From 1bb8deeb3d16b7be94c849702eb3171f6bd1dc19 Mon Sep 17 00:00:00 2001 From: Vladimir Rogojin Date: Wed, 10 Jun 2026 16:06:20 +0200 Subject: [PATCH] fix(docker)(agentic_hosting#26): normalise sphere-sdk version before file: install MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stage-1 of the trader image build uses `npm ci` (lenient — installs from lockfile, doesn't strict-validate the file: dep's own package.json). Stage-2 uses `npm install` (strict — re-resolves the file: dep when the path changes via sed), which validates every encountered version against semver and refuses anything malformed. Upstream sphere-sdk main currently carries `"version": "0.0.a1"` (commit b8b526d, "chore(release): 0.0.a1") — `a1` is not a valid semver prerelease tag (must be `[0-9A-Za-z-]+` and the form here `0.0.a1` parses as `MAJOR.MINOR.PATCH` where `a1` isn't a number). The release-driven build of `trader:v0.2` failed at this exact line with `Invalid Version: 0.0.a1` (run 27281190676). Fix: insert `npm pkg set version=0.0.0-dev --prefix sphere-sdk` between the file: path rewrite and `npm install`. The version field on a file: dep is informational only — npm resolves by path, not by version constraint — so this rewrite has zero functional effect beyond letting the install proceed. Robust against any future invalid-semver drift upstream. A separate upstream PR to sphere-sdk main is appropriate to actually fix the version field there. That's not in this PR's critical path; this Dockerfile patch is enough to unblock the v0.2 image build. Related: vrogojin/agentic_hosting#26 (the rebuild this unblocks), unicity-sphere/sphere-sdk#475 (the soak that consumes v0.2 once it's on ghcr.io) --- Dockerfile | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Dockerfile b/Dockerfile index f4a03fa..0f7a17e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,7 +57,20 @@ COPY --from=build /build/sphere-sdk/ ./sphere-sdk/ # Rewrite the file: dependency to the local copy in the image (the original # `file:../sphere-sdk` would point outside the container). Then install only # production deps. +# +# `npm pkg set version=…` defensively normalises sphere-sdk's own +# version field before the file: install resolves it. Upstream sphere-sdk +# main currently carries `"version": "0.0.a1"` (commit b8b526d) — `a1` +# isn't a valid semver prerelease tag, so the strict-resolve mode of +# `npm install` (as opposed to `npm ci` in the build stage) fails with +# `Invalid Version: 0.0.a1`. We pin to `0.0.0-dev` here — a valid +# prerelease tag — without modifying the SDK source. The version on a +# file: dep is informational only (npm resolves by path, not by version +# constraint), so this rewrite has zero functional effect beyond letting +# the install proceed. Robust against any future invalid-semver drift +# upstream. RUN sed -i 's|"file:../sphere-sdk"|"file:./sphere-sdk"|' package.json \ + && npm pkg set version=0.0.0-dev --prefix sphere-sdk \ && npm install --omit=dev --ignore-scripts # Standard host-manager-injected directory layout. Mounted at runtime by the