`, discarding any location information, and computes `const targetFormat =
pkg.format || installedFormat;` at `update.ts:88-90`.
4. For this MCP package, `handleUpdate()` calls `handleInstall()` with `await
handleInstall(\`${packageId}@${latestVersion}\`, { as: targetFormat, global: pkg.global
});` at `packages/cli/src/commands/update.ts:91-94`. Because `pkg.global` is `undefined`,
`options.global` is now falsy inside `handleInstall()`. In the MCP branch at
`install.ts:175-189`, `editor` defaults to `'claude'` when `options.editor` is unset, so
`isGlobal` becomes `false` (`globalOnlyEditors` does not include `'claude'` and
`options.global || false` is `false`). The updated MCP servers are therefore merged into
the *local* config path via `getMCPConfigLocation(editor, isGlobal)` at
`install.ts:193-214`, while the original global config written in step 2 is left
untouched. As a result, a previously global MCP server install is effectively converted to
a local install on update, with globalness not preserved because `handleUpdate` only
forwarded `pkg.global` and did not fall back to `pluginMetadata.mcpGlobal` or any location
information from the lockfile key.Fix in Cursor | Fix in VSCode Claude
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** packages/cli/src/commands/update.ts
**Line:** 91:94
**Comment:**
*Logic Error: Update only forwards `pkg.global`, which breaks preservation of global installs from existing lockfiles that don't have this new field populated (for example older MCP/plugin entries that tracked globalness in metadata). Those packages will be reinstalled as local during update. Add a fallback based on existing metadata/key location when `pkg.global` is undefined.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
|
CodeAnt AI finished reviewing your PR. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/cli/src/commands/install.ts">
<violation number="1" location="packages/cli/src/commands/install.ts:1722">
P2: Global installs recorded in lockfile are not preserved when reinstalling from `prpm.lock` because `installFromLockfile()` does not forward `lockEntry.global` to `handleInstall`.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Addressed review feedback from cubic and CodeAnt:
Verification:
|
There was a problem hiding this comment.
1 issue found across 4 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/cli/src/commands/install.ts">
<violation number="1" location="packages/cli/src/commands/install.ts:2190">
P2: Lockfile installs ignore editor-only `--as` values because `singleAs` is not forwarded as `editor`.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Follow-up review feedback addressed in e1ed48c.\n\n- Forward editor-only |
1 participant
User description
Summary
Verification
CodeAnt-AI Description
Fix global installs for multi-format packages
What Changed
Impact
✅ Reliable global multi-format installs✅ Fewer uninstall mismatches✅ Local and global installs can coexist🔄 Retrigger CodeAnt AI Review
Details
💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.