Move the action from Deno to Node.js and Vite+ #20

Merged

temeddix merged 4 commits from node-migration into main 2026-10-16 12:43:37 +00:00

Conversation 5 Commits 4 Files Changed 78

+7186 -2231

temeddix commented 2026-10-15 17:21:25 +00:00

Owner

Copy Link

Copy Source

Summary

Moves commons/bot-agents off Deno. The action's TypeScript now runs directly on the job image's Node.js (node src/<phase>.ts, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (vp check, vp test).

What changed

• Runtime. action.yml runs prepare.ts, run.ts, and post.ts with node instead of deno run -A. package.json ("type": "module", engines.node >=24.2 for import.meta.main) is now copied into the root-owned source copy by scripts/protect-source.sh.
• Profiles. profiles.yml → profiles.json, with the same content (encrypted values unchanged), parsed with JSON.parse. This drops the only runtime dependency (@std/yaml).
• Deno APIs → Node.
  • src/command.ts wraps child_process.spawn with the old Deno.Command shapes: output()/spawn(), clearEnv, uid/gid, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for output(), inherited for spawn()). A signal exit maps to 128 + signo. Status settles on process exit.
  • src/errors.ts maps NotFound to ENOENT/ESRCH.
  • fs, path, stream, and readline calls are mapped one for one. makeTempFile becomes an exclusive wx 0600 create.
• Size refactors. These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files.
  • run.ts is split into run-context.ts, agents.ts, and agent-{claude,codex,opencode}.ts.
  • post.ts is split into post.ts and post-artifacts.ts.
  • parseCredentials, readOutcome, and postRuntime are broken into helpers.
  • Loops that awaited sequentially became recursion or a reduce chain, so they stay sequential. /proc status reads became Promise.all.
  • src/json.ts adds type guards in place of as casts.
• Tests. The 58 Deno.test cases were converted to Vitest with the codemod, and its TODOs were finished by hand.
  • Unit tests are src/*.test.ts; the repository-level workflow test is tests/workflow.test.ts.
  • Root-only tests are now test.skipIf(!IS_ROOT), so they show as skipped instead of silently passing.
  • New tests/entrypoints.test.ts runs each phase under real Node to prove its whole import graph loads.
• Config. The only config files are package.json, tsconfig.json, and vite.config.ts, plus package-lock.json.
  • Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks.
  • scripts/project-lint.ts holds the rule list. It maps Deno's recommended rules that fall outside those categories, adds the template's id-match, no-disable-comments, and no-non-ts-imports, and maps Deno's no-window/no-process-global/no-node-globals to no-restricted-globals (so process/Buffer come from node: imports).
• CI. .gitea/workflows/check.yml runs node --version, npm ci, npx vp check, and npx vp test in the default runner image.
• Formatting. Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff.
• AGENTS.md is updated for the new toolchain.

Deviations / risks

• Live @main switch. Six consumer repos use commons/bot-agents@main, so merging switches all of them at once. Suggested before merging: tag the current main (e.g. deno-final) as a rollback target, and canary this branch from one consumer (uses: …/commons/bot-agents@node-migration) on a throwaway PR.
• Node version. post.ts relies on import.meta.main, which needs Node ≥ 24.2. DANNYEC's cached node:24-bookworm minor is unknown (forcePull=false), and the CI job now prints node --version to confirm it.
• Deno stays in the global install. deno remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move.
• prefer-readonly-parameter-types is off. This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (Response, Stats, RequestInit) can never satisfy it. scripts/** has one narrow override (no-unsafe-enum-comparison) for AST node type comparisons.
• Stricter validation of malformed input. For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value:
  • Gitea /user and comment responses are checked.
  • The runtime manifest and the outcome's profile type are checked against known values.
  • Some type-check errors are now TypeError (same messages).
• @cunarist lint plugins. "CI fails until @cunarist/eslint-plugin-* are published" does not apply here. This repo's Deno setup enabled no plugin, so it depends on none of @cunarist/eslint-plugin-*, and CI can pass as is.

Verification

• vp check: formatting, lint (0 warnings), and type check all pass.
• vp test as a normal user: 56 passed, 5 root-only skipped.
• vp test as root in node:24-bookworm (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and prepare.ts cleanup tests.
• End-to-end smoke as root in node:24-bookworm, with fake codex/claude/npx binaries and a fake Gitea, through protect-source.sh → prepare.ts → run.ts → post.ts:
  • Codex hit "usage limit" and fell through to Claude.
  • Agents ran as UIDs 20000/20001 without the master key.
  • The Codex login was persisted to /root/.codex/auth.json (0600).
  • The PR review with an inline comment was posted with the reviewer token.
  • Runtime credentials were removed and the git author was configured.

🤖 Generated with Claude Code

## Summary Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`). ## What changed - **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`. - **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`). - **Deno APIs → Node.** - `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit. - `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`. - fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create. - **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files. - `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`. - `post.ts` is split into `post.ts` and `post-artifacts.ts`. - `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers. - Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`. - `src/json.ts` adds type guards in place of `as` casts. - **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand. - Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`. - Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing. - New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads. - **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`. - Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks. - `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports). - **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image. - **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff. - **AGENTS.md** is updated for the new toolchain. ## Deviations / risks - **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR. - **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it. - **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move. - **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons. - **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value: - Gitea `/user` and comment responses are checked. - The runtime manifest and the outcome's profile type are checked against known values. - Some type-check errors are now `TypeError` (same messages). - **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is. ## Verification - `vp check`: formatting, lint (0 warnings), and type check all pass. - `vp test` as a normal user: 56 passed, 5 root-only skipped. - `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests. - End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`: - Codex hit "usage limit" and fell through to Claude. - Agents ran as UIDs 20000/20001 without the master key. - The Codex login was persisted to `/root/.codex/auth.json` (0600). - The PR review with an inline comment was posted with the reviewer token. - Runtime credentials were removed and the git author was configured. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

temeddix added 2 commits 2026-10-15 17:21:25 +00:00

Format the TypeScript sources with Oxfmt 9b55e98d8c

Move the action from Deno to Node.js and Vite+ 8f23da2b42

temeddix commented 2026-10-15 17:21:30 +00:00

Author

Owner

Copy Link

Copy Source

@bot

@bot

bot approved these changes 2026-10-15 17:25:23 +00:00

Dismissed

bot left a comment

Owner

Copy Link

Copy Source

✅ Approved
Node/Vite+ migration is ready to merge.

Checks

Verification

• npm ci
• npx vp check
• npx vp test — 61 passed
• CI: Check / check passed on 8f23da2
• Declined to judge: none.

Profile: codex · gpt-5.6-terra

✅ Approved Node/Vite+ migration is ready to merge. ## Checks <details> <summary>Verification</summary> - `npm ci` - `npx vp check` - `npx vp test` — 61 passed - CI: `Check / check` passed on `8f23da2` - Declined to judge: none. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix added 1 commit 2026-10-15 23:28:55 +00:00

Add damem notes and skills c02ab9b156

temeddix commented 2026-10-15 23:39:19 +00:00

Author

Owner

Copy Link

Copy Source

@bot

@bot

bot approved these changes 2026-10-15 23:43:22 +00:00

bot left a comment

Owner

Copy Link

Copy Source

✅ Approved
Node/Vite+ migration is ready to merge.

Checks

Verification

• npx vp check — formatting, lint, and type checks passed.
• npx vp test — 56 passed, 5 root-only tests skipped.
• Check / check (pull_request) passed on c02ab9b.
• Declined to judge: none.

Strengths

• The Node runtime migration retains protected-source execution, profile isolation, and artifact validation.
• The entrypoint and workflow tests cover the direct Node execution contract.

Issues

• None.

Profile: codex · gpt-5.6-terra

✅ Approved Node/Vite+ migration is ready to merge. ## Checks <details> <summary>Verification</summary> - `npx vp check` — formatting, lint, and type checks passed. - `npx vp test` — 56 passed, 5 root-only tests skipped. - `Check / check (pull_request)` passed on `c02ab9b`. - Declined to judge: none. </details> <details> <summary>Strengths</summary> - The Node runtime migration retains protected-source execution, profile isolation, and artifact validation. - The entrypoint and workflow tests cover the direct Node execution contract. </details> <details> <summary>Issues</summary> - None. </details> > Profile: `codex` · `gpt-5.6-terra`

temeddix added 1 commit 2026-10-16 06:09:25 +00:00

Drop local tarball steps from the migration notes 7122051b31

temeddix merged commit 006bbe6b0c into main 2026-10-16 12:43:37 +00:00

temeddix referenced this pull request 2026-10-16 13:08:41 +00:00

Document that package.json aliases may target only direct subfolders of src #21

temeddix commented 2026-10-16 13:10:25 +00:00

Author

Owner

Copy Link

Copy Source

Alias-target rule docs landed after this merge, so they moved to #21.

Alias-target rule docs landed after this merge, so they moved to #21.

temeddix referenced this issue from a commit 2026-10-18 14:37:51 +00:00

Document that package.json aliases may target only direct subfolders of src (#21)

Sign in to join this conversation.

Reviewers

No Reviewers

bot

Labels

No items

No Label

Milestone

No items

No Milestone

Assignees

Clear assignees

bot RaymondCho temeddix

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: commons/bot-agents#20