Bundle Safety

<!-- generated by opencode-swarm skill-generator. Do not edit by hand; edits will be preserved on regeneration only with controlled update mode. -->

Bundle Safety

Trigger

• minify / minification / bundle / esbuild / build size
• re-export / namespace re-export / exportLines / exportRanges
• dist/index.js conformance checks
• identifier preservation / stack trace readability
• consumer-constraint verification before transforms

Required Procedure

(a) Minification Variant Selection

The standard minification configuration for the plugin bundle is identifier-preserving:

--minify-whitespace --minify-syntax

This yields ~22.3% size reduction on the main bundle (~1.28 MB absolute). The reduction is below the optimistic 35–43% range because identifier mangling is deliberately skipped.

Full identifier mangling (--minify-identifiers) is REJECTED. It breaks two hard constraints:

1. 13 grep guardrail assertions — split across tests/unit/build/full-auto-toolbefore-fail-closed.test.ts (fail-closed hook substring/wrapping checks) and tests/unit/turbo/lean/runtime-conformance.test.ts (Lean Turbo identifier-preservation checks). Mangling would rename these identifiers and cause all 13 assertions to fail.
2. Stack-trace readability — preserved identifier names are required for runtime debugging. The release-gate test tests/unit/build/throw-and-verify-located.test.ts asserts that thrown errors carry readable stack frames with recognizable function names (e.g. initializeOpenCodeSwarm).

Decision is final: identifier-preserving minify is the standard. Do not enable --minify-identifiers without a documented exception approved by the team.

(b) Consumer-Constraint Verification Before Transforms

Before merging any minification or transform change:

1. Build the smallest possible test bundle with the proposed transform flags.
2. Run the consumer's exact constraint check first — the 13 grep guardrails are split across tests/unit/build/full-auto-toolbefore-fail-closed.test.ts (fail-closed hook constraints) and tests/unit/turbo/lean/runtime-conformance.test.ts (Lean Turbo identifier-preservation checks). Together they are the authoritative consumer constraint.
3. Run the full build conformance suite (tests/unit/build/throw-and-verify-located.test.ts, tests/unit/turbo/lean/runtime-conformance.test.ts) to verify runtime integrity and stack-trace readability.
4. Only merge if all guardrail assertions pass. A single grep guardrail failure blocks the change.

This procedure applies to any transform that could rename, inline, or remove identifiers — not just minification flags.

(c) Identifier-Preservation Testing

Verify identifier names survive the transform via the layered test stack:

Static (grep) layer:

• tests/unit/build/full-auto-toolbefore-fail-closed.test.ts — fail-closed hook substring/wrapping checks verifying that specific identifier substrings (e.g. fullAutoPermissionHook.toolBefore, guardrailsHooks.toolBefore, scopeGuardHook.toolBefore, delegationGateHooks.toolBefore) are present and that fail-closed hooks are not wrapped in safeHook(...).
• tests/unit/turbo/lean/runtime-conformance.test.ts — distContains() checks verifying that Lean Turbo integration-point identifiers (verifyLeanTurboPhaseReady, verifyLeanTurboTaskCompletion, LEAN_TURBO_BANNER, enableLeanTurbo, hasActiveTurboMode) survive the build.

Runtime layer:

• tests/unit/build/throw-and-verify-located.test.ts — asserts that thrown errors carry readable stack frames with preserved function names (e.g. initializeOpenCodeSwarm). This is the runtime complement to the static grep assertions.

Before enabling --minify-identifiers, confirm ALL of the following:

• No eval() or Function('...') dispatch in the bundle (mangled identifiers break dynamic dispatch).
• No constructor.name or Function.name introspection in production paths.
• No @__PURE__ annotations or side-effectful top-level patterns that depend on identifier stability.
• All 13 grep guardrails still pass.
• Stack-trace readability is verified at runtime.

If any of these checks fail, --minify-identifiers must not be enabled.

(d) Namespace Re-Export Coverage

When modifying re-export or export-tracking logic (e.g. exportLines, exportRanges, parseFileImports):

Test both forms of namespace re-export — they are distinct AST forms that require separate tracking:

1. Regular namespace re-export: export * from './module'
2. Aliased namespace re-export: export * as ns from './module'

The regex in src/tools/repo-graph/builder.ts (parseFileImports) handles both via the pattern export\s+\*(?:\s+as\s+\w+)?\s+from\s+['"]([^'"\0\t\r\n]+)['"]`. Both forms must be tested when modifying export tracking because:

• They produce different importType values in the parsed output (namespace for both, but the aliased form carries a local binding name).
• They require separate tracking in exportLines/exportRanges — the aliased form creates a local binding (ns) that must be recorded alongside the re-exported symbols.
• Missing either form causes silent graph gaps in repo-graph callers/dead-exports analysis.

Test file: tests/unit/tools/repo-graph-reexports.test.ts covers both forms (see test case "4. export * as ns from './bar' — TypeScript namespace re-export → importType: namespace"). Run this test alongside any export-tracking change.