Standalone binary and dependency diet: --splitting, Node-only provider registration, webfetch DOM swap, jiti/codemode single-ship, dependency hygiene

[code-yeongyu]

Summary

Track one release-oriented dependency-diet effort for standalone binaries and the published package.

Reproduction

Build the standalone binaries and inspect their entry graphs and published tarball. Exercise Bedrock, Cursor-agent, and Devin-agent from an embedded dist/cli.js consumer, and exercise webfetch and codemode in a compiled binary.

Expected

Standalone builds avoid duplicating the shared RPC session-worker graph, provider modules resolve when first used in every isolate, webfetch uses a compile-safe lightweight DOM, jiti and codemode are shipped once, and release artifacts omit unnecessary sourcemaps and unused dependencies.

Actual

Compiled standalone binaries bundle each entry point separately, so the RPC session worker duplicates approximately 21 MiB of the main graph. Bedrock/Cursor-agent/Devin-agent use variable-specifier lazy imports while only the senpi binary's own startup registers static overrides, so consumers embedding dist/cli.js can get Cannot find module at first provider use; Devin has no override setter. Webfetch pulls jsdom plus css-tree, approximately 8 MiB of a 21 MiB entry bundle, and css-tree needs compile-time patching inside $bunfs. jiti is statically imported in compiled binaries. Codemode ships twice (bundled factory plus on-disk sidecar). The published package includes 19 MiB of dist/**/*.map.

Evidence

Bun documentation states that multiple entrypoints are bundled separately; --splitting is supported with --compile and was verified with the production SessionWorkerClient. The startup-only static override is in src/bun/runtime-setup.ts. The dependency audit found exact-pinned packages behind: @anthropic-ai/sdk 0.125.0, claude-agent-sdk 0.3.270, bedrock 3.1131.0, @google/genai 2.22.0, @bufbuild/protobuf 2.15.0, typebox 1.3.30, and zod 4.6.4; glob, @opentelemetry/api, and canvas are unused.

Root cause

The release build treats entrypoints and runtime/provider registration as binary-local concerns, while several providers and runtime assets are discovered through variable-specifier imports. Heavy DOM and runtime tooling remains in the default graph, and packaging does not consistently enforce single-shipping or sourcemap exclusion.

Scope + acceptance criteria

Deliver the senpi todos 2-8 outcomes:

• --splitting is enabled in the release script and build:binary, with CI on Bun 1.4.2.
• @code-yeongyu/senpi/bun-runtime exports registerBunRuntimeModules with per-isolate registration.
• Replace jsdom with linkedom and add 12 golden fixtures.
• Add a native Bun extension importer.
• Ship codemode once.
• Complete the dependency-hygiene batch and exclude sourcemaps.
• Publish the resulting version.

Related

Prior art and adjacent work: PRs #1499, #1038, #1540, #1053, #1049, #818, #1283, #1426, #1165, #1164, #643, #1108, #850, #860, and #64; issues #923, #1639, #1290, #854, #1422, #1603, #1604, and #1615. These are related or same-root-cause prior items, not replacements for this release tracker.

[code-yeongyu]

Todo 2 RED captured on the base revision: the parsed-argv contract suite reports 9 passing and 4 failing tests. Both release commands and build:binary lack --splitting; build:binary also lacks the RPC session-worker entry. Existing minify, keep-names, worker-entry and autoload characterization checks pass.

[code-yeongyu]

Todo 3 RED captured against cb31c35: override tests report 2 failures and 1 passing fallback case because the setter is absent. The runtime-entry suite also exposes the missing provider public subpath before execution. Remote isolated install and baseline build passed. No production changes yet.

[code-yeongyu]

Todo 2 GREEN: all 13 compile-argv contracts pass (18 including existing packaging checks). Split and unsplit real-client relocation tests pass three consecutive runs with two live workers, SharedArrayBuffer acknowledgments and clean exits. Same-script release comparison: 107,470,512 -> 83,618,064 bytes, a reduction of 23,852,448 bytes (22.75 MiB), exceeding the 14 MiB gate. Relocated --version exits 0.

[code-yeongyu]

Todo 2 QA evidence: the relocated release binary opens two distinct sessions, returns each scripted local-model answer on the correct session, reattaches an existing path, rejects a prompt without a session id, and exits 0 after closing. The missing-splitting mutation fails exactly the Windows command contract and passes after restoration. All 249 scripts tests pass, and isolated npm/Bun/pnpm install+build verification passes. No real provider credentials were used.

[code-yeongyu]

Todo 3 GREEN: 3 setter tests, 2 registration tests, and 3 bundle-reachability tests pass. Relocated release-binary probes return auth for all 3 APIs in both classic and shared RPC (6/6). Worker-registration mutation produces 3 shared-mode module-resolution failures while all 3 classic probes still pass; mutation restored. Root static check passes. Separate Node-bundle and entry-graph gates expose existing issues being checked against the unchanged base.

[code-yeongyu]

Todo 2 CI milestone: all three relocated-worker legs (Ubuntu/macOS/Windows) are GREEN in run 34751382116; static, changelog, scripts/workspaces and coding-agent shards also pass. Broader CI run 34751382143 fails RPC named pipes (Windows): rpc-host-lifecycle.test.ts, "does not exit while a turn is active even with no connections; exits after the turn settles", connect ENOENT on the named pipe (26 pass, 1 fail). Check and test fails only as its aggregate. Exact-base main run 34748558133 and newer-main run 34751189154 both PASS that job, so an identical base failure is NOT established. Attribution: the failing job already uses Bun 1.4.2, runs the unchanged workspace build, and launches the unchanged Node source host; it never invokes the changed standalone commands or worker-compile test. This is an unresolved external-path lifecycle risk, not a proven base reproduction. No blind rerun or unrelated fix was made. PR #1658 remains open for orchestration.

[code-yeongyu]

Todo 2 cleanup complete: the remote task namespace, clones, binaries and fixture trees were removed with exit 0. The RPC child and fake model server were closed; the real credential store remained unchanged. No task files or processes were created on the offline secondary host. PR #1658 stays open and unmerged; compiled-worker CI is green, while the separately documented Windows source-host lifecycle failure and its aggregate remain red.

[code-yeongyu]

todo 2 merged: #1658 (336293e) - standalone binaries compile with --splitting; darwin-arm64 pi binary 107,470,512 -> 83,618,064 B (-22.75 MiB); compiled-worker CI green on ubuntu/macos/windows; gate review confirmed.

[code-yeongyu]

Todo 3 QA evidence: fresh committed-branch verification passed install/build, root static and browser checks, relative imports, runtime dependency validation, 5 unit tests, and 3 bundle checks. Relocated release probes passed three consecutive runs: 18/18 auth outcomes. An isolated consumer resolved the published bun-runtime subpath and called it synchronously twice. The per-worker mutation remains a precise 3-pass/3-fail negative control. Both additional gate failures were reproduced on the unchanged base and are documented in PR #1660. Required unreleased notes have been added; CI is checking the documentation follow-up.

[code-yeongyu]

Todo 18 RED captured: a deterministic real-socket regression places an authenticated readiness connection entirely between idle ticks. The sampled-only proxy closes the listener at the next tick, and the following client fails with connect ENOENT (1 failed; 28ms test execution). The existing lifecycle suite passed 30/30 before and after the behavior-preserving proxy extraction. No retry or timeout increase is used. Refs #1656.

[code-yeongyu]

Todo 18 GREEN: recording authenticated connection edges removes the forced-ordering ENOENT failure; the complete macOS lifecycle suite passes 31/31. The idle window and tick interval are unchanged, rejected authentication does not count as activity, and no client retry was added. Windows CI streak and boundary/security controls follow before completion.

[code-yeongyu]

Todo 18 QA: macOS lifecycle suite passed 33/33 on 3 consecutive runs; related ensure/transport/daemon suites passed 40/40. Static validation and build passed. Real RPC CLI QA passed 4/4; deterministic model-to-tool-to-final-text QA passed 4/4 with 2 model requests. Mutation removes the activity notifications and reproduces ENOENT (1 failed, 2 controls passed). Broader mock-loop self-test remains 13/22 on both base and patched source: 9 pre-existing tool-text recovery assertions fail; recorded separately, not changed here. Windows proof remains pending.

[code-yeongyu]

Todo 3 CI GREEN: PR #1660 is OPEN and CLEAN at 3c687da after rebasing onto 336293e. All required checks passed, including Static checks, coding-agent 1-3, workspaces/scripts, Windows RPC, and relocated-worker on all three platforms. Frozen install needed no lockfile changes; both manifest changes are retained. Final split-binary probes passed 18/18 over three consecutive runs, and the worker-registration negative control remained precise. Remote test artifacts and namespaces are cleaned. The PR remains unmerged for orchestration.

[code-yeongyu]

todo 3 merged: #1660 (7924335) - registerBunRuntimeModules() public subpath @code-yeongyu/senpi/bun-runtime registers Bedrock/Cursor/Devin (new Devin setter) once per isolate incl. the shared-session worker; compiled provider probes 18/18 auth across both RPC modes; gate review confirmed. Pre-existing base defects found on the way are tracked as plan items (Node worker-bundle builder, check:entry-graphs).

[code-yeongyu]

Todo 5: baseline golden RED captured: 24 missing golden artifacts failed as expected; the multibyte output-cap assertion passed. Production conversion code remains unchanged. Generating the 24 baseline artifacts before the DOM migration.