perf(cli): compile the CLI with bytecode

[avallete]

Compiled CLI builds now enable minification, ESM, and bytecode at depth 2 to reduce startup work. Release, local, and E2E binaries share the same compilation options, including the local npm release workflow.

Depth 2 limits the binary-size cost compared with compiling all nested functions ahead of time.

[github-actions]

🤖 AI Review

Only Claude’s independent review was available; Codex’s pass did not complete. After verification against the PR code, trusted conventions, and pinned Bun 1.4.1 behavior, three correctness concerns are refuted and six documentation/maintainability nits are confirmed. No blocking defect was verified.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	apps/cli/scripts/build.ts:124	maintainability	claude	The helper’s merge order forces shared flags over caller configuration while callers still redundantly specify minify: true, obscuring which layer owns those settings.
⚪ NIT	apps/cli/scripts/bundle-externals.ts:11	documentation	claude	The new compile-flags declaration separates the opening oxfmt documentation from the externals constant it describes.
⚪ NIT	tools/release/local-release.ts:194	duplication	claude	The shell-based local release duplicates the shared bytecode settings as CLI literals, allowing its configuration to drift from the object-API builds.
⚪ NIT	apps/cli/scripts/bundle-externals.ts:8	naming	claude	The compiledBytecode name and “published CLI binary” documentation understate the object’s scope and consumers.
⚪ NIT	apps/cli/scripts/build-binary.ts:24	developer-experience	claude	The local/E2E binary is now minified and bytecode-compiled without documenting the developer-experience trade-off.
⚪ NIT	docs/adr/0011-cli-release-and-distribution-strategy.md:48	documentation	claude	The packaging ADR’s illustrative compile command omits the newly required bytecode depth and ESM settings.

Findings outside the diff

• ⚪ NIT docs/adr/0011-cli-release-and-distribution-strategy.md:48 — The packaging ADR’s illustrative compile command omits the newly required bytecode depth and ESM settings.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/scripts/bundle-externals.ts:14 (build-config): bytecodeDepth may be ignored by Bun’s object API, causing release build paths to use different bytecode depths.
  Refuted: Pinned Bun 1.4.1 explicitly recognizes and validates the object-API property: a string value reports that bytecodeDepth must be a number, negative and fractional values receive range/type errors, and the valid configuration proceeds to executable output. The missing bun-types declaration does not mean the runtime ignores the property.
• apps/cli/scripts/bundle-externals.ts:15 (build-config): Combining bytecode with ESM may be unsupported or silently disable bytecode, leaving the optimization ineffective.
  Refuted: Bun 1.4.1 explicitly reports that ESM bytecode requires compile: true; both affected object-API builds supply that option. The exact valid combination is accepted and reaches executable generation, so the cited historical CJS restriction does not apply to the pinned runtime.
• apps/cli/scripts/build-binary.ts:24 (release-risk): The PR switches compiled binaries from CJS to ESM, potentially breaking injected require behavior without cross-platform validation.
  Refuted: The prior build had no bytecode flag and Bun 1.4.1 defaults such builds to ESM, so this does not switch the binary from CJS to ESM. Moreover, .github/workflows/build-cli-artifacts.yml:109-118 builds every target before publication, and release smoke tests execute Linux glibc/musl artifacts on both architectures plus native Windows and macOS artifacts. Some platform/command coverage gaps remain, but not the claimed format regression.

Stats

Claude findings: 9 · Codex findings: 0 · Confirmed: 6 · Refuted: 3 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[jgoux]

Triaged the AI review and addressed all six confirmed nits, including the release ADR example mentioned outside the inline diff. Build paths now share compileOptions; local release consumes the same object through Bun.build, and the redundant flags and displaced documentation are cleaned up.

The three previously refuted correctness concerns remain refuted: the pinned Bun accepts the depth option and ESM bytecode, and this does not introduce a CJS-to-ESM format switch. No speculative compatibility changes were added.

Formatting, lint, type-checking, binary compilation, and native startup checks pass. #6712 is now based on this branch, with the build conflicts resolved while preserving these options.