#351 bumped the published packages' engines.node to >=24 along with
the dev-side switch to Node's native TypeScript support. End users
never run our .ts source files, only the compiled dist/cli.js, which
targets ES2020 and works fine on Node 22.
- @redwoodjs/agent-ci and dtu-github-actions: engines.node >=22
- repo-root package.json: gain engines.node >=24 to signal that the
dev scripts (which run .ts files directly) need Node 24.
* chore: require Node 24 and drop tsx
Node 24 ships native TypeScript stripping as a stable feature. We no
longer need tsx to execute .ts files in development scripts.
Changes:
- `engines.node` bumped from `>=22` to `>=24` in each package.
- `tsx` removed from every workspace's devDependencies.
- Each `tsx foo.ts` invocation in package scripts becomes `node foo.ts`.
Includes `scripts/agent-ci-dev.sh` (the dev wrapper) and the demo
package.
- tsconfigs gain `allowImportingTsExtensions`, `rewriteRelativeImportExtensions`,
and `verbatimModuleSyntax` so source uses `.ts` extensions while tsc
still emits `.js` paths in dist.
- All relative imports rewritten from `from "./foo.js"` to `from "./foo.ts"`
across 72 source files. Dynamic imports updated too.
- Type-only imports (`Job`, `Polka`, MessageResponse, …) converted to
`import type` to satisfy `verbatimModuleSyntax`.
- The json-loader hook registration in workflow-parser.ts picks `.ts`
when the source file exists (dev) and `.js` otherwise (compiled dist).
- Root `package.json` adds `"type": "module"` (no existing .js files
affected) and `yaml` as a devDep (already used by scripts/diff-parse.ts;
previously hoisted through cli's deps).
- `tests.yml` CI bumps from Node 22 to Node 24. Smoke fixtures that set
`node-version: 22` are left alone — they exercise `actions/setup-node`
with various versions deliberately.
Verified:
- pnpm check: clean
- Node 24 dev run: `node packages/cli/src/cli.ts --help` works
- Full smoke suite (`pnpm agent-ci-dev run --all`): 45/45 jobs pass
* fix(shutdown.test): use `node --input-type=module` instead of `npx tsx`
The shutdown integration test spawns a fresh process to sidestep
vitest's mock system. It was using `npx tsx`, but `tsx` is no longer
a dependency. Node 24 reads TypeScript files natively, so we ask Node
directly via `--input-type=module`.
Replaces the eight optional arguments threaded through `resolveExprAtom` and
`evaluateExprValue` with a single `ExprContext` object, dispatches built-in
functions through a name->handler table, and moves context-variable lookups
into a dedicated resolver with constant tables.
`expandExpressions` keeps its positional public signature so no caller has
to change. No behaviour change; all workflow-parser tests still pass and
the full smoke suite (`pnpm agent-ci-dev run --all`) is green.
Measured complexity drop (fallow health):
- resolveExprAtom: cognitive 124 -> off the high-complexity list
- evaluateExprValue: cognitive 57 -> 28
- file length: 1913 -> 1736 lines
Also adds `fallow` as a workspace-root dev dependency and ignores the
locally generated `.fallow-reports/` directory.
Target tmux panes by captured pane ID instead of window:pane indices so
the script works regardless of the user's tmux base-index. Invoke
scripts/agent-ci-dev.sh directly instead of going through
pnpm --dir "$REPO_ROOT", so the CLI inherits DEMO_DIR as its cwd and
resolves the demo's own .github/workflows/ci.yml.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Closes#297. CI/scripts-only — no packages/ change, so no changeset required
per .claude/rules/changeset-required.md.
- scripts/diff-parse.ts: walks raw YAML at workflow + job scopes (in addition
to the existing step scope) and grades every recognized key against a
preservation predicate or a documented expected-drop. Reuses focused parsers
(parseJobIf, parseJobOutputDefs, parseWorkflowContainer, parseWorkflowServices,
parseMatrixDef, parseFailFast, parseJobDependencies, getWorkflowTemplate).
defaults.run.shell preservation detects the heredoc-wrap marker emitted by
wrapScriptForShell.
- third-party-workflows/: vendored scan-only corpus — turborepo-lint.yml,
playwright-infra.yml, docker-validate.yml — each with attribution header.
Picked up automatically by collectWorkflowFiles.
- package.json: parse:diff added to the parallel pnpm check pipeline so
regressions fail standard CI.
Result: 37 workflows scanned (.github/workflows + third-party-workflows),
0 drifts. pnpm check exits 0; pnpm agent-ci-dev run --all reports 39/39.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
For each .github/workflows/*.yml, read the raw YAML and compare against
what parseWorkflowSteps emits, flagging any step-level key our parser
silently drops without a documented expected-drop policy.
First run over all 26 workflows: 0 drifts. Job-level and workflow-level
scans are tracked as follow-ups in #297.
Refs #297.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(compat): make compatibility.json the source of truth
Flip the compatibility matrix so packages/cli/compatibility.json is
authoritative. scripts/gen-compatibility-md.mjs renders the .md from it,
pnpm check runs a drift check, and the website imports the JSON directly
and renders inline markdown in keys/notes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test: add compat smoke coverage for secrets, working-dir defaults, runner image
Fill three audit gaps identified against packages/cli/compatibility.json:
- smoke-secrets-env-file: secrets resolved from .env.agent-ci and from
the shell environment fallback
- smoke-defaults-workdir: workflow- and job-level
defaults.run.working-directory plus a step-level override
- smoke-runner-image: .github/agent-ci.Dockerfile is picked up and the
resulting image is used at job start
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(workflow): propagate defaults.run.working-directory to steps
Parse defaults.run.working-directory at workflow and job level and merge
it into each run-step's inputs with step > job > workflow precedence.
Step-level working-directory already worked; the defaults blocks were
silently ignored.
Closes#290.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(compat): add proof field to compatibility.json rows
Every `supported`/`partial` row now lists the smoke workflows that
exercise it end-to-end. `pnpm compat:gen`/`compat:check` fails if a
listed path does not resolve, catching renames.
Rows with an empty `proof: []` are the audit gaps tracked in #292.
Refs #292.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(dtu): attach step env per-step so it does not leak to siblings
Step-level env was being aggregated into the job-wide EnvironmentVariables
map (last-wins), so a later step's `env: FOO=x` would override an earlier
step's effective FOO at runtime. Emit step.Env as the mapped step's own
`environment` instead.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(compat): fill audit gaps #292 — env, expressions, local action
Three smokes covering eight of the ten gaps listed in #292:
- smoke-env-scoping: workflow + job + step `env:` precedence
- smoke-expressions: hashFiles, format, join, runner.arch, type
literals, startsWith/endsWith
- smoke-local-action: `steps[*].uses: ./.github/actions/...`
(verified via marker file rather than steps.<id>.outputs.*)
Proof fields updated for every row these smokes cover. hashFiles
downgraded to ⚠️ partial — agent-ci emits SHA-1, GitHub Actions emits
SHA-256 (tracked by #294).
Two gaps remain open as filed issues:
- #293 defaults.run.shell / steps[*].shell not applied
- #295 ${{ steps.<id>.outputs.<name> }} leaks literal text in run
scripts
Refs #292.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
During pnpm run version, scripts/release-closes.mjs captures
Closes|Fixes|Resolves #N references from pending changesets into
.release-closes.json, pairs each with the PR that added the
changeset, and rewrites the keywords to Refs #N so the 'Version
Packages' PR does not close them on merge. After the release
workflow publishes, a new step closes each captured issue with
the comment 'Closes Issue #N via PR #M.'
The release workflow failed because changeset-generated CHANGELOGs weren't
formatted. Fix the existing files and run oxfmt after `changeset version`
so future Version Packages PRs include formatted markdown.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Auto-generated CHANGELOGs from changesets don't match oxfmt's
markdown formatting, which breaks the release workflow when
changesets/action tries to commit version bumps through husky.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: support local reusable workflows (uses: ./.github/workflows/...)
Inline called workflow jobs into the caller's dependency graph so that
`jobs.<id>.uses` with local refs works end-to-end. Includes dependency
rewiring, smoke tests, runner seed resilience fix, boot-failure log
surfacing, and dev script improvements.
Closes#149
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update website compatibility matrix for reusable workflows
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add section descriptions to website compatibility matrix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add descriptions to compatibility matrix legend items
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add 'not planned' status icon to compatibility matrix
Distinguish architectural limitations (concurrency groups, GitHub
secrets) from features that could be implemented in the future.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support remote reusable workflows (uses: owner/repo/path@ref)
Pre-fetch remote workflow YAML from GitHub Contents API before expansion,
cache SHA refs forever and always re-fetch mutable tag/branch refs. Also
changes missing workflow files from warn+skip to hard failure.
Closes#165
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: split monolithic smoke-tests.yml into discrete workflow files
Each smoke test area now has its own workflow file for isolated failure
visibility: matrix, artifacts/services, cross-job outputs, job conditions,
reusable workflows (local + remote), and binary smoke.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: fix formatting in .docs/ files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: clarify agent-ci-dev.sh is for local development only
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Introduces the packages/ts-runner package skeleton with build config,
planning docs (PLAN.md, SPEC.md), and a research document exploring
RivetKit Agent OS integration. No runtime code yet — this sets up the
foundation for subsequent PRs.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: action tarball disk cache, step output capture, and demo recording
- Cache action tarballs on first download and serve from disk on re-runs,
eliminating ~30s GitHub CDN delays
- Capture step output via tee to signals dir for reliable pause-on-failure
tail display
- Fix CLI to treat empty results as failure and skip summary print
- Add marketing demo recording setup with VHS tape and test project
- Add `agent-ci` script alias in root package.json
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test: add tests for action tarball cache, group filtering, and empty-results fix (#119)
Cover the untested changes from the tarball cache PR: action tarball proxy
cache hit/miss, download info URL rewriting with sub-path stripping, step
output group filtering, tee output capture, and CLI empty-results exit logic.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: prevent concurrent tarball cache-miss race condition
Use an in-flight download map so concurrent requests for the same
tarball coalesce into a single GitHub fetch instead of racing on
the same tmp file, which could cause corruption or rename errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use relative path in demo.tape for portability
Replace hard-coded absolute path with a relative path so the demo
recording works on any contributor's machine.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct sanitized-refs test to assert 404 for slash-containing refs
The test was passing vacuously (status >= 200 matches 404). Now it
properly asserts that Polka does not bind :ref across slashes, so
slash-containing refs return 404 and do not serve cached content.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
pnpm -r test was including the root workspace, whose test script
is itself `pnpm -r test`, causing every test to run twice in parallel.
Both runs share /tmp/dtu_cache, and when one run's beforeEach cleanup
deleted temp files the other run's server was using → ENOENT.
Add --include-workspace-root=false to prevent the root workspace from
being matched by recursive test runs.
- Rename package from 'machinen' to 'agent-ci' across all source, tests, scripts, configs, and docs
- Rename CLI binary from 'machinen' to 'agent-ci'
- Rename .machinen → .agent-ci, .env.machinen → .env.agent-ci, MACHINEN_* → AGENT_CI_*
- Rename --runner flag to --name/-n (--runner still accepted for compat)
- agent-ci-dev script now builds DTU before running CLI
- Extract YAML compatibility tables to cli/compatibility.md
- Expand CLI usage docs with per-command flag tables
- Document DOCKER_HOST support for remote Docker
- Add RenderContext class that composites multiple workflow trees
into a single logUpdate frame, grouped by workflow name
- Multi-job workflows always share a RenderContext so all runners
appear in one composite tree (fixes overwriting bug)
- --all mode runs workflows in parallel via Promise.allSettled
- Completed jobs collapse to a single ✓/✗ summary line
- Paused jobs show retry hint as child node
- Suppress console.log/emit in shared context to prevent logUpdate
cursor corruption
- handleRun returns JobResult[] with single summary at the end
- Add warm-cache serialization for --all mode
- Add taskId to buildJob in multi-job path
- Simplify machinen-dev script to run tsx directly
- Document workflow relevance criteria for --all in README
- Add machinen-dev script alias to root package.json
- Make --pause-on-failure the default, add --exit-on-failure/-x to opt out
- Remove unused dev script, concurrently, and wait-on deps
- Move tagline from root README to cli/README
- Switch typecheck from 'pnpm -r exec tsgo' to 'pnpm -r run typecheck'
to skip ui package (electrobun ships .ts source with type errors)
- Add typecheck script to cli/package.json
- Fix formatting in cli/src/cli.ts
Peter Pistorius