fix(esbuild): resolve paths from absWorkingDir instead of process.cwd()

[ScriptedAlchemy]

Description

esbuild reports every metafile output path relative to absWorkingDir. The plugin resolved those paths, and the manifest's shared package.json lookups, from process.cwd(). A build whose absWorkingDir is not the process directory failed in onEnd with ENOENT: no such file or directory, open 'dist/remoteEntry.js'. When both directories happened to have a dist, the manifest was written next to the process instead of the build, and shared versions came from the process directory's node_modules.

The plugin now reads absWorkingDir once in setup, defaulting to process.cwd() as esbuild does, and resolves the remote entry, the manifest path, and the shared package.json lookups against it. Builds that do not set absWorkingDir are unchanged.

The RFC #5036 stack carries the output-path half of this fix in #5097. Main bugs found in stack work get their own PR, so this is it.

Tests

• packages/esbuild/__tests__/abs-working-dir.spec.mjs builds from a temp directory under os.tmpdir(), with a shared dep@1.2.3 installed only there. It first asserts that the temp directory is not the process directory. Then it asserts that the module map is rewritten in the temp dist/remoteEntry.js, that mf-manifest.json is written next to it and lists dep@1.2.3, and that no manifest lands under the process directory.
• With main's plugin.ts and manifest.ts, the build fails with the ENOENT above. With only the shared-version lookup reverted, the test fails with version: undefined where '1.2.3' is expected. With the fix, it passes.
• The package gains "test": "node --test __tests__/*.spec.mjs". The turbo test task depends on build, so the test runs against dist/plugin.mjs, the published entry.
• pnpm --filter @module-federation/esbuild run lint passes.

Not tested: Windows paths, and write: false builds (see below).

Not in this PR

These share the family but not the mechanism or the correct base directory, so each is its own change:

• manifest.ts resolves the build name from /package.json, an absolute root path. It fails on every machine and falls back to config.name. Fixing it changes buildName for every build.
• getExports in collect-exports.ts resolves the shared module from process.cwd(). Its correct base is esbuild's resolveDir for the importer, which onLoad already receives, not absWorkingDir.
• share-utils.ts reads process.cwd() while normalizing config, before a build exists.
• write: false builds. The plugin reads the remote entry back from disk to fill in __MODULE_MAP__, so nothing is there to read. The map should be generated in the container's onLoad instead of patched after the write.

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist

• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the documentation.

[changeset-bot]

🦋 Changeset detected

Latest commit: c5ae170

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@module-federation/esbuild	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-26T02:58:33.868892Z	15ee09c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@c5ae170

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@c5ae170

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@c5ae170

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@c5ae170

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@c5ae170

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@c5ae170

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@c5ae170

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@c5ae170

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@c5ae170

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@c5ae170

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@c5ae170

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@c5ae170

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@c5ae170

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@c5ae170

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@c5ae170

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@c5ae170

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@c5ae170

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@c5ae170

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@c5ae170

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@c5ae170

@module-federation/playground

pnpm add https://pkg.pr.new/@module-federation/playground@c5ae170

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@c5ae170

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@c5ae170

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@c5ae170

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@c5ae170

@module-federation/rstest

pnpm add https://pkg.pr.new/@module-federation/rstest@c5ae170

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@c5ae170

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@c5ae170

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@c5ae170

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@c5ae170

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@c5ae170

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@c5ae170

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@c5ae170

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@c5ae170

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@c5ae170

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@c5ae170

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@c5ae170

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@c5ae170

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@c5ae170

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@c5ae170

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@c5ae170

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@c5ae170

commit: c5ae170

[github-actions]

Bundle Size Report

7 package(s) changed, 36 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/esbuild	255.8 kB	+692 B (+0.3%)	67 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-4 B (-0.2%)	2.4 kB	-33 B (-1.3%)
@module-federation/core	1.0 kB	-3 B (-0.3%)	1.0 kB	-34 B (-3.1%)
@module-federation/devtools	30.3 kB	no change	30.3 kB	-25 B (-0.1%)
@module-federation/enhanced	2.7 kB	+10 B (+0.4%)	2.8 kB	-45 B (-1.6%)
@module-federation/metro-plugin-rnc-cli	416 B	-1 B (-0.2%)	435 B	-27 B (-5.8%)
@module-federation/node	9.1 kB	+3 B (+0.0%)	9.1 kB	-29 B (-0.3%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	22.3 kB	-25 B (-0.1%)	23.8 kB	-16 B (-0.1%)	+1.6 kB	+9 B

Total dist (raw): 23.41 MB (+692 B (+0.0%))
Total ESM gzip: 111.7 kB (no change)
Total web bundle (gzip): 253.3 kB (+5 B (+0.0%))
Total node bundle (gzip): 255.5 kB (-193 B (-0.1%))
Tracked ./bundler entry gzip: 563 B (no change)
Tracked ./bundler web bundle (gzip): 4.9 kB (no change)
Tracked ./bundler node bundle (gzip): 4.9 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.