build: Bundle vats with vite #763

grypez · 2026-01-22T02:24:30Z

Summary

Replace @endo/bundle-source with vite for vat bundling and remove @endo/import-bundle for bundle loading.

Changes

Bundle vats using vite's build() API with IIFE output format
Load bundles via Compartment.evaluate() instead of importBundle()
Remove @endo/import-bundle dependency from all packages.
Remove @endo/bundle-source dependency from all packages except kernel-shims.

Bundle Format

New bundles use vite-iife format:

{
  "moduleFormat": "vite-iife",
  "code": "var __vatExports__ = ...",
  "exports": ["buildRootObject"],
  "modules": { ... }
}

Closes: #742

Note

Replaces Endo tooling with a Vite-based pipeline and a new runtime loader for vats.

Bundling: Add vite-based bundler (bundleVat) producing IIFE bundles with __vatExports__; includes export-metadata and strip-comments Rollup plugins
CLI: Use Vite bundler in bundle/watch; update README; adjust tests and fixtures to new bundle shape
Kernel runtime: Remove @endo/import-bundle; add loadBundle to evaluate IIFE bundles in a SES Compartment; VatSupervisor now fetches bundle text and loads via loadBundle
Utils: Introduce VatBundle type and isVatBundle; export from kernel-utils
Deps: Drop Endo bundling/import deps; add vite, rollup, acorn; update lockfile
Tests: Add coverage for bundler, loader, and comment stripping; update integration tests and test bundle to new format

^{Written by Cursor Bugbot for commit daa5828. This will update automatically on new commits. Configure here.}

socket-security · 2026-01-22T02:25:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rollup@4.46.3 ⏵ 4.55.3

View full report

github-actions · 2026-01-22T15:26:31Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	87.91% ⬇️ -0.19%	5735 / 6523
🔵	Statements	87.81% ⬇️ -0.18%	5828 / 6637
🔵	Functions	86.83% ⬇️ -0.27%	1491 / 1717
🔵	Branches	84.24% ⬇️ -0.23%	2080 / 2469

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/cli/src/app.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	15-155
packages/cli/src/commands/bundle.ts	92.3% 🟰 ±0%	50% 🟰 ±0%	100% 🟰 ±0%	92.3% 🟰 ±0%	72
packages/cli/src/commands/watch.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/cli/src/vite/export-metadata-plugin.ts	0%	0%	0%	0%	23-46
packages/cli/src/vite/strip-comments-plugin.ts	100%	100%	100%	100%
packages/cli/src/vite/vat-bundler.ts	0%	0%	0%	0%	20-59
packages/kernel-utils/src/index.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/kernel-utils/src/vat-bundle.ts	100%	100%	100%	100%
packages/ocap-kernel/src/vats/VatSupervisor.ts	74.64% 🟰 ±0%	44.82% 🟰 ±0%	58.33% 🟰 ±0%	74.64% 🟰 ±0%	122, 133, 141, 179, 217-221, 232, 241-242, 263-265, 268, 272-274, 309, 326-334
packages/ocap-kernel/src/vats/bundle-loader.ts	100%	100%	100%	100%

Generated in workflow #3332 for commit daa5828 by the Vitest Coverage Report Action

github-actions · 2026-01-22T15:26:32Z

📊 View full HTML coverage report for main

rekmarks

Really nice!

packages/ocap-kernel/src/vats/bundle-loader.ts

packages/cli/README.md

packages/cli/test/integration/serve.test.ts

packages/cli/src/vite/vat-bundler.ts

packages/cli/src/commands/bundle.test.ts

packages/cli/src/vite/strip-comments-plugin.ts

cursor · 2026-01-23T22:16:41Z

packages/kernel-utils/src/vat-bundle.ts

+  hasProperty(value, 'moduleFormat') &&
+  value.moduleFormat === 'iife' &&
+  hasProperty(value, 'code') &&
+  typeof value.code === 'string';


Incomplete type guard doesn't validate all VatBundle properties

Medium Severity

The isVatBundle type guard asserts that a value is a VatBundle, but only validates moduleFormat and code properties. The VatBundle type also requires exports: string[] and modules: Record<...> properties. Code that uses this type guard will believe it has a complete VatBundle after the check, but accessing .exports or .modules could return undefined if an incomplete object passed the check.

cursor · 2026-01-23T22:16:41Z

packages/cli/src/vite/strip-comments-plugin.ts

+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        onComment: comments,
+      });


Wrong sourceType for parsing IIFE bundle output

Low Severity

The stripCommentsPlugin uses sourceType: 'module' to parse vite's IIFE output, but IIFE bundles are scripts, not modules. Module parsing implies strict mode, which rejects certain legacy JavaScript patterns (octal literals, with statements, etc.). If bundled dependencies contain non-strict-mode code that wasn't transpiled, parse() throws a SyntaxError, preventing comment stripping and causing the build to fail unexpectedly.

Drop support for the legacy endoZipBase64 bundle format and remove the @endo/import-bundle dependency. All vat bundles now use the vite-iife format loaded via Compartment.evaluate(). - Remove @endo/import-bundle from ocap-kernel dependencies - Simplify bundle-loader.ts to only support vite-iife format - Update VatSupervisor to use synchronous loadBundle - Update CLI tests to mock bundleVat instead of @endo/bundle-source - Update serve integration test to check vite-iife format Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

Reuses the acorn parsing dependency from `@ocap/kernel-agents-repl` to authoritatively scrub comments from vat bundles. Refs #770  --- > [!NOTE] > Replaces the comment scrubber with an AST-based implementation to reliably remove comments (including those containing `import(`) from bundled code. > > - Refactors `vite/strip-comments-plugin` to use Acorn (`parse` with `onComment`) and return unchanged code when no comments are found > - Adds unit tests for `strip-comments-plugin` covering single/multi-line comments, strings, regex, templates, and empty input > - Adds `acorn` dependency in `@ocap/cli` and updates `yarn.lock` > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 3a59ba8. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

cursor · 2026-01-23T23:13:19Z

packages/ocap-kernel/src/vats/bundle-loader.ts

+    assert: globalThis.assert,
+    ...endowments,
+    ...inescapableGlobalProperties,
+  });


inescapableGlobalProperties treated as regular escapable globals

Medium Severity

The loadBundle function accepts an inescapableGlobalProperties parameter but treats it identically to regular endowments by spreading both into the Compartment constructor. In the original importBundle from @endo/import-bundle, inescapableGlobalProperties had special SES semantics that prevented the evaluated code from shadowing these globals. The current implementation makes them regular globals that can be shadowed by var declarations in the evaluated code. The test only verifies the properties are accessible, not that they're truly inescapable.

status: substantiated repro: 763#discussion_r2723046643

status: substantiated repro: 763#discussion_r2718760552

status: substantiated repro: 763#discussion_r2723046645

grypez force-pushed the grypez/bundle-with-vite branch 3 times, most recently from 504110d to 1a13965 Compare January 22, 2026 15:17

grypez marked this pull request as ready for review January 22, 2026 18:29

grypez requested a review from a team as a code owner January 22, 2026 18:29

grypez force-pushed the grypez/bundle-with-vite branch from 1a13965 to b8e02c0 Compare January 22, 2026 18:45

rekmarks requested changes Jan 22, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

cursor bot reviewed Jan 23, 2026

View reviewed changes

rekmarks mentioned this pull request Jan 23, 2026

refactor: Make makeJsonAgent bundleable with @endo/bundle-source #750

Closed

grypez force-pushed the grypez/bundle-with-vite branch from bdc4c89 to 85c60f8 Compare January 23, 2026 19:56

grypez enabled auto-merge January 23, 2026 20:05

grypez force-pushed the grypez/bundle-with-vite branch from 85c60f8 to 56f5732 Compare January 23, 2026 20:37

cursor bot reviewed Jan 23, 2026

View reviewed changes

grypez and others added 9 commits January 23, 2026 17:02

build: Support bundling with vite

d3bf48c

respin yarn

7bfa20d

fix test mock

94482c2

Apply some suggestions from code review

eccd27f

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

address remaining review comments

ebbfee6

small fixes

bf74145

add isVatBundle to index test

7e46603

grypez force-pushed the grypez/bundle-with-vite branch from fcdd1f3 to cc26d68 Compare January 23, 2026 23:03

cursor bot reviewed Jan 23, 2026

View reviewed changes

grypez force-pushed the grypez/bundle-with-vite branch from cc26d68 to 44ef8b3 Compare January 24, 2026 23:00

test: isVatBundle type guard missing property validation

9c28dfb

status: substantiated repro: 763#discussion_r2723046643

grypez added 2 commits January 24, 2026 17:43

test: loadBundle missing code property validation

5053a31

status: substantiated repro: 763#discussion_r2718760552

test: stripCommentsPlugin nonstrict parsing

daa5828

status: substantiated repro: 763#discussion_r2723046645

grypez force-pushed the grypez/bundle-with-vite branch from 44ef8b3 to daa5828 Compare January 25, 2026 19:16

build: Bundle vats with vite #763

Are you sure you want to change the base?

build: Bundle vats with vite #763

Uh oh!

Conversation

grypez commented Jan 22, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Bundle Format

Uh oh!

socket-security bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

rekmarks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

Incomplete type guard doesn't validate all VatBundle properties

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

Wrong sourceType for parsing IIFE bundle output

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

inescapableGlobalProperties treated as regular escapable globals

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

grypez commented Jan 22, 2026 •

edited by cursor bot

Loading

socket-security bot commented Jan 22, 2026 •

edited

Loading

github-actions bot commented Jan 22, 2026 •

edited

Loading

`inescapableGlobalProperties` treated as regular escapable globals