pi-crew 0.9.52 → 0.9.54

package/CHANGELOG.md

@@ -3,6 +3,45 @@
 > **Note:** `atomic-write-v2.ts` / `AtomicWriter` mentioned in historical entries below was consolidated into `atomic-write.ts` as of v0.9.42. This changelog is preserved as historical record — the migration was completed (the v2 class was never adopted; v1 won on simplicity + symlink-safety + link+unlink atomicity). See `docs/migration/atomic-write-v2-migration.md` for the decision rationale.
 
 
+## [0.9.54] — HOTFIX (real root cause): esbuild runtime dep mis-declared as devDependency (2026-07-29)
+
+**Fixes the TRUE root cause** of the extension-load regression that affected 0.9.52 AND 0.9.53. Both are deprecated; `latest` now points here.
+
+### Root cause (the real one — 0.9.53 diagnosed the symptom, not the cause)
+`esbuild` is imported at **runtime** by the shipped bundle `dist/index.mjs` — via `src/runtime/dynamic-workflow-runner.ts` (`import { transformSync } from "esbuild"`, used to compile `.dwf.ts` dynamic-workflow files). But it was declared as a **`devDependency`**, not a `dependency`. `devDependencies` are NOT installed by `npm install pi-crew` (production), so the bundle failed to load with `Cannot find package 'esbuild'`, and `index.ts` then fell back to the `src/` strip-types path — which also fails when `src/` isn't shipped (PKG-2) → `Cannot find module './src/extension/register.ts'`.
+
+This was **latent** since esbuild was first used at runtime: pre-0.9.52 it was masked because `src/` WAS shipped, so the strip-types fallback loaded `register.ts` without eagerly pulling in the dynamic-workflow runner's esbuild import. PKG-2 (0.9.52) removed `src/`, surfacing the latent bundle-load failure.
+
+0.9.53's dynamic-import change to `index.ts` was necessary (correct) but NOT sufficient — it only changed how `index.ts` *reaches* `src/`; it did not fix the bundle failing to load in the first place.
+
+### Fix
+- **Move `esbuild` from `devDependencies` to `dependencies`.** The bundle now loads in production. Verified via a faithful simulation of Pi's loader (jiti with Pi's peerDep alias map) on a production install (`npm install --omit=dev`, no `src/`).
+
+### Regression guards (run in CI's Test step on all platforms)
+- `test/unit/bundle-deps-consistency.test.ts` — **new**. Parses `dist/index.mjs`'s external imports and asserts each is declared in `dependencies` or `peerDependencies` (not `devDependencies`-only). Would have caught both 0.9.52 and 0.9.53. (Regex allows `{}` in named imports so it doesn't miss `import { transformSync } from "esbuild"`.)
+- `test/unit/extension-entry-load.test.ts` (from 0.9.53) — asserts `index.ts` has no static top-level `./src/` imports.
+
+### Note on 0.9.52 / 0.9.53
+Both **deprecated** on npm. `latest` → 0.9.54. Upgrade: `npm install pi-crew@latest`.
+
+## [0.9.53] — HOTFIX: extension-load regression in published npm installs (2026-07-29)
+
+**Fixes the v0.9.52 regression** where every fresh `npm install pi-crew` failed at extension load with `Cannot find module './src/extension/register.ts'`. Affected all platforms.
+
+### Root cause
+v0.9.52's PKG-2 (Sprint 6) excluded `src/` from the npm tarball to slim it (16→4.8MB), but `index.ts` — the extension entry Pi loads via strip-types — still had **top-level static imports** from `./src/extension/register.ts` and `./src/runtime/run-tracker.ts`. The module loader resolves static imports BEFORE any code in the file runs, so the load failed before the shipped, self-contained `dist/index.mjs` bundle was ever tried. Pre-0.9.52 this was masked because `src/` was shipped alongside.
+
+CI missed it because the `test:bundle` step loads `dist/index.mjs` directly (with repo peerDeps), and the CI-5 smoke test used `node --check` (syntax only — does not resolve imports).
+
+### Fix (`index.ts`)
+The src/ imports are now **dynamic `import()`** inside the fallback path only. The self-contained `dist/index.mjs` bundle (always shipped in the tarball) is the default and loads without `src/`. The src/ fallback is reached only when the bundle is absent — i.e. dev clones without a built `dist/`. Published installs never touch `src/`. No behavior change for bundle users; the fallback semantics (`PI_CREW_USE_BUNDLE=0` opt-out) are preserved.
+
+### Regression guard
+New `test/unit/extension-entry-load.test.ts` asserts `index.ts` has no static top-level `./src/` value imports (and that the dynamic src/ fallback imports still exist). Would have caught v0.9.52. Runs in CI's Test step on all platforms.
+
+### Note on v0.9.52
+v0.9.52 is **deprecated** on npm — upgrade to 0.9.53. If you installed 0.9.52, run `npm install pi-crew@latest` (or `npx pi install npm:pi-crew`).
+
 ## [0.9.52] — Sprint 1-6: security hardening, durability, god-module refactor, tarball slim (2026-07-28)
 
 A full audit-driven upgrade pass — 6 sprints, ~60 findings from `REVIEW-UPGRADE-2026-07-27.md`, independently verified in `VERIFY-2026-07-27.md` (~22% of the original report's claims corrected: 4 false positives, count inflations, stale line refs). Test suite 6446 unit + 191 integration, 0 fail. CI green on ubuntu/macos/windows.

package/index.ts

@@ -47,18 +47,29 @@
  *     avoid recursion), the bundle flip risk is acceptable.
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { registerPiTeams as registerPiTeamsFromSrc } from "./src/extension/register.ts";
-import { waitForRun as waitForRunFromSrc } from "./src/runtime/run-tracker.ts";
 import { accessSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 
-// Minimal bundle shape — we only use a few named exports. Keep this loose
-// because dist/index.mjs has no .d.ts (it's a build artifact, not source).
+// IMPORTANT: src/ imports here MUST be dynamic (lazy `import()`), never
+// top-level static imports. Published npm packages ship only dist/index.mjs
+// in the tarball (src/ is excluded by the package.json "files" field — keeps
+// the package ~5MB instead of ~16MB). A top-level static
+// `import { x } from "./src/..."` is resolved by the module loader BEFORE
+// this file's code runs, so it would break every fresh `npm install`
+// (Cannot find module './src/...'). Dynamic import() defers src/ resolution
+// to the fallback path below, which only executes when the bundle is
+// unavailable — i.e. dev clones that still have src/. Published installs
+// always ship + load the bundle, so src/ is never touched there.
+
+// Minimal bundle shape — loose types because dist/index.mjs has no .d.ts
+// (it's a build artifact, not source). The src fallback types use
+// `typeof import(...)` type queries, which are type-only constructs erased
+// at runtime (no module load) — they stay in sync with the real modules.
 type BundleModule = {
 	default?: (pi: ExtensionAPI) => void;
-	waitForRun?: typeof waitForRunFromSrc;
-	registerPiTeams?: (pi: ExtensionAPI) => void;
+	waitForRun?: typeof import("./src/runtime/run-tracker.ts").waitForRun;
+	registerPiTeams?: typeof import("./src/extension/register.ts").registerPiTeams;
 };
 
 const OPT_OUT = new Set(["0", "false", "no", "off"]);
@@ -91,8 +102,26 @@ if (!envForceOff) {
 	}
 }
 
-export const waitForRun = bundleModule?.waitForRun ?? waitForRunFromSrc;
-export const registerPiTeams: (pi: ExtensionAPI) => void =
-	bundleModule?.registerPiTeams ?? registerPiTeamsFromSrc;
+// Lazy src/ fallback — only resolved when the bundle is unavailable
+// (dev clones without a built dist/). NEVER imported in published
+// installs, where the bundle always ships + loads above. This dynamic
+// import() is what lets us exclude src/ from the npm tarball.
+let srcRegister:
+	| typeof import("./src/extension/register.ts").registerPiTeams
+	| undefined;
+let srcWaitForRun:
+	| typeof import("./src/runtime/run-tracker.ts").waitForRun
+	| undefined;
+if (!bundleModule) {
+	({ registerPiTeams: srcRegister } = await import(
+		"./src/extension/register.ts",
+	));
+	({ waitForRun: srcWaitForRun } = await import(
+		"./src/runtime/run-tracker.ts",
+	));
+}
 
-export default bundleModule?.default ?? ((pi: ExtensionAPI) => registerPiTeamsFromSrc(pi));
+export const waitForRun = bundleModule?.waitForRun ?? srcWaitForRun!;
+export const registerPiTeams: (pi: ExtensionAPI) => void =
+	bundleModule?.registerPiTeams ?? srcRegister!;
+export default bundleModule?.default ?? ((pi: ExtensionAPI) => srcRegister!(pi));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-crew",
-  "version": "0.9.52",
+  "version": "0.9.54",
   "description": "Pi extension for coordinated AI teams, workflows, worktrees, and async task orchestration",
   "author": "baphuongna",
   "license": "MIT",
@@ -121,6 +121,7 @@
     "ajv": "^8.20.0",
     "cli-highlight": "^2.1.11",
     "diff": "^5.2.0",
+    "esbuild": "^0.28.1",
     "jiti": "^2.7.0",
     "yaml": "^2.9.0"
   },
@@ -131,7 +132,6 @@
     "@earendil-works/pi-coding-agent": "^0.82.0",
     "@earendil-works/pi-tui": "^0.82.0",
     "@types/node": "^25.9.5",
-    "esbuild": "^0.28.1",
     "tsx": "^4.23.0",
     "typescript": "^7.0.2"
   },