Move the action from Deno to Node.js and Vite+ (#20)
## Summary
Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`).
## What changed
- **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`.
- **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`).
- **Deno APIs → Node.**
- `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit.
- `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`.
- fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create.
- **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files.
- `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`.
- `post.ts` is split into `post.ts` and `post-artifacts.ts`.
- `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers.
- Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`.
- `src/json.ts` adds type guards in place of `as` casts.
- **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand.
- Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`.
- Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing.
- New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads.
- **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`.
- Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks.
- `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports).
- **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image.
- **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff.
- **AGENTS.md** is updated for the new toolchain.
## Deviations / risks
- **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR.
- **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it.
- **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move.
- **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons.
- **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value:
- Gitea `/user` and comment responses are checked.
- The runtime manifest and the outcome's profile type are checked against known values.
- Some type-check errors are now `TypeError` (same messages).
- **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is.
## Verification
- `vp check`: formatting, lint (0 warnings), and type check all pass.
- `vp test` as a normal user: 56 passed, 5 root-only skipped.
- `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests.
- End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`:
- Codex hit "usage limit" and fell through to Claude.
- Agents ran as UIDs 20000/20001 without the master key.
- The Codex login was persisted to `/root/.codex/auth.json` (0600).
- The PR review with an inline comment was posted with the reviewer token.
- Runtime credentials were removed and the git author was configured.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #20
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>
This commit was merged in pull request #20.
This commit is contained in:
Danny Kim
@@ -0,0 +1,178 @@
|
||||
import { expect, test } from "vite-plus/test";
|
||||
import { mkdir, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
|
||||
|
||||
import {
|
||||
codexAuthentication,
|
||||
isClaudeAuthFailure,
|
||||
isCodexAuthFailure,
|
||||
persistCodexAuth,
|
||||
retryInvalidToken,
|
||||
stageCodexAuth,
|
||||
} from "./auth.ts";
|
||||
import { currentGid, currentUid, IS_WINDOWS, makeTempDir } from "./testing.ts";
|
||||
|
||||
test("retries once after an invalid refresh token", async () => {
|
||||
let attempts = 0;
|
||||
let relogins = 0;
|
||||
const result = await retryInvalidToken(
|
||||
() =>
|
||||
Promise.resolve({
|
||||
status: { success: false },
|
||||
error: attempts++ === 0 ? "ERROR: invalid_refresh_token" : "still failed",
|
||||
}),
|
||||
() => {
|
||||
relogins++;
|
||||
return Promise.resolve();
|
||||
},
|
||||
);
|
||||
|
||||
expect({ attempts, relogins, error: result.error }).toStrictEqual({
|
||||
attempts: 2,
|
||||
relogins: 1,
|
||||
error: "still failed",
|
||||
});
|
||||
});
|
||||
|
||||
test("does not retry an unrelated failure", async () => {
|
||||
let attempts = 0;
|
||||
let relogins = 0;
|
||||
await retryInvalidToken(
|
||||
() => {
|
||||
attempts++;
|
||||
return Promise.resolve({
|
||||
status: { success: false },
|
||||
error: "rate limited",
|
||||
});
|
||||
},
|
||||
() => {
|
||||
relogins++;
|
||||
return Promise.resolve();
|
||||
},
|
||||
);
|
||||
|
||||
expect({ attempts, relogins }).toStrictEqual({ attempts: 1, relogins: 0 });
|
||||
});
|
||||
|
||||
// Verbatim stderr lines from the revoked-login job on lead/memona-home#36.
|
||||
const REVOKED_CODEX = [
|
||||
`2026-10-12T02:28:04.702126Z ERROR codex_models_manager::manager: failed to refresh available models: unexpected status 401 Unauthorized: Encountered invalidated oauth token for user, failing request, url: https://chatgpt.com/backend-api/codex/models?client_version=0.162.1, cf-ray: a492ab48fdefea25-ICN, request id: req_4caa104fe9184a63bb8877f42817172d, auth error: 401, auth error code: token_revoked`,
|
||||
`2026-10-12T02:28:05.082447Z ERROR codex_login::auth::manager: Failed to refresh token status=401 Unauthorized detail=TokenErrorDetail { error_code: Some("refresh_token_invalidated"), error_message: Some("Your session has ended. Please log in again."), .. }`,
|
||||
`2026-10-12T02:28:05.451678Z ERROR rmcp::transport::worker: worker quit with fatal: Transport channel closed, when UnexpectedServerResponse("HTTP 401: {\\n \\"error\\": {\\n \\"message\\": \\"Encountered invalidated oauth token for user, failing request\\",\\n \\"type\\": null,\\n \\"code\\": \\"token_revoked\\",\\n \\"param\\": null\\n },\\n \\"status\\": 401\\n}")`,
|
||||
"ERROR: workspace routing discovery unauthorized (401)",
|
||||
];
|
||||
|
||||
test("recognizes each Codex sign-in failure line", () => {
|
||||
for (const line of [
|
||||
...REVOKED_CODEX,
|
||||
`2026-10-12T02:28:05Z ERROR codex_login::auth::manager: Failed to refresh token status=401 Unauthorized detail=TokenErrorDetail { error_code: Some("refresh_token_expired"), .. }`,
|
||||
`ERROR: Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again. (refresh_token_reused)`,
|
||||
"ERROR: unexpected status 401 Unauthorized: Incorrect API key provided: sk-inval*d123., auth error: 401, auth error code: invalid_api_key",
|
||||
]) {
|
||||
expect(isCodexAuthFailure(`exec\n${line}\n`), line).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
test("ignores auth words outside Codex error lines", () => {
|
||||
expect(
|
||||
isCodexAuthFailure(
|
||||
"exec\ncurl returned 401 Unauthorized\ntoken_revoked in fixture\nERROR: tests failed\n",
|
||||
),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
test("re-logs in after the job 9837 revoked-session stderr", async () => {
|
||||
let relogins = 0;
|
||||
let attempts = 0;
|
||||
const result = await retryInvalidToken(
|
||||
() =>
|
||||
Promise.resolve({
|
||||
status: { success: attempts++ > 0 },
|
||||
error: attempts === 1 ? REVOKED_CODEX.join("\n") : "",
|
||||
}),
|
||||
() => {
|
||||
relogins++;
|
||||
return Promise.resolve();
|
||||
},
|
||||
);
|
||||
|
||||
expect({ relogins, success: result.status.success }).toStrictEqual({
|
||||
relogins: 1,
|
||||
success: true,
|
||||
});
|
||||
});
|
||||
|
||||
test("recognizes a rejected Claude OAuth token", () => {
|
||||
expect(
|
||||
isClaudeAuthFailure({
|
||||
api_error_status: 401,
|
||||
result: "Failed to authenticate. API Error: 401 OAuth access token is invalid.",
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isClaudeAuthFailure({
|
||||
result: "OAuth token has expired. Please obtain a new token or refresh your existing token.",
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(isClaudeAuthFailure({ api_error_status: 429, result: "API Error: 429" })).toBe(false);
|
||||
});
|
||||
|
||||
test("selects API-key login only for a configured Codex token", () => {
|
||||
expect(codexAuthentication("selected-key")).toStrictEqual({
|
||||
kind: "api-key",
|
||||
token: "selected-key",
|
||||
});
|
||||
expect(codexAuthentication()).toStrictEqual({ kind: "persistent" });
|
||||
});
|
||||
|
||||
const AUTH_TOKENS = {
|
||||
access_token: "access",
|
||||
refresh_token: "refresh",
|
||||
id_token: "id",
|
||||
account_id: "account",
|
||||
};
|
||||
const AUTH = JSON.stringify({ auth_mode: "chatgpt", tokens: AUTH_TOKENS });
|
||||
|
||||
test.skipIf(IS_WINDOWS)("stages and persists only a regular private Codex login", async () => {
|
||||
const root = await makeTempDir();
|
||||
try {
|
||||
const canonical = `${root}/persistent/auth.json`;
|
||||
await mkdir(`${root}/persistent`);
|
||||
await writeFile(canonical, AUTH, { mode: 0o600 });
|
||||
const home = `${root}/profile`;
|
||||
await mkdir(home);
|
||||
|
||||
const staged = await stageCodexAuth(canonical, home, currentUid(), currentGid());
|
||||
expect(await readFile(staged, "utf8")).toStrictEqual(AUTH);
|
||||
expect((await stat(staged)).mode & 0o777).toBe(0o600);
|
||||
|
||||
const refreshed = JSON.stringify({
|
||||
auth_mode: "chatgpt",
|
||||
tokens: { ...AUTH_TOKENS, access_token: "refreshed" },
|
||||
});
|
||||
await writeFile(staged, refreshed);
|
||||
await persistCodexAuth(staged, canonical);
|
||||
expect(await readFile(canonical, "utf8")).toStrictEqual(refreshed);
|
||||
expect((await stat(canonical)).mode & 0o777).toBe(0o600);
|
||||
} finally {
|
||||
await rm(root, { recursive: true });
|
||||
}
|
||||
});
|
||||
|
||||
test.skipIf(IS_WINDOWS)("rejects a symlink or malformed Codex login", async () => {
|
||||
const root = await makeTempDir();
|
||||
try {
|
||||
const canonical = `${root}/auth.json`;
|
||||
const malformed = `${root}/malformed.json`;
|
||||
const linked = `${root}/linked.json`;
|
||||
await writeFile(canonical, AUTH, { mode: 0o600 });
|
||||
await writeFile(malformed, '{"tokens":{}}', { mode: 0o600 });
|
||||
await symlink(canonical, linked);
|
||||
|
||||
await expect(() => persistCodexAuth(linked, canonical)).rejects.toThrow("regular file");
|
||||
await expect(() => persistCodexAuth(malformed, canonical)).rejects.toThrow(
|
||||
"invalid Codex login",
|
||||
);
|
||||
} finally {
|
||||
await rm(root, { recursive: true });
|
||||
}
|
||||
});
|
||||
Reference in New Issue
Block a user