feat: offer to install dependencies missing for a managed sess

[roaldarbol]

Follow-up to REditorSupport#1856, against your branch, as offered in my review there.

A managed sess is shared by every R with the same platform and version, but its Imports may only have been visible to the R that prepared it. With conda/pixi that's easy to hit: a project environment without processx/later/... reuses the ready managed copy and fails with there is no package called 'ps', with no prompt.

With this change, when a ready managed copy is reused by an R that cannot find its dependencies:

• The R terminal lists the missing packages, and the extension asks with a new consent reason, dependencies. On approval, only those packages are installed into the managed library. Declining keeps R running without the session watcher, as for the other reasons. "Don't ask again" still applies per bundled revision.
• sess_load_namespace() names every missing package up front, instead of failing on the first loadNamespace().

Changes:

• R/sess_source.R: sess_imports() and sess_missing_dependencies(), which check Imports plus ps for processx against the normal libraries and the managed library.
• R/attach_sess.R: the dependency path. The consent request and repository selection move into local helpers, so both paths share them unchanged.
• R/sess-package-install.R: sess_install_missing_dependencies(). It reuses sess_install()'s child-process environment setup, which I factored out.
• src/sessConsent.ts and src/session.ts: accept dependencies, with its own prompt text.
• sess/README.md: the limitation note now describes the prompt and names pixi alongside renv.

Tests:

• R/tests/attach_sess.R: new dependencies_approve and dependencies_decline cases. A fixture sess imports a package served from a local file repository; it's installed into the managed library from another "project" library, then reused where that library isn't visible. The consent agent also logs the request reason, so the cases assert dependencies. Without the R changes, the new cases fail with the original there is no package called ....
• src/test/node/sessConsent.test.ts: dependencies reaches the prompt, and an unknown reason is declined without prompting.

Checked locally on macOS x86_64, rebased on b30991f:

• test:sess-identity passes with CRAN R 4.6 and with conda-forge R 4.5 from pixi.
• tsc and lint are clean.
• Node suite: 135 passing vs 133 on b30991f. The same 3 R Interactive tests fail locally with and without this change; they depend on this machine's R setup.
• In pixi environments that share one managed root, I drove vscode_r_prepare_sess() with a scripted consent responder:
  • A dependency-free environment: decline leaves the watcher off, approve installs only the missing packages, and later runs reuse them without prompting.
  • Environments with the dependencies or a conda-forge r-sess are unaffected.
  • No file in any environment's R library changed.

I haven't tested Windows, Linux, or the prompt UI.

I prepared this with an AI coding assistant (Claude Code); I've reviewed the changes and the test results.

🤖 Generated with Claude Code

[eitsupi]

Thanks, but we deliberately decided to defer automatic dependency repair from REditorSupport#1856 because managing dependencies across isolated R environments is considerably more complex than managing the bundled sess package itself (REditorSupport#1856 (comment)).
This limitation is already documented in sess/README.md.

This PR demonstrates a real problem, particularly for conda/pixi environments, but I don't think the current implementation is sufficient to introduce dependency repair safely.

There are several concerns that would need to be addressed first:

• Binary compatibility: The managed library is shared based on R platform, major/minor version, and sess revision. Different R distributions (e.g., CRAN R and conda-forge R) may share that identity without having compatible native dependencies. Packages such as processx and ps make this particularly important.
• Dependency resolution: sess_missing_dependencies() checks package presence but does not validate version constraints or transitive dependencies. A package may exist but still be incompatible or fail to load.
• Managed library consistency: Installing dependencies into an existing .ready library changes its contents after the original verification. We need to define how dependency versions, failed or partial installations, and compatibility across subsequent environments are handled.
• Consent and environment ownership: Installing shared dependencies is different from installing bundled sess. We need to consider interactions with renv/pixi, project-specific dependency versions, and whether the existing revision-scoped "Don't ask again" behavior and installation prompt are appropriate for dependency repair.

The current managed-library design intentionally keeps this scope limited. Expanding it should be a separate design discussion rather than an incremental addition to REditorSupport#1856.

For now, I would prefer to retain the documented limitation and let users install missing dependencies through their project's package manager. Improving the error message to identify missing dependencies could be a useful smaller follow-up without introducing automatic dependency management.

I appreciate the concrete reproduction and investigation, but I would leave automatic dependency repair for future work.

[roaldarbol]

Fair enough, I guess that makes sense. 🙂 I'll close the PR then. Is this documented in an existing issue, or should I go ahead and open an issue for this - in case it makes sense to look into it at a later point?

[eitsupi]

Thanks.
I think we can open issues after REditorSupport#1856 has been merged.