Add ordered bot profiles

run.ts

@@ -4,6 +4,14 @@
 // so it appears as the bot account.
 import { TextLineStream } from "jsr:@std/streams@1/text-line-stream";
 import { retryInvalidToken } from "./auth.ts";
+import {
+  agentEnvironment,
+  type BotProfile,
+  parseProfiles,
+  readProfilesFile,
+  runProfiles,
+  sanitizedEnvironment,
+} from "./profiles.ts";
 import {
   type BotType,
   loadSuperpowersReviewGuide,
@@ -25,20 +33,15 @@ const API = env("GITEA_API_URL");
 const REPO = env("GITEA_REPOSITORY");
 const INDEX = env("ISSUE_INDEX");
 const EVENT = env("EVENT_NAME");
-const BOT = parseBotType(env("BOT_TYPE"));
+const PROCESS_ENV = Deno.env.toObject();
+const PROFILES = parseProfiles(
+  await readProfilesFile(env("PROFILES_FILE"), env("GITHUB_WORKSPACE")),
+  PROCESS_ENV,
+);
 const AUTHOR_TOKEN = env("GITEA_TOKEN");
 const REVIEWER_TOKEN = env("REVIEWER_TOKEN");
 const RULES_PATH = "repos/commons/code-rules/raw/README.md";
-// The mid tiers: a run follows a fixed template and the project's checks.
-const DEFAULT_MODELS: Record<string, string> = {
-  claude: "claude-sonnet-5",
-  codex: "gpt-5.6-terra",
-};
-const model = (bot: string): string =>
-  Deno.env.get("MODEL") || DEFAULT_MODELS[bot];
-
-// The reviewer token is withheld so the agent cannot approve as the bot.
-const { REVIEWER_TOKEN: _, ...agentEnv } = Deno.env.toObject();
+const HELPER_ENV = sanitizedEnvironment(PROCESS_ENV, PROFILES);
 
 async function gitea(
   token: string,
@@ -150,7 +153,11 @@ async function postResult(body: string): Promise<void> {
 }
 
 async function run(command: string, args: string[]): Promise<void> {
-  const { success, code } = await new Deno.Command(command, { args }).output();
+  const { success, code } = await new Deno.Command(command, {
+    args,
+    env: HELPER_ENV,
+    clearEnv: true,
+  }).output();
   if (!success) throw new Error(`${command} ${args[0]} exited with ${code}`);
 }
 
@@ -213,31 +220,40 @@ async function renderPrompt(guide: SuperpowersReviewGuide): Promise<string> {
   );
 }
 
-async function runClaude(): Promise<string> {
-  const token = Deno.env.get("BOT_TOKEN");
-  if (!token) {
-    throw new Error(
-      "Run `claude setup-token` locally and set the `bot-token` action input.",
-    );
-  }
+async function runClaude(profile: BotProfile): Promise<string> {
   const prompt = await renderPrompt(await prepareSuperpowers("claude"));
   const claude = new Deno.Command("claude", {
     args: [
       "--print",
       "--dangerously-skip-permissions",
       "--model",
-      model("claude"),
+      profile.model,
       "--output-format",
       "stream-json",
       "--verbose",
       prompt,
     ],
     // Claude refuses --dangerously-skip-permissions as root outside a sandbox.
-    env: { ...agentEnv, CLAUDE_CODE_OAUTH_TOKEN: token, IS_SANDBOX: "1" },
+    env: {
+      ...agentEnvironment(PROCESS_ENV, profile, PROFILES),
+      IS_SANDBOX: "1",
+    },
     clearEnv: true,
     stdout: "piped",
+    stderr: "piped",
   }).spawn();
-  let result: { result?: string; subtype: string } | undefined;
+  let result:
+    | { is_error?: boolean; result?: string; subtype: string }
+    | undefined;
+  let error = "";
+  const copyError = claude.stderr.pipeThrough(new TextDecoderStream()).pipeTo(
+    new WritableStream({
+      write(chunk) {
+        error += chunk;
+        console.error(chunk);
+      },
+    }),
+  );
   // Print events as they stream so the runner does not kill the job as a zombie.
   const lines = claude.stdout
     .pipeThrough(new TextDecoderStream())
@@ -251,9 +267,17 @@ async function runClaude(): Promise<string> {
     }
     if (event.type === "result") result = event;
   }
-  await claude.status;
+  const [status] = await Promise.all([claude.status, copyError]);
+  if (result?.is_error) {
+    throw new Error(result.result ?? `claude ended with ${result.subtype}`);
+  }
   if (result?.result === undefined) {
-    throw new Error(`claude ended with ${result?.subtype ?? "no result"}`);
+    throw new Error(
+      error.trim() || `claude ended with ${result?.subtype ?? "no result"}`,
+    );
+  }
+  if (!status.success) {
+    throw new Error(error.trim() || `claude exited with ${status.code}`);
   }
   return result.result;
 }
@@ -262,6 +286,8 @@ async function runClaude(): Promise<string> {
 async function codexDeviceLogin(): Promise<void> {
   const login = new Deno.Command("codex", {
     args: ["login", "--device-auth"],
+    env: HELPER_ENV,
+    clearEnv: true,
     stdout: "piped",
     stderr: "piped",
   }).spawn();
@@ -284,50 +310,92 @@ async function codexDeviceLogin(): Promise<void> {
   await Promise.all([status, drained]);
 }
 
-async function runCodex(): Promise<string> {
-  const loggedIn = await new Deno.Command("codex", {
-    args: ["login", "status"],
-  })
-    .output();
-  if (!loggedIn.success) await codexDeviceLogin();
-  const prompt = await renderPrompt(await prepareSuperpowers("codex"));
-  const file = await Deno.makeTempFile();
-  const attempt = async () => {
-    const codex = new Deno.Command("codex", {
-      args: [
-        "exec",
-        "--model",
-        model("codex"),
-        "--dangerously-bypass-approvals-and-sandbox",
-        "--output-last-message",
-        file,
-        prompt,
-      ],
-      env: agentEnv,
-      clearEnv: true,
-      stdout: "inherit",
-      stderr: "piped",
-    }).spawn();
-    const decoder = new TextDecoder();
-    let error = "";
-    for await (const chunk of codex.stderr) {
-      await Deno.stderr.write(chunk);
-      error += decoder.decode(chunk, { stream: true });
+async function codexApiLogin(token: string, codexHome: string): Promise<void> {
+  const login = new Deno.Command("codex", {
+    args: ["login", "--with-api-key"],
+    env: { ...HELPER_ENV, CODEX_HOME: codexHome },
+    clearEnv: true,
+    stdin: "piped",
+  }).spawn();
+  const writer = login.stdin.getWriter();
+  await writer.write(new TextEncoder().encode(`${token}\n`));
+  await writer.close();
+  const status = await login.status;
+  if (!status.success) {
+    throw new Error(`codex login exited with ${status.code}`);
+  }
+}
+
+async function runCodex(profile: BotProfile): Promise<string> {
+  const currentEnv = agentEnvironment(PROCESS_ENV, profile, PROFILES);
+  const temporaryHome = profile.token ? await Deno.makeTempDir() : null;
+  if (temporaryHome !== null) currentEnv.CODEX_HOME = temporaryHome;
+  try {
+    if (profile.token) {
+      await codexApiLogin(profile.token, temporaryHome!);
+    } else {
+      const loggedIn = await new Deno.Command("codex", {
+        args: ["login", "status"],
+        env: HELPER_ENV,
+        clearEnv: true,
+      }).output();
+      if (!loggedIn.success) await codexDeviceLogin();
     }
-    error += decoder.decode();
-    return { status: await codex.status, error };
-  };
-  const { status } = await retryInvalidToken(attempt, async () => {
-    await run("codex", ["logout"]);
-    await codexDeviceLogin();
-  });
-  if (!status.success) throw new Error(`codex exited with ${status.code}`);
-  return await Deno.readTextFile(file);
+    const prompt = await renderPrompt(await prepareSuperpowers("codex"));
+    const file = await Deno.makeTempFile();
+    const attempt = async () => {
+      const codex = new Deno.Command("codex", {
+        args: [
+          "exec",
+          "--model",
+          profile.model,
+          "--dangerously-bypass-approvals-and-sandbox",
+          "--output-last-message",
+          file,
+          prompt,
+        ],
+        env: currentEnv,
+        clearEnv: true,
+        stdout: "inherit",
+        stderr: "piped",
+      }).spawn();
+      const decoder = new TextDecoder();
+      let error = "";
+      for await (const chunk of codex.stderr) {
+        await Deno.stderr.write(chunk);
+        error += decoder.decode(chunk, { stream: true });
+      }
+      error += decoder.decode();
+      return { status: await codex.status, error };
+    };
+    const result = profile.token
+      ? await attempt()
+      : await retryInvalidToken(attempt, async () => {
+        await run("codex", ["logout"]);
+        await codexDeviceLogin();
+      });
+    if (!result.status.success) {
+      throw new Error(
+        result.error.trim() || `codex exited with ${result.status.code}`,
+      );
+    }
+    return await Deno.readTextFile(file);
+  } finally {
+    if (temporaryHome !== null) {
+      await Deno.remove(temporaryHome, { recursive: true });
+    }
+  }
 }
 
 try {
   await configureGitAuthor();
-  const result = BOT === "claude" ? await runClaude() : await runCodex();
+  const result = await runProfiles(
+    PROFILES,
+    (profile) =>
+      parseBotType(profile.type) === "claude"
+        ? runClaude(profile)
+        : runCodex(profile),
+  );
   await postResult(result);
 } catch (error) {
   await postComment(`Bot failed: ${error}`);