halo-dev/halo · info · Error

Shared dependency ${root} resolved to ${packageJson.name ||

Error message

Shared dependency ${root} resolved to ${packageJson.name || "an unnamed package"} at ${packageRoot}.

What it means

processAutoLoginCookie parses token[1] as the expiry epoch and throws InvalidCookieException when it is in the past (tokenExpiryTime < System.currentTimeMillis()). handleError cancels the cookie and returns Mono.empty(), so the effect is a silent re-login prompt rather than an error page.

Source

Thrown at ui/packages/ui-plugin-bundler-kit/src/runtime-snapshot.ts:138

  try {
    packageJsonPath = await resolvePackageJSON(root, {
      from: resolutionBase,
      conditions: ["browser", "import", "default"],
    });
  } catch (error) {
    throw new Error(
      `Cannot resolve shared dependency ${root} from ${resolutionBase}.`,
      { cause: error }
    );
  }
  const packageRoot = fs.realpathSync(path.dirname(packageJsonPath));
  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")) as {
    name?: string;
    version?: string;
  };

  if (packageJson.name !== root || !packageJson.version) {
    throw new Error(
      `Shared dependency ${root} resolved to ${packageJson.name || "an unnamed package"} at ${packageRoot}.`
    );
  }

  return {
    name: packageJson.name,
    version: packageJson.version,
    packageRoot,
  };
}

export async function validateResolvedSharedPackage(
  root: SharedPackageRoot,
  providerRoot: string,
  snapshot: HaloHostRuntimeSnapshot,
  sourceId?: string
) {
  const resolved = await resolveSharedPackage(root, providerRoot, sourceId);

View on GitHub (pinned to d2f5165f9c)

Solutions

1. User logs in again to obtain a fresh remember-me cookie.
2. Increase the remember-me token validity (halo.security.remember-me.token-validity) if users are being logged out too soon.
3. Ensure server clocks are NTP-synced so expiries are not computed prematurely.

Example fix

// application.yaml (halo config) — extend validity
spring:
  security:
    rememberme:
      tokenValiditySeconds: 2592000 # 30 days

// Framework-owned flow. To pre-check expiry of a known token shape:
long expiry = Long.parseLong(tokens[1]);
if (expiry < System.currentTimeMillis()) {
    // expire cookie and prompt re-login rather than submitting
}

autoLogin(exchange)
    .onErrorResume(InvalidCookieException.class, e -> {
        log.debug("Remember-me expired; user must re-authenticate");
        return Mono.empty();
    })

When it happens

Trigger: A returning user presents a remember-me cookie whose stored expiry timestamp has passed the configured token validity period (default two weeks).

Common situations: User returns after the remember-me validity elapsed; server clock skew; validity shortened in config leaving older cookies 'expired'.

Related errors

• Cannot resolve shared dependency ${root} from ${resolutionBa
• Cookie contained signature '{}' but expected '{}'
• Cookie token[1] did not contain a valid number (contained '{
• Cookie token was not Base64 encoded; value was '{}'
• ESM UI provider output must expose a default PluginModule ex

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/70363e600c1eddaf. Report an issue: GitHub.