build: Bundle vats with vite #763

grypez · 2026-01-22T02:24:30Z

Summary

Replace @endo/bundle-source with vite for vat bundling and remove @endo/import-bundle for bundle loading.

Changes

Bundle vats using vite's build() API with IIFE output format
Load bundles via Compartment.evaluate() instead of importBundle()
Remove @endo/import-bundle dependency from all packages.
Remove @endo/bundle-source dependency from all packages except kernel-shims.

Bundle Format

New bundles use vite-iife format:

{
  "moduleFormat": "vite-iife",
  "code": "var __vatExports__ = ...",
  "exports": ["buildRootObject"],
  "modules": { ... }
}

Closes: #742

Note

Replaces Endo bundle tooling with a Vite-based bundling pipeline and a new runtime loader.

Add Vite bundler (bundleVat) producing IIFE bundles; include Rollup plugins export-metadata and strip-comments
Update CLI to use Vite bundler for bundle, watch, and server tests; adjust mocks and types
Replace kernel bundle loading: remove importBundle, fetch bundle as text, and load via loadBundle using Compartment.evaluate()
Introduce VatBundle type and isVatBundle guard in @metamask/kernel-utils; update tests and fixtures to IIFE format
Dependencies: add vite/rollup; remove @endo/bundle-source and @endo/import-bundle; update README accordingly

^{Written by Cursor Bugbot for commit b9cfdcc. This will update automatically on new commits. Configure here.}

socket-security · 2026-01-22T02:25:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rollup@4.46.3 ⏵ 4.55.3				⁺²

View full report

github-actions · 2026-01-22T15:26:31Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	88.12% ⬇️ -0.25%	5564 / 6314
🔵	Statements	88% ⬇️ -0.24%	5654 / 6425
🔵	Functions	87.19% ⬇️ -0.31%	1437 / 1648
🔵	Branches	84.07% ⬇️ -0.36%	2027 / 2411

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/cli/src/app.ts	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	0% 🟰 ±0%	15-155
packages/cli/src/commands/bundle.ts	92.3% 🟰 ±0%	50% 🟰 ±0%	100% 🟰 ±0%	92.3% 🟰 ±0%	79
packages/cli/src/commands/watch.ts	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%	100% 🟰 ±0%
packages/cli/src/vite/export-metadata-plugin.ts	0%	0%	0%	0%	23-46
packages/cli/src/vite/vat-bundler.ts	0%	0%	0%	0%	22-62
packages/ocap-kernel/src/vats/VatSupervisor.ts	74.64% 🟰 ±0%	44.82% 🟰 ±0%	58.33% 🟰 ±0%	74.64% 🟰 ±0%	122, 133, 141, 179, 217-221, 232, 241-242, 263-265, 268, 272-274, 309, 326-334
packages/ocap-kernel/src/vats/bundle-loader.ts	87.5%	80%	100%	87.5%	31

Generated in workflow #3285 for commit b8e02c0 by the Vitest Coverage Report Action

github-actions · 2026-01-22T15:26:32Z

📊 View full HTML coverage report for main

Drop support for the legacy endoZipBase64 bundle format and remove the @endo/import-bundle dependency. All vat bundles now use the vite-iife format loaded via Compartment.evaluate(). - Remove @endo/import-bundle from ocap-kernel dependencies - Simplify bundle-loader.ts to only support vite-iife format - Update VatSupervisor to use synchronous loadBundle - Update CLI tests to mock bundleVat instead of @endo/bundle-source - Update serve integration test to check vite-iife format Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

rekmarks

Really nice!

packages/ocap-kernel/src/vats/bundle-loader.ts

packages/cli/README.md

rekmarks · 2026-01-22T21:01:23Z

packages/cli/test/integration/serve.test.ts

+type ViteBundle = {
+  moduleFormat: 'vite-iife';
+  code: string;
+  exports: string[];
+  modules: Record<string, unknown>;
+};
+
+const isViteBundle = (value: unknown): value is ViteBundle =>


We should import the renamed VatBundle type here, ideally. The type may need to be relocated to kernel-utils to resolve dependency circularity issues. That would also make a nice home for isVatBundle.

rekmarks · 2026-01-22T21:06:04Z

packages/cli/src/vite/vat-bundler.ts

+  // SES rejects code containing `import(` patterns, even in comments.
+  // Replace them with a safe alternative that won't trigger detection.
+  const sanitizedCode = chunk.code.replace(/\bimport\s*\(/gu, 'IMPORT(');


This comment ought to say something about "we solemnly swear that the string import only occurs in comments".

An alternative approach that might be more convincing is to filter comments from the AST using a rollup plugin.

Recommend punting to #770

rekmarks · 2026-01-22T21:06:57Z

packages/cli/src/vite/vat-bundler.ts

+import type { BundleMetadata } from './export-metadata-plugin.ts';
+
+export type VatBundle = BundleMetadata & {
+  moduleFormat: 'vite-iife';


Continuing to harp on this topic: the number of times we declare this property is a code smell.

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

cursor

Cursor Bugbot has reviewed your changes and found 4 potential issues.

packages/cli/src/commands/bundle.test.ts

cursor · 2026-01-23T01:53:55Z

packages/cli/src/vite/strip-comments-plugin.ts

+          // Skip until end of line
+          while (i < code.length && code[i] !== '\n') {
+            i += 1;
+          }


Comment stripper incorrectly handles regex literals

High Severity

The comment stripping logic treats any // sequence as a single-line comment, even when it appears inside regex literals. Code containing regex patterns like /https:\/\// or /\w+\/\// would be incorrectly parsed, with content after the escaped slashes stripped away. The plugin only detects string literals but not regex literals, causing valid JavaScript to be corrupted when regex patterns contain comment-like sequences.

cursor · 2026-01-23T01:53:55Z

packages/cli/src/vite/strip-comments-plugin.ts

+              result += strChar;
+              i += 1;
+            }
+          }


Template literal expressions with comments not handled

Medium Severity

The comment stripper treats backticks as regular string delimiters, copying everything between them without recognizing ${...} template expressions. Comments within these expressions like `${foo /* comment */}` won't be stripped. Since SES rejects code with import( in comments, and this plugin's purpose is preventing that rejection, unstripped comments in template expressions could cause bundle evaluation to fail.

cursor · 2026-01-23T01:53:55Z

packages/cli/src/vite/strip-comments-plugin.ts

+            i += 1;
+          }
+          i += 1; // Skip the closing /
+        }


Stripped multi-line comments create syntax errors

High Severity

Multi-line comments are removed without replacing them with whitespace, causing adjacent tokens to merge. Code like foo/*comment*/instanceof bar becomes fooinstanceof bar, creating a syntax error. The bundled code will fail to parse when loaded by the compartment, causing vat initialization to fail with confusing parse errors rather than executing correctly.

grypez force-pushed the grypez/bundle-with-vite branch 3 times, most recently from 504110d to 1a13965 Compare January 22, 2026 15:17

grypez marked this pull request as ready for review January 22, 2026 18:29

grypez requested a review from a team as a code owner January 22, 2026 18:29

grypez and others added 4 commits January 22, 2026 13:45

build: Support bundling with vite

c336c83

respin yarn

0daa651

fix test mock

b8e02c0

grypez force-pushed the grypez/bundle-with-vite branch from 1a13965 to b8e02c0 Compare January 22, 2026 18:45

rekmarks requested changes Jan 22, 2026

View reviewed changes

Apply some suggestions from code review

d724da0

Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

This comment was marked as outdated.

Sign in to view

address remaining review comments

018479d

cursor bot reviewed Jan 23, 2026

View reviewed changes

small fixes

b9cfdcc

rekmarks mentioned this pull request Jan 23, 2026

refactor: Make makeJsonAgent bundleable with @endo/bundle-source #750

Closed

build: Bundle vats with vite #763

Are you sure you want to change the base?

build: Bundle vats with vite #763

Uh oh!

Conversation

grypez commented Jan 22, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Bundle Format

Uh oh!

socket-security bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

github-actions bot commented Jan 22, 2026

Uh oh!

rekmarks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rekmarks Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

rekmarks Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

grypez Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

grypez Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

rekmarks Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

Comment stripper incorrectly handles regex literals

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

Template literal expressions with comments not handled

Uh oh!

cursor bot Jan 23, 2026

Choose a reason for hiding this comment

Stripped multi-line comments create syntax errors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

grypez commented Jan 22, 2026 •

edited by cursor bot

Loading

socket-security bot commented Jan 22, 2026 •

edited

Loading

github-actions bot commented Jan 22, 2026 •

edited

Loading