Merge remote-tracking branch 'origin/master' into feat/schedule-clear-ended

# Conflicts:
#	packages/client/ui-schedule/README.i18n.yaml

scripts/ci-workflow.spec.ts

@@ -1371,6 +1371,27 @@ describe('Weighted approval workflow', () => {
         'persist-credentials': false,
       },
     })
+    const token = steps.find(step => step.id === 'decision-token')
+    expect(token).toMatchObject({
+      'continue-on-error': true,
+      uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1',
+      with: {
+        'client-id': '${{ vars.DSH_APPROVAL_APP_CLIENT_ID }}',
+        'private-key': '${{ secrets.DSH_APPROVAL_APP_PRIVATE_KEY }}',
+        owner: 'deepseek-harness',
+        repositories: 'deepseek-harness',
+        'permission-checks': 'write',
+      },
+    })
+    const tokenIndex = steps.indexOf(token!)
+    expect(tokenIndex).toBeGreaterThan(steps.indexOf(checkout!))
+    expect(tokenIndex).toBeLessThan(steps.findIndex(step => step.id === 'revoke'))
+    for (const step of steps.filter(step => typeof step.run === 'string' && step.run.startsWith('node .github/review-ownership/check-approval.mjs'))) {
+      expect(step.env).toMatchObject({
+        DECISION_TOKEN: '${{ steps.decision-token.outputs.token }}',
+        DECISION_APP_SLUG: '${{ vars.DSH_APPROVAL_APP_SLUG }}',
+      })
+    }
     const setupIndex = steps.findIndex(step => typeof step.uses === 'string' && step.uses.startsWith('actions/setup-python@'))
     expect(steps[setupIndex]?.if).toBe("steps.revoke.outputs.active == 'true'")
     expect(steps[setupIndex]?.uses).toBe('actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1')
@@ -1409,7 +1430,7 @@ describe('Weighted approval workflow', () => {
     expect(record?.run).toBe("echo 'Recorded a weighted approval review event.'")
     expect(recordSteps).toHaveLength(1)
     expect(JSON.stringify(publisher)).not.toContain('github.event.pull_request.head')
-    expect(JSON.stringify(publisher)).not.toContain('secrets.')
+    expect(JSON.stringify(publisher).match(/secrets\.[A-Za-z0-9_]+/gu)).toEqual(['secrets.DSH_APPROVAL_APP_PRIVATE_KEY'])
     expect(JSON.stringify(reviewEvent)).not.toContain('github.token')
     expect(JSON.stringify(reviewEvent)).not.toContain('secrets.')
   })

scripts/cordis-loader-resolve.spec.ts

@@ -0,0 +1,104 @@
+/** Loader resolves configuration imports in their project when Node internals are unavailable. */
+import { Context } from '@deepseek-ai/cordis'
+import Loader from '@deepseek-ai/cordis-plugin-loader'
+import { existsSync } from 'node:fs'
+import * as fs from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { describe, expect, it, onTestFinished, vi } from 'vitest'
+import { createResolve } from '../vendor/loader/src/resolve.ts'
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs/promises')>()
+  const mkdir = vi.fn(actual.mkdir)
+  return { ...actual, mkdir, default: { ...actual, mkdir } }
+})
+
+async function fixture() {
+  const root = await fs.mkdtemp(join(tmpdir(), 'dsh-cordis-resolve-'))
+  onTestFinished(() => fs.rm(root, { recursive: true, force: true }))
+  await fs.writeFile(join(root, 'package.json'), JSON.stringify({
+    name: 'fixture-app', type: 'module',
+    imports: { '#local': './local.js' }, exports: { './sub': './sub.js' },
+  }))
+  await fs.writeFile(join(root, 'local.js'), 'export const tag = "subpath-import"\n')
+  await fs.writeFile(join(root, 'sub.js'), 'export const tag = "self-reference"\n')
+  const dep = join(root, 'node_modules', 'fixture-dep')
+  await fs.mkdir(dep, { recursive: true })
+  await fs.writeFile(join(dep, 'package.json'), JSON.stringify({
+    name: 'fixture-dep', type: 'module',
+    exports: { '.': { import: './index.js' }, './sub': { import: './sub.js' } },
+  }))
+  await fs.writeFile(join(dep, 'index.js'), 'export const tag = "bare-dep"\n')
+  await fs.writeFile(join(dep, 'sub.js'), 'export const tag = "dependency-subpath"\n')
+  await fs.mkdir(join(root, 'src'))
+  await fs.writeFile(join(root, 'src', 'plugin.js'), 'export const tag = "relative"\n')
+  return { root, baseUrl: pathToFileURL(join(root, 'src', 'cordis.yml')).href }
+}
+
+async function treeFor(baseUrl: string) {
+  const ctx = new Context()
+  onTestFinished(() => ctx.fiber.dispose())
+  await ctx.plugin(Loader, { baseUrl })
+  ctx.loader.internal = undefined
+  return ctx.loader.root.tree
+}
+
+describe('Loader project resolution', () => {
+  it('loads import-only dependencies, subpaths and package mappings from the config project', async () => {
+    const { root, baseUrl } = await fixture()
+    const tree = await treeFor(baseUrl)
+    for (const [specifier, tag] of [
+      ['fixture-dep', 'bare-dep'], ['fixture-dep/sub', 'dependency-subpath'],
+      ['#local', 'subpath-import'], ['fixture-app/sub', 'self-reference'],
+    ] as const) {
+      expect(await tree.import(specifier)).toMatchObject({ tag })
+    }
+    expect(existsSync(join(root, '.cordis', 'resolve.mjs'))).toBe(true)
+    expect(existsSync(join(root, 'src', '.cordis'))).toBe(false)
+    expect(await fs.readFile(join(root, '.cordis', '.gitignore'), 'utf8')).toContain('*')
+    await expect(tree.import('fixture-dep/missing')).rejects.toThrow()
+  })
+
+  it('keeps project scopes independent and shares concurrent resolution within one scope', async () => {
+    const first = await fixture()
+    const second = await fixture()
+    const [a, b, c] = await Promise.all([
+      createResolve(first.baseUrl),
+      createResolve(pathToFileURL(join(first.root, 'cordis.yml')).href),
+      createResolve(second.baseUrl),
+    ])
+    expect(a).toBeTypeOf('function')
+    expect(a).toBe(b)
+    expect(a?.('fixture-dep')).not.toBe(c?.('fixture-dep'))
+  })
+
+  it('imports relative, URL and builtin specifiers without changing their identity', async () => {
+    const { root, baseUrl } = await fixture()
+    const tree = await treeFor(baseUrl)
+    expect(await tree.import('./plugin.js')).toMatchObject({ tag: 'relative' })
+    expect(existsSync(join(root, '.cordis'))).toBe(false)
+    expect(await tree.import(pathToFileURL(join(root, 'local.js')).href)).toMatchObject({ tag: 'subpath-import' })
+    expect(await tree.import('node:path')).toMatchObject({ join })
+    await expect(tree.import('./missing.js')).rejects.toThrow()
+  })
+
+  it('retains native import when helper creation is denied', async () => {
+    const { root, baseUrl } = await fixture()
+    const tree = await treeFor(baseUrl)
+    const denied = vi.mocked(fs.mkdir).mockRejectedValueOnce(Object.assign(new Error('read-only project'), { code: 'EACCES' }))
+    onTestFinished(() => { denied.mockReset() })
+    expect(await createResolve(baseUrl)).toBeUndefined()
+    expect(await tree.import('node:path')).toMatchObject({ join })
+    await expect(tree.import('fixture-dep')).rejects.toThrow()
+    expect(existsSync(join(root, '.cordis'))).toBe(false)
+  })
+
+  it('retains native import without a file-backed package scope', async () => {
+    expect(await createResolve(undefined)).toBeUndefined()
+    expect(await createResolve('https://example.com/cordis.yml')).toBeUndefined()
+    const tree = await treeFor('https://example.com/cordis.yml')
+    expect(await tree.import('node:path')).toMatchObject({ join })
+  })
+})

scripts/no-unknown-casts.baseline.json

@@ -1278,11 +1278,8 @@
     "d423bbcd1caff7aab2e2de52564efbc9061e775620a530157805a43d851c6fe9": 1
   },
   "packages/interaction/user-approval/tests/approval.spec.ts": {
-    "3261a2af17649cc35cf8698e3b7278101044ed1a07efce757615616e0f918d3a": 1,
     "4dd1f265ec710503bb27f057a582099a1e9d8b5db80fb45f148e32fd2afb5325": 2,
     "744b30e13b6390439c34f4970441a292a07f4ac3d26f25e9be75d1b5c18f4f33": 1,
-    "971ec45a1146ab52f2fb13f75b782d5d35c0fb2ddba1fb9ccab14cc54f7291d5": 1,
-    "a6a2f2761dfd14ff3624a7f8684b025d6aa733d41cac4381db7c83f2a38f0c35": 1,
     "f33c4a795e2cda267cb28d2937c632d56134b8e6438d21e4bf74da2735b1c154": 1
   },
   "packages/interaction/user-questions/tests/user-questions.spec.ts": {