Skip to content

feat(density): thin tools.ts + clawql-auth Ready subpaths (~124.6 MB) - #1402

Merged
cursor[bot] merged 8 commits into
mainfrom
cursor/tools-auth-ready-lazy-a621
Oct 23, 2026
Merged

cursor[bot] merged 8 commits into
mainfrom
cursor/tools-auth-ready-lazy-a621

Conversation

@danielsmithdevelopment

@danielsmithdevelopment danielsmithdevelopment commented Oct 23, 2026 •

Copy link
Copy Markdown
Owner

Summary

Thin Ready path for tools/auth after clawql-api defer (#1401):

  • Host tools.ts lazy-loads program / sources / injection-drills
  • MCP HTTP OAuth + passkey AS deferred until configured
  • clawql-auth exposes gateway / provider / siwe subpaths; SIWE off inbound Ready
  • clawql-api stops star-exporting / noExternal-bundling auth

Remasure (Bun --smol, N=2k equal-arm)

CI follow-ups on this PR

  • Dashboard: import getPendingSourcesDir / readPendingSourceEffect from clawql-api/sources (root barrel no longer re-exports them)
  • OSV: bump overrides body-parser → 2.4.0, fast-uri → 3.1.9 (GHSA-27r3-jxmh-p828 + fast-uri advisories)

Test plan

  • Local OSV-scanner recursive → No issues found
  • Memory plateau gate / remasure JSON checked in
  • CI green (Dashboard Docker smoke + Supply chain)
Open in Web Open in Cursor 

cursoragent and others added 8 commits October 23, 2026 20:46
Ready hosts import clawql-auth/gateway (and execute uses /provider) so
inbound MCP OAuth and SIWE/viem stay off the listen module graph.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Remove noExternal auth inlining and the fat clawql-auth star-export.
Execute shims use clawql-auth/provider; heavy program/sources/injection
surfaces move to package subpath entries for Ready RSS.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Core Ready imports stay on clawql-api + clawql-auth/gateway; program and
sources handlers dynamic-import subpaths; OAuth/passkey routes load the
full clawql-auth barrel only when env enables them.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Equal-arm N=2k catalog-on anon median ~124.6 MB (~3.4 MB vs api-lazy tip).

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Ready thinning moved getPendingSourcesDir / readPendingSourceEffect off the
root clawql-api barrel; connections.ts still imported them from "." and broke
Dashboard Docker smoke.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
Clears GHSA-27r3-jxmh-p828 (body-parser) and fast-uri advisories that were
blocking the supply-chain gate after tip lockfile pins went stale.

Co-authored-by: Daniel Smith <danielsmithdevelopment@gmail.com>
@cursor
cursor Bot merged commit 4034ffe into main Oct 23, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants