fix: add micromatch to package deps (#1020)

packages/cli/src/utils/package.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {
+  readPackageUp,
+  type PackageJson as BasePackageJson,
+} from 'read-package-up';
+import { fileURLToPath } from 'url';
+import path from 'path';
+
+export type PackageJson = BasePackageJson & {
+  config?: {
+    sandboxImageUri?: string;
+  };
+};
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+let packageJson: PackageJson | undefined;
+
+export async function getPackageJson(): Promise<PackageJson | undefined> {
+  if (packageJson) {
+    return packageJson;
+  }
+
+  const result = await readPackageUp({ cwd: __dirname });
+  if (!result) {
+    // TODO: Maybe bubble this up as an error.
+    return;
+  }
+
+  packageJson = result.packageJson;
+  return packageJson;
+}

packages/cli/src/utils/sandbox.ts

@@ -10,7 +10,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { quote } from 'shell-quote';
-import { readPackageUp } from 'read-package-up';
+import { getPackageJson } from './package.js';
 import commandExists from 'command-exists';
 import {
   USER_SETTINGS_DIR,
@@ -102,13 +102,10 @@ async function shouldUseCurrentUserInSandbox(): Promise<boolean> {
 async function getSandboxImageName(
   isCustomProjectSandbox: boolean,
 ): Promise<string> {
-  const packageJsonResult = await readPackageUp();
-  const packageJsonConfig = packageJsonResult?.packageJson.config as
-    | { sandboxImageUri?: string }
-    | undefined;
+  const packageJson = await getPackageJson();
   return (
     process.env.GEMINI_SANDBOX_IMAGE ??
-    packageJsonConfig?.sandboxImageUri ??
+    packageJson?.config?.sandboxImageUri ??
     (isCustomProjectSandbox
       ? LOCAL_DEV_SANDBOX_IMAGE_NAME + '-' + path.basename(path.resolve())
       : LOCAL_DEV_SANDBOX_IMAGE_NAME)