feat: node paths

[Kikobeats]

Note

Medium Risk
Changes dependency detection/installation flow and module resolution (via nodePaths), which can alter what gets bundled or when installs occur; risk is moderate due to potential resolution/version edge cases.

Overview
Adds a new nodePaths option to the public API and TypeScript types, threading it through compilation and bundling.

During compilation, dependencies are now validated up-front and, when nodePaths is provided, npm/pnpm install is skipped for packages already resolvable from those paths with a matching version; esbuild is also configured with nodePaths for resolution. install-dependencies now exports validateDependencies and extractPackageName for reuse in this filtering logic.

^{Reviewed by Cursor Bugbot for commit b047c42. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coveralls]

Coverage Report for CI Build 26154129852

Warning

No base build found for commit 18cd963 on master.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 94.081%

Details

• Patch coverage: 12 uncovered changes across 1 file (18 of 30 lines covered, 60.0%).

Uncovered Changes

File	Changed	Covered	%
src/compile/index.js	23	11	47.83%

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	693
Covered Lines:	655
Line Coverage:	94.52%
Relevant Branches:	118
Covered Branches:	108
Branch Coverage:	91.53%
Branches in Coverage %:	Yes
Coverage Strength:	45.21 hits per line

---

💛 - Coveralls

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Allow list bypassed via nodePaths
  • Added validateDependencies call in the else-if branch to ensure dependencies resolved via nodePaths are validated against allow.dependencies and invalid name checks.

Or push these changes by commenting:

@cursor push 1cd5d0e321

Preview (1cd5d0e321)

diff --git a/src/compile/index.js b/src/compile/index.js
--- a/src/compile/index.js
+++ b/src/compile/index.js
@@ -59,6 +59,8 @@
     await enqueueInstall(tmpdir, dependencies, allow)
     phases.install = elapsed()
   } else if (allDependencies.length) {
+    const { validateDependencies } = require('./install-dependencies')
+    validateDependencies(allDependencies, allow.dependencies)
     content = transformDependencies(content)
   }
 

diff --git a/src/compile/install-dependencies.js b/src/compile/install-dependencies.js
--- a/src/compile/install-dependencies.js
+++ b/src/compile/install-dependencies.js
@@ -56,3 +56,5 @@
   validateDependencies(dependencies, allow.dependencies)
   return $(`${install} ${dependencies.join(' ')}`, { cwd, env: { ...process.env, CI: true } })
 }
+
+module.exports.validateDependencies = validateDependencies

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: nodePaths ignores dependency versions
  • Modified the filtering logic to always install dependencies with explicit version specifiers, ensuring the exact requested version is used rather than whatever version exists on nodePaths.
• ✅ Fixed: Duplicates extractPackageName parsing logic
  • Removed the duplicate packageName helper from compile/index.js and reused the exported extractPackageName from install-dependencies.js instead.

Or push these changes by commenting:

@cursor push d456bd359f

Preview (d456bd359f)

diff --git a/src/compile/index.js b/src/compile/index.js
--- a/src/compile/index.js
+++ b/src/compile/index.js
@@ -12,18 +12,6 @@
 
 const DEFAULT_TMPDIR = path.join(require('os').tmpdir(), 'isolated-fn-deps')
 
-const packageName = dep => {
-  if (dep.startsWith('@')) {
-    const slashIndex = dep.indexOf('/')
-    if (slashIndex !== -1) {
-      const atIndex = dep.indexOf('@', slashIndex)
-      return atIndex !== -1 ? dep.substring(0, atIndex) : dep
-    }
-  }
-  const atIndex = dep.indexOf('@')
-  return atIndex !== -1 ? dep.substring(0, atIndex) : dep
-}
-
 const installQueues = new Map()
 
 const enqueueInstall = (tmpdir, dependencies, allow) => {
@@ -44,8 +32,13 @@
   installDependencies.validateDependencies(allDependencies, allow.dependencies)
   const dependencies = nodePaths.length
     ? allDependencies.filter(dep => {
+      const packageName = installDependencies.extractPackageName(dep)
+      const hasVersionSpecifier = packageName !== dep
+      if (hasVersionSpecifier) {
+        return true
+      }
       try {
-        require.resolve(packageName(dep), { paths: nodePaths })
+        require.resolve(packageName, { paths: nodePaths })
         return false
       } catch {
         return true

diff --git a/src/compile/install-dependencies.js b/src/compile/install-dependencies.js
--- a/src/compile/install-dependencies.js
+++ b/src/compile/install-dependencies.js
@@ -58,3 +58,4 @@
 }
 
 module.exports.validateDependencies = validateDependencies
+module.exports.extractPackageName = extractPackageName

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Cwd wins over nodePaths
  • Changed resolveDir to use nodePaths[0] instead of process.cwd() when all dependencies are filtered via nodePaths, ensuring consistent resolution between require.resolve checks and esbuild bundling.

Or push these changes by commenting:

@cursor push 2f88c72d1e

Preview (2f88c72d1e)

diff --git a/src/compile/index.js b/src/compile/index.js
--- a/src/compile/index.js
+++ b/src/compile/index.js
@@ -52,7 +52,7 @@
     content = transformDependencies(content)
   }
 
-  const cwd = dependencies.length ? tmpdir : process.cwd()
+  const cwd = dependencies.length ? tmpdir : (nodePaths.length && allDependencies.length ? nodePaths[0] : process.cwd())
   const elapsed = timeSpan()
   const result = await build({ content, cwd, nodePaths })
   phases.build = elapsed()

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Versioned deps still install
  • Removed the conditional check that skipped require.resolve for non-@latest dependencies, ensuring all dependencies are checked against nodePaths before installation.

Or push these changes by commenting:

@cursor push a41a87a6b5

Preview (a41a87a6b5)

diff --git a/src/compile/index.js b/src/compile/index.js
--- a/src/compile/index.js
+++ b/src/compile/index.js
@@ -32,7 +32,6 @@
   installDependencies.validateDependencies(allDependencies, allow.dependencies)
   const dependencies = nodePaths.length
     ? allDependencies.filter(dep => {
-      if (!dep.endsWith('@latest')) return true
       try {
         require.resolve(installDependencies.extractPackageName(dep), { paths: nodePaths })
         return false

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 233f9de. Configure here.}