chore(setup): add SDK installer library - #750
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 536ddf1. Configure here.
| return nodeInstallCmd(resolveNodePM(packageManager), pkg), pkg | ||
| case "react-native": | ||
| pkg = "launchdarkly-react-native-client-sdk" | ||
| return nodeInstallCmd(resolveNodePM(packageManager), pkg), pkg |
There was a problem hiding this comment.
Wrong React Native package name
High Severity
InstallArgs installs launchdarkly-react-native-client-sdk, the archived v9 package. Current LaunchDarkly docs, npm, and this repo’s own react-native quickstart instructions use @launchdarkly/react-native-client-sdk (v10). Setup would add the wrong SDK with incompatible APIs.
Reviewed by Cursor Bugbot for commit 536ddf1. Configure here.
| return []string{"go", "get", pkg}, pkg | ||
| case "ruby-server-sdk": | ||
| pkg = "launchdarkly-server-sdk" | ||
| return []string{"gem", "install", pkg}, pkg |
There was a problem hiding this comment.
Ruby install skips Gemfile
High Severity
Ruby install runs gem install, which does not add the SDK to the project Gemfile. Detection and IsInstalled both key off Gemfile/Gemfile.lock, and Bundler apps will not see a gem installed only via gem install, so setup reports success while the project dependency is never recorded.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 536ddf1. Configure here.
| pm = "pip" | ||
| } | ||
| pkg = "launchdarkly-server-sdk" | ||
| return []string{pm, "install", pkg}, pkg |
There was a problem hiding this comment.
Python install skips manifests
Medium Severity
Python install runs pip install without updating requirements.txt, pyproject.toml, or setup.py. IsInstalled only inspects those manifests, so a successful install never registers as already installed, and CI or fresh environments that install from the manifest will miss the SDK.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 536ddf1. Configure here.
1 participant
Describe the solution you've provided
Second layer of the guided
setupcommand: the SDK installer. Given a detection result, installs the SDK via the project's package manager (Installerinterface,PackageInstaller,InstallArgs,IsInstalled), and flags SDKs that require manual install.Builds on the detection library (
DetectResult).Related issues
Part of the
setup-ldfeature. Stacked PR — base isffantl/setup-ld/1-detector.Requirements
Note
Medium Risk
Runs real package-manager commands via
execin the user’s project directory when wired in production; incorrect SDK mapping or manifest checks could skip or mis-trigger installs, though scope is isolated to the new setup library with test doubles.Overview
Adds the guided setup install layer: given a
DetectResult, it can install LaunchDarkly SDKs via the project’s package manager or surface manual-install guidance.Introduces an
Installerinterface withPackageInstaller(injectablerunfor tests, otherwiseexecin the project directory),InstallResult, andInstallArgsmapping SDK IDs to npm/yarn/pnpm/bun, pip,go get, gem, anddotnet addcommands.IsInstalledskips installs when the package already appears in manifests (package.json,go.mod, Python/Ruby files,*.csproj). Java, Android, and Swift/iOS are manual-only:RequiresManualInstall, nil install args, andSuccess=falsewithout error so the wizard can show the coordinate; unknown SDK IDs return an error.Includes
StubInstallerfor wiring before real logic and broad unit tests for args, success/failure, skip-if-installed, and manual/unknown SDK behavior.Reviewed by Cursor Bugbot for commit 536ddf1. Bugbot is set up for automated code reviews on this repo. Configure here.