006bbe6b0c
## Summary
Moves `commons/bot-agents` off Deno. The action's TypeScript now runs directly on the job image's Node.js (`node src/<phase>.ts`, using Node's built-in type stripping), with no build step and still no runtime dependency. Repository checks move to Vite+ (`vp check`, `vp test`).
## What changed
- **Runtime.** `action.yml` runs `prepare.ts`, `run.ts`, and `post.ts` with `node` instead of `deno run -A`. `package.json` (`"type": "module"`, `engines.node >=24.2` for `import.meta.main`) is now copied into the root-owned source copy by `scripts/protect-source.sh`.
- **Profiles.** `profiles.yml` → `profiles.json`, with the same content (encrypted values unchanged), parsed with `JSON.parse`. This drops the only runtime dependency (`@std/yaml`).
- **Deno APIs → Node.**
- `src/command.ts` wraps `child_process.spawn` with the old `Deno.Command` shapes: `output()`/`spawn()`, `clearEnv`, `uid`/`gid`, and Deno's stdio defaults (stdin inherited; stdout/stderr piped for `output()`, inherited for `spawn()`). A signal exit maps to `128 + signo`. Status settles on process exit.
- `src/errors.ts` maps `NotFound` to `ENOENT`/`ESRCH`.
- fs, path, stream, and readline calls are mapped one for one. `makeTempFile` becomes an exclusive `wx` 0600 create.
- **Size refactors.** These are needed for Oxlint's default limits. There are no behavior changes and no overrides for source files.
- `run.ts` is split into `run-context.ts`, `agents.ts`, and `agent-{claude,codex,opencode}.ts`.
- `post.ts` is split into `post.ts` and `post-artifacts.ts`.
- `parseCredentials`, `readOutcome`, and `postRuntime` are broken into helpers.
- Loops that awaited sequentially became recursion or a `reduce` chain, so they stay sequential. `/proc` status reads became `Promise.all`.
- `src/json.ts` adds type guards in place of `as` casts.
- **Tests.** The 58 `Deno.test` cases were converted to Vitest with the codemod, and its TODOs were finished by hand.
- Unit tests are `src/*.test.ts`; the repository-level workflow test is `tests/workflow.test.ts`.
- Root-only tests are now `test.skipIf(!IS_ROOT)`, so they show as skipped instead of silently passing.
- New `tests/entrypoints.test.ts` runs each phase under real Node to prove its whole import graph loads.
- **Config.** The only config files are `package.json`, `tsconfig.json`, and `vite.config.ts`, plus `package-lock.json`.
- Lint uses Oxlint correctness/suspicious/pedantic/perf at error, with default limits and type-aware checks.
- `scripts/project-lint.ts` holds the rule list. It maps Deno's `recommended` rules that fall outside those categories, adds the template's `id-match`, `no-disable-comments`, and `no-non-ts-imports`, and maps Deno's `no-window`/`no-process-global`/`no-node-globals` to `no-restricted-globals` (so `process`/`Buffer` come from `node:` imports).
- **CI.** `.gitea/workflows/check.yml` runs `node --version`, `npm ci`, `npx vp check`, and `npx vp test` in the default runner image.
- **Formatting.** Oxfmt formatting is a separate first commit, so the second commit shows only the semantic diff.
- **AGENTS.md** is updated for the new toolchain.
## Deviations / risks
- **Live `@main` switch.** Six consumer repos use `commons/bot-agents@main`, so merging switches all of them at once. Suggested before merging: tag the current `main` (e.g. `deno-final`) as a rollback target, and canary this branch from one consumer (`uses: …/commons/bot-agents@node-migration`) on a throwaway PR.
- **Node version.** `post.ts` relies on `import.meta.main`, which needs Node ≥ 24.2. DANNYEC's cached `node:24-bookworm` minor is unknown (`forcePull=false`), and the CI job now prints `node --version` to confirm it.
- **Deno stays in the global install.** `deno` remains in the action's global npm install because agents still verify Deno-based consumers (memona, memona-home). Remove it once those repos move.
- **`prefer-readonly-parameter-types` is off.** This pedantic rule is turned off, as in the explicit-types template and the app repos, because Node/web types (`Response`, `Stats`, `RequestInit`) can never satisfy it. `scripts/**` has one narrow override (`no-unsafe-enum-comparison`) for AST node `type` comparisons.
- **Stricter validation of malformed input.** For valid input, behavior is unchanged. A few validations are stricter where the old code would have used a malformed value:
- Gitea `/user` and comment responses are checked.
- The runtime manifest and the outcome's profile type are checked against known values.
- Some type-check errors are now `TypeError` (same messages).
- **@cunarist lint plugins.** "CI fails until @cunarist/eslint-plugin-* are published" does **not** apply here. This repo's Deno setup enabled no plugin, so it depends on none of `@cunarist/eslint-plugin-*`, and CI can pass as is.
## Verification
- `vp check`: formatting, lint (0 warnings), and type check all pass.
- `vp test` as a normal user: 56 passed, 5 root-only skipped.
- `vp test` as root in `node:24-bookworm` (Node v24.22.0, the CI image): all 61 passed, including the UID isolation, process cleanup, and `prepare.ts` cleanup tests.
- End-to-end smoke as root in `node:24-bookworm`, with fake `codex`/`claude`/`npx` binaries and a fake Gitea, through `protect-source.sh` → `prepare.ts` → `run.ts` → `post.ts`:
- Codex hit "usage limit" and fell through to Claude.
- Agents ran as UIDs 20000/20001 without the master key.
- The Codex login was persisted to `/root/.codex/auth.json` (0600).
- The PR review with an inline comment was posted with the reviewer token.
- Runtime credentials were removed and the git author was configured.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #20
Reviewed-by: bot <noreply@capsulizers.com>
Co-authored-by: Danny Kim <temeddix@gmail.com>
Co-committed-by: Danny Kim <temeddix@gmail.com>
104 lines
3.1 KiB
TypeScript
104 lines
3.1 KiB
TypeScript
import { assert, expect, test } from "vite-plus/test";
|
|
import {
|
|
collectOpenCodeOutput,
|
|
openCodeArgs,
|
|
openCodeError,
|
|
parseOpenCodeEvents,
|
|
} from "./opencode.ts";
|
|
import { AgentAuthError } from "./profiles.ts";
|
|
|
|
test("builds a non-interactive auto-approved OpenCode command", () => {
|
|
expect(openCodeArgs("openrouter/qwen/qwen3.8-27b", "Review this")).toStrictEqual([
|
|
"run",
|
|
"--format",
|
|
"json",
|
|
"--auto",
|
|
"--model",
|
|
"openrouter/qwen/qwen3.8-27b",
|
|
"Review this",
|
|
]);
|
|
});
|
|
|
|
test("returns the final visible OpenCode text event", () => {
|
|
expect(
|
|
parseOpenCodeEvents(
|
|
[
|
|
JSON.stringify({ type: "step_start", part: { type: "step-start" } }),
|
|
JSON.stringify({ type: "text", part: { type: "text", text: "draft" } }),
|
|
JSON.stringify({ type: "text", part: { type: "text", text: "done" } }),
|
|
JSON.stringify({ type: "step_finish", part: { type: "step-finish" } }),
|
|
].join("\n"),
|
|
),
|
|
).toBe("done");
|
|
});
|
|
|
|
test("rejects a successful OpenCode run without visible text", async () => {
|
|
await expect(async () => {
|
|
parseOpenCodeEvents('{"type":"step_start"}');
|
|
await Promise.resolve();
|
|
}).rejects.toThrow("no text output");
|
|
});
|
|
|
|
const encode = (value: string): Uint8Array => new TextEncoder().encode(value);
|
|
|
|
test("streams OpenCode output while collecting it", async () => {
|
|
const stdout = new ReadableStream<Uint8Array>({
|
|
start(controller) {
|
|
controller.enqueue(encode("first\n"));
|
|
controller.enqueue(encode("second\n"));
|
|
controller.close();
|
|
},
|
|
});
|
|
const stderr = new ReadableStream<Uint8Array>({
|
|
start(controller) {
|
|
controller.enqueue(encode("warning\n"));
|
|
controller.close();
|
|
},
|
|
});
|
|
const shown: string[] = [];
|
|
|
|
const result = await collectOpenCodeOutput(
|
|
stdout,
|
|
stderr,
|
|
(chunk: Uint8Array) => {
|
|
shown.push(`out:${new TextDecoder().decode(chunk)}`);
|
|
},
|
|
(chunk: Uint8Array) => {
|
|
shown.push(`err:${new TextDecoder().decode(chunk)}`);
|
|
},
|
|
);
|
|
|
|
expect(result).toStrictEqual({ stdout: "first\nsecond\n", stderr: "warning\n" });
|
|
expect(shown).toStrictEqual(["out:first\n", "err:warning\n", "out:second\n"]);
|
|
});
|
|
|
|
const openRouterError = (statusCode: number, message: string): string =>
|
|
JSON.stringify({
|
|
type: "error",
|
|
sessionID: "ses_test",
|
|
error: {
|
|
name: "APIError",
|
|
data: {
|
|
message,
|
|
statusCode,
|
|
isRetryable: false,
|
|
responseBody: JSON.stringify({ error: { message, code: statusCode } }),
|
|
},
|
|
},
|
|
});
|
|
|
|
test("reports a rejected OpenRouter key as a sign-in failure", () => {
|
|
const error = openCodeError(openRouterError(401, "User not found."));
|
|
assert.instanceOf(error, AgentAuthError);
|
|
expect(error.message).toBe("opencode sign-in failed");
|
|
assert.instanceOf(error.cause, Error);
|
|
expect(error.cause.message).toBe("opencode APIError (API error 401): User not found.");
|
|
});
|
|
|
|
test("surfaces an OpenCode error event instead of empty output", () => {
|
|
expect(() => parseOpenCodeEvents(openRouterError(429, "Rate limit exceeded"))).toThrow(
|
|
"API error 429",
|
|
);
|
|
expect(openCodeError('{"type":"text","part":{"text":"ok"}}')).toBe(undefined);
|
|
});
|