chore(setup): add SDK init/injection library and templates - #751
chore(setup): add SDK init/injection library and templates#751ffantl-ld wants to merge 4 commits into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| "python-server-sdk": "sdk/server-side/python", | ||
| "react-client-sdk": "sdk/client-side/react", | ||
| "react-native": "sdk/client-side/react-native", | ||
| "react-native-client-sdk": "sdk/client-side/react-native", |
There was a problem hiding this comment.
Incorrect React Native docs URL
Medium Severity
sdkDocsPaths maps react-native and react-native-client-sdk to sdk/client-side/react-native, but the live docs live at sdk/client-side/react/react-native. GetDocsURL therefore returns a dead link for those IDs.
Reviewed by Cursor Bugbot for commit c56c506. Configure here.
|
|
||
| content := string(existing) | ||
| if importSection != "" { | ||
| content = importSection + "\n" + content |
There was a problem hiding this comment.
Import prepend breaks shebang
High Severity
For append-safe SDKs, InjectIntoFile always prepends the import section at byte 0 of an existing file. That displaces a leading shebang and Python encoding cookies, so common entry points like manage.py stop being directly executable.
Reviewed by Cursor Bugbot for commit c56c506. Configure here.
c56c506 to
6a44381
Compare
6a44381 to
2efb79d
Compare
| @@ -0,0 +1,15 @@ | |||
| const LaunchDarkly = require('@launchdarkly/node-server-sdk'); | |||
There was a problem hiding this comment.
Node inject uses CommonJS only
Medium Severity
node-server is marked append-safe and its template loads the SDK with require, then InjectIntoFile reports Success. The detector often targets TypeScript or ESM entry points such as instrumentation.ts or src/index.ts, where CommonJS require fails at runtime, so setup can mark broken code as ready.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2efb79d. Configure here.
2efb79d to
43d2d15
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
There are 5 total unresolved issues (including 3 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 43d2d15. Configure here.
| "node-server": true, | ||
| "python-server-sdk": true, | ||
| "ruby-server-sdk": true, | ||
| } |
There was a problem hiding this comment.
Unsafe Node in-place injection
High Severity
node-server is treated as append-safe and writes a CommonJS require template as ready-to-run code. Detection often targets TypeScript/ESM entry points such as Next.js instrumentation.ts, where that inject neither parses nor matches the required register hook, yet still reports success.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 43d2d15. Configure here.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
react-native.tmpl bound the default export of @launchdarkly/react-native-client-sdk, which has no default export, so the snippet could not compile. The client is the named export ReactNativeLDClient. Register the android template under the SDK ID the detector reports, keeping android-client-sdk as an alias. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Swift and Android snippets did not compile. LDConfig's only public initializer takes autoEnvAttributes, and LDConfig.Builder's only constructor takes AutoEnvAttributes, so neither config could be built as written. These SDKs return a snippet for the user to paste rather than writing a file, so the snippet is the entire deliverable. AutoEnvAttributes is nested in LDConfig.Builder, which the package wildcard import does not cover, so import it explicitly. Add DefaultEntryPoint, naming the file to create for the SDKs that write one when detection found no entry point for them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
LDContextBuilder.build returns a Result, and the snippet unwrapped it with `try ...get()`. try only compiles inside a throwing function, and the places this snippet gets pasted — application(_:didFinishLaunchingWithOptions:) and similar startup hooks — do not throw. Match on the Result instead. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
43d2d15 to
8daf723
Compare
1 participant
Describe the solution you've provided
Third layer of the guided
setupcommand: SDK initialization. Renders per-SDK code snippets from embedded templates and injects them into the project (Initializer,RenderTemplate,InjectIntoFile), plus docs-URL helpers. Ships thesdk_init_templates/for the supported SDKs.Independent library layer.
Related issues
Part of the
setup-ldfeature. Stacked PR — base isffantl/setup-ld/2-installer.Requirements
Note
Medium Risk
Append-safe path mutates user project files and templates embed credentials placeholders; logic is well-tested but wrong injection could break entry files.
Overview
Adds the SDK initialization layer for guided
setup: embedded per-SDK templates, rendering withInitConfig(SDK key, client-side ID, mobile key, flag key), andInjectIntoFilebehavior that depends on language.For append-safe runtimes (Node, Python, Ruby), init code is written into the target file—imports prepended, init block appended, or a default entry file created when missing. For compiled/framework SDKs (Go, Java, .NET, React, mobile, etc.), the user’s files are not modified;
InitResultreturns a copy-paste snippet plus a docs URL, withSuccess=falseso callers don’t treat the project as auto-wired.Also ships docs URL mapping for many SDK IDs (with or without templates), helpers like
InjectsInPlace/DefaultEntryPoint, and tests that lock template imports to the packagesInstallArgsinstalls.Reviewed by Cursor Bugbot for commit 8daf723. Bugbot is set up for automated code reviews on this repo. Configure here.