runline 0.5.0 → 0.5.1

package/dist/core/engine.js

@@ -1,5 +1,4 @@
 import { readFileSync } from "node:fs";
-import { createRequire } from "node:module";
 import { getQuickJS, shouldInterruptAfterDeadline, } from "quickjs-emscripten";
 import { applyEnvOverrides, updateConnectionConfig } from "../config/loader.js";
 export class ExecutionEngine {
@@ -217,15 +216,14 @@ function formatError(cause) {
     }
     return String(cause);
 }
-// MiniSearch UMD bundle, loaded once and inlined into the sandbox source.
-// UMD assigns to globalThis.MiniSearch when run in a non-CJS / non-AMD env
-// (which QuickJS is), so we just paste the file in and use the global.
-const __minisearchSource = (() => {
-    const req = createRequire(import.meta.url);
-    const pkg = req.resolve("minisearch/package.json");
-    const path = pkg.replace(/package\.json$/, "dist/umd/index.js");
-    return readFileSync(path, "utf8");
-})();
+// MiniSearch UMD bundle, vendored at the package root and inlined into the
+// sandbox source. UMD attaches `MiniSearch` to globalThis in a non-CJS /
+// non-AMD env (QuickJS), so pasting the file is enough.
+//
+// `../../vendor/...` resolves identically from src/core/engine.ts (dev) and
+// dist/core/engine.js (published) because tsc preserves the `core/` subdir.
+// See vendor/README.md for the upgrade procedure.
+const __minisearchSource = readFileSync(new URL("../../vendor/minisearch.umd.js", import.meta.url), "utf8");
 function buildHelpData(plugins) {
     const data = {};
     for (const p of plugins) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
@@ -25,7 +25,8 @@
     "runline": "./dist/main.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "vendor"
   ],
   "scripts": {
     "build": "tsc && bun --filter runline-plugins build && rm -rf dist/plugins && cp -R ../runline-plugins/dist dist/plugins",
@@ -58,12 +59,12 @@
     "@types/bun": "^1.2.17",
     "@types/node": "^25.5.0",
     "@types/proper-lockfile": "^4.1.4",
+    "minisearch": "^7.2.0",
     "typescript": "^5.8.0"
   },
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
-    "minisearch": "^7.2.0",
     "proper-lockfile": "^4.1.2",
     "quickjs-emscripten": "^0.32.0",
     "rrule": "^2.8.1"

package/vendor/README.md

@@ -0,0 +1,19 @@
+# vendor
+
+Third-party bundles inlined into the QuickJS sandbox at runtime.
+
+These files are committed deliberately: the sandbox eval'd source is part of runline's behavior, and PR diffs should show exactly what changes when a bundle is bumped.
+
+## minisearch.umd.js
+
+UMD build of [minisearch](https://github.com/lucaong/minisearch). Read by `src/core/engine.ts` and inlined into the sandbox so `MiniSearch` is available as a global to agent code (powers `actions.find()`).
+
+To upgrade:
+
+```bash
+npm i -D minisearch@latest
+cp node_modules/minisearch/dist/umd/index.js vendor/minisearch.umd.js
+git commit -am "vendor: bump minisearch"
+```
+
+The `minisearch` devDependency exists only as a convenience for that `cp` — nothing imports it at runtime.