feat(scripts): vendor hoisted deps for apps/cli

Vendor hoisted runtime/crypto dependencies into apps/cli/node_modules so npm pack includes them (Yarn hoists to repo root by default). Add vendorBundledDependencyFromRootNodeModules and call it for base64-js, @noble/hashes and tweetnacl in bundleWorkspaceDeps.mjs.

Also:
- Add/adjust tests: update bundleWorkspaceDeps tests and add publishBundledDependencies.test to assert bundledDependencies and dependencies are present; add a test for Windows tsc invocation.
- Make runTsc use cmd.exe for .cmd/.bat tsc on win32 to ensure TypeScript builds on Windows.
- Update apps/cli/package.json to include the runtime deps in bundledDependencies and dependencies (move @noble/hashes out of devDependencies); add base64-js and tweetnacl entries.
- Swap workspace build order in top-level package.json build:packages script.

These changes ensure packaged CLI releases include necessary runtime crypto libs and improve cross-platform build reliability.

Author: leeroybrun

apps/cli/package.json

@@ -59,7 +59,10 @@
   "bundledDependencies": [
     "@happier-dev/agents",
     "@happier-dev/cli-common",
-    "@happier-dev/protocol"
+    "@happier-dev/protocol",
+    "base64-js",
+    "@noble/hashes",
+    "tweetnacl"
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",
@@ -110,6 +113,7 @@
     "@happier-dev/cli-common": "0.0.0",
     "@happier-dev/protocol": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.25.3",
+    "@noble/hashes": "^1.8.0",
     "@stablelib/base64": "^2.0.1",
     "@stablelib/hex": "^2.0.1",
     "@types/cross-spawn": "^6.0.6",
@@ -120,6 +124,7 @@
     "@types/tmp": "^0.2.6",
     "ai": "^5.0.107",
     "axios": "^1.13.2",
+    "base64-js": "^1.5.1",
     "chalk": "^5.6.2",
     "cross-spawn": "^7.0.6",
     "expo-server-sdk": "^3.15.0",
@@ -144,7 +149,6 @@
   },
   "devDependencies": {
     "@eslint/compat": "^1",
-    "@noble/hashes": "^1.8.0",
     "@types/node": ">=20",
     "cross-env": "^10.1.0",
     "dotenv": "^16.6.1",

apps/cli/scripts/__tests__/buildSharedDeps.test.ts

@@ -14,6 +14,24 @@ describe('buildSharedDeps', () => {
     );
   });
 
+  it('invokes tsc.cmd via cmd.exe on Windows', () => {
+    const execFileSync = vi.fn(() => undefined);
+
+    runTsc('C:\\repo\\packages\\protocol\\tsconfig.json', {
+      execFileSync,
+      tscBin: 'C:\\repo\\node_modules\\.bin\\tsc.cmd',
+      platform: 'win32',
+    });
+
+    expect(execFileSync).toHaveBeenCalled();
+    const [cmd, args, opts] = execFileSync.mock.calls[0] ?? [];
+    expect(cmd).toBe('cmd.exe');
+    expect(args.slice(0, 3)).toEqual(['/d', '/s', '/c']);
+    expect(String(args[3])).toContain('tsc.cmd');
+    expect(String(args[3])).toContain('-p');
+    expect(opts).toHaveProperty('stdio', 'inherit');
+  });
+
   it('prefers the workspace root tsc binary when present', () => {
     const bin = resolveTscBin({
       exists: (candidate: string) =>

apps/cli/scripts/__tests__/bundleWorkspaceDeps.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 
-import { bundleWorkspaceDeps } from '../bundleWorkspaceDeps.mjs';
+import { bundleWorkspaceDeps, vendorBundledDependencyFromRootNodeModules } from '../bundleWorkspaceDeps.mjs';
 
 function writeJson(path: string, value: unknown) {
   writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
@@ -15,6 +15,29 @@ describe('bundleWorkspaceDeps', () => {
     writeJson(resolve(repoRoot, 'package.json'), { name: 'repo', private: true });
     writeFileSync(resolve(repoRoot, 'yarn.lock'), '# lock\n', 'utf8');
 
+    // Hoisted runtime deps that must be vendored into apps/cli/node_modules for npm pack.
+    mkdirSync(resolve(repoRoot, 'node_modules', 'base64-js'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', 'base64-js', 'package.json'), {
+      name: 'base64-js',
+      version: '1.5.1',
+      main: 'index.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', 'base64-js', 'index.js'), 'module.exports = {};\n', 'utf8');
+    mkdirSync(resolve(repoRoot, 'node_modules', '@noble', 'hashes'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', '@noble', 'hashes', 'package.json'), {
+      name: '@noble/hashes',
+      version: '1.8.0',
+      main: 'index.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', '@noble', 'hashes', 'index.js'), 'module.exports = {};\n', 'utf8');
+    mkdirSync(resolve(repoRoot, 'node_modules', 'tweetnacl'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', 'tweetnacl', 'package.json'), {
+      name: 'tweetnacl',
+      version: '1.0.3',
+      main: 'nacl-fast.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', 'tweetnacl', 'nacl-fast.js'), 'module.exports = {};', 'utf8');
+
     const agentsDir = resolve(repoRoot, 'packages', 'agents');
     const cliCommonDir = resolve(repoRoot, 'packages', 'cli-common');
     const protocolDir = resolve(repoRoot, 'packages', 'protocol');
@@ -60,6 +83,8 @@ describe('bundleWorkspaceDeps', () => {
 
     bundleWorkspaceDeps({ repoRoot, happyCliDir });
 
+    expect(existsSync(join(happyCliDir, 'node_modules', 'base64-js', 'package.json'))).toBe(true);
+    expect(existsSync(join(happyCliDir, 'node_modules', '@noble', 'hashes', 'package.json'))).toBe(true);
     const bundledAgentsPkgJson = JSON.parse(
       readFileSync(resolve(happyCliDir, 'node_modules', '@happier-dev', 'agents', 'package.json'), 'utf8'),
     );
@@ -86,6 +111,29 @@ describe('bundleWorkspaceDeps', () => {
     writeJson(resolve(repoRoot, 'package.json'), { name: 'repo', private: true });
     writeFileSync(resolve(repoRoot, 'yarn.lock'), '# lock\n', 'utf8');
 
+    // Hoisted runtime deps that must be vendored into apps/cli/node_modules for npm pack.
+    mkdirSync(resolve(repoRoot, 'node_modules', 'base64-js'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', 'base64-js', 'package.json'), {
+      name: 'base64-js',
+      version: '1.5.1',
+      main: 'index.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', 'base64-js', 'index.js'), 'module.exports = {};\n', 'utf8');
+    mkdirSync(resolve(repoRoot, 'node_modules', '@noble', 'hashes'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', '@noble', 'hashes', 'package.json'), {
+      name: '@noble/hashes',
+      version: '1.8.0',
+      main: 'index.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', '@noble', 'hashes', 'index.js'), 'module.exports = {};\n', 'utf8');
+    mkdirSync(resolve(repoRoot, 'node_modules', 'tweetnacl'), { recursive: true });
+    writeJson(resolve(repoRoot, 'node_modules', 'tweetnacl', 'package.json'), {
+      name: 'tweetnacl',
+      version: '1.0.3',
+      main: 'nacl-fast.js',
+    });
+    writeFileSync(resolve(repoRoot, 'node_modules', 'tweetnacl', 'nacl-fast.js'), 'module.exports = {};', 'utf8');
+
     const protocolDir = resolve(repoRoot, 'packages', 'protocol');
     const happyCliDir = resolve(repoRoot, 'apps', 'cli');
 
@@ -145,6 +193,9 @@ describe('bundleWorkspaceDeps', () => {
 
     bundleWorkspaceDeps({ repoRoot, happyCliDir });
 
+    expect(existsSync(join(happyCliDir, 'node_modules', 'base64-js', 'package.json'))).toBe(true);
+    expect(existsSync(join(happyCliDir, 'node_modules', '@noble', 'hashes', 'package.json'))).toBe(true);
+
     // dep-a is vendored because protocol declares it.
     expect(() =>
       readFileSync(
@@ -171,4 +222,28 @@ describe('bundleWorkspaceDeps', () => {
       ),
     ).not.toThrow();
   });
+
+  it('vendors a hoisted dependency into apps/cli/node_modules', () => {
+    const repoRoot = mkdtempSync(join(tmpdir(), 'happier-bundle-workspaces-'));
+    const happyCliDir = join(repoRoot, 'apps', 'cli');
+
+    try {
+      mkdirSync(resolve(repoRoot, 'node_modules', 'tweetnacl'), { recursive: true });
+      writeJson(resolve(repoRoot, 'node_modules', 'tweetnacl', 'package.json'), {
+        name: 'tweetnacl',
+        version: '1.0.3',
+        main: 'nacl-fast.js',
+      });
+      writeFileSync(resolve(repoRoot, 'node_modules', 'tweetnacl', 'nacl-fast.js'), 'module.exports = {};', 'utf8');
+
+      mkdirSync(resolve(happyCliDir, 'node_modules'), { recursive: true });
+
+      vendorBundledDependencyFromRootNodeModules({ repoRoot, happyCliDir, packageName: 'tweetnacl' });
+
+      expect(existsSync(join(happyCliDir, 'node_modules', 'tweetnacl', 'package.json'))).toBe(true);
+      expect(existsSync(join(happyCliDir, 'node_modules', 'tweetnacl', 'nacl-fast.js'))).toBe(true);
+    } finally {
+      rmSync(repoRoot, { recursive: true, force: true });
+    }
+  });
 });

apps/cli/scripts/__tests__/publishBundledDependencies.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+describe('apps/cli package publish contract', () => {
+  it('bundles critical crypto/runtime deps for global installs', () => {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const packageJsonPath = resolve(here, '..', '..', 'package.json');
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as {
+      bundledDependencies?: unknown;
+      dependencies?: Record<string, string> | undefined;
+    };
+
+    const bundled = Array.isArray(packageJson.bundledDependencies)
+      ? packageJson.bundledDependencies.map((v) => String(v))
+      : [];
+
+    for (const name of ['base64-js', '@noble/hashes', 'tweetnacl']) {
+      expect(packageJson.dependencies?.[name]).toBeTruthy();
+      expect(bundled).toContain(name);
+    }
+  });
+});
+

apps/cli/scripts/buildSharedDeps.mjs

@@ -43,8 +43,14 @@ const tscBin = resolveTscBin();
 export function runTsc(tsconfigPath, opts) {
   const exec = opts?.execFileSync ?? execFileSync;
   const tsc = opts?.tscBin ?? tscBin;
+  const platform = opts?.platform ?? process.platform;
   try {
-    exec(tsc, ['-p', tsconfigPath], { stdio: 'inherit' });
+    if (platform === 'win32' && (tsc.endsWith('.cmd') || tsc.endsWith('.bat'))) {
+      const command = `"${tsc}" -p "${tsconfigPath}"`;
+      exec('cmd.exe', ['/d', '/s', '/c', command], { stdio: 'inherit' });
+    } else {
+      exec(tsc, ['-p', tsconfigPath], { stdio: 'inherit' });
+    }
   } catch (error) {
     const suffix = tsconfigPath ? ` (${tsconfigPath})` : '';
     const message = error instanceof Error ? error.message : String(error);

apps/cli/scripts/bundleWorkspaceDeps.mjs

@@ -1,3 +1,4 @@
+import { cpSync, existsSync, mkdirSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,6 +11,33 @@ import {
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+export function vendorBundledDependencyFromRootNodeModules(params) {
+  const repoRoot = params.repoRoot;
+  const happyCliDir = params.happyCliDir;
+  const packageName = params.packageName;
+
+  if (typeof repoRoot !== 'string' || repoRoot.length === 0) {
+    throw new Error('vendorBundledDependencyFromRootNodeModules requires repoRoot');
+  }
+  if (typeof happyCliDir !== 'string' || happyCliDir.length === 0) {
+    throw new Error('vendorBundledDependencyFromRootNodeModules requires happyCliDir');
+  }
+  if (typeof packageName !== 'string' || packageName.length === 0) {
+    throw new Error('vendorBundledDependencyFromRootNodeModules requires packageName');
+  }
+
+  const srcDir = resolve(repoRoot, 'node_modules', packageName);
+  const destDir = resolve(happyCliDir, 'node_modules', packageName);
+
+  if (!existsSync(srcDir)) {
+    throw new Error(`Unable to vendor dependency '${packageName}': missing ${srcDir}`);
+  }
+
+  mkdirSync(resolve(happyCliDir, 'node_modules'), { recursive: true });
+  rmSync(destDir, { recursive: true, force: true });
+  cpSync(srcDir, destDir, { recursive: true });
+}
+
 export function bundleWorkspaceDeps(opts = {}) {
   const repoRoot = opts.repoRoot ?? findRepoRoot(__dirname);
   const happyCliDir = opts.happyCliDir ?? resolve(repoRoot, 'apps', 'cli');
@@ -39,6 +67,12 @@ export function bundleWorkspaceDeps(opts = {}) {
       destPackageDir: b.destDir,
     });
   }
+
+  // `npm pack` only includes `bundledDependencies` if they're present under apps/cli/node_modules.
+  // Yarn hoists to the repo root by default, so we explicitly vendor these from the root node_modules.
+  vendorBundledDependencyFromRootNodeModules({ repoRoot, happyCliDir, packageName: 'base64-js' });
+  vendorBundledDependencyFromRootNodeModules({ repoRoot, happyCliDir, packageName: '@noble/hashes' });
+  vendorBundledDependencyFromRootNodeModules({ repoRoot, happyCliDir, packageName: 'tweetnacl' });
 }
 
 const invokedAsMain = (() => {

package.json

@@ -2,7 +2,7 @@
   "name": "monorepo",
   "private": true,
   "scripts": {
-    "build:packages": "yarn workspace @happier-dev/agents build && yarn workspace @happier-dev/protocol build",
+    "build:packages": "yarn workspace @happier-dev/protocol build && yarn workspace @happier-dev/agents build",
     "ci:act": "bash scripts/ci/run-act-tests.sh",
     "test": "yarn -s test:unit",
     "test:unit": "yarn workspace @happier-dev/protocol test && yarn workspace @happier-dev/agents test && yarn workspace @happier-dev/app test && yarn workspace @happier-dev/cli test:unit && yarn --cwd apps/server test:unit && yarn --cwd packages/relay-server test && yarn --cwd apps/stack test:unit",