fix(init): recognise a corepack-only package manager instead of refusing it by drakeo338 · Pull Request #1183 · reticlehq/reticle

drakeo338 · 2026-09-28T22:11:14Z

What & why

preflightRefusal only probed the bare <pm> binary, so a machine where packageManager can only be run through corepack (no pnpm on PATH, only corepack pnpm) was told "pnpm is not installed" even though corepack pnpm --version succeeds — and the suggested fix, corepack enable, needs an elevated shell on Windows, so the refusal sent that user in a circle.

init now also probes corepack <pm>, resolves the invocation exactly once (one probe, not two), and threads whichever prefix actually answers through the install exec, its retry ladder, the install-failure hint's remedy commands, the dev command, and node-io's allowlist. The refusal text no longer suggests corepack right after saying corepack already failed.

Closes #1149

How it was verified

New/updated tests in preflight.test.ts, install-retries.test.ts and install-hint.test.ts, each failing on the pre-fix code.

Gates run

pnpm lint && pnpm typecheck && pnpm test:unit (~2 min — always)
pnpm test:e2e (~8 min) — touched the tool surface, core, an observer, or telemetry
pnpm gate:install (~15 min) — touched reticle init, vite-plugin, next, or babel-plugin
pnpm test:e2e:desktop (~3 min) — touched adapters/realm/electron, adapters/realm/tauri, or desktop capture
None of the above tiers apply to this change

Checklist

Every commit is signed off (git commit -s) — CI's DCO check fails the PR without it. Already pushed? git rebase --signoff origin/main && git push --force-with-lease
Tests added/updated (RED → GREEN); the change is covered by a test that would fail without it
No any, no free strings (wire strings live in @reticlehq/core), no non-null !
No console.log or internal tracking codes left in the diff
Each changed file is under the 1000-line cap
Docs updated, and a user-facing change adds a new file under .changes/ (never edit CHANGELOG.md — that file is assembled at release time, and editing it is what makes PRs conflict; format in .changes/README.md) — added .changes/1149-corepack-pm-probe.md
Security-affecting? Auth/redaction/trust-boundary changes keep the localhost-only, no-app-data-leaves-the-machine, no-arbitrary-JS posture (usage telemetry stays anonymous + opt-out per docs/telemetry.md) and are covered by a test — N/A, this only changes which local package-manager binary init shells out to

…ing it `preflightRefusal` probed only the bare `<pm>` binary, so a machine where `packageManager` can only be run through corepack (no `pnpm` on PATH, only `corepack pnpm`) was refused as "pnpm is not installed" even though `corepack pnpm --version` succeeds. The suggested remedy, `corepack enable`, needs an elevated shell on Windows, so the refusal sent a corepack-managed user in a circle (reticlehq#1149). `init` now also probes `corepack <pm>` before refusing, and threads whichever prefix actually answered through to every place that invokes the package manager for the rest of the run: the dependency-install exec and its retry ladder, the dev-command string that gets printed and later spawned, the install-failure hint's suggested remedy commands, and node-io's closed RUNNABLE_COMMANDS allowlist, which now names `corepack` as a program init is allowed to spawn. Preflight resolves the invocation exactly once: it either hands back the command every later step should use, or the refusal to print, from the same probe — replacing two separate probing passes (one to decide whether to refuse, one to learn what the resolved command was) with one. The refusal text no longer suggests running the package manager through corepack right after saying corepack already failed to. Reverting the preflight.ts and detect/dev-script.ts changes locally and running the new tests confirms they fail without this change, per CONTRIBUTING.md's AI-assisted-contributions note. Closes reticlehq#1149 Signed-off-by: drakeo338 <paranoyouz@gmail.com>

github-actions · 2026-09-28T22:11:24Z

Thanks for your first pull request to Reticle! A maintainer aims to review within two days. Before then, pnpm verify locally catches most of what CI will, and CONTRIBUTING.md explains the rest. If CI does not start, a maintainer needs to approve it for first-time contributors; that is normal.

greptile-apps · 2026-09-28T22:14:34Z

Confidence Score: 4/5

[Medium risk] Adds corepack support to package manager detection and invocation.

The PR appears safe to merge, with non-blocking preflight and refusal-message improvements worth making.

Findings

Unnecessary probe with --url ▶
Contradictory corepack recovery advice ▶

Summary

The PR lets init use a package manager through corepack when its bare binary is unavailable.

Threads the resolved invocation through dependency installation, retries, failure guidance, and the dev command.
Extends the executable allowlist and adds focused preflight and retry tests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Preflight] --> B{Checkout writable?}
  B -- No --> R[Refuse]
  B -- Yes --> C{Bare manager responds?}
  C -- Yes --> D[Use bare manager]
  C -- No --> E{Corepack manager responds?}
  E -- Yes --> F[Use corepack prefix]
  E -- No --> G{Already served via URL?}
  G -- Yes --> H[Continue with bare command]
  G -- No --> R
  D --> I[Build install plan and dev command]
  F --> I
  H --> I

_{Reviews (1) · Last reviewed commit: "fix(init): recognise a corepack-only pac..."}

greptile-apps · 2026-09-28T22:14:37Z

+        'a capabilities file). Fix the permissions, or run init from a checkout you own.',
+    };
  }
+  const resolved = resolvedPmCommand(io, packageManager);


Unnecessary probe with --url When --url says the app is already served, preflight still probes the package manager before checking alreadyServed. On a corepack-only machine, this runs corepack <pm> --version synchronously and silently. If corepack needs time to resolve the manager, an init run that does not need to start the dev server is delayed.

greptile-apps · 2026-09-28T22:14:37Z

+      `installed on this machine — and corepack ${packageManager} could not run it either. Install ` +
+      `it (npm i -g ${packageManager}), or enable corepack for it (corepack enable — on Windows this ` +
+      'needs an elevated shell), or pass --url with the address the app already serves.',


Contradictory corepack recovery advice This refusal says corepack <pm> could not run the manager, then recommends corepack enable. Enabling shims does not address the failed corepack invocation, so the advice can send users to retry an approach the check has already ruled out.

Signed-off-by: drakeo338 <paranoyouz@gmail.com>

The note that preflight takes the package manager init resolved (not a raw lockfile check), and the field report behind the --url tests. Comments only. Signed-off-by: Divyanshu Shekhar <imdshekhar@gmail.com>

drakeo338 requested a review from divshekhar as a code owner September 28, 2026 22:11

github-actions Bot added the area/docs Documentation and docs site label Sep 28, 2026

greptile-apps Bot reviewed Sep 28, 2026

View reviewed changes

drakeo338 and others added 2 commits September 29, 2026 09:21

Format install-retries.ts with Prettier

660a1ec

Signed-off-by: drakeo338 <paranoyouz@gmail.com>

docs(init): restore two rationale comments the refactor dropped

0a43a15

The note that preflight takes the package manager init resolved (not a raw lockfile check), and the field report behind the --url tests. Comments only. Signed-off-by: Divyanshu Shekhar <imdshekhar@gmail.com>

divshekhar enabled auto-merge September 29, 2026 16:50

divshekhar added this pull request to the merge queue Sep 29, 2026

Merged via the queue into reticlehq:main with commit ad2dbd2 Sep 29, 2026
29 of 30 checks passed

Navigation Menu

fix(init): recognise a corepack-only package manager instead of refusing it - #1183

fix(init): recognise a corepack-only package manager instead of refusing it#1183
divshekhar merged 3 commits into
reticlehq:mainfrom
drakeo338:claude/1149-fix-v2

drakeo338 commented Sep 28, 2026

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

greptile-apps Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Sep 28, 2026

Uh oh!

greptile-apps Bot Sep 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

drakeo338 commented Sep 28, 2026

What & why

How it was verified

Gates run

Checklist

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

greptile-apps Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

greptile-apps Bot Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Sep 28, 2026 •

edited

Loading