Skip to content

perf: bundle tar-stream to reduce install footprint - #2286

Merged
thymikee merged 2 commits into
mainfrom
perf/bundle-tar-stream
Sep 5, 2026
Merged

perf: bundle tar-stream to reduce install footprint#2286
thymikee merged 2 commits into
mainfrom
perf/bundle-tar-stream

Conversation

@thymikee

@thymikee thymikee commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Bundle tar-stream's Node.js dependency path so consumers no longer install tar-stream and its transitive packages. Archive extraction behavior stays unchanged.

A clean npm comparison removes 12 runtime packages and saves about 5.7 MB net with current registry resolutions, at a cost of 38,050 bytes of bundled JavaScript. Unused Bare runtime packages are excluded.

Declare tar-stream as a dev dependency in both root and host-kit, matching the existing bundled-pngjs pattern. Keep one explicit bundle allowlist; remove redundant pngjs/tar-stream alwaysBundle entries because dev dependencies bundle automatically. All 392 JavaScript/declaration outputs remain byte-identical after this simplification. Independent review found no further issues or smaller design preserving dependency enforcement.

Scope: four build/dependency metadata files. No dependency versions, runtime source, docs, or skills changed.

Validation

Validated content at 02c811ea65:

  • Reproduced R11's host-kit dependency mismatch before the fix; all 198 layering tests and the layering scan pass afterward.
  • Build, lint, typecheck, formatting, and 31 focused archive/package tests pass.
  • Packed tarball passes publint, attw, dependency-closure validation, all 13 public imports, and CLI smoke checks in a clean install.
  • Installed bundle extracts TAR/TGZ files and rejects path traversal with cleanup, without external tar-stream or Bare packages.

Full affected checks remain skipped at the user's request. Updated-head CI is pending.

@github-actions

github-actions Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-05 18:37 UTC

@github-actions

github-actions Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Size Report

Metric Base Current Diff
JS raw 2.61 MB 2.64 MB +37.3 kB
JS gzip 878.8 kB 889.2 kB +10.5 kB
npm bundled raw 2.61 MB 2.64 MB +37.3 kB
npm bundled gzip 878.8 kB 889.2 kB +10.5 kB
npm tarball 1.04 MB 1.05 MB +11.0 kB
npm unpacked 3.52 MB 3.56 MB +37.3 kB
npm clean-installed 3.52 MB 3.56 MB +37.3 kB

npm unpacked components

Component Base Current Diff
JS / dist source 2.77 MB 2.81 MB +37.3 kB
Apple runner source/project 544.4 kB 544.4 kB 0 B
Apple snapshot presentation source 33.8 kB 33.8 kB 0 B
Apple Simulator snapshot bridge source 30.5 kB 30.5 kB 0 B
macOS helper source 54.8 kB 54.8 kB 0 B
Android helper artifacts 43.3 kB 43.3 kB 0 B
Other package files 46.7 kB 46.7 kB 0 B

Startup median (7 runs, lower is better):

Scenario Base Current Diff
CLI --version 32.8 ms 33.1 ms +0.3 ms
CLI --help 82.8 ms 82.3 ms -0.5 ms

Top changed chunks:

Chunk Raw diff Gzip diff
dist/src/archive.js +45.5 kB +13.5 kB
dist/src/internal/daemon.js +953 B +309 B
dist/src/session2.js +176 B +36 B
dist/src/interaction2.js -15 B -9 B
dist/src/device-claim-rule.js -15 B -4 B

Top changed packed files

Packed file Base Current Diff
dist/src/archive.js 7.9 kB 45.5 kB +37.6 kB
dist/src/request-runtime-binding.js 2.6 kB 0 B -2.6 kB
dist/src/device-ready.js 0 B 975 B +975 B
dist/src/internal/daemon.js 106.9 kB 107.9 kB +953 B
dist/src/rolldown-runtime.js 309 B 788 B +479 B
dist/src/response.js 0 B 278 B +278 B
dist/src/session2.js 218.4 kB 218.6 kB +176 B
dist/src/record-runtime.js 7.2 kB 7.1 kB -145 B
dist/src/session-snapshot.js 26.9 kB 26.9 kB -87 B
dist/src/snapshot4.js 12.0 kB 11.9 kB -79 B

@thymikee

thymikee commented Sep 5, 2026

Copy link
Copy Markdown
Member Author

Repo Guards is correctly blocking this head: moving root tar-stream to devDependencies leaves packages/host-kit/package.json declaring it as a runtime dependency, so R11 can no longer match the private package’s external dependency to a root published dependency.

Move tar-stream to host-kit’s devDependencies too, following the existing bundled-dependency pattern, keep the root entry only for build resolution, and rerun Repo Guards plus the packed clean-install/archive checks. Do not weaken R11 or restore the root runtime dependency, which would defeat the install-footprint goal. The established tsdown bundling path and the reported +37.3 kB packed-output tradeoff otherwise look sound.

@thymikee

thymikee commented Sep 5, 2026

Copy link
Copy Markdown
Member Author

Addressed the R11 dependency comment in 02c811e:

  • Moved host-kit's tar-stream declaration to devDependencies and updated the lockfile. The root dev dependency remains for build resolution; R11 and root runtime dependencies are unchanged.
  • Simplified bundling by removing redundant pngjs/tar-stream alwaysBundle entries. The explicit onlyBundle allowlist remains; all 392 JS/declaration outputs are byte-identical.
  • Observed the R11 test fail before the fix and pass afterward. All 198 layering tests, 31 focused archive/package tests, lint, typecheck, and packed clean-install checks pass. The installed bundle still extracts TAR/TGZ and rejects traversal without external tar-stream/Bare packages.

Independent review found no further issues. Repo Guards is rerunning on this head; full local affected checks remain skipped as requested.

@thymikee

thymikee commented Sep 5, 2026

Copy link
Copy Markdown
Member Author

Reviewed 02c811e: no remaining actionable findings. Root and host-kit dependency declarations now agree without weakening R11; the existing bundler path is reused. Packed clean-install TAR/TGZ and traversal evidence covers the bundled result. Bundled growth is justified by net installed footprint reduction. Code-review clean; remaining CI status must be checked before merge.

@thymikee thymikee added the ready-for-human Valid work that needs human implementation, judgment, or maintainer merge label Sep 5, 2026
@thymikee
thymikee merged commit a90d95a into main Sep 5, 2026
21 checks passed
@thymikee
thymikee deleted the perf/bundle-tar-stream branch September 5, 2026 18:37
thymikee added a commit that referenced this pull request Sep 5, 2026
@thymikee
Merge remote-tracking branch 'origin/main' into HEAD
943abd2 
* origin/main:
  perf: bundle runtime dependencies and report full install size (#2310)
  ci: avoid unrelated Apple runner cache invalidation (#2303)
  fix(web): preserve the backend ref so snapshot refs match actionable refs (#2283)
  test(daemon): session-open-url-prewarm through the request seam (#2304)
  test(daemon): session-devices-batch-runtime through the request seam (#2305)
  chore(gates): layering baselines ratchet against merge-base (#2299)
  test(daemon): one typed conformance helper for the daemon runtime suites (#2298)
  chore(layering): derive the contracts export inventory from package.json (#2297)
  perf: bundle tar-stream to reduce install footprint (#2286)
  docs: simplify agent context and resolve conflicting guidance (#2287)
  refactor(cli): let help resolve command aliases itself and retire R12 (#2293)
thymikee added a commit that referenced this pull request Sep 5, 2026
@thymikee
Merge remote-tracking branch 'origin/main' into HEAD
8e97157 
* origin/main:
  perf: bundle runtime dependencies and report full install size (#2310)
  ci: avoid unrelated Apple runner cache invalidation (#2303)
  fix(web): preserve the backend ref so snapshot refs match actionable refs (#2283)
  test(daemon): session-open-url-prewarm through the request seam (#2304)
  test(daemon): session-devices-batch-runtime through the request seam (#2305)
  chore(gates): layering baselines ratchet against merge-base (#2299)
  test(daemon): one typed conformance helper for the daemon runtime suites (#2298)
  chore(layering): derive the contracts export inventory from package.json (#2297)
  perf: bundle tar-stream to reduce install footprint (#2286)
  docs: simplify agent context and resolve conflicting guidance (#2287)
  refactor(cli): let help resolve command aliases itself and retire R12 (#2293)
  refactor(commands): retire the navigation-only type projection (#2294)
  feat(runtime): route managed leases through contained transports (#2285)
  refactor(contracts): build unavailable runtime facts once (#2291)
  refactor(cli): derive the common flag readers from the common-field table (#2292)
  feat(daemon): add managed allocation operation journal (#2284)
thymikee added a commit that referenced this pull request Sep 5, 2026
@thymikee
Merge remote-tracking branch 'origin/main' into HEAD
31af377 
* origin/main:
  perf: bundle runtime dependencies and report full install size (#2310)
  ci: avoid unrelated Apple runner cache invalidation (#2303)
  fix(web): preserve the backend ref so snapshot refs match actionable refs (#2283)
  test(daemon): session-open-url-prewarm through the request seam (#2304)
  test(daemon): session-devices-batch-runtime through the request seam (#2305)
  chore(gates): layering baselines ratchet against merge-base (#2299)
  test(daemon): one typed conformance helper for the daemon runtime suites (#2298)
  chore(layering): derive the contracts export inventory from package.json (#2297)
  perf: bundle tar-stream to reduce install footprint (#2286)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ready-for-human Valid work that needs human implementation, judgment, or maintainer merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thymikee