Skip to content

fix(workbench): validate unstable_defineApp config (build fails, dev warns)#1330

Open
gu-stav wants to merge 4 commits into
mainfrom
fix/workbench-validate-app
Open

fix(workbench): validate unstable_defineApp config (build fails, dev warns)#1330
gu-stav wants to merge 4 commits into
mainfrom
fix/workbench-validate-app

Conversation

@gu-stav

@gu-stav gu-stav commented Jun 18, 2026

Copy link
Copy Markdown
Member

unstable_defineApp is a pure identity wrapper and its DefineAppInputSchema was never run on a real config, so an illegal name, missing title, or duplicate view/service names loaded fine and only surfaced later in dev or deploy (#907 review).


Note

Low Risk
CLI-only config validation using an existing Zod schema; no runtime auth, data, or deploy behavior changes beyond failing builds on already-invalid configs.

Overview
Adds validateWorkbenchApp in @sanity/workbench-cli, running the existing DefineAppInputSchema on the resolved branded app config and returning a formatted error string (or null). Because unstable_defineApp stays a pure identity wrapper, this is the first time that schema is enforced on real sanity.cli.ts configs.

sanity build (app and studio paths) calls the validator when a workbench app is detected and exits with code 1 on failure. sanity dev runs the same check for branded apps but warns and still starts the dev servers so authors can fix config live.

Invalid cases surfaced early include bad name, missing title, duplicate view/service names, and studio configs that declare entry. Tests cover the helper and dev warning behavior.

Reviewed by Cursor Bugbot for commit 4387270. Bugbot is set up for automated code reviews on this repo. Configure here.

@gu-stav gu-stav requested a review from a team as a code owner June 18, 2026 21:32
@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

📦 Bundle Stats — @sanity/cli

Compared against main (a2deacf2)

@sanity/cli

Metric Value vs main (a2deacf)
Internal (raw) 2.7 KB -
Internal (gzip) 1.0 KB -
Bundled (raw) 11.15 MB -
Bundled (gzip) 2.10 MB -
Import time 770ms -1ms, -0.1%

bin:sanity

Metric Value vs main (a2deacf)
Internal (raw) 782 B -
Internal (gzip) 423 B -
Bundled (raw) 9.87 MB -
Bundled (gzip) 1.77 MB -
Import time 1.76s +6ms, +0.4%

🗺️ View treemap · Artifacts

Details
  • Import time regressions over 10% are flagged with ⚠️
  • Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (a2deacf2)

Metric Value vs main (a2deacf)
Internal (raw) 106.7 KB -
Internal (gzip) 26.7 KB -
Bundled (raw) 21.71 MB -
Bundled (gzip) 3.45 MB -
Import time 677ms -4ms, -0.5%

🗺️ View treemap · Artifacts

Details
  • Import time regressions over 10% are flagged with ⚠️
  • Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (a2deacf2)

Metric Value vs main (a2deacf)
Internal (raw) 908 B -
Internal (gzip) 483 B -
Bundled (raw) 931 B -
Bundled (gzip) 491 B -
Import time ❌ ChildProcess denied: node -
Details
  • Import time regressions over 10% are flagged with ⚠️
  • Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

Base automatically changed from feat/workbench to main June 19, 2026 13:31

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 65f9d88. Configure here.

if (process.env.SANITY_STUDIO_REACT_STRICT_MODE) {
return process.env.SANITY_STUDIO_REACT_STRICT_MODE === 'true'
}
return Boolean(cliConfig?.reactStrictMode)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strict mode default regressed

Low Severity

When neither SANITY_STUDIO_REACT_STRICT_MODE nor reactStrictMode in the CLI config is set, dev now passes reactStrictMode: false into the runtime instead of leaving it unset so renderStudio can apply its own default.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 65f9d88. Configure here.

Comment thread packages/@sanity/cli/src/actions/dev/devAction.ts
gu-stav and others added 3 commits June 19, 2026 15:56
…warns)

unstable_defineApp is a pure identity wrapper and DefineAppInputSchema was never
run on a real config, so an illegal name, missing title, or duplicate
view/service names loaded fine and only surfaced later in dev or deploy. Wire
the schema in as a gate: sanity build fails on it, sanity dev warns and starts.
@gu-stav gu-stav force-pushed the fix/workbench-validate-app branch from 65f9d88 to caf4f4b Compare June 19, 2026 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant