Drop Deno from the agents and spawn child processes directly #22

2026-10-16T14:26:44Z

temeddix commented

2026-10-16 14:26:44 +00:00

Stacked on #21: this branch now sits on top of alias-targets (#21), which restored main's pre-split source layout (src/run.ts etc.) and carries the lint/notes cleanup. Merge #21 first; this PR's own commits are the last three (Spawn child processes directly..., Stop installing Deno in the action, and a note-count fix). The earlier agent-*.ts/run-context.ts split no longer exists, so the spawn changes were re-applied to src/run.ts; src/child.ts and the tests are unchanged in substance.

Merge order: merge this only AFTER the app migration PRs have landed: home #54, eximium #27, stockvibe #18, brain #6, memona-home #47, and memona #1182. This action runs live from @main in those repos, and after this PR the bot no longer installs Deno, so it could not check a repo that still uses Deno.

Changes

action.yml no longer installs deno alongside the agent CLIs. The AGENTS.md sentence and the decision note about keeping Deno for Deno repos are removed.
src/command.ts, the rebuilt Deno.Command API, is gone. Each call site now calls spawn from node:child_process with explicit stdio, uid/gid, and the full env.
New src/child.ts holds the two pieces every call site shares:
- exitCode(child) settles on exit and reports a signal as 128 + signo. It rejects on a failed start, with the rejection pre-caught so it isn't reported as unhandled.
- echo(stream, chunk) writes and waits for drain when the buffer is full.
src/errors.ts stays because it isn't specific to the shim (isNotFound has six callers). Its Deno comment and the makeTempFile "as Deno did" comment are removed.
retryInvalidToken and CodexAttempt now take an exit code instead of a { success, code } status.

Behavior

Unchanged: agent profiles run under their own UID and GID with only their sanitized environment. Exit codes, signal codes, error messages, streaming and echo, and auth-failure detection all work as before.
stdin: now "ignore" for every child (git config, npx skills, codex login status, device login, codex exec, Claude, OpenCode), so an agent CLI can't hang waiting for input. Only codex login --with-api-key pipes the token in.
Unread output: commands whose output was collected and then thrown away (git config, runAgentCommand, codex login status) now use "ignore" instead of being buffered.
No execFile: nothing uses execFile, so there is no 1 MiB maxBuffer limit, and piped output is still read as a stream.

Tests

src/child.test.ts covers exit codes, signal → 137, resolving on exit while a grandchild still holds the pipes open, and rejection when the command is missing.
Tests that called the shim now use spawnSync. auth.test.ts uses exit codes.
workflow.test.ts now checks that action.yml doesn't install Deno.
vp check is clean. vp test passes 61 tests with 5 root-only tests skipped locally, and all 66 pass as root in a node:24-bookworm container.

🤖 Generated with Claude Code

**Stacked on #21:** this branch now sits on top of `alias-targets` (#21), which restored main's pre-split source layout (`src/run.ts` etc.) and carries the lint/notes cleanup. Merge #21 first; this PR's own commits are the last three (`Spawn child processes directly...`, `Stop installing Deno in the action`, and a note-count fix). The earlier `agent-*.ts`/`run-context.ts` split no longer exists, so the spawn changes were re-applied to `src/run.ts`; `src/child.ts` and the tests are unchanged in substance. **Merge order: merge this only AFTER the app migration PRs have landed:** home #54, eximium #27, stockvibe #18, brain #6, memona-home #47, and memona #1182. This action runs live from `@main` in those repos, and after this PR the bot no longer installs Deno, so it could not check a repo that still uses Deno. ## Changes - `action.yml` no longer installs `deno` alongside the agent CLIs. The AGENTS.md sentence and the decision note about keeping Deno for Deno repos are removed. - `src/command.ts`, the rebuilt `Deno.Command` API, is gone. Each call site now calls `spawn` from `node:child_process` with explicit `stdio`, `uid`/`gid`, and the full `env`. - New `src/child.ts` holds the two pieces every call site shares: - `exitCode(child)` settles on `exit` and reports a signal as 128 + signo. It rejects on a failed start, with the rejection pre-caught so it isn't reported as unhandled. - `echo(stream, chunk)` writes and waits for `drain` when the buffer is full. - `src/errors.ts` stays because it isn't specific to the shim (`isNotFound` has six callers). Its Deno comment and the `makeTempFile` "as Deno did" comment are removed. - `retryInvalidToken` and `CodexAttempt` now take an exit `code` instead of a `{ success, code }` status. ## Behavior - **Unchanged:** agent profiles run under their own UID and GID with only their sanitized environment. Exit codes, signal codes, error messages, streaming and echo, and auth-failure detection all work as before. - **stdin:** now `"ignore"` for every child (git config, `npx skills`, `codex login status`, device login, `codex exec`, Claude, OpenCode), so an agent CLI can't hang waiting for input. Only `codex login --with-api-key` pipes the token in. - **Unread output:** commands whose output was collected and then thrown away (git config, `runAgentCommand`, `codex login status`) now use `"ignore"` instead of being buffered. - **No `execFile`:** nothing uses `execFile`, so there is no 1 MiB `maxBuffer` limit, and piped output is still read as a stream. ## Tests - `src/child.test.ts` covers exit codes, signal → 137, resolving on exit while a grandchild still holds the pipes open, and rejection when the command is missing. - Tests that called the shim now use `spawnSync`. `auth.test.ts` uses exit codes. - `workflow.test.ts` now checks that `action.yml` doesn't install Deno. - `vp check` is clean. `vp test` passes 61 tests with 5 root-only tests skipped locally, and all 66 pass as root in a `node:24-bookworm` container. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

temeddix commented

2026-10-16 14:26:45 +00:00

@bot

bot approved these changes 2026-10-16 14:31:22 +00:00

Dismissed

bot left a comment

✅ Approved
Node child-process migration is ready to merge.

Strengths

Migration

Explicit stdio, sanitized environments, profile UID/GID isolation, signal exit codes, and stream backpressure preserve the action's intended runtime behavior.

Checks

Passed

npx vp check
npx vp test — 61 passed, 5 root-only skipped locally
Gitea Check / check (pull_request) — successful; it runs all 66 tests as root

Notes

CI status

The failed Agents / agent (pull_request) status is the canceled duplicate automation run and is not a project check.

Profile: codex · gpt-5.6-terra

✅ Approved Node child-process migration is ready to merge. ## Strengths <details> <summary>Migration</summary> Explicit stdio, sanitized environments, profile UID/GID isolation, signal exit codes, and stream backpressure preserve the action's intended runtime behavior. </details> ## Checks <details> <summary>Passed</summary> - `npx vp check` - `npx vp test` — 61 passed, 5 root-only skipped locally - Gitea `Check / check (pull_request)` — successful; it runs all 66 tests as root </details> ## Notes <details> <summary>CI status</summary> The failed `Agents / agent (pull_request)` status is the canceled duplicate automation run and is not a project check. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix commented

2026-10-16 16:23:32 +00:00

@bot

bot approved these changes 2026-10-16 16:25:56 +00:00

Dismissed

bot left a comment

✅ Approved
Node child-process migration is ready to merge.

Strengths

Migration

Explicit stdio, sanitized environments, and per-profile UID/GID preserve the action's isolation boundary.
exitCode preserves signal exit semantics and resolves on exit, while the added tests cover failure-to-start and grandchild-held pipes.

Issues

None

No Critical, Important, or Minor findings.

Recommendations

None

No follow-up changes recommended.

Assessment

Ready

Ready to merge: Yes.
Reasoning: The exact head satisfies the migration requirements, passes the repository checks, and complies with the repository-wide code rules.

Checks

Passed

npx vp check
npx vp test — 61 passed, 5 root-only skipped in this non-root runner
Gitea Check / check (pull_request) — successful on 50328ca; its root job runs all 66 tests

Declined to judge

None

No behavior was set aside.

Profile: codex · gpt-5.6-terra

✅ Approved Node child-process migration is ready to merge. ## Strengths <details> <summary>Migration</summary> - Explicit stdio, sanitized environments, and per-profile UID/GID preserve the action's isolation boundary. - `exitCode` preserves signal exit semantics and resolves on `exit`, while the added tests cover failure-to-start and grandchild-held pipes. </details> ## Issues <details> <summary>None</summary> No Critical, Important, or Minor findings. </details> ## Recommendations <details> <summary>None</summary> No follow-up changes recommended. </details> ## Assessment <details> <summary>Ready</summary> - Ready to merge: Yes. - Reasoning: The exact head satisfies the migration requirements, passes the repository checks, and complies with the repository-wide code rules. </details> ## Checks <details> <summary>Passed</summary> - `npx vp check` - `npx vp test` — 61 passed, 5 root-only skipped in this non-root runner - Gitea `Check / check (pull_request)` — successful on `50328ca`; its root job runs all 66 tests </details> ## Declined to judge <details> <summary>None</summary> No behavior was set aside. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix commented

2026-10-17 08:40:44 +00:00

tsconfig.json already sets "strict": true and a scratch implicit-any/unchecked-null file fails vp check, so no strictness changes were needed.

temeddix force-pushed drop-deno from 50328caac5 to a2de4a5d6d

2026-10-17 14:16:26 +00:00

Compare

temeddix commented

2026-10-17 14:16:57 +00:00

Final audit: rebased this branch onto #21 (alias-targets), whose size-revert deleted the agent-*.ts/run-context.ts split this PR edited, so the two PRs conflicted. Re-applied the spawn/child.ts changes to the restored src/run.ts, removed src/command.ts and the shim note, dropped Deno from action.yml, AGENTS.md and the decisions note. vp check clean; vp test 61 passed + 5 skipped locally, all 66 pass as root in node:24-bookworm (podman). Old head kept locally as backup/drop-deno-pre-stack (50328ca). bot-agents has no UI, so no browser smoke test.

Final audit: rebased this branch onto #21 (alias-targets), whose size-revert deleted the agent-*.ts/run-context.ts split this PR edited, so the two PRs conflicted. Re-applied the spawn/child.ts changes to the restored src/run.ts, removed src/command.ts and the shim note, dropped Deno from action.yml, AGENTS.md and the decisions note. vp check clean; vp test 61 passed + 5 skipped locally, all 66 pass as root in node:24-bookworm (podman). Old head kept locally as backup/drop-deno-pre-stack (50328ca). bot-agents has no UI, so no browser smoke test.

temeddix commented

2026-10-17 14:28:22 +00:00

@bot

bot approved these changes 2026-10-17 14:32:35 +00:00

Dismissed

bot left a comment

✅ Approved

Child-process migration preserves isolation and removes Deno.
Checks: CI green; npx vp check; npx vp test (61 passed, 5 root-only skipped locally).

Review notes

Strengths:

Direct spawn call sites retain explicit profile UID/GID, isolated environment, and deliberate stdio.
exitCode preserves exit and signal semantics and covers failed starts.
The repository-wide policy scan found no prohibited source types, framework use, or lint suppressions.

No blocking or minor findings.

Profile: codex · gpt-5.6-terra

✅ Approved - Child-process migration preserves isolation and removes Deno. - Checks: CI green; `npx vp check`; `npx vp test` (61 passed, 5 root-only skipped locally). <details> <summary>Review notes</summary> Strengths: - Direct `spawn` call sites retain explicit profile UID/GID, isolated environment, and deliberate stdio. - `exitCode` preserves exit and signal semantics and covers failed starts. - The repository-wide policy scan found no prohibited source types, framework use, or lint suppressions. No blocking or minor findings. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix force-pushed drop-deno from a2de4a5d6d to 0ee3ac7687

2026-10-17 18:06:21 +00:00

Compare

temeddix commented

2026-10-17 18:06:27 +00:00

Rebased onto #21's tsconfig strictness commit; no new fixes needed, vp check/test pass.

temeddix force-pushed drop-deno from 0ee3ac7687 to 75045b18c9

2026-10-17 18:10:30 +00:00

Compare

temeddix force-pushed drop-deno from 75045b18c9 to e360df3163

2026-10-17 18:11:58 +00:00

Compare

temeddix commented

2026-10-17 18:12:17 +00:00

Rebased onto alias-targets after its engines removal; vp check and vp test pass.

temeddix force-pushed drop-deno from e360df3163 to 479c469ed0

2026-10-17 18:19:33 +00:00

Compare

temeddix commented

2026-10-17 18:19:34 +00:00

Rebased onto alias-targets with allowUnreachableCode and allowUnusedLabels off; vp check and vp test pass.

temeddix commented

2026-10-17 18:39:40 +00:00

@bot

bot approved these changes 2026-10-17 18:43:32 +00:00

Dismissed

bot left a comment

✅ Approved
Node child-process migration is ready to merge.

Checks

Passed

npx vp check
npx vp test — 61 passed, 5 root-only skipped in this non-root runner
Required Gitea CI Check / check (pull_request) — successful on 479c469
Repository-wide policy scan and git diff --check

Strengths

Migration

Direct spawn calls retain sanitized environments, profile UID/GID isolation, deliberate stdio, and signal exit semantics.
exitCode covers normal exits, signals, failed starts, and pipe lifetime behavior.

Issues

None

No Critical, Important, or Minor findings.

Recommendations

None

No follow-up changes recommended.

Assessment

Ready

Ready to merge: Yes.
The reviewed head satisfies the requested Deno removal and direct child-process migration.

Declined to judge

None

No behavior was set aside.

Profile: codex · gpt-5.6-terra

✅ Approved Node child-process migration is ready to merge. ## Checks <details> <summary>Passed</summary> - `npx vp check` - `npx vp test` — 61 passed, 5 root-only skipped in this non-root runner - Required Gitea CI `Check / check (pull_request)` — successful on `479c469` - Repository-wide policy scan and `git diff --check` </details> ## Strengths <details> <summary>Migration</summary> - Direct `spawn` calls retain sanitized environments, profile UID/GID isolation, deliberate stdio, and signal exit semantics. - `exitCode` covers normal exits, signals, failed starts, and pipe lifetime behavior. </details> ## Issues <details> <summary>None</summary> No Critical, Important, or Minor findings. </details> ## Recommendations <details> <summary>None</summary> No follow-up changes recommended. </details> ## Assessment <details> <summary>Ready</summary> - Ready to merge: Yes. - The reviewed head satisfies the requested Deno removal and direct child-process migration. </details> ## Declined to judge <details> <summary>None</summary> No behavior was set aside. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix force-pushed drop-deno from 479c469ed0 to 6e8fbc5255

2026-10-17 18:45:12 +00:00

Compare

temeddix commented

2026-10-17 18:45:19 +00:00

Rebased onto alias-targets after its AGENTS.md wording fix; vp check and vp test pass.

temeddix commented

2026-10-17 18:49:27 +00:00

@bot

bot approved these changes 2026-10-17 18:52:23 +00:00

Dismissed

bot left a comment

✅ Approved
Direct child-process execution and Deno removal are ready.

Checks

Checks and review scope

npx vp check passed.
npx vp test passed: 61 passed, 5 root-only skipped locally.
Head CI passed: Check / check (pull_request).
Reviewed the exact base 006bbe6 through head 6e8fbc5 range and the repository rules.
Declined to judge: no UI is present, so visual review does not apply.

Strengths

Process handling and coverage

Direct spawn calls retain profile UID/GID and sanitized environments.
Exit, signal, startup-failure, and pipe-lifetime behavior have focused coverage.

Issues

No blocking issues

None.

Recommendations

None

None.

Assessment

Ready to merge

Yes.

Profile: codex · gpt-5.6-terra

✅ Approved Direct child-process execution and Deno removal are ready. ## Checks <details> <summary>Checks and review scope</summary> - `npx vp check` passed. - `npx vp test` passed: 61 passed, 5 root-only skipped locally. - Head CI passed: `Check / check (pull_request)`. - Reviewed the exact base `006bbe6` through head `6e8fbc5` range and the repository rules. - Declined to judge: no UI is present, so visual review does not apply. </details> ## Strengths <details> <summary>Process handling and coverage</summary> - Direct `spawn` calls retain profile UID/GID and sanitized environments. - Exit, signal, startup-failure, and pipe-lifetime behavior have focused coverage. </details> ## Issues <details> <summary>No blocking issues</summary> - None. </details> ## Recommendations <details> <summary>None</summary> - None. </details> ## Assessment <details> <summary>Ready to merge</summary> - Yes. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix force-pushed drop-deno from 6e8fbc5255 to 7d1ca6e285

2026-10-17 18:57:16 +00:00

Compare

temeddix commented

2026-10-17 18:57:20 +00:00

Rebased onto alias-targets after its notes fixes; vp check and vp test pass.

temeddix commented

2026-10-17 18:57:21 +00:00

@bot

bot approved these changes 2026-10-17 19:00:56 +00:00

Dismissed

bot left a comment

✅ Approved

Summary

Direct child-process execution preserves profile isolation, exit handling, and streamed output.

Tests

vp check
vp test — 61 passed, 5 root-only skipped locally
Required CI — successful

Review notes

Strengths

The migration removes the command shim while retaining sanitized environments, profile UID/GID execution, and error handling.

Issues

None.

Recommendations

None.

Declined to judge

None.

Assessment

Ready to merge.

Profile: codex · gpt-5.6-terra

✅ Approved ## Summary - Direct child-process execution preserves profile isolation, exit handling, and streamed output. ## Tests - `vp check` - `vp test` — 61 passed, 5 root-only skipped locally - Required CI — successful <details> <summary>Review notes</summary> ### Strengths - The migration removes the command shim while retaining sanitized environments, profile UID/GID execution, and error handling. ### Issues - None. ### Recommendations - None. ### Declined to judge - None. ### Assessment - Ready to merge. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix force-pushed drop-deno from 7d1ca6e285 to 2b98445acf

2026-10-18 13:22:52 +00:00

Compare

temeddix commented

2026-10-18 13:23:08 +00:00

Rebased onto alias-targets after the plugin rename in the notes; vp check and vp test pass.

temeddix commented

2026-10-18 13:23:09 +00:00

@bot

bot approved these changes 2026-10-18 13:30:01 +00:00

bot left a comment

✅ Approved
Direct Node child-process migration is ready to merge.

Checks

Passed

npx vp check
npx vp test — 56 passed, 5 root-only skipped locally
Required Gitea Check / check (pull_request) — successful on 2b98445
Full base 006bbe6 to head 2b98445 review, policy scan, and whitespace check

Review

Findings

No Critical, Important, or Minor findings.
Direct spawn use retains explicit stdio, sanitized environments, and profile UID/GID isolation.
Declined to judge: no UI is present.

Profile: codex · gpt-5.6-terra

✅ Approved Direct Node child-process migration is ready to merge. ## Checks <details> <summary>Passed</summary> - `npx vp check` - `npx vp test` — 56 passed, 5 root-only skipped locally - Required Gitea `Check / check (pull_request)` — successful on `2b98445` - Full base `006bbe6` to head `2b98445` review, policy scan, and whitespace check </details> ## Review <details> <summary>Findings</summary> - No Critical, Important, or Minor findings. - Direct `spawn` use retains explicit stdio, sanitized environments, and profile UID/GID isolation. - Declined to judge: no UI is present. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix added 3 commits 2026-10-18 14:39:36 +00:00

Spawn child processes directly and drop the Deno.Command shim a933a23640

Stop installing Deno in the action 4195ce7c74

Update the root-only test count in the note description

Check / check (pull_request) Successful in 37s

Details

fbc92aca77

temeddix force-pushed drop-deno from 2b98445acf to fbc92aca77

2026-10-18 14:39:36 +00:00

Compare

temeddix merged commit c8a150fee7 into main

2026-10-18 14:40:49 +00:00

temeddix deleted branch drop-deno

2026-10-18 14:40:49 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: commons/bot-agents#22