feat(workbench): setup

[gu-stav]

Description

Note

Please ignore this PR. It's just open to have visibility into the state of the feature branch.

What to review

Testing

Notes for release

[claude]

Claude finished @gu-stav's task in 5m 1s —— View job

---

Review

• Gather context
• Analyze diff and key changed files
• Review changesets
• Post findings

---

startWorkbenchDevServer.ts:98 — Lock leaked if resolveOrganizationId throws

If resolveOrganizationId throws (e.g. no project configured), the workbench lock was already acquired but is never released. Subsequent runs in the same process lifetime would find the lock valid (same PID, still alive) and silently skip the workbench.

// startWorkbenchDevServer.ts
const workbenchLock = acquireWorkbenchLock(...)
// workbenchLock is held at this point

const organizationId = await resolveOrganizationId(cliConfig)  // ← can throw, lock not released

Fix: wrap in try/catch and call workbenchLock.release() on error, similar to the server.listen() error path at line 151.

Fix this →

---

extractDevServerManifest.ts:28 — Return type includes undefined but is unreachable

extractStudioManifest declares Promise<StudioManifest | undefined> but either throws or returns a parsed value — it never returns undefined. The type misleads callers into thinking extraction can silently produce no result.

export async function extractStudioManifest(...): Promise<StudioManifest | undefined> {
  await extractManifest(...)
  const raw = await readFile(...)  // throws if file missing
  return JSON.parse(raw)           // never undefined
}

Remove | undefined from the return type, or explicitly handle the missing-file case.

---

devAction.ts:124 — Unhandled promise in signal handler

closeWorkbenchServer() returns a Promise<void> but is called without void or await, which will trigger no-floating-promises lint rules:

onSignal = () => {
  cleanupManifest()
  void stopManifestWatcher()
  closeWorkbenchServer()          // ← missing void
  process.off('SIGINT', onSignal!)

Change to void closeWorkbenchServer() to make the intentional fire-and-forget explicit.

---

getViteConfig.ts — Known non-null assertion on relativeConfigLocation

studioConfigPath: entries.relativeConfigLocation!,  // TODO: fix this non-null assertion

relativeConfigLocation is null when tryFindStudioConfigPath finds no sanity.config.(ts|js). For federation builds of studios without a detectable config, viteFederation would receive undefined as studioConfigPath. This should be validated before the federation build path is taken, rather than deferred.

---

Changeset issues

pr-1028.md — Summary uses a commit message prefix: fix(workbench): add \__mf__temp` directory to .gitignore. Changeset summaries should be a plain user-facing sentence without conventional-commit prefixes. Also: a .gitignore`-only change does not affect runtime behavior; this changeset is unnecessary.

pr-988.md — Typo: "add promt for federation" → "add prompt for federation".

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (737ab0b3)

@sanity/cli

Metric	Value	vs main (737ab0b)
Internal (raw)	2.1 KB	+8 B, +0.4%
Internal (gzip)	801 B	+2 B, +0.3%
Bundled (raw)	10.94 MB	+176 B, +0.0%
Bundled (gzip)	2.05 MB	+57 B, +0.0%
Import time	829ms	-8ms, -0.9%

bin:sanity

Metric	Value	vs main (737ab0b)
Internal (raw)	975 B	-
Internal (gzip)	460 B	-
Bundled (raw)	9.84 MB	-
Bundled (gzip)	1.77 MB	-
Import time	2.32s	+318ms, +15.9% ⚠️

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (737ab0b3)

Metric	Value	vs main (737ab0b)
Internal (raw)	96.3 KB	+3.2 KB, +3.4%
Internal (gzip)	22.6 KB	+688 B, +3.1%
Bundled (raw)	21.62 MB	+2.9 KB, +0.0%
Bundled (gzip)	3.42 MB	+701 B, +0.0%
Import time	800ms	+12ms, +1.5%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (737ab0b3)

Metric	Value	vs main (737ab0b)
Internal (raw)	976 B	-
Internal (gzip)	507 B	-
Bundled (raw)	50.7 KB	-
Bundled (gzip)	12.6 KB	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

File	Statements
packages/@sanity/cli-core/src/config/cli/getCliConfig.ts	100.0% (±0%)
packages/@sanity/cli-core/src/config/cli/schemas.ts	100.0% (±0%)
packages/@sanity/cli-core/src/services/cliUserConfig.ts	100.0% (±0%)
packages/@sanity/cli-core/src/util/getSanityConfigDir.ts	66.7% (new)
packages/@sanity/cli/src/actions/build/buildApp.ts	95.1% (±0%)
packages/@sanity/cli/src/actions/build/buildStaticFiles.ts	97.6% (+ 1.0%)
packages/@sanity/cli/src/actions/build/buildStudio.ts	96.5% (±0%)
packages/@sanity/cli/src/actions/build/buildVendorDependencies.ts	67.4% (±0%)
packages/@sanity/cli/src/actions/build/getViteConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/build/writeSanityRuntime.ts	96.0% (+ 0.8%)
packages/@sanity/cli/src/actions/deploy/deployApp.ts	80.5% (±0%)
packages/@sanity/cli/src/actions/dev/devAction.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/dev/devServerRegistry.ts	93.5% (new)
packages/@sanity/cli/src/actions/dev/extractDevServerManifest.ts	20.0% (new)
packages/@sanity/cli/src/actions/dev/getDevServerConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/dev/startAppDevServer.ts	100.0% (+ 13.0%)
packages/@sanity/cli/src/actions/dev/startDevManifestWatcher.ts	90.9% (new)
packages/@sanity/cli/src/actions/dev/startStudioDevServer.ts	100.0% (+ 5.0%)
packages/@sanity/cli/src/actions/dev/startWorkbenchDevServer.ts	100.0% (new)
packages/@sanity/cli/src/actions/dev/writeWorkbenchRuntime.ts	100.0% (new)
packages/@sanity/cli/src/actions/init/bootstrapLocalTemplate.ts	89.7% (±0%)
packages/@sanity/cli/src/actions/init/bootstrapTemplate.ts	0.0% (±0%)
packages/@sanity/cli/src/actions/init/createAppCliConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/init/createCliConfig.ts	100.0% (+ 50.0%)
packages/@sanity/cli/src/actions/init/createStudioConfig.ts	83.3% (±0%)
packages/@sanity/cli/src/actions/init/initAction.ts	97.2% (+ 0.1%)
packages/@sanity/cli/src/actions/init/scaffoldTemplate.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/init/types.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/extractCoreAppManifest.ts	93.1% (new)
packages/@sanity/cli/src/actions/manifest/extractManifest.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/types.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/writeManifestFile.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/dev.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/init.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/manifest/extract.ts	100.0% (±0%)
packages/@sanity/cli/src/constants.ts	100.0% (new)
packages/@sanity/cli/src/prompts/init/federation.ts	100.0% (new)
packages/@sanity/cli/src/server/devServer.ts	94.1% (±0%)
packages/@sanity/cli/src/services/userApplications.ts	92.8% (±0%)

Comparing 39 changed files against main @ 737ab0b3fdee054b76a4262635097637a1ebd6a2

Overall Coverage

Metric	Coverage
Statements	84.5% (+ 0.3%)
Branches	74.5% (+ 0.4%)
Functions	84.4% (+ 0.4%)
Lines	85.0% (+ 0.3%)

[github-actions]

Preview this PR with pkg.pr.new

Run the Sanity CLI

npx https://pkg.pr.new/sanity-io/cli/@sanity/cli@236d11c <command>

...Or upgrade project dependencies

📦 @sanity/cli

pnpm install https://pkg.pr.new/@sanity/cli@236d11c

📦 @sanity/cli-core

pnpm install https://pkg.pr.new/@sanity/cli-core@236d11c

📦 @sanity/cli-test

pnpm install https://pkg.pr.new/@sanity/cli-test@236d11c

📦 @sanity/eslint-config-cli

pnpm install https://pkg.pr.new/@sanity/eslint-config-cli@236d11c

View Commit (236d11c)

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[gu-stav]

The axios security warning will be resolved by module-federation/core#4644 I think

[gu-stav]

Rebased onto main