WordPress-plugin zip ships a non-functional bundled CLI (missing @automattic/wp-codebox-core node_modules)

[chubes4]

Summary

The WordPress-plugin zip ships a non-functional bundled CLI: vendor/wp-codebox-cli contains dist/*.js that do runtime import "@automattic/wp-codebox-core" / "@automattic/wp-codebox-playground", but those workspace packages are not present in the bundled node_modules. Running the bundled CLI fails immediately:

$ wp-content/plugins/wp-codebox/vendor/wp-codebox-cli/bin/wp-codebox commands --json
node:internal/modules/package_json_reader:301
  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@automattic/wp-codebox-core'
  imported from .../vendor/wp-codebox-cli/packages/cli/dist/commands/artifacts.js

Confirmed on a freshly deployed v0.8.5 plugin zip (not just an old build). Because the bundled CLI can't run, production installs are forced to depend on a separately, manually npm i -g'd global CLI — which then drifts out of sync with the deployed plugin's recipe-writer (we hit "Unsupported recipe schema" from exactly this skew on prod).

Impact

• The WordPress plugin is not self-contained. WP_Codebox_Agent_Sandbox_Runner::default_bin() prefers the bundled CLI when present, but the bundled CLI is unrunnable, so operators must pin wp_codebox_bin to a hand-installed global binary.
• That global binary is unmanaged by deploys → silent version skew → opaque recipe-run failures (the agent-task path returns "did not return valid JSON" downstream when the skewed CLI rejects a newer recipe schema).

Root cause (where it's packaged)

• scripts/package-release-artifact.ts builds the standalone CLI tarball correctly: it copies packages/{runtime-core,runtime-playground,cli} then runs npm install --omit=dev ... in the package root so @automattic/wp-codebox-cli (declared "file:packages/cli" in the root package.json) and its workspace deps resolve into node_modules. That tarball IS self-contained.
• scripts/build-wordpress-plugin-zip.ts copies dist/release/wp-codebox-cli into the plugin's vendor/wp-codebox-cli (await cp(cliPackageRoot, join(stagingPlugin, "vendor", "wp-codebox-cli"), { recursive: true })). But the bundled vendor/wp-codebox-cli that lands in the deployed plugin does not contain the resolved node_modules/@automattic/* — so the bare-specifier imports in dist/*.js cannot resolve at runtime.

So either (a) the plugin-zip path copies from a CLI root that was never npm installed, or (b) the node_modules are excluded during the copy/zip, or (c) the workspace deps need to be vendored differently (the @automattic/* packages are not published to npm, so they only resolve via the in-monorepo file:/workspace linkage at build time — a plain copy won't carry them).

Fix options

1. Vendor resolved deps into the plugin zip. Ensure build-wordpress-plugin-zip.ts copies a CLI root that has already had npm install --omit=dev run (i.e. reuse the same self-contained dist/release/wp-codebox-cli that package-release-artifact.ts produces, including its node_modules), and confirm the zip step does not exclude node_modules.
2. Bundle to a single file. Build packages/cli/dist/index.js as a standalone bundle (esbuild/rollup) with the @automattic/wp-codebox-core / -playground workspace packages inlined, so there are no bare @automattic/* imports at runtime. This removes the node_modules dependency entirely and makes the bundled CLI trivially portable.

Either makes vendor/wp-codebox-cli runnable standalone, lets wp_codebox_bin point at the bundled CLI, and eliminates the global-install dependency and the version-skew class permanently.

Acceptance criteria

• In a freshly built plugin zip, vendor/wp-codebox-cli/bin/wp-codebox commands --json runs and returns the JSON command catalog (no ERR_MODULE_NOT_FOUND).
• recipe-run works end-to-end via the bundled CLI without any globally-installed wp-codebox.
• A smoke/self-check in homeboy.json asserts the bundled CLI boots from the packaged zip (catch this regression automatically).
• Docs note that wp_codebox_bin should default to / point at the bundled CLI, not a global install.

Repro

1. homeboy build wp-codebox (or inspect the deployed plugin).
2. node <plugin>/vendor/wp-codebox-cli/packages/cli/dist/index.js commands --json → ERR_MODULE_NOT_FOUND @automattic/wp-codebox-core.
3. Confirm <plugin>/vendor/wp-codebox-cli/node_modules/@automattic/ is absent.

Context

This blocks the Roadie propose_code_change → live preview URL flow on the Extra Chill platform (the bundled CLI is the right runtime; the global fallback skews). Filed after shipping v0.8.5 and confirming the bundle is still depless.