Loading workspace insights... Statistics interval
7 days30 daysLatest CI Pipeline Executions
851bd248 fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487) (#799)
* fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487)
@tanstack/ai-code-mode hard-depended on esbuild to strip TypeScript before
sandbox execution. esbuild ships a Node-native binary and pulls in Node-only
built-ins (e.g. require("pnpapi")), which broke browser bundles and edge
runtimes such as Cloudflare Workers/Pages.
Replace esbuild with sucrase, a pure-JavaScript transform with no native
binary, on the default TypeScript-stripping path. Add an optional `transpile`
escape hatch on createCodeModeTool so callers who don't need edge safety can
swap in a heavier Node-only transpiler (e.g. esbuild).
sucrase is a type-stripper rather than a down-leveler, so unlike esbuild it
does not compile a few exotic constructs (value `namespace` blocks, decorators,
the `accessor` keyword, post-ES2022 syntax such as `using` and the `/v` regex
flag). These are documented on stripTypeScript and in the changeset, with the
transpile hook as the workaround.
Add an edge-safety guard test asserting no source imports esbuild or a
Node-only built-in, and keep the dependency out of every install-facing bucket.
* test(code-mode): escape module names in edge-safety import scan
Escape regex metacharacters before interpolating each FORBIDDEN entry into
the import-scan pattern. The current entries contain no metacharacters, so
behavior is unchanged, but this keeps the pattern correct if an entry ever
contains one and silences a static-analysis ReDoS warning.
* ci: apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> 81e3aee3 fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487) (#799)
* fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487)
@tanstack/ai-code-mode hard-depended on esbuild to strip TypeScript before
sandbox execution. esbuild ships a Node-native binary and pulls in Node-only
built-ins (e.g. require("pnpapi")), which broke browser bundles and edge
runtimes such as Cloudflare Workers/Pages.
Replace esbuild with sucrase, a pure-JavaScript transform with no native
binary, on the default TypeScript-stripping path. Add an optional `transpile`
escape hatch on createCodeModeTool so callers who don't need edge safety can
swap in a heavier Node-only transpiler (e.g. esbuild).
sucrase is a type-stripper rather than a down-leveler, so unlike esbuild it
does not compile a few exotic constructs (value `namespace` blocks, decorators,
the `accessor` keyword, post-ES2022 syntax such as `using` and the `/v` regex
flag). These are documented on stripTypeScript and in the changeset, with the
transpile hook as the workaround.
Add an edge-safety guard test asserting no source imports esbuild or a
Node-only built-in, and keep the dependency out of every install-facing bucket.
* test(code-mode): escape module names in edge-safety import scan
Escape regex metacharacters before interpolating each FORBIDDEN entry into
the import-scan pattern. The current entries contain no metacharacters, so
behavior is unchanged, but this keeps the pattern correct if an entry ever
contains one and silences a static-analysis ReDoS warning.
* ci: apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> 81e3aee3 fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487) (#799)
* fix(code-mode): drop esbuild for edge-safe TypeScript stripping (#487)
@tanstack/ai-code-mode hard-depended on esbuild to strip TypeScript before
sandbox execution. esbuild ships a Node-native binary and pulls in Node-only
built-ins (e.g. require("pnpapi")), which broke browser bundles and edge
runtimes such as Cloudflare Workers/Pages.
Replace esbuild with sucrase, a pure-JavaScript transform with no native
binary, on the default TypeScript-stripping path. Add an optional `transpile`
escape hatch on createCodeModeTool so callers who don't need edge safety can
swap in a heavier Node-only transpiler (e.g. esbuild).
sucrase is a type-stripper rather than a down-leveler, so unlike esbuild it
does not compile a few exotic constructs (value `namespace` blocks, decorators,
the `accessor` keyword, post-ES2022 syntax such as `using` and the `/v` regex
flag). These are documented on stripTypeScript and in the changeset, with the
transpile hook as the workaround.
Add an edge-safety guard test asserting no source imports esbuild or a
Node-only built-in, and keep the dependency out of every install-facing bucket.
* test(code-mode): escape module names in edge-safety import scan
Escape regex metacharacters before interpolating each FORBIDDEN entry into
the import-scan pattern. The current entries contain no metacharacters, so
behavior is unchanged, but this keeps the pattern correct if an entry ever
contains one and silences a static-analysis ReDoS warning.
* ci: apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>