fix(release): allow fzfWorker.js in standalone dist allowlist#5049
Merged
Conversation
esbuild emits dist/fzfWorker.js as a standalone entry next to cli.js, but create-standalone-package.js's DIST_ALLOWED_ENTRIES did not list it, so 'Build Standalone Archives' failed with 'Unexpected dist asset'. prepare-package.js already whitelists it for the npm tarball; this syncs the standalone packer.
Collaborator
Author
Local reproduction of the failing
|
Collaborator
|
Thanks for the PR, @yiliang114! Template looks good ✓ — all required sections present with bilingual coverage. On direction: this is a clear-cut release pipeline fix. The v0.18.0 release failed because On approach: minimal and correct — adds one filename to the allowlist with a comment explaining why it must live next to Moving on to code review. 🔍 中文说明感谢贡献，@yiliang114！ 模板完整 ✓ — 所有必要章节齐全，中英双语覆盖。 方向：这是一个明确的发布流水线修复。v0.18.0 发布失败，因为 方案：最小且正确 — 往白名单里加一个文件名，附注释说明为什么必须与 进入代码审查 🔍 — Qwen Code · qwen3.7-max |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR unblocks the standalone release packaging by allowing the newly emitted dist/fzfWorker.js esbuild output to be copied into standalone archives.
Changes:
- Add
fzfWorker.jstoDIST_ALLOWED_ENTRIESinscripts/create-standalone-package.jssocopyRuntimeAssetsno longer fails on the new dist entry.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
45
to
50
| const DIST_ALLOWED_ENTRIES = new Set([ | ||
| 'cli.js', | ||
| // fzf fuzzy-search worker; esbuild emits it as a standalone entry that must | ||
| // sit next to cli.js so `new URL('./fzfWorker.js', ...)` resolves at runtime. | ||
| 'fzfWorker.js', | ||
| 'chunks', |
Collaborator
Code ReviewThe diff is exactly what I'd write independently: add The comment in the diff is justified — the Real-Scenario TestingRan Before (main branch, no fix)After (this PR — fzfWorker.js added to allowlist)Archive contents verificationBoth files present in the standalone archive as expected. 中文说明代码审查diff 与我的独立方案完全一致：将 diff 中的注释是合理的 — 真实场景测试运行 改动前报错 — Qwen Code · qwen3.7-max |
Collaborator
ReflectionThis is a clean, surgical fix for a broken release pipeline. The problem is unambiguous (standalone packer aborts on an unexpected dist entry), the root cause is clear (a second allowlist in My independent proposal was identical — add The before/after test on Linux x64 confirms the fix works end-to-end: the exact error from the failed release run ( One minor observation: the dual-allowlist pattern (separate whitelists in Verdict: Approve. The fix is correct, tested, and ships the minimum change needed to unblock the release. 中文说明反思这是一个干净、精准的发布流水线修复。问题明确（standalone 打包脚本遇到意外的 dist 文件就中止），根因清楚（ 我的独立方案完全一致——将 Linux x64 上的改动前/改动后测试确认了修复的端到端效果：main 上复现了与失败发布完全相同的错误，PR 修复后归档正确包含了 一个小观察：双白名单模式（ 结论：通过。 修复正确、经过测试、是解除发布阻塞所需的最小改动。 — Qwen Code · qwen3.7-max |
qwen-code-ci-bot
approved these changes
Jun 12, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, looks ready to ship. ✅
chiga0
approved these changes
Jun 12, 2026
chiga0
left a comment
chiga0
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. Simple allowlist addition for esbuild-emitted fzfWorker.js (from the fzf npm package). Comment correctly documents the runtime requirement (new URL('./fzfWorker.js', ...) resolution). No concerns.
yiliang114
enabled auto-merge (squash)
June 12, 2026 13:59
doudouOUC
self-requested a review
June 12, 2026 14:08
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
This was referenced Jun 15, 2026
pomelo-nwu
pushed a commit
that referenced
this pull request
Jun 15, 2026
The OOM-prevention work in #4914 added a dist/cli-entry.js bin wrapper (re-spawns node --expose-gc cli.js) via prepare-package.js, but did not register it in the standalone packager's strict dist allowlist. The release job then fails with: Error: Unexpected dist asset: .../dist/cli-entry.js Add cli-entry.js to DIST_ALLOWED_ENTRIES, same fix as #5049 did for fzfWorker.js.
doudouOUC
pushed a commit
that referenced
this pull request
Jun 15, 2026
esbuild emits dist/fzfWorker.js as a standalone entry next to cli.js, but create-standalone-package.js's DIST_ALLOWED_ENTRIES did not list it, so 'Build Standalone Archives' failed with 'Unexpected dist asset'. prepare-package.js already whitelists it for the npm tarball; this syncs the standalone packer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Adds
fzfWorker.jsto theDIST_ALLOWED_ENTRIESallowlist inscripts/create-standalone-package.js, so the standalone packer accepts the fzf worker bundle that esbuild now emits atdist/fzfWorker.js.Why it's needed
The fzf fuzzy-search feature added a second esbuild entry that outputs
dist/fzfWorker.jsnext todist/cli.js(it has to live there sonew URL('./fzfWorker.js', ...)resolves at runtime).scripts/prepare-package.jswas updated to whitelist this file for the npm tarball, butscripts/create-standalone-package.jskeeps its own allowlist that was not updated. ItscopyRuntimeAssetsstep fails on any unexpected dist entry, so the release job'sBuild Standalone Archivesstep aborted withError: Unexpected dist asset: .../dist/fzfWorker.jsand the whole release failed (see #5048 / run 27417076690). This change syncs the standalone allowlist withprepare-package.js.Reviewer Test Plan
How to verify
Build the bundle, then run the standalone packer for one target against a downloaded Node runtime. Before the change it fails on the unexpected asset; after it produces an archive that contains
lib/fzfWorker.js.Evidence (Before & After)
Reproduced the failing
Build Standalone Archivesstep locally in tmux. Full terminal capture is in the PR comment below.fzfWorker.js):Error: Unexpected dist asset: .../dist/fzfWorker.js, exit 1 — same error as the failed release run.Created qwen-code-darwin-arm64.tar.gz, exit 0; the archive containsqwen-code/lib/fzfWorker.jsalongsideqwen-code/lib/cli.js.Tested on
Verified on macOS (darwin-arm64). The change is a platform-independent allowlist entry shared by all five release targets, so it behaves identically on Windows and Linux; those targets were not packaged locally.
Environment (optional)
Local
npm run bundle+node scripts/create-standalone-package.jsagainst a Node 22.22.0 darwin-arm64 runtime archive. No sandbox.Risk & Scope
package:standalone:release(Node downloads were throttled); validated the exact failing code path on darwin-arm64 instead.Linked Issues
Closes #5048
中文说明
这个 PR 做了什么
在
scripts/create-standalone-package.js的DIST_ALLOWED_ENTRIES白名单里加入fzfWorker.js，让 standalone 打包脚本接受 esbuild 新产出的dist/fzfWorker.js。为什么需要
fzf 模糊搜索功能新增了一个 esbuild 入口，输出
dist/fzfWorker.js，且必须与dist/cli.js同级（运行时靠new URL('./fzfWorker.js', ...)解析）。scripts/prepare-package.js（npm tarball 白名单）已经同步了这个文件，但scripts/create-standalone-package.js维护着另一份独立的白名单，没有同步。它的copyRuntimeAssets遇到白名单外的 dist 文件就会失败，因此 release 的Build Standalone Archives步骤报Error: Unexpected dist asset: .../dist/fzfWorker.js并导致整个发布失败（见 #5048 / run 27417076690）。本次改动把 standalone 白名单与prepare-package.js对齐。如何验证
先
npm run bundle，再用下载好的 Node runtime 对单个目标跑 standalone 打包。改动前会因为意外的 dist 文件失败，改动后能产出包含lib/fzfWorker.js的归档。详见下方评论里的完整终端输出。fzfWorker.js）：Error: Unexpected dist asset: .../dist/fzfWorker.js，退出码 1 —— 与失败的 release run 报错一致。Created qwen-code-darwin-arm64.tar.gz，退出码 0；归档内同时包含qwen-code/lib/fzfWorker.js与qwen-code/lib/cli.js。风险与范围
package:standalone:release（Node 下载被限速），改为在 darwin-arm64 上验证了出错的那段代码路径。