Distillation

Date: Jul 28, 2026

• 🟡 (12:37) Agent traced app-builder-lib@26 minimatch usage via cached source: out/util/filter.js uses minimatchAll (calls Minimatch.match()), out/fileMatcher.js:69,76,82 constructs new Minimatch(pattern, minimatchOptions) directly. Both paths trigger minimatch's brace expansion during construction. app-builder-lib@26.8.1 cached at /home/byk/.bun/install/cache/app-builder-lib@26.8.1@@@1/
• 🟡 (12:37) Agent pinpointed exact minimatch@10 brace-expansion call: minimatch.js line 268 this.globSet = [...new Set(this.braceExpand())] runs in Minimatch constructor → calls exports.braceExpand (line 149) → (0, brace_expansion_1.expand)(...) → brace-expansion@2.x has NO expand export → TypeError at construction time. Every new Minimatch(pattern) in app-builder-lib (fileMatcher.js lines 69, 76, 82) crashes
• 🟡 (12:37) Agent confirmed CONFIRMED CATASTROPHIC REGRESSION IN PR #1341: blanket override "brace-expansion": ">=2.1.0 <3" forces ALL brace-expansion installs (including minimatch@10's required ^5) to 2.1.3. dmg-builder@26.15.7 → app-builder-lib@26.15.7 → minimatch@10.2.5 → brace-expansion@2.1.3 (forced) → expand is not a function TypeError on every new Minimatch() in fileMatcher.js during build:mac DMG creation
• 🟡 (12:37) Agent verified shiki usage: NOT vestigial in packages/spotlight — actively used at packages/spotlight/src/ui/ShikiProvider.tsx:2 (createHighlighter, bundledLanguages from shiki/bundle-web.mjs), sentinel-theme.ts:1 (type ThemeRegistration), telemetry/components/insights/envelopes/CodeViewer.tsx:1,4 (transformerNotationHighlight, bundledLanguages). shiki@^3.13.0 IS vestigial in packages/website (devDep only, no imports)
• 🟡 (12:37) Agent traced @vitejs/plugin-react@5.2.0 source: pulled by @astrojs/react@6.0.1 (PR #1342's website bump from ^5.0.5 to ^6.0.1). Direct @vitejs/plugin-react@6.0.4 dep is in spotlight. Both target vite@8.1.5
• 🟡 (12:37) Agent confirmed dmg-builder@26.15.7 dep tree: app-builder-lib: 26.15.7, builder-util: 26.15.3, fs-extra: 10.1.0, js-yaml: 4.3.0. dmg-builder→app-builder-lib→minimatch@10 chain is the macOS DMG build path that PR #1341's brace-expansion override breaks
• 🟡 (12:37) Agent observed peer mismatch: lockfile shows app-builder-lib@26.15.7(dmg-builder@26.15.7)(electron-builder-squirrel-windows@24.13.3) — electron-builder-squirrel-windows was DOWNGRADED from 26.15.7 to 24.13.3 (peer mismatch tolerated by pnpm autoInstallPeers). Not correctness-blocking but indicates override drift
• 🟡 (12:37) Agent confirmed shiki dual install is harmless: shiki@3.13.0 (spotlight direct devDep, code uses 3.x APIs) AND shiki@4.0.2 (astro 7 transitive, astro bundles its own internally). No runtime collision — astro doesn't expose shiki to user code
• 🟡 (12:39) Agent created scratch test environment: cloned repo to /tmp/opencode/scratch1341/, checked out PR #1341 (SHA 5001610), ran pnpm install — succeeded cleanly with NO peer warnings, 1425 packages, done in 16.5s. Lockfile is internally consistent; runtime brace-expansion crash is a behavior bug not a resolution bug
• 🟡 (12:40) Agent began runtime verification of brace-expansion bug: confirmed node_modules/.pnpm/minimatch@10.2.5 and node_modules/.pnpm/brace-expansion@2.1.3 coexist in installed tree. Direct require('minimatch') from project root fails (MODULE_NOT_FOUND — hoist prevents it), agent pivoting to test via app-builder-lib's own minimatch access pattern