Summary
Surfaced during the round-3 review of PR #1788 (#1778). All five package.json files (root + clients/web/cli/tui/launcher) declare prettier as ^3.8.1 — a caret range — while the lockfiles resolve 3.8.4, which is what CI runs (.github/workflows/main.yml uses lockfile-honoring npm install). So the format gate is green today.
The problem is latent: current prettier@latest (3.9.6) also satisfies ^3.8.1, and under it 10 already-gated files become dirty:
core/auth/challenge.ts
core/auth/connection-state.ts
core/auth/oauthUx.ts
core/mcp/__tests__/fakeInspectorClient.ts
core/mcp/types.ts
core/mcp/urlElicitation.ts
clients/web/src/test/core/mcp/state/fetchRequestLogState.test.ts
clients/web/src/test/integration/mcp/mcp-app-demo.test.ts
clients/web/src/types/navigation.ts
clients/web/src/utils/oauthNetworkPhase.ts
So a npm update, a dependabot bump, or a regenerated lockfile would fail format:check:core and web's format:check on files nobody touched — a gate verdict that depends on which in-range patch happens to be installed.
Note: the scopes newly gated by #1788 (scripts/** and clients/web/server + top-level configs) are already drift-free — the exposure is entirely in scopes gated before it.
Proposal
Either:
- Pin prettier to an exact version in all five
package.json files (drop the caret), so the gate's verdict is deterministic across installs; or
- Bump to 3.9.x and run
npm run format once to normalize the 10 files, then pin.
Pinning is the smaller change and directly makes the format gate trustworthy regardless of install timing. Natural companion to #1789.
Notes
Summary
Surfaced during the round-3 review of PR #1788 (#1778). All five
package.jsonfiles (root +clients/web/cli/tui/launcher) declare prettier as^3.8.1— a caret range — while the lockfiles resolve 3.8.4, which is what CI runs (.github/workflows/main.ymluses lockfile-honoringnpm install). So the format gate is green today.The problem is latent: current
prettier@latest(3.9.6) also satisfies^3.8.1, and under it 10 already-gated files become dirty:So a
npm update, a dependabot bump, or a regenerated lockfile would failformat:check:coreand web'sformat:checkon files nobody touched — a gate verdict that depends on which in-range patch happens to be installed.Note: the scopes newly gated by #1788 (
scripts/**andclients/web/server+ top-level configs) are already drift-free — the exposure is entirely in scopes gated before it.Proposal
Either:
package.jsonfiles (drop the caret), so the gate's verdict is deterministic across installs; ornpm run formatonce to normalize the 10 files, then pin.Pinning is the smaller change and directly makes the format gate trustworthy regardless of install timing. Natural companion to #1789.
Notes