fix(cli): tolerate invalid optional package cache manifests (#5349)

packages/cli/src/commands/doctor.test.ts

@@ -295,7 +295,7 @@ describe("checkOptionalPackage", () => {
     });
   });
 
-  it("reports the installed version read from the cached package", () => {
+  function checkCachedManifest(manifest: string) {
     const cacheDir = mkdtempSync(join(tmpdir(), "hf-doctor-optional-"));
     dirs.push(cacheDir);
     const pkgDir = join(
@@ -303,13 +303,27 @@ describe("checkOptionalPackage", () => {
       "node_modules/@google/genai",
     );
     mkdirSync(pkgDir, { recursive: true });
-    writeFileSync(join(pkgDir, "package.json"), JSON.stringify({ version: "1.52.0" }));
+    writeFileSync(join(pkgDir, "package.json"), manifest);
     const cliUrl = pathToFileURL(join(cacheDir, "cli.js")).href;
-    expect(checkOptionalPackage("@google/genai", cacheDir, cliUrl)).toEqual({
+    return checkOptionalPackage("@google/genai", cacheDir, cliUrl);
+  }
+
+  it("reports the installed version read from the cached package", () => {
+    expect(checkCachedManifest('{"version":"1.52.0"}')).toEqual({
       ok: true,
       detail: "1.52.0 installed",
     });
   });
+
+  it.each(['{"version":', "null", '{"version":123}'])(
+    "finishes the dependency check with an invalid cached manifest: %s",
+    (manifest) => {
+      expect(checkCachedManifest(manifest)).toEqual({
+        ok: true,
+        detail: "Not installed (installs on first use)",
+      });
+    },
+  );
 });
 
 describe("checkSettingsLock", () => {

packages/cli/src/utils/optionalPackages.test.ts

@@ -58,6 +58,40 @@ describe("loadInstalledOptionalPackage", () => {
   });
 });
 
+describe("installedOptionalPackageVersion from the cache", () => {
+  it.each(['{"version":', "null", '"1.52.0"', "[]", "{}", '{"version":123}', '{"version":""}'])(
+    "treats an invalid cached manifest as unavailable: %s",
+    (manifest) => {
+      const cache = mkdtempSync(join(tmpdir(), "hf-optional-version-"));
+      const name = "@google/genai";
+      const packageDir = join(optionalPackageDir(name, cache), "node_modules", name);
+      mkdirSync(packageDir, { recursive: true });
+      writeFileSync(join(packageDir, "package.json"), manifest);
+      const cliUrl = pathToFileURL(join(cache, "cli.js")).href;
+      try {
+        expect(installedOptionalPackageVersion(name, cache, cliUrl)).toBeNull();
+      } finally {
+        rmSync(cache, { recursive: true, force: true });
+      }
+    },
+  );
+
+  it("returns the cached version without loading the package entry", () => {
+    const cache = mkdtempSync(join(tmpdir(), "hf-optional-version-"));
+    const name = "@google/genai";
+    const packageDir = join(optionalPackageDir(name, cache), "node_modules", name);
+    mkdirSync(packageDir, { recursive: true });
+    writeFileSync(join(packageDir, "package.json"), '{"version":"1.52.0","main":"index.js"}');
+    writeFileSync(join(packageDir, "index.js"), 'throw new Error("entry must not load");');
+    const cliUrl = pathToFileURL(join(cache, "cli.js")).href;
+    try {
+      expect(installedOptionalPackageVersion(name, cache, cliUrl)).toBe("1.52.0");
+    } finally {
+      rmSync(cache, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("loadOptionalPackage", () => {
   it("installs on first use with one plain line, then loads from the cache without installing again", async () => {
     const { deps, install, log } = fakeDeps();

packages/cli/src/utils/optionalPackages.ts

@@ -71,9 +71,14 @@ export function installedOptionalPackageVersion(
 ): string | null {
   if (pinnedPackageBesideCli(name, cliUrl)?.resolution === "entry") return OPTIONAL_PACKAGES[name];
   const dir = optionalPackageDir(name, cacheDir);
-  if (!isInstalled(dir, name)) return null;
-  return (JSON.parse(readFileSync(manifestPath(dir, name), "utf-8")) as { version: string })
-    .version;
+  try {
+    const manifest: unknown = JSON.parse(readFileSync(manifestPath(dir, name), "utf-8"));
+    if (typeof manifest !== "object" || manifest === null || !("version" in manifest)) return null;
+    const version = manifest.version;
+    return typeof version === "string" && version.length > 0 ? version : null;
+  } catch {
+    return null;
+  }
 }
 
 export function loadInstalledOptionalPackage<N extends OptionalPackage>(