fix(release): esbuild 先打成单 CJS 再 pkg(解 ESM 打包崩溃)

rc3 定位到真因:package.json "type":"module" 让 pkg 把每个 src/*.js 当 ESM 加载,
但其 bytecode/fallback 产物是 CommonJS(module.exports)→ 启动即
"module is not defined in ES module scope"(config.js:25)。

改用 esbuild 先把整个 ESM 图打成单个 CJS(src/_bundle.cjs,无 per-file ESM/CJS
歧义),再 pkg 包这个 CJS。bundle 用 banner shim 保留 import.meta.url
(pathToFileURL(__filename)),使 config.js/server.js/devin-connect-models 仍能
相对 bundle 解析 dashboard/ 与 data/;pkg assets 把这些文件按同路径打进 snapshot。
本地已验:bundle 起服务 /health 200 + /dashboard 484KB + /v1/models 200。

- package.json: build:bundle(esbuild)+ build:exe(bundle 后 pkg src/_bundle.cjs);
  pkg.assets 加 src/data/*.json + package.json。
- release.yml windows-exe: npm run build:bundle → pkg 单 CJS。
- .gitignore 忽略 dist-windows/ 与 src/_bundle.cjs(CI 构建产物不进 git)。

Author: dwgx

.github/workflows/release.yml

@@ -128,20 +128,23 @@ jobs:
           # runner → fails). node22 is LTS and has multiple prebuilts.
           node-version: '22'
 
-      # Build the single .exe with @yao-pkg/pkg. The Windows runner has the
-      # network + toolchain to fetch (or, worst case, compile) the pkg base
-      # binary — neither is reliably available on a dev box. Zero runtime deps,
-      # so nothing to `npm ci`; pkg reads the `pkg` config block in package.json
-      # (assets = the dashboard html/i18n/data files server.js reads at runtime,
-      # served from pkg's snapshot FS so no source change is needed).
+      # Build the single .exe. pkg can't ingest our ESM tree directly:
+      # package.json has "type":"module", so pkg loads each src/*.js as ESM but
+      # its bytecode/fallback path emits CommonJS (module.exports) → "module is
+      # not defined in ES module scope" at boot (seen in rc1/rc2). Fix: esbuild
+      # first bundles the whole ESM graph into ONE CommonJS file (src/_bundle.cjs)
+      # — no per-file ESM/CJS ambiguity — then pkg wraps that single CJS file.
+      # The bundle keeps import.meta.url meaningful via a banner shim
+      # (pathToFileURL(__filename)), so config.js/server.js/devin-connect-models
+      # still resolve dashboard/ + data/ relative to the bundle; pkg's `assets`
+      # (in package.json) map those files into the snapshot at the same paths.
+      # The Windows runner has the network to fetch pkg's node22 base binary
+      # (node20 has none → don't use it). Zero runtime deps, so no `npm ci`.
       - name: Build windsurfapi.exe
         run: |
-          npm i -g @yao-pkg/pkg@6.21.0
-          # --fallback-to-source: our ESM entry can't be turned into V8 bytecode
-          # by pkg (server.js/config.js warn "Failed to make bytecode"); ship
-          # those as plain source inside the snapshot instead of failing/booting
-          # a half-compiled exe.
-          pkg . --targets node22-win-x64 --fallback-to-source --output dist-windows/windsurfapi.exe
+          npm i -g @yao-pkg/pkg@6.21.0 esbuild
+          npm run build:bundle
+          pkg src/_bundle.cjs --config package.json --targets node22-win-x64 --output dist-windows/windsurfapi.exe
 
       - name: Smoke-check the exe boots
         shell: pwsh

.gitignore

@@ -99,3 +99,7 @@ docs/*.bak
 2026-*dprojectwindsurfapiclaudetxt*.txt
 *这个是*.txt
 *这也是*.txt
+
+# Windows single-exe build artifacts (built in CI, never committed)
+/dist-windows/
+/src/_bundle.cjs

package.json

@@ -24,16 +24,17 @@
     "probe:web-search": "node scripts/web-search-direct-probe.mjs",
     "sync:contributors": "node scripts/sync-docs-contributors.mjs",
     "secret-scan": "node scripts/secret-scan.mjs",
-    "build:exe": "pkg . --targets node22-win-x64 --fallback-to-source --output dist-windows/windsurfapi.exe"
+    "build:bundle": "esbuild src/index.js --bundle --platform=node --format=cjs --target=node22 --outfile=src/_bundle.cjs --external:node:* --define:import.meta.url=__WA_IMPORT_META_URL__ --banner:js=\"const __WA_IMPORT_META_URL__=require('node:url').pathToFileURL(__filename).href;\"",
+    "build:exe": "npm run build:bundle && pkg src/_bundle.cjs --config package.json --targets node22-win-x64 --output dist-windows/windsurfapi.exe"
   },
   "pkg": {
-    "scripts": ["src/**/*.js"],
     "assets": [
       "src/dashboard/index.html",
       "src/dashboard/index-sketch.html",
       "src/dashboard/i18n/*.json",
       "src/dashboard/data/*.json",
-      "src/vendor/**/*"
+      "src/data/*.json",
+      "package.json"
     ],
     "targets": ["node22-win-x64"],
     "outputPath": "dist-windows"

test/release-workflow.test.js

@@ -31,7 +31,10 @@ describe('release workflow', () => {
     const winExe = jobBlock('windows-exe');
     assert.match(winExe, /\bneeds:\s*test\b/);
     assert.match(winExe, /runs-on:\s*windows-latest/);
-    assert.match(winExe, /pkg \. --targets node22-win-x64/);
+    // esbuild bundles the ESM graph to one CJS file, then pkg wraps it (pkg
+    // can't ingest the raw "type":"module" tree — emits CJS into ESM scope).
+    assert.match(winExe, /npm run build:bundle/);
+    assert.match(winExe, /pkg src\/_bundle\.cjs .*node22-win-x64/);
     // Must smoke-check the exe actually boots + serves the dashboard, so a
     // broken asset bundle fails the release rather than shipping a dead exe.
     assert.match(winExe, /\/health/);