@kb-labs/devkit 2.104.0 → 2.105.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kb-labs/devkit",
   "description": "Shared developer toolkit for KB Labs projects: TS/ESLint/Prettier/Vitest/Tsup presets and reusable GitHub Actions.",
-  "version": "2.104.0",
+  "version": "2.105.0",
   "type": "module",
   "license": "MIT",
   "exports": {
@@ -107,6 +107,26 @@
     ".github/workflow-templates/**",
     ".github/actions/**"
   ],
+  "scripts": {
+    "build": "echo \"@kb-labs/devkit: nothing to build\"",
+    "clean": "rimraf dist",
+    "dev": "tsup --config tsup.config.ts --watch",
+    "fixtures": "node scripts/fixtures.js –help",
+    "fixtures:bootstrap": "node scripts/fixtures.js –action=bootstrap",
+    "fixtures:build": "node scripts/fixtures.js –action=build",
+    "fixtures:check": "node scripts/fixtures.js –action=check",
+    "fixtures:ci": "node scripts/fixtures.js –action=check –since=${GITHUB_BASE_REF:-origin/main} –concurrency=3 || node scripts/fixtures.js –action=check",
+    "fixtures:clean": "node scripts/fixtures.js –action=clean",
+    "fixtures:lint": "node scripts/fixtures.js –action=lint",
+    "fixtures:test": "node scripts/fixtures.js –action=test",
+    "lint": "echo \"@kb-labs/devkit: lint skipped (plain JS/MJS, not TS project)\" && exit 0",
+    "lint:fix": "eslint . --fix --ignore-pattern 'dist/**'",
+    "paths": "node ./bin/devkit-paths.mjs",
+    "postinstall": "kb-devkit-tsup-external --generate || true",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest --passWithNoTests",
+    "type-check": "echo \"@kb-labs/devkit: type-check skipped (plain JS/MJS, not TS project)\" && exit 0"
+  },
   "dependencies": {
     "eslint-import-resolver-typescript": "^3.10.1",
     "eslint-plugin-import": "^2.32.0",
@@ -117,6 +137,7 @@
     "yaml": "^2.8.0"
   },
   "devDependencies": {
+    "@kb-labs/devkit": "workspace:*",
     "@types/node": "^24.3.3",
     "@vitest/coverage-istanbul": "^4.1.4",
     "@vitest/coverage-v8": "^3.2.4",
@@ -130,13 +151,13 @@
     "tsup": "^8.5.0",
     "typescript": "^5.9.2",
     "typescript-eslint": "^8.44.0",
-    "vitest": "^3.2.6",
-    "@kb-labs/devkit": "2.104.0"
+    "vitest": "^3.2.6"
   },
   "engines": {
     "node": ">=20.0.0",
     "pnpm": ">=9.11.0"
   },
+  "packageManager": "pnpm@9.11.0+sha512.0a203ffaed5a3f63242cd064c8fb5892366c103e328079318f78062f24ea8c9d50bc6a47aa3567cabefd824d170e78fa2745ed1f16b132e16436146b7688f19b",
   "peerDependencies": {
     "@playwright/test": "*",
     "eslint": "^9.35.0",
@@ -170,25 +191,5 @@
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "echo \"@kb-labs/devkit: nothing to build\"",
-    "clean": "rimraf dist",
-    "dev": "tsup --config tsup.config.ts --watch",
-    "fixtures": "node scripts/fixtures.js –help",
-    "fixtures:bootstrap": "node scripts/fixtures.js –action=bootstrap",
-    "fixtures:build": "node scripts/fixtures.js –action=build",
-    "fixtures:check": "node scripts/fixtures.js –action=check",
-    "fixtures:ci": "node scripts/fixtures.js –action=check –since=${GITHUB_BASE_REF:-origin/main} –concurrency=3 || node scripts/fixtures.js –action=check",
-    "fixtures:clean": "node scripts/fixtures.js –action=clean",
-    "fixtures:lint": "node scripts/fixtures.js –action=lint",
-    "fixtures:test": "node scripts/fixtures.js –action=test",
-    "lint": "echo \"@kb-labs/devkit: lint skipped (plain JS/MJS, not TS project)\" && exit 0",
-    "lint:fix": "eslint . --fix --ignore-pattern 'dist/**'",
-    "paths": "node ./bin/devkit-paths.mjs",
-    "postinstall": "kb-devkit-tsup-external --generate || true",
-    "test": "vitest run --passWithNoTests",
-    "test:watch": "vitest --passWithNoTests",
-    "type-check": "echo \"@kb-labs/devkit: type-check skipped (plain JS/MJS, not TS project)\" && exit 0"
   }
-}
+}

package/tsup/node.js

@@ -2,6 +2,10 @@ import { defineConfig } from 'tsup'
 import { readTsupExternalSync } from './external-sync.mjs'
 import { readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
 
 /**
  * Derive tsup entry points from package.json.
@@ -55,10 +59,10 @@ function resolveManifestDistPath() {
 }
 
 /**
- * tsup `onSuccess`: emit dist/manifest.json by reading the compiled
- * dist/manifest.js as TEXT and evaluating the exported object.
+ * Fast path: read the compiled dist/manifest.js as TEXT and evaluate just the
+ * `manifest` object literal via Function().
  *
- * Why not dynamic `import()`?
+ * Why not dynamic `import()` here?
  * In multi-entry tsup builds `onSuccess` fires while Node's module cache may
  * still hold a stale (empty) version of dist/manifest.js from an earlier
  * watch-mode iteration, or the file descriptors may not be fully flushed.
@@ -66,32 +70,88 @@ function resolveManifestDistPath() {
  * it returned an empty module in CI, producing a 0-byte manifest.json that
  * kb-create rejected with "unexpected end of JSON input".
  *
- * Reading the COMPILED JS as text is safe: tsup has already written the file
- * before invoking `onSuccess`, and we're parsing plain JavaScript (no type
- * annotations) with a small Function() eval — controlled, no user input.
+ * This only works when `manifest = {...}` is a self-contained literal with no
+ * references to other module-scope variables. Service manifests tend to be
+ * written that way. Plugin manifests generally are NOT — they build
+ * `permissions` via `combinePermissions().build()` as a prior statement and
+ * reference the result by identifier inside the `manifest` literal, which
+ * this isolated eval can't resolve. For those, see `emitManifestJsonViaSubprocess`.
+ */
+function emitManifestJsonFast(distPath) {
+  const js = readFileSync(distPath, 'utf8')
+  // tsup ESM output pattern (from inspecting actual built files):
+  //   var manifest = { schema: "kb.service/1", id: "...", ... };
+  //   var manifest_default = manifest;
+  //   export { manifest_default as default, manifest };
+  // Capture everything between `var manifest =` and the next `var manifest_default`.
+  const match = js.match(/var\s+manifest\s*=\s*(\{[\s\S]*?\n\});\s*\nvar\s+manifest_default/)
+  if (!match) return null
+  // eslint-disable-next-line no-new-func
+  const obj = new Function(`"use strict"; return (${match[1]})`)()
+  if (!obj || typeof obj !== 'object') return null
+  return obj
+}
+
+/**
+ * Fallback path: spawn a fresh `node` process to `import()` the compiled
+ * module and dump the resolved default export as JSON on stdout.
+ *
+ * Running in a separate process (rather than `import()` in-process) sidesteps
+ * the same-process module-cache staleness problem the fast path avoids by
+ * using text parsing — this process only ever imports the file once, fresh
+ * off disk. This is the same technique `internal/scan/scanner.js` in
+ * kb-create already uses at install time; here it runs once at build time
+ * instead. For plugin manifests (which build `permissions` via
+ * `combinePermissions().build()` as a separate statement, not an inline
+ * literal) this is the path that actually resolves the real object — the
+ * fast text-eval path can't see that prior statement's result. In practice
+ * this fallback fires for nearly every plugin manifest, not rarely.
+ */
+async function emitManifestJsonViaSubprocess(distPath) {
+  const url = new URL(`file://${distPath}`).href
+  const script = `import(${JSON.stringify(url)}).then(m => process.stdout.write(JSON.stringify(m.default ?? m.manifest)))`
+  const { stdout } = await execFileAsync(process.execPath, ['-e', script], {
+    cwd: process.cwd(),
+    timeout: 30_000,
+  })
+  const obj = JSON.parse(stdout)
+  if (!obj || typeof obj !== 'object') return null
+  return obj
+}
+
+/**
+ * tsup `onSuccess`: emit dist/manifest.json from the compiled manifest
+ * module, for both service (`kb.service/*`) and plugin (`kb.plugin/*`)
+ * schemas, so kb-create (a Go binary) can read install-relevant fields
+ * without executing JS.
  */
-function emitManifestJson() {
+async function emitManifestJson() {
   const distPath = resolveManifestDistPath()
   if (!distPath || !existsSync(distPath)) return
+  let obj = null
+  let fastPathError = null
+  try {
+    obj = emitManifestJsonFast(distPath)
+  } catch (err) {
+    fastPathError = err
+  }
+  if (!obj || typeof obj.schema !== 'string' || !/^kb\.(service|plugin)\//.test(obj.schema)) {
+    try {
+      obj = await emitManifestJsonViaSubprocess(distPath)
+    } catch (err) {
+      console.warn(`[kb-devkit] failed to emit manifest JSON for ${distPath}:`, fastPathError ?? err)
+      return
+    }
+  }
+  if (!obj || typeof obj.schema !== 'string' || !/^kb\.(service|plugin)\//.test(obj.schema)) {
+    console.warn(`[kb-devkit] manifest at ${distPath} has no recognizable kb.service/kb.plugin schema — skipping JSON emission`)
+    return
+  }
   try {
-    const js = readFileSync(distPath, 'utf8')
-    // tsup ESM output pattern (from inspecting actual built files):
-    //   var manifest = { schema: "kb.service/1", id: "...", ... };
-    //   var manifest_default = manifest;
-    //   export { manifest_default as default, manifest };
-    // Capture everything between `var manifest =` and the next `var manifest_default`.
-    const match = js.match(/var\s+manifest\s*=\s*(\{[\s\S]*?\n\});\s*\nvar\s+manifest_default/)
-    if (!match) return
-    // eslint-disable-next-line no-new-func
-    const obj = new Function(`"use strict"; return (${match[1]})`)()
-    if (!obj || typeof obj !== 'object') return
-    // Scope to SERVICE manifests only — plugin/adapter manifests are loaded as
-    // JS by the runtime and don't need a sibling .json.
-    if (typeof obj.schema !== 'string' || !obj.schema.startsWith('kb.service/')) return
     const jsonPath = distPath.replace(/\.js$/, '.json')
     writeFileSync(jsonPath, JSON.stringify(obj, null, 2) + '\n')
-  } catch {
-    // Never fail the build over manifest emission.
+  } catch (err) {
+    console.warn(`[kb-devkit] failed to write manifest JSON for ${distPath}:`, err)
   }
 }
 
@@ -142,7 +202,8 @@ export default defineConfig({
   skipNodeModulesBundle: true,
   shims: false,
   // Emit dist/manifest.json from the built manifest module so Go installers
-  // (kb-create) can register the service. No-op for packages without a manifest.
+  // (kb-create) can read service/plugin install metadata without executing
+  // JS. No-op for packages without a manifest.
   onSuccess: emitManifestJson,
   ignoreWatch: [
     '**/node_modules/**',