Move the action from Deno to Node.js and Vite+ (#20)

## Summary

Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`).

## What changed

- **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`.
- **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`).
- **Deno APIs → Node.**
  - `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit.
  - `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`.
  - fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create.
- **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files.
  - `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`.
  - `post.ts` is split into `post.ts` and `post-artifacts.ts`.
  - `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers.
  - Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`.
  - `src/json.ts` adds type guards in place of `as` casts.
- **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand.
  - Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`.
  - Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing.
  - New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads.
- **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`.
  - Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks.
  - `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports).
- **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image.
- **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff.
- **AGENTS.md** is updated for the new toolchain.

## Deviations / risks

- **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR.
- **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it.
- **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move.
- **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons.
- **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value:
  - Gitea `/user` and comment responses are checked.
  - The runtime manifest and the outcome's profile type are checked against known values.
  - Some type-check errors are now `TypeError` (same messages).
- **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is.

## Verification

- `vp check`: formatting, lint (0 warnings), and type check all pass.
- `vp test` as a normal user: 56 passed, 5 root-only skipped.
- `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests.
- End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`:
  - Codex hit "usage limit" and fell through to Claude.
  - Agents ran as UIDs 20000/20001 without the master key.
  - The Codex login was persisted to `/root/.codex/auth.json` (0600).
  - The PR review with an inline comment was posted with the reviewer token.
  - Runtime credentials were removed and the git author was configured.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #20
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>

src/runtime.ts

@@ -1,5 +1,8 @@
-import { join } from "jsr:@std/path@1";
+import { chmod, chown, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
 import { parseCredentials } from "./credentials.ts";
+import { isMapping } from "./json.ts";
 import type { BotProfile, ProfileFailure } from "./profiles.ts";
 
 const FIRST_PROFILE_UID = 20_000;
@@ -12,33 +15,46 @@ export type RuntimeProfile = Pick<BotProfile, "type" | "model"> & {
   tokenFile: string | null;
 };
 
-export type RuntimeManifest = {
+export interface RuntimeManifest {
   runtimeDir: string;
   manifestPath: string;
   reviewerFile: string;
   outcomeFile: string;
   profiles: RuntimeProfile[];
-};
+}
 
 export type RuntimeOutcome =
   | {
-    ok: true;
-    body: string;
-    reviewPath: string;
-    anchorsPath: string;
-    profile: Pick<RuntimeProfile, "type" | "model">;
-  }
+      ok: true;
+      body: string;
+      reviewPath: string;
+      anchorsPath: string;
+      profile: Pick<RuntimeProfile, "type" | "model">;
+    }
   | { ok: false; failures: ProfileFailure[] };
 
-async function writePrivate(
-  path: string,
-  value: string,
-  uid: number,
-  gid: number,
-): Promise<void> {
-  await Deno.writeTextFile(path, value, { mode: 0o600 });
-  await Deno.chmod(path, 0o600);
-  await Deno.chown(path, uid, gid);
+async function writePrivate(path: string, value: string, uid: number, gid: number): Promise<void> {
+  await writeFile(path, value, { mode: 0o600 });
+  await chmod(path, 0o600);
+  await chown(path, uid, gid);
+}
+
+async function prepareProfile(
+  runtimeDir: string,
+  profile: BotProfile,
+  index: number,
+): Promise<RuntimeProfile> {
+  const uid = FIRST_PROFILE_UID + index;
+  const home = join(runtimeDir, `profile-${index}`);
+  await mkdir(home, { mode: 0o700 });
+  await chmod(home, 0o700);
+  await chown(home, uid, uid);
+  const tokenFile =
+    profile.token === undefined || profile.token === "" ? null : join(home, "token");
+  if (tokenFile !== null && profile.token !== undefined) {
+    await writePrivate(tokenFile, profile.token, uid, uid);
+  }
+  return { index, type: profile.type, model: profile.model, uid, gid: uid, home, tokenFile };
 }
 
 export async function prepareRuntime(
@@ -47,39 +63,23 @@ export async function prepareRuntime(
   masterKey: string,
 ): Promise<RuntimeManifest> {
   const credentials = await parseCredentials(
-    await Deno.readTextFile(join(actionPath, "profiles.yml")),
+    await readFile(join(actionPath, "profiles.json"), "utf8"),
     masterKey,
   );
-  const runtimeDir = await Deno.makeTempDir({
-    dir: runtimeRoot,
-    prefix: "bot-agents-",
-  });
+  const runtimeDir = await mkdtemp(join(runtimeRoot, "bot-agents-"));
   try {
-    await Deno.chmod(runtimeDir, 0o711);
+    await chmod(runtimeDir, 0o711);
     const reviewerFile = join(runtimeDir, "reviewer-token");
     await writePrivate(reviewerFile, credentials.reviewerToken, 0, 0);
 
-    const profiles: RuntimeProfile[] = [];
-    for (const [index, profile] of credentials.profiles.entries()) {
-      const uid = FIRST_PROFILE_UID + index;
-      const home = join(runtimeDir, `profile-${index}`);
-      await Deno.mkdir(home, { mode: 0o700 });
-      await Deno.chmod(home, 0o700);
-      await Deno.chown(home, uid, uid);
-      const tokenFile = profile.token ? join(home, "token") : null;
-      if (tokenFile !== null) {
-        await writePrivate(tokenFile, profile.token!, uid, uid);
-      }
-      profiles.push({
-        index,
-        type: profile.type,
-        model: profile.model,
-        uid,
-        gid: uid,
-        home,
-        tokenFile,
-      });
-    }
+    // One profile at a time, in order, as each claims the next UID.
+    const profiles = await credentials.profiles.reduce<Promise<RuntimeProfile[]>>(
+      async (previous, profile, index) => [
+        ...(await previous),
+        await prepareProfile(runtimeDir, profile, index),
+      ],
+      Promise.resolve([]),
+    );
 
     const manifestPath = join(runtimeDir, "manifest.json");
     const manifest: RuntimeManifest = {
@@ -92,13 +92,26 @@ export async function prepareRuntime(
     await writePrivate(manifestPath, JSON.stringify(manifest), 0, 0);
     return manifest;
   } catch (error) {
-    await Deno.remove(runtimeDir, { recursive: true }).catch(() => undefined);
+    await rm(runtimeDir, { recursive: true }).catch(() => {});
     throw error;
   }
 }
 
-export async function readRuntimeManifest(
-  path: string,
-): Promise<RuntimeManifest> {
-  return JSON.parse(await Deno.readTextFile(path));
+function isRuntimeManifest(value: unknown): value is RuntimeManifest {
+  return (
+    isMapping(value) &&
+    typeof value.runtimeDir === "string" &&
+    typeof value.manifestPath === "string" &&
+    typeof value.reviewerFile === "string" &&
+    typeof value.outcomeFile === "string" &&
+    Array.isArray(value.profiles)
+  );
+}
+
+export async function readRuntimeManifest(path: string): Promise<RuntimeManifest> {
+  const value: unknown = JSON.parse(await readFile(path, "utf8"));
+  if (!isRuntimeManifest(value)) {
+    throw new Error(`${path}: invalid runtime manifest`);
+  }
+  return value;
 }