Configure CLI build pipeline for npm publishing by ivan-ottinger · Pull Request #2697 · Automattic/studio

ivan-ottinger · 2026-03-03T13:21:33Z

Related issues

Related to STU-1362

In this PR I am proposing to add a new CLI build - for now with manual package creation. As the next step I am planning to look into our organization npm access so we could manually publish it (privately-first) to npm under @automattic/wp-studio - as we discussed in STU-1357.

Then we can continue with making the publishing automated.

How AI was used in this PR

Claude Code implemented the plan from STU-1362 and iterated on build issues (externalized dependency resolution, shebang injection, ...) based on my feedback and manual testing. I have reviewed the whole generated code myself and with Copilot as well.

Proposed Changes

Configure CLI package as @automattic/wp-studio with version, bin, files, engines, and publishConfig fields for npm publishing
Add vite.config.npm.ts — a separate Vite config that externalizes runtime dependencies (npm handles them) and adds a #!/usr/bin/env node shebang to the main entry point
Add scripts/postinstall-npm.mjs — applies patches via patch-package after npm install (no-op in workspace context)
Extract shared Vite config into vite.config.base.ts to reduce duplication between Electron and npm builds
Remove redundant web WASM pruning (removed upstream in wordpress-playground#3315)
Bundle @studio/common dependencies at build time rather than listing them as runtime dependencies
Update workspace references across root and studio app package.json files to use the new scoped package name
Add cli:build:npm root script for the npm build

Testing Instructions

Verify the existing Electron build still works:
```
npm run cli:build
```
Verify the npm build works:
```
npm run cli:build:npm
```

Verify no node_modules/ in npm build output and shebang is present:

ls apps/cli/dist/cli/node_modules  # should not exist
head -1 apps/cli/dist/cli/main.js  # should be #!/usr/bin/env node

Test end-to-end from a tarball:

cd apps/cli && npm pack
mkdir /tmp/test-wp-studio && cd /tmp/test-wp-studio
npm init -y && npm install /path/to/automattic-wp-studio-0.1.0.tgz
npx studio --version
npx studio --help

Pre-merge Checklist

Have you checked for TypeScript, React or other console errors?

Copilot

Pull request overview

This PR prepares the Studio CLI workspace package for publishing to npm under the new scoped name @automattic/studio-cli, including a dedicated npm-oriented build (externalized deps + shebang) and an npm-consumer postinstall pruning step.

Changes:

Renames the CLI workspace/package to @automattic/studio-cli and updates workspace script references.
Adds a dedicated vite.config.npm.ts build that externalizes runtime dependencies and prepends a Node shebang to main.js.
Adds an npm postinstall script to apply patches and prune large/unneeded binaries after install.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Updates root scripts to reference the new scoped CLI workspace and adds `cli:build:npm`.
package-lock.json	Reflects the CLI rename/versioning and dependency reshaping needed for npm publishing.
apps/studio/package.json	Updates Studio app scripts to call the renamed CLI workspace.
apps/cli/vite.config.npm.ts	Introduces npm-specific Vite build config (externalization + shebang injection + locales copy).
apps/cli/scripts/postinstall-npm.mjs	Adds npm-consumer postinstall actions (patches + binary pruning).
apps/cli/package.json	Updates CLI package metadata for npm publishing (name/version/bin/files/engines/scripts).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/cli/package.json

apps/cli/scripts/postinstall-npm.mjs

fredrikekelund

Thanks for tackling this! The main questions I see here are:

We need to think about how to handle @studio/common when publishing to npm. I don't think the current approach of just including those dependencies in apps/cli/package.json is reliable enough.
We should reduce the postinstall script as much as possible. In a follow-up PR, we should consider even removing patch-package altogether.

apps/cli/scripts/postinstall-npm.mjs

fredrikekelund · 2026-03-05T10:30:28Z

apps/cli/scripts/postinstall-npm.mjs

+// Apply patches via patch-package
+try {
+	execSync( 'npx --no-install patch-package --patch-dir ./patches', {
+		cwd: packageDir,
+		stdio: 'inherit',
+	} );
+} catch {
+	console.log( 'patch-package failed — patches may not apply cleanly' );
+}


Removing patch-package isn't trivial… The pm2-axon and pm2 patches will soon be redundant. We might be able to manage without the ps-man patch. The @wp-playground/wordpress patch could potentially be merged upstream in some way (gated by some config flag).

Is there anything against keeping the patch-package?

Even if we clear current ones, there is a chance we will need hotfix something in the future, so it seems reasonable to have that way available for both UI and CLI.

I expanded a little bit on the "why" in #2697 (comment)

Basically, the ideal end state to me is that we don't have a postinstall script when people install this package. pnpm disables the postinstall script by default and touts this as a security feature (which it is). Yarn mentions this in their docs:

Postinstall scripts should be avoided at all cost, as they make installs slower and riskier. Many users will refuse to install dependencies that have postinstall scripts. Additionally, since the output isn't shown out of the box, using them to print a message to the user will not work as you expect.

I don't know that the npm CLI has taken a stance on this, but given the multiple high-profile security incidents in the npm ecosystem in recent years, it's not unreasonable to expect them to address this.

For us, patch-package is the most difficult thing to remove. It's not feasible to tackle that in this PR, but the end goal of removing the postinstall script from the CLI package is definitely something we should consider.

apps/cli/package.json

apps/cli/vite.config.npm.ts

wpmobilebot · 2026-03-05T14:39:16Z

📊 Performance Test Results

Comparing b8819dc vs trunk

site-editor

Metric	trunk	`b8819dc`	Diff	Change
load	1464.00 ms	1426.00 ms	-38.00 ms	⚪ 0.0%

site-startup

Metric	trunk	`b8819dc`	Diff	Change
siteCreation	6092.00 ms	6099.00 ms	+7.00 ms	⚪ 0.0%
siteStartup	3942.00 ms	3939.00 ms	-3.00 ms	⚪ 0.0%

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

ivan-ottinger · 2026-03-05T16:25:47Z

We should reduce the postinstall script as much as possible. In a follow-up PR, we should consider even removing patch-package altogether.

I have created related issue: STU-1375.

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

apps/cli/vite.config.npm.ts

apps/cli/scripts/postinstall-npm.mjs

apps/cli/vite.config.npm.ts

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

apps/cli/scripts/postinstall-npm.mjs

apps/cli/package.json

apps/cli/vite.config.npm.ts

Add a separate Vite config (vite.config.npm.ts) that externalizes all runtime dependencies and adds a Node.js shebang, producing a standalone CLI package publishable to npm as @automattic/studio-cli. The existing Electron-bundled build (vite.config.ts) is unchanged.

- Remove unused `main` field (CLI-only package) - Include source maps in `files` whitelist - Use `npx --no-install` for deterministic postinstall

…ground#3315)

ivan-ottinger self-assigned this Mar 3, 2026

ivan-ottinger requested a review from Copilot March 3, 2026 14:10

Copilot started reviewing on behalf of ivan-ottinger March 3, 2026 14:11 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

apps/cli/package.json Outdated Show resolved Hide resolved

apps/cli/package.json Show resolved Hide resolved

apps/cli/scripts/postinstall-npm.mjs Outdated Show resolved Hide resolved

ivan-ottinger marked this pull request as ready for review March 3, 2026 15:21

ivan-ottinger requested a review from a team March 3, 2026 15:22

fredrikekelund reviewed Mar 5, 2026

View reviewed changes

ivan-ottinger force-pushed the stu-1362-cli-npm-build-pipeline branch from 531f4cb to abf57d5 Compare March 5, 2026 14:23

ivan-ottinger requested a review from Copilot March 6, 2026 09:16

Copilot started reviewing on behalf of ivan-ottinger March 6, 2026 09:17 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

apps/cli/vite.config.npm.ts Outdated Show resolved Hide resolved

apps/cli/scripts/postinstall-npm.mjs Outdated Show resolved Hide resolved

apps/cli/vite.config.npm.ts Outdated Show resolved Hide resolved

ivan-ottinger requested a review from Copilot March 6, 2026 09:53

Copilot started reviewing on behalf of ivan-ottinger March 6, 2026 09:54 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

apps/cli/scripts/postinstall-npm.mjs Show resolved Hide resolved

apps/cli/package.json Show resolved Hide resolved

apps/cli/vite.config.npm.ts Outdated Show resolved Hide resolved

ivan-ottinger added 11 commits March 6, 2026 11:19

Address Copilot review feedback

7a11d15

- Remove unused `main` field (CLI-only package) - Include source maps in `files` whitelist - Use `npx --no-install` for deterministic postinstall

Remove redundant web WASM pruning (removed upstream in wordpress-play…

20d6efd

…ground#3315)

Remove node_modules pruning from postinstall script

64fb5f6

Extract shared Vite config into vite.config.base.ts

336e809

Remove @studio/common deps from dependencies (bundled by Vite)

cb65de3

Rename package from @automattic/studio-cli to @automattic/wp-studio

8a40aee

Simplify externalDeps filter (no-op @studio/common exception removed)

14567b1

Fail loudly when patch-package fails during postinstall

aa2f5da

Use Rollup banner for shebang to preserve sourcemap accuracy

a8c6106

Deduplicate Node builtin externals in npm Vite config

b8819dc

ivan-ottinger force-pushed the stu-1362-cli-npm-build-pipeline branch from 59e0919 to b8819dc Compare March 6, 2026 10:19

ivan-ottinger requested a review from fredrikekelund March 6, 2026 10:51

Conversation

ivan-ottinger commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issues

How AI was used in this PR

Proposed Changes

Testing Instructions

Pre-merge Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fredrikekelund left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fredrikekelund Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

wojtekn Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

fredrikekelund Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wpmobilebot commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Performance Test Results

site-editor

site-startup

Uh oh!

ivan-ottinger commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ivan-ottinger commented Mar 3, 2026 •

edited

Loading

wpmobilebot commented Mar 5, 2026 •

edited

Loading