feat(workbench): setup

[gu-stav]

Description

Note

Please ignore this PR. It's just open to have visibility into the state of the feature branch.

What to review

Testing

Notes for release

[claude]

Claude finished @gu-stav's task in 2m 29s —— View job

---

Review

• Gather context
• Review diff for issues
• Check changesets
• Post findings

---

Issues

1. Lock leak when resolveOrganizationId throws — startWorkbenchDevServer.ts

The workbench lock is acquired before resolveOrganizationId is called. If it throws (e.g. neither app.organizationId nor api.projectId is configured), the lock file is never cleaned up. Since the process is still alive, subsequent sanity dev invocations will find the lock "held" by the current process and skip starting the workbench entirely.

// startWorkbenchDevServer.ts
const workbenchLock = acquireWorkbenchLock(...)  // lock acquired here
// ...
const organizationId = await resolveOrganizationId(cliConfig)  // throws → lock leaks

Fix: release the lock before re-throwing.

let organizationId: string
try {
  organizationId = await resolveOrganizationId(cliConfig)
} catch (err) {
  workbenchLock.release()
  throw err
}

There's no test covering this failure path. Fix this →

---

2. String.replace with $ in replacement string — writeWorkbenchRuntime.ts

const indexHtml = indexHtmlTemplate.replace(/%SANITY_WORKBENCH_PREFETCH_HINTS%/, prefetchHints)

If prefetchHints contains $&, $$, $', or $` (possible if the remote URL has $ in a query param), String.prototype.replace interprets these as special replacement patterns and produces corrupted HTML. Use a replacer function to avoid this:

const indexHtml = indexHtmlTemplate.replace(/%SANITY_WORKBENCH_PREFETCH_HINTS%/, () => prefetchHints)

---

3. Non-null assertion on relativeConfigLocation — getViteConfig.ts:230

studioConfigPath: entries.relativeConfigLocation!,

relativeConfigLocation is null when no sanity.config.(ts|js) is found. The TODO comment acknowledges this, but until fixed a null config path will pass into the federation plugin and likely crash with a confusing error at runtime.

---

4. Changeset summary issues

Several changeset summaries should be updated before shipping:

File	Issue
.changeset/pr-988.md	Typo: "promt" → "prompt"; also too vague
.changeset/pr-989.md	Typo: "promt"; describes internal types, not user-facing change
.changeset/bump-federation-alpha-6.md	Describes a dep version bump — internal implementation detail
.changeset/fancy-cycles-strive.md	Describes an internal build detail ("externalize")
.changeset/pr-1042.md	Uses conventional commit prefix perf(workbench): — should be a plain sentence
.changeset/pr-1047.md	Uses conventional commit prefix fix(workbench): — should be a plain sentence

---

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (37f95779)

@sanity/cli

Metric	Value	vs main (37f9577)
Internal (raw)	2.1 KB	+8 B, +0.4%
Internal (gzip)	801 B	+2 B, +0.3%
Bundled (raw)	10.94 MB	+176 B, +0.0%
Bundled (gzip)	2.05 MB	+51 B, +0.0%
Import time	817ms	-3ms, -0.3%

bin:sanity

Metric	Value	vs main (37f9577)
Internal (raw)	975 B	-
Internal (gzip)	460 B	-
Bundled (raw)	9.84 MB	-
Bundled (gzip)	1.77 MB	-
Import time	2.25s	+323ms, +16.8% ⚠️

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (37f95779)

Metric	Value	vs main (37f9577)
Internal (raw)	96.3 KB	+3.2 KB, +3.4%
Internal (gzip)	22.6 KB	+688 B, +3.1%
Bundled (raw)	21.60 MB	+2.9 KB, +0.0%
Bundled (gzip)	3.42 MB	+729 B, +0.0%
Import time	780ms	+2ms, +0.3%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (37f95779)

Metric	Value	vs main (37f9577)
Internal (raw)	976 B	-
Internal (gzip)	507 B	-
Bundled (raw)	50.7 KB	-
Bundled (gzip)	12.6 KB	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

File	Statements
packages/@sanity/cli-core/src/config/cli/getCliConfig.ts	100.0% (±0%)
packages/@sanity/cli-core/src/config/cli/schemas.ts	100.0% (±0%)
packages/@sanity/cli-core/src/services/cliUserConfig.ts	100.0% (±0%)
packages/@sanity/cli-core/src/util/getSanityConfigDir.ts	66.7% (new)
packages/@sanity/cli/src/actions/build/buildApp.ts	95.1% (±0%)
packages/@sanity/cli/src/actions/build/buildStaticFiles.ts	97.6% (+ 1.0%)
packages/@sanity/cli/src/actions/build/buildStudio.ts	96.5% (±0%)
packages/@sanity/cli/src/actions/build/buildVendorDependencies.ts	67.4% (±0%)
packages/@sanity/cli/src/actions/build/getViteConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/build/writeSanityRuntime.ts	96.0% (+ 0.8%)
packages/@sanity/cli/src/actions/deploy/deployApp.ts	80.5% (±0%)
packages/@sanity/cli/src/actions/dev/devAction.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/dev/devServerRegistry.ts	93.5% (new)
packages/@sanity/cli/src/actions/dev/extractDevServerManifest.ts	20.0% (new)
packages/@sanity/cli/src/actions/dev/getDevServerConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/dev/startAppDevServer.ts	100.0% (+ 13.0%)
packages/@sanity/cli/src/actions/dev/startDevManifestWatcher.ts	90.9% (new)
packages/@sanity/cli/src/actions/dev/startStudioDevServer.ts	100.0% (+ 5.0%)
packages/@sanity/cli/src/actions/dev/startWorkbenchDevServer.ts	98.5% (new)
packages/@sanity/cli/src/actions/dev/writeWorkbenchRuntime.ts	100.0% (new)
packages/@sanity/cli/src/actions/init/bootstrapLocalTemplate.ts	89.7% (±0%)
packages/@sanity/cli/src/actions/init/bootstrapTemplate.ts	0.0% (±0%)
packages/@sanity/cli/src/actions/init/createAppCliConfig.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/init/createCliConfig.ts	100.0% (+ 50.0%)
packages/@sanity/cli/src/actions/init/createStudioConfig.ts	83.3% (±0%)
packages/@sanity/cli/src/actions/init/initAction.ts	97.2% (+ 0.1%)
packages/@sanity/cli/src/actions/init/scaffoldTemplate.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/init/types.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/extractCoreAppManifest.ts	93.1% (new)
packages/@sanity/cli/src/actions/manifest/extractManifest.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/types.ts	100.0% (±0%)
packages/@sanity/cli/src/actions/manifest/writeManifestFile.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/dev.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/init.ts	100.0% (±0%)
packages/@sanity/cli/src/commands/manifest/extract.ts	100.0% (±0%)
packages/@sanity/cli/src/constants.ts	100.0% (new)
packages/@sanity/cli/src/prompts/init/federation.ts	100.0% (new)
packages/@sanity/cli/src/server/devServer.ts	94.1% (±0%)
packages/@sanity/cli/src/services/userApplications.ts	92.8% (±0%)

Comparing 39 changed files against main @ 37f957796a99f7eff882d6ab0c36b25b4be39165

Overall Coverage

Metric	Coverage
Statements	84.5% (+ 0.3%)
Branches	74.5% (+ 0.4%)
Functions	84.3% (+ 0.3%)
Lines	85.0% (+ 0.4%)

[github-actions]

Preview this PR with pkg.pr.new

Run the Sanity CLI

npx https://pkg.pr.new/sanity-io/cli/@sanity/cli@1d8897a <command>

...Or upgrade project dependencies

📦 @sanity/cli

pnpm install https://pkg.pr.new/@sanity/cli@1d8897a

📦 @sanity/cli-core

pnpm install https://pkg.pr.new/@sanity/cli-core@1d8897a

📦 @sanity/cli-test

pnpm install https://pkg.pr.new/@sanity/cli-test@1d8897a

📦 @sanity/eslint-config-cli

pnpm install https://pkg.pr.new/@sanity/eslint-config-cli@1d8897a

View Commit (1d8897a)

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[gu-stav]

The axios security warning will be resolved by module-federation/core#4644 I think

[gu-stav]

Rebased onto main