[Bug]: pnpm global-store links fail updater package verification

Open
  • Is something wrong?
#8,183 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
67/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
backend, cli

Research direction

Find verifyPnpmInstallTree and read the ownership and sentinel dependency checks; the issue says the global virtual-store link directory has neither .pnpm nor .modules.yaml. Reproduce the reported layout and run the verifier’s tests. Done means valid linked bun and zod dependencies pass while ownership and integrity checks still reject invalid installations.

Written by the indexing model from the issue text.

Description

bug install
Client or integration

Other: OpenCodex CLI

Area

Installation or packaging

Summary

ocx update rejects a working pnpm global installation before it reaches the update. The verifier reports missing Bun and Zod even though both are linked in the package's pnpm global virtual-store dependency directory and the CLI and proxy start successfully. The proxy is left running.

Reproduction
  1. Install @bitkyc08/opencodex globally with pnpm 12 using a global virtual store. In the affected installation, the active package is a symlink into store/v11/links/.../node_modules/@bitkyc08/opencodex; its sibling node_modules/bun and node_modules/zod are valid links.
  2. Start the proxy and run ocx update --tag latest.
  3. The updater reports that the active package failed verification and exits before stopping the proxy. This occurs with both 2.96.0 and 2.97.0. A direct call to verifyPnpmInstallTree reports the two missing sentinel dependencies.

Expected: the verifier recognises the package's pnpm-owned dependency links and allows a valid installation to proceed, while retaining its ownership and integrity checks.

The verifier treats an enclosing node_modules as pnpm-owned only if it contains .pnpm or .modules.yaml, or is beneath .pnpm. The affected global-store link directory has neither marker. This looks like a layout not covered by the fix in #4235. The same checks are present on main at cab7eb7d0332ae0ebb4289d7c6bac1de666b6e40; the live reproduction was on the published package, not a clean source checkout.

Version

2.96.0 and 2.97.0

Operating system

Ubuntu 24.04.5 LTS, Linux arm64, pnpm 12.16.1

Provider and model

Not applicable.

Logs or error output
opencodex: the active pnpm package failed verification; aborting before stopping the proxy.

The verifier's failure list is sentinel dependency missing: bun and sentinel dependency missing: zod.

Screenshots and supporting files

None.

Redacted configuration

pnpm global virtual-store layout as described above.

Checks
  • I searched existing issues and documentation.
  • I removed secrets, tokens, account details, request credentials, and personal data.
Dominant language
TypeScript
Stars
16.9k
Forks
1.3k
Avg merge
19h 31m
Merged PRs (30d)
676

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from lidge-jun/opencodex

All issues in lidge-jun/opencodex

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.