test(ci): pin #767 Bun preflight behavior - #770
Conversation
独立窄审 · PR #770 (Draft)Verdict: CLEAN — no BLOCKER, no MAJOR, no MINOR. Reviewer: 通信IM马 (independent, read-only). Extracted PR tree via Per brief: this audit does NOT touch #766's product choice; it verifies only that test766 correctly PINS whatever behavior is currently in Provenance
Item-by-item① strictly test/CI-only, no product semantic changes — CONFIRMEDEvery changed path (8/8): No files in Note: ② tri-state matrix runs REAL production CLI preflight + bunx fixture preserves exact argv — CONFIRMEDAll three probes invoke the actual production entry: Not a mock CLI. Not a helper. The real Bun runtime executing the real cli.ts source. Case 1 —
Case 2 —
Case 3 — #!/bin/sh
set -eu
capture=${TEST766_CAPTURE:?TEST766_CAPTURE is required}
printf '%s\n' "$@" > "$capture"
exec /usr/local/bin/bun /repo/tests/test766-bunx-preflight/fixture-server.ts "$@"
The bunx-existence branch is verified BOTH at argv wiring (captured) AND at run-through completion (server bind). This is real preflight + real spawn + real HTTP fixture, not a static mock. ③ 2 mutations each red on named behavior, not baseline/suicide/no-op/unrelated — CONFIRMEDMutation 1 — # pre-guard: exactly one target string (defends against no-op OR ambiguous multi-match)
[[ "$(grep -Fc 'if (!commandExists("bunx")) {' agent-network/bin/cli.ts)" -eq 1 ]]
# sed
sed -i 's/if (!commandExists("bunx")) {/if (!commandExists("bunx") \&\& !commandExists("bun")) {/' agent-network/bin/cli.ts
# post-guard: new form present (defends against sed silent match miss)
grep -Fq 'if (!commandExists("bunx") && !commandExists("bun")) {' agent-network/bin/cli.ts
# expect_red: probe_bun_only must FAIL (bun-only would now be allowed → healthy banner appears, but probe requires reject-msg)
expect_red old-or-allows-bun-only probe_bun_onlySemantically restores the pre-fix permissive OR-form that was the whole reason bun-only was silently allowed. Mutation on real production code. Survival = mutation escaped, so Mutation 2 — [[ "$(grep -Fc 'if (!commandExists("bunx")) {' agent-network/bin/cli.ts)" -eq 1 ]]
sed -i 's/if (!commandExists("bunx")) {/if (true || !commandExists("bunx")) {/' agent-network/bin/cli.ts
grep -Fq 'if (true || !commandExists("bunx")) {' agent-network/bin/cli.ts
expect_red valid-bunx-blocked probe_bunxForces guard to always-reject. Under this mutation, even valid Guard analysis (defends against the classic mutation-test failure modes):
Both mutations use the SAME single-line target Exactly one occurrence — pre-guard will succeed. ④ qa.sh adds test766 to active L1 + 15/15 evidence + pinned Bun digest — CONFIRMED
Pinned Bun digest: Dockerfile uses Same digest as PR #762 (final source
Report evidence:
⑤ source/report provenance + secret + current-main merge — CONFIRMED
⑥ #766 product choice NOT mixed into this narrow audit — CONFIRMEDReport explicit: "It pins the behavior selected by #767; it does not decide whether #766 should later adopt the separately tested automatic Test766 verifies BEHAVIOR-AS-IS in
That IS the current cli.ts logic (I independently verified the bun-only branch's expected strings match line-by-line in main). Test766 is a REGRESSION gate for the current choice; not an ADVOCACY of any future choice. Additional observations (informational, not blocking)
Reviewer discipline (self)Applied Independent verifications:
No approve, no merge, no deploy. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6901503314
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| COPY agent-network/package.json /repo/agent-network/package.json | ||
| RUN cd /repo/agent-network && bun install --ignore-scripts |
There was a problem hiding this comment.
Because only package.json is present when bun install runs, the image resolves every ranged dependency from the registry instead of using the committed agent-network/package-lock.json; copying the repository afterward is too late. A new compatible dependency release can therefore make this active L1 suite pass or fail differently for the same source commit, undermining the recorded reproducibility guarantees. Copy the lockfile before installation and use a frozen-lockfile install.
AGENTS.md reference: AGENTS.md:L25-L25
Useful? React with 👍 / 👎.
| [[ "$(sed -n '1p' "$capture" 2>/dev/null || true)" == "--bun" ]] || rc=1 | ||
| grep -Fxq '@sleep2agi/commhub-server@0.9.0-preview.29' "$capture" || rc=1 |
There was a problem hiding this comment.
The healthy-path probe only requires --bun to be first and the package string to occur somewhere in the capture. If the CLI appends an unintended argument, including a flag that changes server behavior, the fixture ignores it and this suite still passes despite claiming to preserve the exact argv. Compare the entire capture, including its line count and order, against the expected two arguments.
Useful? React with 👍 / 👎.
| COPY agent-network/package.json /repo/agent-network/package.json | ||
| RUN cd /repo/agent-network && bun install --ignore-scripts | ||
|
|
||
| COPY agent-network /repo/agent-network |
There was a problem hiding this comment.
When a checkout contains the ignored agent-network/node_modules directory, as it normally does after local setup, this COPY merges those host files over the dependencies installed in the preceding image layer because Docker does not honor .gitignore and this repository has no .dockerignore. The supposedly isolated suite can therefore use stale or host-specific dependency artifacts and produce results that differ between otherwise identical Docker runs; exclude node_modules from the build context or copy only tracked source paths.
AGENTS.md reference: AGENTS.md:L7-L7
Useful? React with 👍 / 👎.
| set -e | ||
| if [[ "$rc" -eq 0 ]] \ | ||
| || ! grep -Fq '找到了 bun,但没有 bunx' "$log" \ | ||
| || ! grep -Fq 'ln -s "$(command -v bun)"' "$log" \ |
There was a problem hiding this comment.
The bun-only probe matches only the source half of the suggested ln -s command. If the destination is removed or changed to an invalid path, the suite still passes even though the user-facing remediation it explicitly intends to preserve no longer creates bunx. Assert the complete command, including "$(dirname "$(command -v bun)")/bunx", rather than this prefix.
Useful? React with 👍 / 👎.
2 participants
Scope
Test/CI-only behavior gate for the
anet hub startpreflight selected by #767.bunwithoutbunx: precise fail-fast diagnosis and symlink remediationbunx: exact package argv and healthy CLI bannerscripts/qa.shThis PR does not modify product code, publish packages, deploy anything, close #766, or decide whether bun-only installations should later auto-fallback to
bun x.Frozen coordinates
3b049160b2db542d06a32988a530f0b21f773c96885a74d7c5418d0ee20de46c728396a367ec41cf69015033143a91fef7ba5d8230cd08a87e27738esha256:60994c0f0a088167e7f5ed77f74fc5fefbde57be414bd9a23b1764f48dc746bc1779a95c74afdd17670d2311dc99f09605b671ff1ecfc8dac9a209c4b0de55f8fca1054ab0b7604a0d86e2a1f212e7d78b7214c2702c53e0e4d4a62d7b310a03Verification
RESULT pass=4 fail=0agent-networkbuild: passALL PASS in 107s(wall 107.24s)Full evidence:
docs/tests/report-test766-bunx-preflight.txt.Honest limits
The healthy path uses an HTTP fixture after the real CLI selects and invokes bunx. It proves preflight and argv wiring, not registry availability or the full commhub-server implementation; existing Hub E2E remains authoritative for those layers.