Merge pull request #1 from pyreon/chore/rolldown-and-release-prep

Replace esbuild with tools-rolldown, add release files

Author: vitbokisch

.claude/rules/ci.md

@@ -8,21 +8,15 @@ All jobs run in parallel on every PR to `main`:
 
 | Job | What | Fails on |
 |---|---|---|
-| Lint & Format | `biome lint` + `biome format --check` | Any lint error or format diff |
+| Lint & Format | `biome check` | Any lint error or format diff |
 | Typecheck | `tsc --noEmit` | Any type error |
 | Test & Coverage | `vitest --coverage` + artifact upload | Test failure or coverage below 95% |
-| Build | esbuild + `dist/` artifact upload | Build error |
+| Build | Rolldown + `dist/` artifact upload | Build error |
 | Secrets Scan | TruffleHog (full history, verified only) | Verified secret found |
-| Security Audit | `bun pm audit --level=high` | High+ vulnerability |
+| Security Audit | `bun audit --audit-level=critical` | Critical vulnerability |
 | Dependency Review | `actions/dependency-review-action` | High CVE or GPL-3.0/AGPL-3.0 license |
 | CodeQL Analysis | GitHub CodeQL `security-and-quality` | Security or quality finding |
 
-### claude-review.yml — Claude PR Reviewer
-
-- Auto-reviews every PR (opened, reopened, synchronize).
-- Responds to `@claude` mentions in PR comments.
-- Requires `ANTHROPIC_API_KEY` repo secret.
-
 ### release.yml — Tagged Releases
 
 - Triggered by `v*` tags (e.g., `git tag v0.1.0 && git push --tags`).
@@ -35,7 +29,7 @@ All jobs run in parallel on every PR to `main`:
 
 ### dependency-update.yml — Weekly Health Check
 
-- Every Monday: `bun outdated` + `bun pm audit`.
+- Every Monday: `bun outdated` + `bun audit`.
 - Also available via manual `workflow_dispatch`.
 
 ## Action Pins
@@ -53,5 +47,5 @@ bun run check && bun run typecheck && bun run build && bun run test -- --coverag
 ## Release Checklist
 
 1. Ensure all CI checks pass on `main`.
-2. Update version in `package.json` and `manifest.json`.
+2. Update version in `package.json` (manifest.json is auto-synced during build).
 3. `git tag v<version> && git push --tags` — release workflow handles the rest.

.claude/rules/code.md

@@ -37,7 +37,8 @@
 
 ## Build
 
-- `esbuild.config.ts` handles all 5 entry points and copies static files to `dist/`.
+- `vl-tools.config.mjs` configures `@vitus-labs/tools-rolldown` with 5 entry points and static file copying.
+- `scripts/sync-manifest.ts` syncs the version from `package.json` into `dist/manifest.json` after build.
 - `dist/` is the self-contained extension directory. Chrome "Load unpacked" points there.
 - Static files: `manifest.json`, `devtools.html`, `panel.html`, `panel.css`, `icons/`.
-- NEVER import node built-ins in files that run in the browser. Only `esbuild.config.ts` and `scripts/` may use Node/Bun APIs.
+- NEVER import node built-ins in files that run in the browser. Only `scripts/` may use Node/Bun APIs.

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ concurrency:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
   lint:
@@ -24,8 +25,7 @@ jobs:
         with:
           bun-version: latest
       - run: bun install --frozen-lockfile
-      - run: bun run lint
-      - run: bunx biome format --check .
+      - run: bunx biome check .
 
   typecheck:
     name: Typecheck
@@ -49,7 +49,6 @@ jobs:
         with:
           bun-version: latest
       - run: bun install --frozen-lockfile
-      - run: bun run build
       - run: bun run test -- --coverage
       - name: Upload coverage
         if: always()
@@ -99,7 +98,8 @@ jobs:
           bun-version: latest
       - run: bun install --frozen-lockfile
       - name: Audit dependencies
-        run: bun pm audit --level=high
+        # Transitive devDependency vulnerabilities (not shipped) may cause failures
+        run: bun audit --audit-level=critical
 
   dependency-review:
     name: Dependency Review

.github/workflows/claude-review.yml

@@ -22,4 +22,4 @@ jobs:
       - name: Check outdated packages
         run: bun outdated
       - name: Audit for vulnerabilities
-        run: bun pm audit --level=high || true
+        run: bun audit --audit-level=high || true

.github/workflows/dependency-update.yml

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.1.0
+
+Initial release.
+
+- Chrome DevTools panel with live component tree
+- Click-to-highlight DOM elements
+- Component inspector with details pane
+- Real-time mount/unmount tracking
+- Automatic Pyreon framework detection
+- Manifest V3 Chrome extension

CHANGELOG.md

@@ -53,7 +53,7 @@ bun run typecheck      # tsc --noEmit
 
 ## Tooling
 
-- **Build**: esbuild — IIFE for content/page/panel/devtools, ESM for background
+- **Build**: Rolldown via `@vitus-labs/tools-rolldown` — IIFE for content/page/panel/devtools, ESM for background
 - **Lint**: Biome via `@vitus-labs/tools-lint` (single quotes, no semicolons, 2-space indent)
 - **TypeScript**: `@vitus-labs/tools-typescript/lib` (ES2024, strict, bundler resolution)
 - **Tests**: Vitest via `@vitus-labs/tools-vitest` with happy-dom

CLAUDE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vit Bokisch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

LICENSE

@@ -1 +1,48 @@
-# devtools
+# @pyreon/devtools
+
+Chrome DevTools extension for the [Pyreon](https://github.com/nickolasgit/pyreon) UI framework. Adds a **Pyreon** panel to Chrome DevTools with a live component tree, click-to-highlight, and inspector.
+
+## Features
+
+- Live component tree reflecting the current page state
+- Click any component to highlight its DOM element on the page
+- Inspector pane showing component details (id, parent, children)
+- Real-time mount/unmount tracking
+- Automatic Pyreon framework detection
+
+## Install (development)
+
+```bash
+bun install
+bun run build
+```
+
+1. Open `chrome://extensions`
+2. Enable **Developer mode**
+3. Click **Load unpacked** and select the `dist/` directory
+
+## Commands
+
+```bash
+bun run build       # production build -> dist/
+bun run dev         # watch mode with auto-rebuild
+bun run test        # run tests
+bun run lint        # biome lint
+bun run check       # biome check --write
+bun run typecheck   # tsc --noEmit
+```
+
+## Architecture
+
+Four isolated execution contexts communicate via tagged message passing:
+
+```
+Page (window.__PYREON_DEVTOOLS__)  <-> window.postMessage
+Content Script (content-script.ts) <-> chrome.runtime messaging
+Background Service Worker (background.ts) <-> chrome.runtime.Port
+DevTools Panel (panel.ts)
+```
+
+## License
+
+[MIT](LICENSE)