feat(react-email): installation of UI without npm install

[gabrielmfern]

• Removes the need for projects to install @react-email/preview-server; the CLI downloads/packs it into ~/.react-email automatically.
• Keeps @react-email/preview-server published for backwards compatibility and independent versioning (step toward a single react-email package).
• Makes builds more predictable by copying node_modules instead of reinstalling; copies node_modules/.bin separately to preserve npm symlinks (verbatimSymlinks).
• Adds a behavior specific to when running in React Email's monorepo: if running from source (not under node_modules), use the monorepo’s local @react-email/preview-server path by using @manypkgs/get-packages.
• Trade-off: switching CLI versions frequently will re-download/reinstall the preview server (can be improved later).

My plan is to release this as a canary first, try it out for a week or more and then release it as a stable version.

---

Summary by cubic

Run the React Email UI without adding @react-email/preview-server to your project. The CLI auto-installs the UI into $HOME/.react-email (or uses the monorepo workspace) and installs its dependencies, keeping setup fast and backward compatible.

• New Features
  • Automatically downloads and extracts @react-email/preview-server via npm pack to $HOME/.react-email; installs all UI dependencies.
  • Ensures the UI version matches react-email; reinstalls on mismatch.
  • Updates email build to use the installed UI, sets turbopack/output tracing roots to the project root, and shows an error if the emails directory is missing.
  • Adds install spinners and messages; adds tar dependency and a basic installer test.

^{Written for commit 55b1594. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 55b1594

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
react-email	Minor
@react-email/preview-server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
react-email	Ready	Preview, Comment	Jan 23, 2026 4:44pm
react-email-demo	Ready	Preview, Comment	Jan 23, 2026 4:44pm

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[gabrielmfern]

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend/react-email/@react-email/preview-server@2573

npm i https://pkg.pr.new/resend/react-email@2573

commit: 55b1594

[cubic-dev-ai]

3 issues found across 8 files

Prompt for AI agents (all 3 issues)

Understand the root cause of the following 3 issues and fix them.


<file name="packages/react-email/src/utils/get-preview-server-location.ts">

<violation number="1" location="packages/react-email/src/utils/get-preview-server-location.ts:42">
Avoid emitting the success spinner message when installation fails; the finally block currently overrides error cases with a success status.</violation>

<violation number="2" location="packages/react-email/src/utils/get-preview-server-location.ts:78">
The installation logic incorrectly assumes `@react-email/preview-server` only needs `next` as a dependency. By stripping out all other dependencies from `package.json`, it guarantees runtime crashes. The original `packages/preview-server/package.json` lists numerous required dependencies that are now omitted from installation.</violation>

<violation number="3" location="packages/react-email/src/utils/get-preview-server-location.ts:87">
The installation process is opaque and harms developer experience. It uses `execSync` with `stdio: &#39;ignore&#39;`, which hides `npm` errors from the user. Furthermore, it breaks the monorepo&#39;s local development workflow by always fetching from npm, which prevents testing local changes to the preview server.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}