Stop the consoles bundling two copies of the SDK - #210
Merged
Conversation
The deployed rbac-manager threw `useAuth must be used within a <ConfigHubAuthProvider>` on load, with the provider plainly mounted in main.tsx. There were two copies of @confighub/react-auth in the bundle. The consoles alias webkit to source, and webkit resolves its own bare imports from webkit/node_modules while the console resolves the same names from its own — so AppShell got one instance of the package and main.tsx got another, each with its own React context. The same split duplicated the whole MUI/emotion tree. resolve.dedupe fixes it, but the reason this shipped is worth more than the fix: nothing reported it. tsc passed, vite build passed, the container served, and the dev server worked — Vite pre-bundles dependencies into a single copy, so only a production build has the problem, and only its source map records it. So the check is the other half of this change. scripts/check-bundle-dedupe.mjs reads the source map and fails when one package was resolved from more than one node_modules root, ignoring ordinary nesting within a root. Removing the dedupe list from one console makes it report 24 duplicated packages, @confighub/react-auth among them. js-apps.yml runs lint, test, build, and that check for webkit and all six consoles, on every PR that touches them. Verified by loading every console's production build in a browser, and the rbac-manager container image, rather than trusting an exit code. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P9g7PRiXsoTGFMkzmeNgEJ
configboard imported `@mui/icons-material/AddChart`; the file is `Addchart.d.ts`. macOS resolves it anyway because its filesystem is case-insensitive, so this only fails on Linux — and no CI had ever built these apps on Linux. Found by the JS console workflow added in this change, on its first run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P9g7PRiXsoTGFMkzmeNgEJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the deployed rbac-manager, which throws on load:
…with the provider plainly mounted in
main.tsx.Cause
Two copies of
@confighub/react-authin the bundle. The consoles aliaswebkitto source, and webkit resolves its own bare imports from
webkit/node_moduleswhile the console resolves the same names from its own. So
AppShellgot oneinstance of the package and
main.tsxgot another — each with its own Reactcontext, so the hook could not see the provider. From the source map:
The same split duplicated the whole MUI/emotion tree.
resolve.dedupein each console's vite config fixes it.Why it shipped
Nothing reported it.
tscpassed,vite buildpassed, the container served thebundle, and the dev server worked — Vite pre-bundles dependencies into a single
copy, so only a production build has the problem, and only its source map
records it. My verification was dev-server and HTTP 200s; I never loaded a
production build in a browser.
So the check is the other half of this change:
scripts/check-bundle-dedupe.mjsreads the source map and fails when a packagewas resolved from more than one
node_modulesroot. Ordinary nesting inside oneroot (npm resolving two versions of a transitive dep) is normal and ignored.
.github/workflows/js-apps.ymlruns lint, test, build, and that check forwebkit and all six consoles on every PR that touches them. There was no CI for
the JS packages at all before this.
Removing the dedupe list from one console makes the check report 24 duplicated
packages,
@confighub/react-authamong them — so it does catch the thing it isnamed for.
Verification
Every console's production build loaded in a browser, plus the rbac-manager
container image, all rendering with no console errors — rather than trusting an
exit code.
🤖 Generated with Claude Code
https://claude.ai/code/session_01P9g7PRiXsoTGFMkzmeNgEJ