Stamp env blobs with their producer varlock version to surface version skew - #1052
Open
theoephraim wants to merge 1 commit into
Open
Stamp env blobs with their producer varlock version to surface version skew#1052theoephraim wants to merge 1 commit into
theoephraim wants to merge 1 commit into
Conversation
Blobs cross version boundaries in several supported flows: runtime glue bundled into integrations, varlock run children, global CLI vs local package. Until now the format compatibility was implicit. - getSerializedGraph records varlockVersion (baked from package.json at build time, treeshaken to just the version string) - automatic injected-env reuse re-resolves when the producer version differs (or is absent, matching the existing older-producer fallbacks); forced sandbox mode still trusts the blob since there is nothing to re-resolve from - initVarlockEnv warns once per process when the blob was produced by a different minor/major than the runtime code consuming it; patch skew is debug-only - SerializedEnvGraph documents the backward-compat requirement
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | 3d1f45f | Commit Preview URL Branch Preview URL |
Aug 31 2026, 04:36 AM |
Contributor
|
The changes in this PR will be included in the next version bump.
|
Contributor
📦 Bundle size
dist/ only; native binaries are versioned separately and not counted here. |
varlock
@varlock/native-helper-darwin
@varlock/native-helper-linux-arm64
@varlock/native-helper-linux-x64
@varlock/native-helper-win32-x64
commit: |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes across the serialized graph contract, automatic blob reuse, runtime skew diagnostics, documentation, and focused tests.
- Version stamping:
EnvGraph.getSerializedGraph()records the build-timevarlockpackage version in every blob and documents the compatibility contract. - Reuse gating: automatic consumers re-resolve unstamped or differently versioned blobs, while explicit sandbox trust mode preserves its no-source fallback behavior.
- Runtime diagnostics: consumers distinguish patch skew from minor or major skew and deduplicate user-facing warnings across module copies through shared global state.
- Documentation and tests: the integration guide, release note, reuse cases, serialization assertion, and runtime warning thresholds match the implemented behavior.
azure/gpt-5.6-sol ｜ 𝕏
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Serialized
__VARLOCK_ENVblobs cross version boundaries in several supported flows: runtime glue bundled into integrations (the nextjs@next/envreplacement),varlock runchild processes, and a global CLI vs a local package dependency. Until now the format's cross-version compatibility was implicit, so a skew bug would surface as subtle wrong behavior with nothing pointing at the cause. Follow-up hardening from the discussion on #1051.Changes
getSerializedGraphstampsvarlockVersionon every blob. The version comes from package.json at build time; rolldown treeshakes the import down to just the version string, so no package.json contents land in runtime chunks._VARLOCK_USE_INJECTED_ENV=1) still trusts the blob, since there is nothing to re-resolve from.initVarlockEnvwarns once per process (flag onglobalThis, since bundlers create multiple module copies) when the blob was produced by a different minor or major than the runtime code consuming it. Patch skew is expected between lockstep releases and stays debug-only.SerializedEnvGraphnow documents the requirement that format changes stay backward compatible within a major.Tests
Unit tests for the reuse gate (mismatch, unversioned, forced-mode bypass), the serialization stamp, and the runtime warning thresholds (match/patch/minor/major, warn-once across module copies). Full varlock unit suite and the injected-env-reuse smoke tests (19 E2E scenarios through the real CLI) pass; verified a real CLI-produced blob carries the stamp.