T-IGB5-auto-detect-artifact-bundled-deps

Status: closed/obsoleted · Impact: low · Complexity: medium

Goal

build-artifact bundles the deps that can’t resolve under plain Node — markdown-contract and @sksizer/agent-plugin — from a hardcoded list. Any future non-resolvable dep the shipped code imports (another TS-source workspace package, another file: tarball) silently breaks the plain-Node artifact until someone hits it while cutting a release. Detect these automatically so an extraction can’t regress the artifact without a loud, immediate signal.

Today

Location	Role today
plugin/lib/services/plugin/ops/build-artifact.ts	resolveVendored() returns a HARDCODED two-entry list (markdown-contract, @sksizer/agent-plugin). A third non-resolvable shipped import is not bundled and not flagged.
.github/workflows/release.yml	The pull_request gate now runs build + smoke on PRs, so a regression fails a PR — but only after it lands, and the fix is still a manual resolveVendored edit.
plugin/lib/**, plugin/cli/**	Shipped code may import any workspace package (@sksizer/*) or vendored dep; only the two above resolve in the artifact.

Proposed

build-artifact detects every bare specifier the shipped tree imports that will not resolve under plain Node — a .ts-source entry, a file:/workspace package — and either bundles it automatically or fails with a clear message naming the offenders and how to make them ship-ready. A newly-extracted workspace dep can never produce an artifact that breaks under plain Node.

Approach

1. Scan the emitted plugin JS (or the source import graph) for bare specifiers that resolve to a .ts entry or a file:/workspace package.
2. Decide the policy: auto-bundle each (esbuild, as the current two) versus a fail-loud allowlist. Auto-bundle is more robust; an allowlist is more controlled. Pick one; document why.
3. Keep the cross-bundle specifier rewrite (a bundled dep importing another bundled dep, e.g. agent-plugin → markdown-contract).
4. Cover it with a test/gate so the detection itself can’t silently regress.

Files to touch

Location	Kind	Change
plugin/lib/services/plugin/ops/build-artifact.ts	modify	Replace the hardcoded resolveVendored list with detection (auto-bundle or fail-loud).
plugin/lib/services/plugin/tests/	new	A test that a shipped import of a .ts-source workspace package is handled (bundled or fails clearly).

Acceptance criteria

• AC-1: Adding a shipped import of a .ts-source workspace package makes build-artifact either bundle it or fail with a message naming it — it never emits an artifact that breaks under plain Node.
• AC-2: With auto-bundle, the consumer-install smoke passes for an artifact containing a newly-extracted workspace dep without a manual resolveVendored edit; with an allowlist, the build fails clearly instead.
• AC-3: A bundled dep importing another bundled dep still rewrites to the sibling bundle.

Out of scope

• The broader question of whether the sdlc package should live in this monorepo at all — a separate architecture discussion.
• Making individual workspace packages ship pre-compiled .js instead of .ts source.

Dependencies

• none. Builds on the agent-plugin bundling and the PR-gating shipped alongside this task.

Discovery context

The harness extraction (@sksizer/agent-plugin) broke the plain-Node artifact and was caught only while cutting v0.3.1 — the second such regression after the moon-v2 / Polish work. PR-gating (release.yml pull_request) now catches these at PR time, but the remedy is still a manual resolveVendored entry, which this task removes.

---

← Back to Tasks