Move the action from Deno to Node.js and Vite+ (#20)

## Summary Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`). ## What changed - **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`. - **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`). - **Deno APIs → Node.** - `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit. - `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`. - fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create. - **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files. - `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`. - `post.ts` is split into `post.ts` and `post-artifacts.ts`. - `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers. - Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`. - `src/json.ts` adds type guards in place of `as` casts. - **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand. - Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`. - Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing. - New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads. - **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`. - Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks. - `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports). - **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image. - **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff. - **AGENTS.md** is updated for the new toolchain. ## Deviations / risks - **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR. - **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it. - **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move. - **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons. - **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value: - Gitea `/user` and comment responses are checked. - The runtime manifest and the outcome's profile type are checked against known values. - Some type-check errors are now `TypeError` (same messages). - **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is. ## Verification - `vp check`: formatting, lint (0 warnings), and type check all pass. - `vp test` as a normal user: 56 passed, 5 root-only skipped. - `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests. - End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`: - Codex hit "usage limit" and fell through to Claude. - Agents ran as UIDs 20000/20001 without the master key. - The Codex login was persisted to `/root/.codex/auth.json` (0600). - The PR review with an inline comment was posted with the reviewer token. - Runtime credentials were removed and the git author was configured. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #20 Reviewed-by: bot <noreply@capsulizers.com> Co-authored-by: Danny Kim <temeddix@gmail.com> Co-committed-by: Danny Kim <temeddix@gmail.com>
2026-10-16 12:43:37 +00:00
parent f001a71c61
commit 006bbe6b0c
78 changed files with 7186 additions and 2231 deletions
@@ -1,4 +1,6 @@
-import { parse } from "jsr:@std/yaml@1";
+import { webcrypto } from "node:crypto";
+
+import { isMapping } from "./json.ts";
 import type { BotProfile } from "./profiles.ts";

 const DEFAULT_MODELS: Record<BotProfile["type"], string> = {
@@ -7,54 +9,40 @@ const DEFAULT_MODELS: Record<BotProfile["type"], string> = {
  opencode: "openrouter/qwen/qwen3.8-27b",
 };

-export type BotCredentials = {
+export interface BotCredentials {
  reviewerToken: string;
  profiles: BotProfile[];
-};
+}

 function decodeBase64Url(value: string): Uint8Array {
  const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+  return Uint8Array.from(atob(padded), (character) => character.codePointAt(0) ?? 0);
 }

 function encodeBase64Url(value: Uint8Array): string {
-  const binary = Array.from(value, (byte) => String.fromCharCode(byte)).join(
-    "",
-  );
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_")
-    .replaceAll("=", "");
+  const binary = Array.from(value, (byte) => String.fromCodePoint(byte)).join("");
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
 }

-const buffer = (value: Uint8Array): ArrayBuffer =>
-  Uint8Array.from(value).buffer;
+const buffer = (value: Uint8Array): ArrayBuffer => Uint8Array.from(value).buffer;

-async function importMasterKey(
-  encoded: string,
-  usage: KeyUsage,
-): Promise<CryptoKey> {
+function importMasterKey(encoded: string, usage: webcrypto.KeyUsage): Promise<webcrypto.CryptoKey> {
  const bytes = decodeBase64Url(encoded);
  if (bytes.length !== 32) {
    throw new Error("master-key must be 32 bytes encoded as base64url");
  }
-  return await crypto.subtle.importKey("raw", buffer(bytes), "AES-GCM", false, [
-    usage,
-  ]);
+  return webcrypto.subtle.importKey("raw", buffer(bytes), "AES-GCM", false, [usage]);
 }

-export async function decryptCredential(
-  encrypted: string,
-  masterKey: string,
-): Promise<string> {
-  const [version, encodedNonce, encodedCiphertext, extra] = encrypted.split(
-    ":",
-  );
-  if (version !== "v1" || !encodedNonce || !encodedCiphertext || extra) {
+export async function decryptCredential(encrypted: string, masterKey: string): Promise<string> {
+  const [version, encodedNonce = "", encodedCiphertext = "", extra = ""] = encrypted.split(":");
+  if (version !== "v1" || encodedNonce === "" || encodedCiphertext === "" || extra !== "") {
    throw new Error("credential must use v1:<nonce>:<ciphertext>");
  }
  const nonce = decodeBase64Url(encodedNonce);
  if (nonce.length !== 12) throw new Error("credential nonce must be 12 bytes");
-  const plaintext = await crypto.subtle.decrypt(
+  const plaintext = await webcrypto.subtle.decrypt(
    { name: "AES-GCM", iv: buffer(nonce) },
    await importMasterKey(masterKey, "decrypt"),
    buffer(decodeBase64Url(encodedCiphertext)),
@@ -65,80 +53,68 @@ export async function decryptCredential(
 export async function encryptCredential(
  plaintext: string,
  masterKey: string,
-  nonce: Uint8Array = crypto.getRandomValues(new Uint8Array(12)),
+  nonce: Uint8Array = webcrypto.getRandomValues(new Uint8Array(12)),
 ): Promise<string> {
  if (nonce.length !== 12) throw new Error("AES-GCM nonce must be 12 bytes");
-  const ciphertext = await crypto.subtle.encrypt(
+  const ciphertext = await webcrypto.subtle.encrypt(
    { name: "AES-GCM", iv: buffer(nonce) },
    await importMasterKey(masterKey, "encrypt"),
    new TextEncoder().encode(plaintext),
  );
-  return `v1:${encodeBase64Url(nonce)}:${
-    encodeBase64Url(new Uint8Array(ciphertext))
-  }`;
+  return `v1:${encodeBase64Url(nonce)}:${encodeBase64Url(new Uint8Array(ciphertext))}`;
 }

-export async function parseCredentials(
-  text: string,
-  masterKey: string,
-): Promise<BotCredentials> {
-  const value: unknown = parse(text);
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error("credentials must be a mapping");
+async function parseProfile(entry: unknown, index: number, masterKey: string): Promise<BotProfile> {
+  const at = `profiles[${index}]`;
+  if (!isMapping(entry)) {
+    throw new TypeError(`${at}: expected a mapping`);
  }
-  const record = value as Record<string, unknown>;
-  for (const key of Object.keys(record)) {
+  for (const key of Object.keys(entry)) {
+    if (key !== "type" && key !== "model" && key !== "token") {
+      throw new Error(`${at}.${key}: unknown field`);
+    }
+  }
+  const { type, model, token } = entry;
+  if (type !== "claude" && type !== "codex" && type !== "opencode") {
+    throw new Error(`${at}.type: expected "claude", "codex", or "opencode"`);
+  }
+  if (model !== undefined && (typeof model !== "string" || model === "")) {
+    throw new Error(`${at}.model: expected a model name`);
+  }
+  if ((type === "claude" || type === "opencode") && typeof token !== "string") {
+    throw new Error(`${at}.token: expected an encrypted credential`);
+  }
+  if (token !== undefined && typeof token !== "string") {
+    throw new Error(`${at}.token: expected an encrypted credential`);
+  }
+  return {
+    type,
+    model: model ?? DEFAULT_MODELS[type],
+    ...(typeof token === "string" && {
+      token: await decryptCredential(token, masterKey),
+    }),
+  };
+}
+
+export async function parseCredentials(text: string, masterKey: string): Promise<BotCredentials> {
+  const value: unknown = JSON.parse(text);
+  if (!isMapping(value)) {
+    throw new TypeError("credentials must be a mapping");
+  }
+  for (const key of Object.keys(value)) {
    if (key !== "reviewer-token" && key !== "profiles") {
      throw new Error(`${key}: unknown field`);
    }
  }
-  if (typeof record["reviewer-token"] !== "string") {
-    throw new Error("reviewer-token: expected an encrypted credential");
+  const { "reviewer-token": reviewerToken, profiles } = value;
+  if (typeof reviewerToken !== "string") {
+    throw new TypeError("reviewer-token: expected an encrypted credential");
  }
-  if (!Array.isArray(record.profiles) || record.profiles.length === 0) {
+  if (!Array.isArray(profiles) || profiles.length === 0) {
    throw new Error("profiles must contain at least one profile");
  }
-  const profiles = await Promise.all(
-    record.profiles.map(async (entry: unknown, index): Promise<BotProfile> => {
-      const at = `profiles[${index}]`;
-      if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-        throw new Error(`${at}: expected a mapping`);
-      }
-      const profile = entry as Record<string, unknown>;
-      for (const key of Object.keys(profile)) {
-        if (key !== "type" && key !== "model" && key !== "token") {
-          throw new Error(`${at}.${key}: unknown field`);
-        }
-      }
-      const { type, model, token } = profile;
-      if (type !== "claude" && type !== "codex" && type !== "opencode") {
-        throw new Error(
-          `${at}.type: expected \"claude\", \"codex\", or \"opencode\"`,
-        );
-      }
-      if (model !== undefined && (typeof model !== "string" || model === "")) {
-        throw new Error(`${at}.model: expected a model name`);
-      }
-      if (
-        (type === "claude" || type === "opencode") &&
-        typeof token !== "string"
-      ) {
-        throw new Error(`${at}.token: expected an encrypted credential`);
-      }
-      if (token !== undefined && typeof token !== "string") {
-        throw new Error(`${at}.token: expected an encrypted credential`);
-      }
-      return {
-        type,
-        model: model ?? DEFAULT_MODELS[type],
-        ...(typeof token === "string" && {
-          token: await decryptCredential(token, masterKey),
-        }),
-      };
-    }),
+  const parsed = await Promise.all(
+    profiles.map((entry: unknown, index) => parseProfile(entry, index, masterKey)),
  );
-  return {
-    reviewerToken: await decryptCredential(record["reviewer-token"], masterKey),
-    profiles,
-  };
+  return { reviewerToken: await decryptCredential(reviewerToken, masterKey), profiles: parsed };
 }