From e94ce2248da5e80a4f90674ff1227e1b39b6141c Mon Sep 17 00:00:00 2001 From: chitcommit Date: Tue, 18 Aug 2026 23:10:23 +0000 Subject: [PATCH 1/3] =?UTF-8?q?fix(ci):=20unbreak=20build=20=E2=80=94=20se?= =?UTF-8?q?parate=20workerd=20test=20pool,=20correct=20phantom=20dep=20ver?= =?UTF-8?q?sion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `build` job has been red on every PR opened or updated since the DO coordinator merge (c979f6a, Aug 2). The cause was not in any of those PRs. 1. vitest config overlap. vitest.config.ts globs `tests/**/*.test.ts`, which also matched tests/workers/coordinator.test.ts — a workerd-pool test that imports `cloudflare:test`. That specifier only resolves under @cloudflare/vitest-pool-workers (vitest.workers.config.mts), so the node suite died at import with ERR_MODULE_NOT_FOUND before running an assertion. Excluded tests/workers/** from the node suite, preserving vitest's default node_modules/dist excludes. 2. hono-agents "^0.19.0" never existed. a60d0e1 applied the agents-SDK version to the wrong package; the registry tops out at 3.0.12 and the lockfile already pins 3.0.7. Fresh `npm i` failed outright. Aligned the manifest to the locked version — the resolved version is still 3.0.7, so this is a manifest-only correction with no runtime change. 3. The workers suite ran nowhere in CI. `npm run test:workers` was never invoked by any workflow, so the DO coordinator tests had never executed. Excluding them from `npm test` would have converted "loudly broken" into "silently unrun", so they are now wired into the build job. Booting them required @cloudflare/vitest-pool-workers 0.22: the pinned 0.20.1 bundles a workerd supporting compatibility dates only through 2026-08-06, one day behind the 2026-08-07 date a60d0e1 set. Dev-only; the lockfile change is confined to that chain (pool-workers, miniflare, wrangler, workerd). Verified locally, full build sequence: tsc --noEmit clean; npm test 68 passed; npm run test:workers 24 passed (previously 0 — the suite could not boot). Not addressed here: the production advisories (hono, js-yaml, fast-uri, ip-address, nanoid) that fail the Dependency Audit gate are pre-existing on main and are what PR #128 already fixes. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SpK3ddoHzUqgW3keYafHsD --- .github/workflows/ci.yml | 5 +++ package-lock.json | 86 ++++++++++++++++++++-------------------- package.json | 4 +- vitest.config.ts | 4 ++ 4 files changed, 54 insertions(+), 45 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b7c2a7..24b6299 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -83,6 +83,11 @@ jobs: run: npx tsc -p tsconfig.json --noEmit - name: Test run: npm test + - name: Test (workers) + # tests/workers/** runs in workerd via @cloudflare/vitest-pool-workers. + # `npm test` deliberately excludes it, so without this step the DO + # coordinator suite would not run in CI at all. + run: npm run test:workers - name: Governance Pressure Tests run: bash scripts/pressure-test-governance.sh - name: Lint (skipped) diff --git a/package-lock.json b/package-lock.json index 585c0e2..9473ff5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20,7 +20,7 @@ "zod": "^4.3.6" }, "devDependencies": { - "@cloudflare/vitest-pool-workers": "^0.20.1", + "@cloudflare/vitest-pool-workers": "^0.22.0", "@cloudflare/workers-types": "^4.20240512.0", "drizzle-kit": "^0.31.9", "typescript": "^5.5.0", @@ -181,16 +181,16 @@ } }, "node_modules/@cloudflare/vitest-pool-workers": { - "version": "0.20.1", - "resolved": "https://registry.npmjs.org/@cloudflare/vitest-pool-workers/-/vitest-pool-workers-0.20.1.tgz", - "integrity": "sha512-eN5jHaX78lY/btWlyWIiNtTIgmXnI0CvwC6CPukgRjHoXs66jqX0AEKUsUJOeybfXEmZUhhy5FP/Xx+6wNwI7A==", + "version": "0.22.0", + "resolved": "https://registry.npmjs.org/@cloudflare/vitest-pool-workers/-/vitest-pool-workers-0.22.0.tgz", + "integrity": "sha512-OJv/qikkOgxnKxJ5xrLS7zuOLZhc/6iziU+llqZm4tiQf2CJUYwlMuXN68VaWIQebORd1AUx4w6A0oy8XRbuaQ==", "dev": true, "license": "MIT", "dependencies": { "cjs-module-lexer": "1.2.3", "esbuild": "0.28.1", - "miniflare": "5.20260730.0-alpha", - "wrangler": "4.118.0", + "miniflare": "5.20260815.0-alpha", + "wrangler": "4.124.0", "zod": "4.4.3" }, "peerDependencies": { @@ -226,9 +226,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workerd-darwin-64": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260730.1.tgz", - "integrity": "sha512-+MBHmPaiTe2KajryW0T24rZvWFxb41hD3d8anNzQqHzft6vSEb18+sp0znSwxgij7ApPhSM1+vhkNg4f3YMguA==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20260815.1.tgz", + "integrity": "sha512-7PsLdcz6pT9EMd1EJGZEgMyYRfs0CHxGs62PS2L1w3s6+xGmQcRXKm/zoMftmqZF45JBa4MzFeownRKbRt/x5g==", "cpu": [ "x64" ], @@ -243,9 +243,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workerd-darwin-arm64": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260730.1.tgz", - "integrity": "sha512-SBHKntPkKvNPgaCrTe99xC1CAl8ygJDzlYfK0LbuJ1muKadIw35WnhO0wu894fKBtllsVQdNzDLee+cm0ppLSQ==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20260815.1.tgz", + "integrity": "sha512-60wtg8ng7FVWeOg/UMbZ9Ye0sslpRRAKoftPbdtuH2volq676quxVr6Zm2EjVULH/JFZeCn72dbLlrnbh0Mpcw==", "cpu": [ "arm64" ], @@ -260,9 +260,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workerd-linux-64": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260730.1.tgz", - "integrity": "sha512-ouyPOSMbiKPeSwUJUvxtMcxGAXs2J4aPE4T5ABIYX5ClcQx5j5bbHTmnqOQEY8sAuLTPjH7dY+iB6UI5ISlwwA==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20260815.1.tgz", + "integrity": "sha512-MuqKIHPo0Qyo8MZMmy0lP2B5PeAL7f4T9Fu4Usk3QdbV4JIrKG/OoybN3Ign7m/Dff+L1Oo/ZHydB+hEg1ueFw==", "cpu": [ "x64" ], @@ -277,9 +277,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workerd-linux-arm64": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260730.1.tgz", - "integrity": "sha512-YQ+Mi78U3TPdgBPtwq+Sm6rJU+Ihl2y0pjYtuuKkdmUbYzL7oLR6Xqq9wljhasnuCFICssDJaqhMep5WizYoEQ==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20260815.1.tgz", + "integrity": "sha512-XNFtJ5rIqJxnY6ISjkfbhT/ODiWJ6LcBvNbntuPD6I/F2k7aZeKgPaXrvWvKde66LXyzFKzc8Hn+Ydx4shevQg==", "cpu": [ "arm64" ], @@ -294,9 +294,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workerd-windows-64": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260730.1.tgz", - "integrity": "sha512-27fAN+vUECW1oYVc1KOcHYpkL8COM2Uxtxql7TL595kxbjoqS5yckw7NLz7bTf2pALFCZWjqXDjZGJ/xbG4ZKQ==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20260815.1.tgz", + "integrity": "sha512-PiIUWrhbMg3quolwjgMvPOd75vKESjT4aDm7nL6mSjL5IOgmpO/zKstXnYfnEH3pq7sC0UCvKlF8ZPcfsh8NMw==", "cpu": [ "x64" ], @@ -311,9 +311,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/@cloudflare/workers-types": { - "version": "5.20260801.1", - "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-5.20260801.1.tgz", - "integrity": "sha512-XCv5xWi47WQOK0LpLa6997Mrpz8Ct+nZmp/M5Xp8Z4BFsarf7nYjkznGOcOoYK5m1GfbMFEEuQ2OIZnbIWoe9A==", + "version": "5.20260818.1", + "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-5.20260818.1.tgz", + "integrity": "sha512-a89taQDbqb7Ni+xAVSsiOSd5wQPcbBJBnZgIG3EujVdDcdQkGVwab3xa2e9z29uqtMQb/P2gYDeDcNXcBRSWQQ==", "dev": true, "license": "MIT OR Apache-2.0", "optional": true, @@ -780,16 +780,16 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/miniflare": { - "version": "5.20260730.0-alpha", - "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260730.0-alpha.tgz", - "integrity": "sha512-8/dspSXDshP6nSkCpjKO7BYc2qZoYSXm7iM+QxY7qJyJpAB3onnQSaiu0cvKJlfuMGwULl55hG69FJCcCMXU1Q==", + "version": "5.20260815.0-alpha", + "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20260815.0-alpha.tgz", + "integrity": "sha512-YAaGj4Sh5f4fqHKiMQ8zRHDOOM5IGUVtMhnLIeyjuQfU+9P6hcOTrHUVtbfj/ZPay9Kzik4pWELB39pGgefjiQ==", "dev": true, "license": "MIT", "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.35.2", - "undici": "7.28.0", - "workerd": "1.20260730.1", + "undici": "7.29.0", + "workerd": "1.20260815.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" }, @@ -843,9 +843,9 @@ } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/workerd": { - "version": "1.20260730.1", - "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260730.1.tgz", - "integrity": "sha512-zmfNIjwYSWFY5chGBOjWtH3xAE7p97FTC6vR4Ep98290ho6AeAR/NVcBD274YCLEUYzqm8yxdtZlxMybU8a3jA==", + "version": "1.20260815.1", + "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20260815.1.tgz", + "integrity": "sha512-8bArFkHmlp7qFEKVPyNzDzHzS35gc2fg0PYBcDtaNLF7UCDryCX2BQnpkUkTHYIy824IRrHOTwOEoTj0sUO2Fg==", "dev": true, "hasInstallScript": true, "license": "Apache-2.0", @@ -856,17 +856,17 @@ "node": ">=16" }, "optionalDependencies": { - "@cloudflare/workerd-darwin-64": "1.20260730.1", - "@cloudflare/workerd-darwin-arm64": "1.20260730.1", - "@cloudflare/workerd-linux-64": "1.20260730.1", - "@cloudflare/workerd-linux-arm64": "1.20260730.1", - "@cloudflare/workerd-windows-64": "1.20260730.1" + "@cloudflare/workerd-darwin-64": "1.20260815.1", + "@cloudflare/workerd-darwin-arm64": "1.20260815.1", + "@cloudflare/workerd-linux-64": "1.20260815.1", + "@cloudflare/workerd-linux-arm64": "1.20260815.1", + "@cloudflare/workerd-windows-64": "1.20260815.1" } }, "node_modules/@cloudflare/vitest-pool-workers/node_modules/wrangler": { - "version": "4.118.0", - "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.118.0.tgz", - "integrity": "sha512-9pkBw/b8zWqGx2S+oLhgHMR1M/4VOE8SynUFABnGWiSFGlcOQ4xiI/B71Xf66RYP2xzngU37IQFPtUruij3lYw==", + "version": "4.124.0", + "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.124.0.tgz", + "integrity": "sha512-75euoZKjVTJYFy+Xhctt/5JlZL4M6A4xmovZsUlep+6GHcCm14n9VtdGzNIybOW2t8wuNxRj5iMUwjT5E7Ctog==", "dev": true, "license": "MIT OR Apache-2.0", "dependencies": { @@ -874,10 +874,10 @@ "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.28.1", - "miniflare": "5.20260730.0-alpha", + "miniflare": "5.20260815.0-alpha", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", - "workerd": "1.20260730.1" + "workerd": "1.20260815.1" }, "bin": { "cf-wrangler": "bin/cf-wrangler.js", @@ -891,7 +891,7 @@ "fsevents": "2.3.3" }, "peerDependencies": { - "@cloudflare/workers-types": "^5.20260730.1" + "@cloudflare/workers-types": "^5.20260815.1" }, "peerDependenciesMeta": { "@cloudflare/workers-types": { diff --git a/package.json b/package.json index a4d0f28..dca6886 100644 --- a/package.json +++ b/package.json @@ -28,13 +28,13 @@ "ai": "^6.0.141", "drizzle-orm": "^0.45.2", "hono": "^4.12.23", - "hono-agents": "^0.19.0", + "hono-agents": "^3.0.7", "jose": "^6.2.3", "workers-ai-provider": "^3.1.8", "zod": "^4.3.6" }, "devDependencies": { - "@cloudflare/vitest-pool-workers": "^0.20.1", + "@cloudflare/vitest-pool-workers": "^0.22.0", "@cloudflare/workers-types": "^4.20240512.0", "drizzle-kit": "^0.31.9", "typescript": "^5.5.0", diff --git a/vitest.config.ts b/vitest.config.ts index d9bbbed..edc7cbe 100644 --- a/vitest.config.ts +++ b/vitest.config.ts @@ -6,6 +6,10 @@ export default defineConfig({ globals: true, environment: 'node', include: ['tests/**/*.test.ts', 'tests/**/*.spec.ts'], + // tests/workers/** runs in workerd via vitest.workers.config.mts and imports + // `cloudflare:test`, which only resolves under @cloudflare/vitest-pool-workers. + // Without this exclude the node suite globs those files and dies at import. + exclude: ['**/node_modules/**', '**/dist/**', 'tests/workers/**'], testTimeout: 15000, pool: 'threads', maxWorkers: 1, From 9c5d8ca2365d331fd6f7f35928f53e9cfc7f9c9d Mon Sep 17 00:00:00 2001 From: chitcommit Date: Tue, 18 Aug 2026 23:18:44 +0000 Subject: [PATCH 2/3] fix(ci): restate vitest default excludes rather than replacing them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Finding from separated adversarial review (claude-sonnet-4-5 via chittyclaw, reviewer != implementer): setting `exclude` replaces vitest's built-in default list wholesale instead of appending to it. The previous commit kept only node_modules and dist, silently dropping the cypress, dot-directory, and *.config.* patterns. Verified inert today — nothing under tests/ matches any dropped pattern, and `include` is scoped to tests/** so root config files were never candidates. It is restated anyway so a future file under e.g. tests/.cache/ cannot quietly re-enter the node suite. Also verified from the same review, empirically rather than by assertion: - `npm run test:workers` exits 1 on a broken config, so the new CI step is a real gate and not decorative. Checked by temporarily breaking the workers config and reading the exit code. - `npm ls @cloudflare/workers-types` reports no unmet peer dependency. wrangler 4.124 (pulled by pool-workers 0.22) resolves its own nested workers-types v5 while the project continues to resolve v4; tsc --noEmit passes against v4. Re-verified after this change: tsc clean, npm test 68 passed, test:workers 24 passed. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SpK3ddoHzUqgW3keYafHsD --- vitest.config.ts | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/vitest.config.ts b/vitest.config.ts index edc7cbe..da9837a 100644 --- a/vitest.config.ts +++ b/vitest.config.ts @@ -9,7 +9,17 @@ export default defineConfig({ // tests/workers/** runs in workerd via vitest.workers.config.mts and imports // `cloudflare:test`, which only resolves under @cloudflare/vitest-pool-workers. // Without this exclude the node suite globs those files and dies at import. - exclude: ['**/node_modules/**', '**/dist/**', 'tests/workers/**'], + exclude: [ + // vitest's built-in defaults, restated because setting `exclude` replaces + // them wholesale rather than appending. Dropping them here would silently + // re-admit files the default config had always kept out. + '**/node_modules/**', + '**/dist/**', + '**/cypress/**', + '**/.{idea,git,cache,output,temp}/**', + '**/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build,eslint,prettier}.config.*', + 'tests/workers/**', + ], testTimeout: 15000, pool: 'threads', maxWorkers: 1, From 13f61cad2b2c9f7c266a12a07e61b229c1c4d36e Mon Sep 17 00:00:00 2001 From: chitcommit Date: Tue, 18 Aug 2026 23:20:31 +0000 Subject: [PATCH 3/3] fix(deps): update hono within its declared range to clear 12 advisories `npm audit --audit-level=high --omit=dev` is the first step of the CI build job, so it gates every other check. It currently fails on `main` for reasons no PR introduced: npm audit is a moving gate, and advisories published after a branch last ran will fail it retroactively. hono 4.12.23 -> 4.13.3 is entirely inside the already-declared "^4.12.23", so this is a lockfile-only change with no manifest edit and no range widening. It clears 12 hono advisories, including CORS middleware reflecting any Origin with credentials when origin defaults to wildcard, hono/jsx cross-request context leakage, memo() retaining SSR output across requests, and ReDoS in the CORS and language middlewares. Production advisory count drops 7 -> 5. Validated after the bump: tsc --noEmit clean, npm test 68 passed, npm run test:workers 24 passed. The gate is still red on the remaining 4 (fast-uri, ip-address, js-yaml, nanoid). Those are transitive under agents/partyserver and each needs a forced MAJOR override (js-yaml 4->5, nanoid 5->6, fast-uri 3->4) pushed into packages that expect the older major. That is a distinct change with real silent-breakage risk and belongs in its own reviewed PR, not bundled into a CI fix. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SpK3ddoHzUqgW3keYafHsD --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9473ff5..ff8ce0b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1533,9 +1533,9 @@ } }, "node_modules/@hono/node-server": { - "version": "1.19.13", - "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz", - "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==", + "version": "1.19.17", + "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz", + "integrity": "sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==", "license": "MIT", "peer": true, "engines": { @@ -3928,9 +3928,9 @@ } }, "node_modules/hono": { - "version": "4.12.23", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.23.tgz", - "integrity": "sha512-eIaZ9qDgu7XV0pxOCrg7/WhnQ6Ivm22UcxhXx/A3dcbqbbYgBEkc6e/J/s7j2tS96zoB0S9VBdLwQNCWwUo4LA==", + "version": "4.13.3", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.3.tgz", + "integrity": "sha512-r8AO2mYHoLxSHkgafNeC/BXyb2vWRxD3jem4Ts+ptav8oTG5FIRifAjuJEmZI4bSvvc2ns0GxmIYiZnHqN3mMw==", "license": "MIT", "engines": { "node": ">=16.9.0"