@stigmer/runner 3.0.8-dev.20260612082024 → 3.0.8-dev.20260612100207

package/README.md

@@ -36,6 +36,8 @@ make build-runner-slim          # or: npm run build:slim
 
 This produces `dist-slim/`: a tree-shaken esbuild bundle of the whole runner (`main.js`), a build-time-prebuilt Temporal workflow bundle, and a staged `node_modules` containing only the packages that genuinely cannot be bundled (the platform-pruned Temporal native bridge, `@cursor/sdk` and its native binaries, `jq-wasm`) — **~85 MB per platform**. `node dist-slim/main.js` accepts the same modes, environment variables, and IPC protocol as `dist/main.js`. See `scripts/bundle-slim.mjs` for the full layout, `scripts/verify-slim-artifact.mjs` for the boot verification that gates releases, and the [embedding guide](https://docs.stigmer.ai/guides/runners/embedding) for how apps stage it.
 
+> **Why the slim bundle is CommonJS, not ESM.** The runner's auth correctness depends on a deliberate module **load order**: it installs the fetch + HTTP/2 interceptors first, then lazily loads `@cursor/sdk` and `@connectrpc/connect-node` (via dynamic `import()`) so the interceptors are in place before those packages capture `globalThis.fetch` / snapshot the `node:http2` ESM facade. An **ESM** esbuild bundle destroys this — it hoists every external `import` to the top of the output and evaluates them before any code runs, freezing the `node:http2` facade and capturing the original `fetch` before install, which silently breaks proxy auth on the authenticated path (this was the regression in [#170](https://github.com/stigmer/stigmer/issues/170)). A **CJS** bundle preserves the source's lazy evaluation order, so the dynamic-import boundary keeps both interceptors correct. The meta `package.json` deliberately omits `"type": "module"` so `node main.js` runs as CommonJS — do **not** add it back, and do not flip `format` to `"esm"` in `bundle-slim.mjs`. The boot guard `assertHttp2ConnectPatched()` plus the authenticated check in `verify-slim-artifact.mjs` fail loudly if this is ever reverted.
+
 The slim build is also published to npm as `@stigmer/runner-slim` (with per-platform `@stigmer/runner-slim-<platform>` support packages) alongside the full `@stigmer/runner` package on every release.
 
 ## Run modes

package/dist/.build-fingerprint

@@ -1 +1 @@
-{"hash":"fbb008e1ad9ac26c","builtAt":"2026-06-12T08:24:01.655Z","fileCount":193}
+{"hash":"fbb008e1ad9ac26c","builtAt":"2026-06-12T10:03:59.435Z","fileCount":193}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.0.8-dev.20260612082024",
+  "version": "3.0.8-dev.20260612100207",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -86,7 +86,7 @@
     "@opentelemetry/resources": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.0.8-dev.20260612082024",
+    "@stigmer/protos": "3.0.8-dev.20260612100207",
     "@temporalio/activity": "^1.11.0",
     "@temporalio/client": "^1.11.0",
     "@temporalio/common": "^1.11.0",

package/src/activities/execute-cursor/__tests__/http2-interceptor.test.ts

@@ -337,6 +337,15 @@ describe("http2-interceptor", () => {
     // factories. Here we cover the two deterministic contracts: it is a no-op
     // when unconfigured (no import, so it never freezes the facade), and it
     // throws when the frozen facade is out of sync with the patched connect.
+    //
+    // This guard does double duty as a BUNDLER regression detector. The
+    // load-order contract is also defeatable at build time: an ESM esbuild
+    // bundle hoists every external `import` (including the node:http2 pulled in
+    // by connect-node) to the top of the output, freezing the facade before any
+    // install() runs. That is exactly stigmer/stigmer#170's second failure — the
+    // slim bundle is therefore emitted as CJS (scripts/bundle-slim.mjs) and
+    // verified on the authenticated boot path (scripts/verify-slim-artifact.mjs).
+    // The "out of sync" case below is the unit-level analog of that bundle bug.
 
     it("resolves without throwing (and without importing node:http2) when unconfigured", async () => {
       uninstallHttp2Interceptor();