[BLOCKED — DO NOT MERGE] build(deps): better-sqlite3 13.0.3 pin + prebuild prune

.github/workflows/binary-build.yml

@@ -38,6 +38,7 @@ jobs:
               node_modules/onnxruntime-node/bin/napi-v3/darwin/arm64/onnxruntime_binding.node
               node_modules/onnxruntime-node/bin/napi-v3/darwin/arm64/libonnxruntime.1.21.0.dylib
               node_modules/sqlite-vec-darwin-arm64/vec0.dylib
+              node_modules/better-sqlite3/prebuilds/darwin-arm64.node
               node_modules/@napi-rs/keyring-darwin-arm64/keyring.darwin-arm64.node
               node_modules/wreq-js/rust/wreq-js.darwin-arm64.node
               node_modules/@anush008/tokenizers-darwin-universal/tokenizers.darwin-universal.node
@@ -51,6 +52,7 @@ jobs:
               node_modules/onnxruntime-node/bin/napi-v3/darwin/x64/onnxruntime_binding.node
               node_modules/onnxruntime-node/bin/napi-v3/darwin/x64/libonnxruntime.1.21.0.dylib
               node_modules/sqlite-vec-darwin-x64/vec0.dylib
+              node_modules/better-sqlite3/prebuilds/darwin-x64.node
               node_modules/@napi-rs/keyring-darwin-x64/keyring.darwin-x64.node
               node_modules/wreq-js/rust/wreq-js.darwin-x64.node
               node_modules/@anush008/tokenizers-darwin-universal/tokenizers.darwin-universal.node
@@ -124,9 +126,15 @@ jobs:
           const cfg = JSON.parse(fs.readFileSync(path.join(root, 'packaging/binary/pkg.config.json'), 'utf8'));
           // Keep only the platform-agnostic assets; drop the macOS-arm64 native
           // lines baked into the committed config, then add this platform's.
+          // ⚠ better-sqlite3 joined this list when the pin moved 12.9.0 -> 13.0.3. Under v12 it
+          // compiled to `build/Release/better_sqlite3.node` — the SAME path on every target — so
+          // it was genuinely platform-agnostic and belonged in `common`. v13 ships per-target
+          // prebuilds under `prebuilds/<platform>-<arch>.node`, so leaving it in `common` would
+          // bake the darwin-arm64 binary into every platform's binary.
           const common = cfg.pkg.assets.filter((a) =>
             !a.includes('onnxruntime-node/bin/napi-v3/') &&
             !a.startsWith('node_modules/sqlite-vec-') &&
+            !a.startsWith('node_modules/better-sqlite3/prebuilds/') &&
             !a.includes('/keyring') &&
             !a.startsWith('node_modules/wreq-js/rust/') &&
             !a.includes('/tokenizers') &&

.github/workflows/ci.yml

@@ -247,9 +247,36 @@ jobs:
       matrix:
         # Every desktop OS across the supported Node range. The floor is Node 22
         # (`engines.node: ">=22"`): Node 20 "Iron" went EOL upstream on
-        # 2026-03-24, so it is no longer built or tested here. 12.9.0 ships
-        # prebuilt native binaries for every row (win32-x64 + darwin/linux arm64
-        # across Node 22/24), so npm ci never falls back to a source compile.
+        # 2026-03-24, so it is no longer built or tested here. better-sqlite3
+        # 13.0.3 ships prebuilt native binaries for every row: v13's are
+        # Node-API, carry no ABI suffix, and all eight targets travel in the ONE
+        # tarball, so there is no per-platform artifact to resolve. The
+        # postinstall then drops the seven the host cannot load
+        # (scripts/prune/sqlite-prebuilds.mjs).
+        #
+        # ⚠ AND ON WINDOWS `npm ci` STILL COMPILES FROM SOURCE, WHICH IS WHY
+        # THIS PIN IS NOT MERGEABLE. An earlier version of this comment claimed
+        # v13 "never falls back to a source compile on any row". That is false
+        # and was written from a green macOS run; this matrix measured it. Every
+        # macOS and Linux row passes, every Windows row fails, at `npm ci`:
+        #   npm error command C:\...\cmd.exe /d /s /c node-gyp rebuild
+        #   npm error gyp ERR! find VS could not find a version of
+        #                          Visual Studio 2017 or newer to use
+        # v12 shipped an `install` script (prebuild-install) that ran in pure
+        # Node and exited 0 the moment it found the bundled binary, so node-gyp
+        # was never invoked. v13 removed it, and npm then supplies its own
+        # implicit `node-gyp rebuild` for any package carrying a binding.gyp.
+        # better-sqlite3 publishes `gypfile: false` precisely to suppress that,
+        # and npm ignores it (npm/cli#9837, WiseLibs/better-sqlite3#1503/#1505).
+        # binding.gyp's own `prebuild_exists` guard cannot save it either: gyp
+        # must CONFIGURE before it can evaluate any variable, and configure is
+        # the step that needs the toolchain.
+        #
+        # This is not a CI-image problem to paper over. It means a Windows user
+        # without Python and VC++ Build Tools cannot `npm i wigolo` at all, and
+        # that is exactly the failure this clean-machine job exists to catch.
+        # Revisit when npm/cli#9837 lands or better-sqlite3 restores a
+        # JS-only install script.
         os: [ubuntu-latest, macos-latest, windows-latest]
         node: ['22', '24']
         include:

package.json

@@ -126,7 +126,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@mozilla/readability": "^0.6.0",
     "ajv": "8.17.1",
-    "better-sqlite3": "~12.9.0",
+    "better-sqlite3": "13.0.3",
     "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
     "defuddle": "^0.16.0",

packaging/binary/pkg.config.json

@@ -1,5 +1,5 @@
 {
-  "//": "pkg config for the wigolo single-file binary. Copied to the repo root as pkg.build.json at build time so all globs resolve relative to the repo root (pkg resolves scripts/assets relative to the CONFIG file's directory — round-1 finding). The entry fed to pkg is the esbuild CJS bundle at dist/cli/agents/wigolo.bundle.cjs; `scripts` stays empty because the bundle is self-contained JS. Native .node/.dylib and asset-carrier packages are declared here so pkg's require-hook can extract them at runtime.",
+  "//": "pkg config for the wigolo single-file binary. Copied to the repo root as pkg.build.json at build time so all globs resolve relative to the repo root (pkg resolves scripts/assets relative to the CONFIG file's directory — round-1 finding). The entry fed to pkg is the esbuild CJS bundle at dist/cli/agents/wigolo.bundle.cjs; `scripts` stays empty because the bundle is self-contained JS. Native .node/.dylib and asset-carrier packages are declared here so pkg's require-hook can extract them at runtime. NOTE the better-sqlite3 line is PLATFORM-SPECIFIC and was not always: v12 compiled to a fixed `build/Release/better_sqlite3.node`, the same path on every target, so it sat with the platform-agnostic entries and binary-build.yml's composer left it alone. v13 ships per-target Node-API prebuilds under `prebuilds/<platform>-<arch>.node` and the loader computes that name at RUNTIME, so pkg cannot discover it by static analysis and it must be declared per target — this file carries the darwin-arm64 one and the workflow strips it for the other rows exactly as it does the other natives.",
   "pkg": {
     "scripts": [],
     "assets": [
@@ -17,7 +17,7 @@
       "node_modules/playwright-core/browsers.json",
       "node_modules/playwright-core/cli.js",
       "node_modules/playwright-core/**/*.js",
-      "node_modules/better-sqlite3/build/Release/better_sqlite3.node",
+      "node_modules/better-sqlite3/prebuilds/darwin-arm64.node",
       "node_modules/onnxruntime-node/bin/napi-v3/darwin/arm64/onnxruntime_binding.node",
       "node_modules/onnxruntime-node/bin/napi-v3/darwin/arm64/libonnxruntime.1.21.0.dylib",
       "node_modules/sqlite-vec-darwin-arm64/vec0.dylib",