refactor(cli-core): remove configstore dependency, use sync config I/O

Replace the configstore-backed getUserConfig() with a dependency-free
implementation that reads/writes the CLI config JSON file directly
using sync I/O. This fixes a race condition in logout where concurrent
async read-modify-write cycles on the same config file could silently
lose data (e.g. telemetry consent surviving a logout).

The getUserConfig() public API keeps its name. The return type narrows
from configstore's ConfigStore class to a minimal ConfigStore interface
with get/set/delete. Moves telemetry utilities from src/util/ to
src/telemetry/ in cli-core. Removes 6 transitive packages.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rexxars

packages/@sanity/cli-core/package.json

@@ -68,7 +68,6 @@
     "@sanity/client": "catalog:",
     "babel-plugin-react-compiler": "^1.0.0",
     "boxen": "^8.0.1",
-    "configstore": "^7.0.0",
     "debug": "catalog:",
     "get-it": "^8.7.0",
     "get-tsconfig": "catalog:",

packages/@sanity/cli-core/src/SanityCommand.ts

@@ -18,7 +18,7 @@ import {
 } from './services/apiClient.js'
 import {type CLITelemetryStore} from './telemetry/types.js'
 import {type Output} from './types.js'
-import {getCliTelemetry, reportCliTraceError} from './util/getCliTelemetry.js'
+import {getCliTelemetry, reportCliTraceError} from './telemetry/getCliTelemetry.js'
 import {isInteractive} from './util/isInteractive.js'
 
 type Flags<T extends typeof Command> = Interfaces.InferredFlags<

packages/@sanity/cli-core/src/config/__tests__/cliUserConfig.test.ts

@@ -1,110 +1,92 @@
-import {mkdir} from 'node:fs/promises'
+import {mkdirSync} from 'node:fs'
 import {homedir} from 'node:os'
 
 import {afterEach, beforeEach, describe, expect, test, vi} from 'vitest'
 
-import {getCliUserConfig, setCliUserConfig} from '../../services/cliUserConfig'
-import {readJsonFile} from '../../util/readJsonFile'
-import {writeJsonFile} from '../../util/writeJsonFile'
+import {getCliUserConfig, getUserConfig, setCliUserConfig} from '../../services/cliUserConfig'
+import {readJsonFileSync} from '../../util/readJsonFileSync'
+import {writeJsonFileSync} from '../../util/writeJsonFileSync'
 
-vi.mock('node:fs/promises')
+vi.mock('node:fs')
 vi.mock('node:os')
-vi.mock('../../util/readJsonFile')
-vi.mock('../../util/writeJsonFile')
+vi.mock('../../util/readJsonFileSync')
+vi.mock('../../util/writeJsonFileSync')
 
 const mockHomedir = '/mock/home/dir'
 
 describe('cliUserConfig', () => {
   beforeEach(() => {
     vi.resetAllMocks()
     vi.mocked(homedir).mockReturnValue(mockHomedir)
-    vi.mocked(mkdir).mockResolvedValue(undefined)
-    vi.mocked(readJsonFile).mockResolvedValue({})
-    vi.mocked(writeJsonFile).mockResolvedValue()
+    vi.mocked(mkdirSync).mockReturnValue(undefined)
+    vi.mocked(readJsonFileSync).mockReturnValue({})
+    vi.mocked(writeJsonFileSync).mockReturnValue()
   })
 
   afterEach(() => {
-    vi.resetAllMocks()
+    vi.clearAllMocks()
   })
 
   describe('readConfig behavior', () => {
-    test('returns empty config when file read fails', async () => {
-      vi.mocked(readJsonFile).mockRejectedValueOnce(new Error('File not found'))
-      const result = await getCliUserConfig('authToken')
+    test('returns empty config when file read fails', () => {
+      vi.mocked(readJsonFileSync).mockImplementationOnce(() => {
+        throw new Error('File not found')
+      })
+      const result = getCliUserConfig('authToken')
       expect(result).toBeUndefined()
     })
 
-    test('returns empty config when file content is null', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce(null)
-      const result = await getCliUserConfig('authToken')
+    test('returns empty config when file content is null', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce(null)
+      const result = getCliUserConfig('authToken')
       expect(result).toBeUndefined()
     })
 
-    test('returns empty config when file content is an array', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce([])
-      const result = await getCliUserConfig('authToken')
+    test('returns empty config when file content is an array', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce([])
+      const result = getCliUserConfig('authToken')
       expect(result).toBeUndefined()
     })
 
-    test('returns empty config when file content is not an object', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce('not an object')
-      const result = await getCliUserConfig('authToken')
+    test('returns empty config when file content is not an object', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce('not an object')
+      const result = getCliUserConfig('authToken')
       expect(result).toBeUndefined()
     })
   })
 
   describe('getCliUserConfig', () => {
-    test('returns authToken when valid', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce({
+    test('returns authToken when valid', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
         authToken: 'test-token',
       })
 
-      const result = await getCliUserConfig('authToken')
+      const result = getCliUserConfig('authToken')
       expect(result).toBe('test-token')
     })
 
-    test('returns undefined when authToken is not set', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce({})
+    test('returns undefined when authToken is not set', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({})
 
-      const result = await getCliUserConfig('authToken')
+      const result = getCliUserConfig('authToken')
       expect(result).toBeUndefined()
     })
 
-    test('returns telemetryConsent when valid', async () => {
-      const mockConsent = {
-        updatedAt: Date.now(),
-        value: {
-          status: 'granted',
-          type: 'explicit',
-        },
-      }
-      vi.mocked(readJsonFile).mockResolvedValueOnce({
-        telemetryConsent: mockConsent,
-      })
-
-      const result = await getCliUserConfig('telemetryConsent')
-      expect(result).toEqual(mockConsent)
-    })
-
-    test('throws error for invalid property', async () => {
-      await expect(getCliUserConfig('invalidProp' as never)).rejects.toThrow('No schema defined')
-    })
-
-    test('returns undefined for invalid value type', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce({
+    test('returns undefined for invalid value type', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
         authToken: 123, // Invalid type, should be string
       })
 
-      await expect(getCliUserConfig('authToken')).resolves.toBeUndefined()
+      expect(getCliUserConfig('authToken')).toBeUndefined()
     })
   })
 
   describe('setCliUserConfig', () => {
-    test('sets valid authToken', async () => {
-      await setCliUserConfig('authToken', 'new-token')
+    test('sets valid authToken', () => {
+      setCliUserConfig('authToken', 'new-token')
 
-      expect(mkdir).toHaveBeenCalledWith(expect.any(String), {recursive: true})
-      expect(writeJsonFile).toHaveBeenCalledWith(
+      expect(mkdirSync).toHaveBeenCalledWith(expect.any(String), {recursive: true})
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
         expect.any(String),
         expect.objectContaining({
           authToken: 'new-token',
@@ -113,58 +95,148 @@ describe('cliUserConfig', () => {
       )
     })
 
-    test('sets valid telemetryConsent', async () => {
-      const mockConsent = {
-        updatedAt: Date.now(),
-        value: {
-          status: 'granted' as const,
-          type: 'explicit',
-        },
-      }
+    test('throws error for invalid value type', () => {
+      expect(() => setCliUserConfig('authToken', 123 as never)).toThrow('Invalid value')
+    })
+
+    test('merges new config with existing config', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        authToken: 'existing-token',
+        someOtherKey: 'preserved',
+      })
 
-      await setCliUserConfig('telemetryConsent', mockConsent)
+      setCliUserConfig('authToken', 'new-token')
 
-      expect(writeJsonFile).toHaveBeenCalledWith(
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
         expect.any(String),
         expect.objectContaining({
-          telemetryConsent: mockConsent,
+          authToken: 'new-token',
+          someOtherKey: 'preserved',
         }),
         expect.any(Object),
       )
     })
+  })
+
+  describe('getUserConfig', () => {
+    test('get returns raw value from file', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        myKey: 'myValue',
+        nested: {deep: true},
+      })
+
+      const store = getUserConfig()
+      const result = store.get('myKey')
+      expect(result).toBe('myValue')
+    })
+
+    test('get returns undefined for missing key', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({})
+
+      const store = getUserConfig()
+      const result = store.get('nonexistent')
+      expect(result).toBeUndefined()
+    })
+
+    test('get returns undefined when file read fails', () => {
+      vi.mocked(readJsonFileSync).mockImplementationOnce(() => {
+        throw new Error('File not found')
+      })
+
+      const store = getUserConfig()
+      const result = store.get('anyKey')
+      expect(result).toBeUndefined()
+    })
+
+    test('set reads file, adds key, and writes file', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        existing: 'value',
+      })
 
-    test('throws error for invalid property', async () => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      await expect(setCliUserConfig('invalidProp' as any, 'value')).rejects.toThrow(
-        'No schema defined',
+      const store = getUserConfig()
+      store.set('newKey', 'newValue')
+
+      expect(mkdirSync).toHaveBeenCalledWith(expect.any(String), {recursive: true})
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
+        expect.any(String),
+        {existing: 'value', newKey: 'newValue'},
+        {pretty: true},
+      )
+    })
+
+    test('set overwrites existing key', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        myKey: 'oldValue',
+      })
+
+      const store = getUserConfig()
+      store.set('myKey', 'updatedValue')
+
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
+        expect.any(String),
+        {myKey: 'updatedValue'},
+        {pretty: true},
       )
     })
 
-    test('throws error for invalid value type', async () => {
-      await expect(setCliUserConfig('authToken', 123 as never)).rejects.toThrow('Invalid value')
+    test('set handles complex values', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({})
+
+      const store = getUserConfig()
+      const complexValue = {status: 'granted', updatedAt: 12_345}
+      store.set('telemetryConsent', complexValue)
+
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
+        expect.any(String),
+        {telemetryConsent: complexValue},
+        {pretty: true},
+      )
     })
 
-    test('merges new config with existing config', async () => {
-      vi.mocked(readJsonFile).mockResolvedValueOnce({
-        authToken: 'existing-token',
+    test('delete removes key from file and writes', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        keepMe: 'yes',
+        removeMe: 'bye',
       })
 
-      await setCliUserConfig('telemetryConsent', {
-        updatedAt: 123,
-        value: {
-          status: 'granted' as const,
-          type: 'explicit',
-        },
+      const store = getUserConfig()
+      store.delete('removeMe')
+
+      expect(mkdirSync).toHaveBeenCalledWith(expect.any(String), {recursive: true})
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
+        expect.any(String),
+        {keepMe: 'yes'},
+        {pretty: true},
+      )
+    })
+
+    test('delete is a no-op write when key does not exist', () => {
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({
+        existing: 'value',
       })
 
-      expect(writeJsonFile).toHaveBeenCalledWith(
+      const store = getUserConfig()
+      store.delete('nonexistent')
+
+      expect(writeJsonFileSync).toHaveBeenCalledWith(
         expect.any(String),
-        expect.objectContaining({
-          authToken: 'existing-token',
-          telemetryConsent: expect.any(Object),
-        }),
-        expect.any(Object),
+        {existing: 'value'},
+        {pretty: true},
       )
     })
+
+    test('each operation does a fresh read', () => {
+      const store = getUserConfig()
+
+      // First call returns one state
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({counter: 1})
+      expect(store.get('counter')).toBe(1)
+
+      // Second call returns updated state
+      vi.mocked(readJsonFileSync).mockReturnValueOnce({counter: 2})
+      expect(store.get('counter')).toBe(2)
+
+      expect(readJsonFileSync).toHaveBeenCalledTimes(2)
+    })
   })
 })

packages/@sanity/cli-core/src/index.ts

@@ -20,7 +20,7 @@ export * from './SanityCommand.js'
 export * from './services/apiClient.js'
 export * from './services/cliUserConfig.js'
 export * from './services/getCliToken.js'
-export * from './telemetry/getTelemetryBaseInfo.js'
+export {getTelemetryBaseInfo} from './telemetry/getTelemetryBaseInfo.js'
 export {
   type CLITelemetryStore,
   type ConsentInformation,
@@ -34,10 +34,9 @@ export {
   CLI_TELEMETRY_SYMBOL,
   getCliTelemetry,
   setCliTelemetry,
-} from './util/getCliTelemetry.js'
+} from './telemetry/getCliTelemetry.js'
 export * from './util/getSanityEnvVar.js'
 export * from './util/getSanityUrl.js'
-export * from './util/getUserConfig.js'
 export * from './util/importModule.js'
 export * from './util/isCi.js'
 export * from './util/isInteractive.js'