fix(init-stack): use correct package add commands for bun and pnpm by rsvedant · Pull Request #886 · stack-auth/stack-auth

rsvedant · 2025-09-07T07:59:34Z

Description

This PR fixes an issue where the Stack Auth init wizard incorrectly uses bun install and pnpm install when adding dependencies to a project. These commands don't work for adding new packages - they should use bun add and pnpm add respectively.

Problem

When running npx @stackframe/init-stack and selecting Bun or pnpm as the package manager, the wizard would fail to add the Stack Auth dependencies because:

bun install @stackframe/stack is invalid (should be bun add @stackframe/stack)
pnpm install @stackframe/stack is invalid (should be pnpm add @stackframe/stack)

Solution

Updated the package manager command mapping to use the correct "add" commands:

npm: npm install (unchanged)
yarn: yarn add (unchanged)
pnpm: pnpm add (fixed)
bun: bun add (fixed)

Testing

✅ Tested locally by:

Building the monorepo with the fix
Creating a fresh Next.js app with Bun
Running the patched init wizard from source
Confirming that @stackframe/stack was successfully added to package.json

Checklist

Code follows ESLint conventions (ran pnpm run lint on init-stack package)
Formatted with proper indentation and semicolons
Tests pass (memory issue in test suite unrelated to this change - init-stack has no specific tests)
No Prisma schema changes
No API changes requiring e2e tests
Dependencies are in correct package.json files
Ready for review

Related Issues

This fixes issues reported by users trying to use Bun or pnpm with the Stack Auth init wizard.

Note: This is a draft PR pending internal review before submitting to Stack Auth maintainers.

Review by RecurseML

🔍 Review performed on 9318e2b..5cc5706

✨ No bugs found, your code is sparkling clean

✅ Files analyzed, no issues (1)

• packages/init-stack/src/index.ts

Important

Fixes incorrect package manager commands in index.ts for bun and pnpm by using add instead of install.

Behavior:
- Fixes incorrect package manager commands in index.ts for bun and pnpm.
- Changes bun install to bun add and pnpm install to pnpm add.
Testing:
- Verified locally by building the monorepo, creating a Next.js app with Bun, and running the init wizard.
- Confirmed successful addition of @stackframe/stack to package.json.

^{This description was created by}^{for 5cc5706. You can customize this summary. It will automatically update as commits are pushed.}

Summary by CodeRabbit

Bug Fixes
- Ensures correct dependency installation across package managers.
- pnpm and bun now use the “add” command, updating dependencies and package.json as expected.
- Adds safer handling of package names to avoid shell-related install errors.
- npm and yarn behavior remains unchanged.

Previously, the init wizard incorrectly used 'bun install' and 'pnpm install' when adding dependencies, which doesn't work. These package managers require 'bun add' and 'pnpm add' for adding new packages. - npm: npm install (unchanged) - yarn: yarn add (unchanged) - pnpm: pnpm add (fixed) - bun: bun add (fixed)

vercel · 2025-09-07T07:59:39Z

@rsvedant is attempting to deploy a commit to the Stack Team on Vercel.

A member of the Team first needs to authorize it.

CLAassistant · 2025-09-07T07:59:40Z

All committers have signed the CLA.

coderabbitai · 2025-09-07T07:59:40Z

Walkthrough

Replaced inline package-manager logic with an installCommandMap (Map<string,string>), JSON-stringifies package names for shell safety, and executes the resolved install command in a single shell invocation with shell: true and cwd set to the project path. No public API changes.

Changes

Cohort / File(s)	Summary
Package manager install command mapping & safe install execution `packages/init-stack/src/index.ts`	Replaced prior inline decision with a `Map<string, string>` (`installCommandMap`) mapping `npm`→"npm install", `yarn`→"yarn add", `pnpm`→"pnpm add", `bun`→"bun add". Resolves `installCommand` via `map.get(pm) ?? \`${pm} install``. Escapes packages by` JSON.stringify`-ing each entry to produce` safePackages`, then runs the install as a single shell command (`shell: true`) with` cwd`set to`projectPath`. Behavior changes for` pnpm`and`bun` (use "add").

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor User
    participant CLI as Init CLI
    participant Resolver as InstallCommandResolver (Map)
    participant Shell

    User->>CLI: Run init command
    CLI->>Resolver: Lookup install command for packageManager
    Resolver-->>CLI: installCommand (e.g., "pnpm add")
    CLI->>CLI: JSON.stringify package names -> safePackages
    CLI->>Shell: Execute installCommand + safePackages (shell: true, cwd: projectPath)
    Shell-->>CLI: Exit code / result
    CLI-->>User: Completion status

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I mapped my hops from npm to bun,
I wrapped each name so shells won't stun.
With pnpm's "add" the carrots land,
In project burrow, tidy and planned.
Thump-thump! The install ran—what fun! 🥕🐇

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5cc5706 and 4c65b58.

📒 Files selected for processing (1)

packages/init-stack/src/index.ts (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

packages/init-stack/src/index.ts

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Security Check

✨ Finishing Touches

📝 Generate Docstrings

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

greptile-apps

Greptile Summary

This PR fixes a critical bug in the Stack Auth initialization wizard (@stackframe/init-stack) where incorrect package manager commands were being used for Bun and pnpm. The issue was in the command generation logic that determines how to install the @stackframe/stack dependency.

The original code used a simple ternary operator that only handled yarn correctly, defaulting to <manager> install for other package managers. However, both Bun and pnpm require the add subcommand to install new packages, not just install. This caused the wizard to fail when users selected these package managers.

The fix replaces the ternary operator with a proper mapping object (installCommandMap) that explicitly defines the correct command for each supported package manager:

npm: npm install (unchanged)
yarn: yarn add (unchanged)
pnpm: pnpm add (fixed from pnpm install)
bun: bun add (fixed from bun install)

This change is located in packages/init-stack/src/index.ts at lines 237-243 and ensures the initialization wizard works correctly across all supported package managers. The mapping approach is more maintainable and explicit about the intent for each package manager.

Confidence score: 5/5

This PR is safe to merge with minimal risk as it fixes a straightforward bug with correct package manager commands
Score reflects a simple, well-tested fix that addresses a clear functional issue without introducing complexity
No files require special attention as this is a single-file change with clear intent and proper testing

_{1 file reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/init-stack/src/index.ts (1)

244-247: Eliminate shell-based command construction to remove injection risk.

Build args and use spawn/execFile with shell: false. Keeps behavior, improves Windows compatibility, and closes injection class.

// Suggested API (outside this hunk): allow args array.
async function shellNicelyFormatted(cmd: string, args: string[] = [], { quiet, ...options }: ShellOptions): Promise<void> {
  // ...
  const child = child_process.spawn(cmd, args, { shell: false, ...options });
  // ...
}

// Call site change (paired with Map suggestion above):
const [bin, ...binArgs] = installCommand.split(" ");
await shellNicelyFormatted(bin, [...binArgs, ...packagesToInstall], { cwd: projectPath });

🧹 Nitpick comments (1)

packages/init-stack/src/index.ts (1)
243-244: Avoid fallback to " install" for unknown package managers.

Safer to fail fast than run a non-add command (e.g., bun install).
-  const installCommand = installCommandMap.get(packageManager) ?? `${packageManager} install`;
+  const installCommand = installCommandMap.get(packageManager);
+  if (!installCommand) {
+    throw new UserError(`Unsupported package manager: ${packageManager}`);
+  }

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9318e2b and 5cc5706.

📒 Files selected for processing (1)

packages/init-stack/src/index.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

Prefer ES6 Map over Record when representing key–value collections

Files:

packages/init-stack/src/index.ts

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Security Check

packages/init-stack/src/index.ts

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

rsvedant marked this pull request as ready for review September 7, 2025 08:01

Copilot AI review requested due to automatic review settings September 7, 2025 08:01

Copilot AI reviewed Sep 7, 2025

View reviewed changes

greptile-apps bot reviewed Sep 7, 2025

View reviewed changes

coderabbitai bot reviewed Sep 7, 2025

View reviewed changes

packages/init-stack/src/index.ts Outdated Show resolved Hide resolved

Update packages/init-stack/src/index.ts

4c65b58

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

N2D4 merged commit 1245390 into stack-auth:dev Sep 9, 2025
3 of 7 checks passed

rsvedant deleted the fix/init-stack-bun-add branch September 9, 2025 16:13

coderabbitai bot mentioned this pull request Sep 24, 2025

init script: add projectId and pck to next client app #911

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(init-stack): use correct package add commands for bun and pnpm#886

fix(init-stack): use correct package add commands for bun and pnpm#886
N2D4 merged 2 commits intostack-auth:devfrom
rsvedant:fix/init-stack-bun-add

rsvedant commented Sep 7, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

vercel bot commented Sep 7, 2025

Uh oh!

CLAassistant commented Sep 7, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Sep 7, 2025 •

edited

Loading

Review ran into problems

Uh oh!

Copilot AI left a comment

Uh oh!

greptile-apps bot left a comment

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rsvedant commented Sep 7, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Problem

Solution

Testing

Checklist

Related Issues

Review by RecurseML

Summary by CodeRabbit

Uh oh!

vercel bot commented Sep 7, 2025

Uh oh!

CLAassistant commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Review ran into problems

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Greptile Summary

Confidence score: 5/5

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rsvedant commented Sep 7, 2025 •

edited by coderabbitai bot

Loading

CLAassistant commented Sep 7, 2025 •

edited

Loading

coderabbitai bot commented Sep 7, 2025 •

edited

Loading