fix(packages/bundler): correct autoload region marker and restructure tests

[zrosenbauer]

Summary

• Bug fix: The autoload plugin's transform hook searched for //#region src/autoloader.ts but core's dist emits //#region src/autoload.ts (the source file is autoload.ts, not autoloader.ts). This meant the runtime readdir-based autoloader was never replaced with the static version during kidd build, causing ENOENT: no such file or directory, scandir 'dist/commands' at runtime.
• Test restructure: Moved unit tests masquerading as integration tests into packages/core/src/ where they belong. Replaced them with true E2E tests that build example CLIs and run the binaries as subprocesses.

Changes

Bug fix

• packages/bundler/src/autoloader/autoload-plugin.ts — fixed region marker constant and replacement output
• packages/bundler/src/autoloader/generate-autoloader.ts — aligned (static) region labels
• Updated corresponding test assertions

Test restructure

• Moved to packages/core/src/: auth-http-chain, typed-middleware, device-code-e2e, oauth-e2e, mock-oauth-server
• New E2E tests (tests/integration/): simple.test.ts and advanced.test.ts — build example CLIs, run node dist/index.mjs, assert stdout
• Deleted: 9 old integration tests that imported package internals and example command files directly
• Simplified vitest.exports.config.ts — removed @ alias (no longer needed)

Test plan

• pnpm check passes (typecheck + lint + format)
• pnpm test passes (740 core tests including moved tests)
• pnpm test:exports passes (56 tests: exports + E2E simple + E2E advanced)
• E2E tests build both examples and run --help, greet, list, deploy --help
• E2E tests would catch this exact regression (marker name drift → transform misses → readdir fails)

[changeset-bot]

🦋 Changeset detected

Latest commit: 458a29d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@kidd-cli/bundler	Patch
@kidd-cli/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR renames bundler autoloader region labels from "src/autoloader.ts" to "src/autoload.ts" (code and tests), switches several auth tests to import mock OAuth utilities from a centralized test module and removes those re-exports from tests/helpers index, removes multiple per-command integration test files and adds consolidated example-based integration suites plus a new tests/helpers.ts runner, updates Vitest config (removes the @ alias, adds testTimeout), adjusts root package.json test scripts to add test:integration, and updates turbo.json task wiring and CI build steps.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• refactor(repo): code review cleanup across all packages #72 — Refactors autoloader naming/placement; directly overlaps the autoloader region/name changes in this PR.
• feat(packages/core)!: replace oauth with PKCE and add device code flow #7 — Introduces/centralizes the mock OAuth server used by tests; matches the import-path changes away from test helpers.
• refactor(repo): inline tsdown per-package, lift integration tests to root, consolidate test utils #76 — Reworks test orchestration and integration test layout; overlaps with new integration test task, Vitest config, and example-based integration suites.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the two primary changes: the autoload region marker fix and the test restructuring.
Description check	✅ Passed	The description clearly documents the bug fix, test restructuring, and verification steps, directly relating to the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/autoload-region-marker

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/helpers.ts`:
- Around line 15-20: The test helper currently builds a shell-interpolated
command via execSync(`node dist/index.mjs ${args.join(' ')}`) which breaks
arguments with spaces and risks injection; change it to use an argv-based child
process call (e.g., execFileSync or spawnSync) that passes 'node' as the
executable and ['dist/index.mjs', ...args] as the args array so arguments are
not shell-interpolated, keeping the same options (cwd, encoding, timeout) and
return value behavior in the function that returns (...args: readonly string[]).

In `@tests/integration/advanced.test.ts`:
- Around line 1-39: The test file tests/integration/advanced.test.ts violates
the project testing standard; move it to the canonical location
test/integration/advanced.test.ts and update any relative imports accordingly
(e.g., adjust the import of createExampleRunner from '../helpers.js' so it
correctly resolves from the new file location). Ensure the test still imports
createExampleRunner and uses the same describe/it assertions as before (retain
the symbols createExampleRunner and the test name strings) and run the test
suite to verify paths are correct.

In `@tests/integration/simple.test.ts`:
- Around line 1-76: The test file simple.test.ts is placed under
tests/integration/ but must live in test/integration/ per the repo testing
standard; move this file (the suite that begins with describe('examples/simple
(built CLI)') and uses createExampleRunner) into the required directory
test/integration/, then update any relative imports (e.g., the
createExampleRunner import from '../helpers.js') so they resolve from the new
file location and run the suite from the new path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e9b18a1c-9793-432d-990b-fc8336b6fcc7

📥 Commits

Reviewing files that changed from the base of the PR and between 7476b81 and 6b86e58.

📒 Files selected for processing (4)

• package.json
• tests/helpers.ts
• tests/integration/advanced.test.ts
• tests/integration/simple.test.ts

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

tests/helpers.ts (1)

1-1: ⚠️ Potential issue | 🟠 Major

Replace shell-interpolated execSync with argv-based process execution.

Line 20 builds a shell command using args.join(' '), which mis-parses args containing spaces and allows shell metacharacter injection.

🔧 Proposed fix

-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
@@
   return (...args: readonly string[]): string =>
-    execSync(`node ${distPath} ${args.join(' ')} 2>&1`, {
+    execFileSync('node', [distPath, ...args], {
       cwd,
       encoding: 'utf8',
       timeout: 10_000,
     })

#!/bin/bash
set -euo pipefail

# Verify shell-interpolated execution is still present.
rg -n "execSync\\(`node \\$\\{distPath\\} \\$\\{args\\.join\\(' '\\)\\} 2>&1`" tests/helpers.ts

# Inspect current call sites that depend on this helper.
rg -n "createExampleRunner\\(" tests/integration/*.test.ts tests/helpers.ts

Also applies to: 19-24

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/helpers.ts` at line 1, The helper currently builds a shell-interpolated
command using execSync with args.join(' '), which mis-parses spaced arguments
and allows shell injection; in the createExampleRunner helper replace that
execSync call with a argv-based API (e.g., child_process.execFileSync or
spawnSync) by invoking 'node' with an array like [distPath, ...args] so each arg
is preserved, capture stdout/stderr via options (encoding:'utf8' and
stdio:'pipe' or combine stderr into the returned string), and remove the inline
"2>&1" shell redirection; update any result handling to use the returned
buffers/strings from execFileSync/spawnSync.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/helpers.ts`:
- Around line 13-16: The exported function createExampleRunner currently uses
two positional parameters (example, distPath) which violates the repo standard;
change its signature to accept a single destructured object parameter ({
example, distPath = 'dist/index.mjs' }) and update all callers to pass an object
instead of positional args; keep the same default for distPath, preserve the
return type and behavior, and update any tests/imports that call
createExampleRunner to use the new object shape.

---

Duplicate comments:
In `@tests/helpers.ts`:
- Line 1: The helper currently builds a shell-interpolated command using
execSync with args.join(' '), which mis-parses spaced arguments and allows shell
injection; in the createExampleRunner helper replace that execSync call with a
argv-based API (e.g., child_process.execFileSync or spawnSync) by invoking
'node' with an array like [distPath, ...args] so each arg is preserved, capture
stdout/stderr via options (encoding:'utf8' and stdio:'pipe' or combine stderr
into the returned string), and remove the inline "2>&1" shell redirection;
update any result handling to use the returned buffers/strings from
execFileSync/spawnSync.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 72c579c8-025f-4b91-9aef-99900ddc56f9

📥 Commits

Reviewing files that changed from the base of the PR and between 33cd83f and 5a1242f.

📒 Files selected for processing (6)

• examples/authenticated-service/cli/package.json
• tests/helpers.ts
• tests/integration/authenticated-service.test.ts
• tests/integration/diagnostic-output.test.ts
• tests/integration/icons.test.ts
• turbo.json

[zrosenbauer]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.