CommandBox installer leaving root folders

CommandBox 5.2.1+00295

Working on getting a site up on my IIS server. Running Lucee. NOT using Commandbox for server on production, only local.

When I do “install” in the commandbox prompt, it pulls down the dependencies, including some lex items. Then leaves them behind. Not sure if I’m doing something wrong, or this is some expected side effect.Commandbox-LEX-Leftovers

It’s working as designed, though probably not working like you want. The CommandBox ability to install a lex file will only place it in the actual Lucee server’s deploy folder if there is a CommandBox Lucee server defined in the same folder that you ran the install from. CommandBox doesn’t know anything about your non-CommandBox folder, so it just does the default installation routine which is to dump it in a folder there in the working dir.

I would assume they aren’t doing anything just sitting there. If I remove them, will they come back with a “box install” command being run? Also, as dependencies that seem to be required, should I do something with them? I’ve made sure that all of the packages in the Lucee server are updated. (Like Lucene, etc.)

I’m trying to get a Contentbox site up and running. Lastly, is there a document somewhere that can explain how one can work locally, yet be able to provide updates, etc. to the site? I guess using import / export?

No, not in your web root. but to be clear, that’s where you asked for them to be installed. Again, like I said above, CommandBox only does the trick where it “detects” the existence of a Lucee server and puts the lex files int he deploy folder IF AND ONLY IF you are using a CommandBox server. The default behavior is exactly what you see here and is the same as any other non-module package like testbox or coldbox,. They just get dropped in the web root. CommandBox is doing what it’s built to do. You seem to think it’s going to do more.

Yes of course. That’s what package managers do. They install things. So CommandBox will keep installing those every time you ask it to.

Well yes, if you want them to be used, lol. If you keep installing them to the web root, you’d need to manually move them. I would recommend you stop using the box.json to handle your lex dependencies unless you start using the installPaths entry to tell CommandBox an alternative location to put them. Perhaps just use the env vars or JVM args that ask Lucee to install those extensions on first run.

Assuming you are talking about logging into the Lucee admin and updating extensions there-- that is wholly unrelated to this conversation and has no real overlap in the functionality of CommandBox. If you’re just going to manually update your extensions in the Lucee admin, why are you even asking CommandBox to also download extensions as well? I don’t quite follow why you’ve set this up.

This is also irrelevant so far as I know unless you’re trying to say that this box.json is not something you created and it came as part of a ContentBox download or something. I’ve been assuming you setup the box.json. Is this not the case?

I don’t follow what you’re asking, but if this is a question about how ContentBox works, please start a fresh thread for it.

Sorry to make things confusing. The box.json came from my local, running, of course, as a Commandbox Lucee server for the site development work. I guess it isn’t super clear (to me) what things are being installed for Commandbox as opposed to what things are being installed for the site itself. I had assumed “box install” was … like “npm install” and installs site dependencies as opposed to things that the Commandbox itself needs. Since I’m pretty sure Commandbox knows where it lives, I wouldn’t expect it to be an issue to get “it’s own stuff in it’s own place”. I figured Lucene lex, for example, was related to the Contentbox search features not to Commandbox.

As to “why am I asking Commandbox to install extensions”, I didn’t, per se. They just showed up in box.json, again, I assumed as dependencies to any or all of Contentbox, Contentbox-installer, Contentbox-DSNCreator packages or it’s internal package dependencies.

It seems you’re saying that I should setup this installPaths variables, point it at the correct Lucee installation directory, and hope they get there. I’m not sure I’m qualified to determine what should be installed and what shouldn’t. Working with npm, which obviously Commandbox is very similar to, typically one would push their own core code, and run “box install” to get the /modules installed (as opposed to committing them to your project repo). I would’ve expected this means that box.json gets committed so the project does know its dependencies. While “I’m setting up a contentbox site” might be irrelevant, sure, I added that to basically describe where these dependencies came from.

I apologize, Brad. I know it can be tough to answer rookie questions when the helper (you in this case) are so super familiar with the underlying tech. Thanks for the help and clarifications.

I don’t think any of them are being installed “for commandBox” unless there are actual CommandBox modules in the dependency list. I do think you’re conflating CommandBox and Lucee. Also, I think we need to see your box.json file. We’re quite a few posts in and still making a lot of guesses about what you have setup since you haven’t shown any of it.

To be clear, CommandBox doesn’t need any of those lex files. There is no relation there. CommandBox can install system modules which are the equivalent of installing a “global” module in npm which can also register a global command in the path.

It does, but what does CommandBox have to do with your app or your Lucee server that’s running your app. These are totally unrelated things. The CommandBox CLI may embed Lucee server, but that’s a black box implementation detail that shouldn’t effect anything you’re doing.

CommadBox isn’t trying to get anything for itself. I’m not understanding where you got that idea from. We just really need to see your box.json to understand what you’re doing. If there are lex files in there, which I presume there are, they have nothing at all to do with CommandBox itself.

I don’t understand. Where did this box.json come from? Is there another developer sitting at your computer and typing into your JSON files while you’re at lunch? Dependencies don’t just show up in there on their own.

If this is a ContentBox site and you just downloaded a ContentBox installer and ran install, then this 100% changes the entire conversation we’re having. This should have been information in the very first post. This is potentially the difference between you adding lex dependencies manually, or just downloading a project that happened to already have them in there. but since I can’t see your box.json nor do I know the steps you followed to get to this point, I still really don’t know the answer to this.

We need to back up. You started this thread (tagged as CommandBox CLI) saying nothing at all about ContentBox and nothing at all about getting your box.json from some outside source. So I assumed these are dependencies you explicitly added. if this is not the case, we need to start this entire conversation over from scratch with context about what’s going on.

Yes, that is exactly how CommandBox works, just like npm.

To rephrase, if you’re working with ContentBox on the side and decided to manually add some Lucee extensions to your box.json because you wanted to control some Lucee extensions, then the ContentBox part is irrelevant. If the lex dependencies themselves actually came from a ContentBox download, then it’s supremely relevant. Again, this is still not clear what is going on here.

No need to apologize. Just trying to get to the bottom of this so we can help you :slight_smile:

Quite right, box.json might help. Yes, other than initially creating the site with Commandbox, then bringing contentbox down with “install contentbox” (or similar command), I didn’t add anything to the json file. I did install some themes, which didn’t work (older verions, not good for current Contentbox) so I removed them manually, other than that, I didn’t touch the box.json.

To be clear, in no way did I manually add those extensions. I’m also certain that I did NOT copy the file from anywhere, box created it. As to the extensions, I’ll run a quick test on a “new site” I’ll create for this.

Well, none of the things I installed (contentbox, -installer, cfconfig) added those dependencies. I have ZERO idea where they came from, therefore I think that solves the issue. I certainly didn’t add them manually, but I can’t tell you where they came from, either. (I did find a slightly older copy of the site, and that box.json had them, too, so maybe I DID copy it, but it still would’ve been commandbox setup). I wish I had better answers to your questions to my questions!

We can close the topic. Thanks for getting me to investigate further. (I had assumed you’d immediately recognize them as being part of one of the core modules, but clearly they aren’t.)

Thanks for the time, Brad. And thanks for the further detail on how Commandbox works.

"name": "rvkb",
"version": "1.0.0",
"author": "You",
"location": "",
"slug": "rvkb",
"createPackageDirectory": false,
"type": "mvc",
"keywords": "",
"homepage": "",
"documentation": "",
"repository": {
	"type": "",
	"url": ""
"bugs": "",
"shortDescription": "",
"contributors": [],
"ignore": [],
"devDependencies": {
	"testbox": "^4.0.0"
"installPaths": {
	"coldbox": "coldbox/",
	"testbox": "testbox",
	"contentbox": "modules/contentbox/",
	"cbvictory": "modules/contentbox/themes/cbvictory/"
"dependencies": {
	"coldbox": "^5.3.0",
	"lucenesearch24132lex": "lex:",
	"microsoftsqljdbc400lex": "lex:",
	"commysqlcj809lex": "lex:",
	"pdfextension10080lex": "lex:",
	"s3extension094122lex": "lex:",
	"contentbox": "^4.2.1",
	"contentbox-installer": "^4.2.1",
	"cbvictory": "^1.0"
"scripts": {}