Skip to content

spec(open-knowledge): remove Bun, Node as sole execution engine (#2375)#663

Merged
inkeep-oss-sync[bot] merged 1 commit into
mainfrom
copybara/sync
Jul 17, 2026
Merged

spec(open-knowledge): remove Bun, Node as sole execution engine (#2375)#663
inkeep-oss-sync[bot] merged 1 commit into
mainfrom
copybara/sync

Conversation

@inkeep-oss-sync

Copy link
Copy Markdown
Contributor

Copybara-translated 1 Inkeep OSS change. Rebase-merge this PR so the prepared commit lands directly on public main.

* spec(open-knowledge): remove Bun, Node as sole execution engine

Full /spec workflow output: problem framing, 7-worker research wave
(toolchain, test-runner, TS-exec scan, public mirror, gate semantics,
CI timings, vitest spike on packages/core), decisions D1-D16, phased
rollout, 26-seam verification plan, and two cold-reader passes
(design review + claim audit) with corrections applied.

Headline decisions (agent-derived, pending ratification):
- pnpm 10.x replaces bun as installer/script-runner (D7)
- Vitest >=4.1 replaces bun test for all tiers via bun:test shim (D8);
  spike: core suite green at 0.64x bun wall-clock on Node 24
- tsx for scripts day one; native type-stripping ratchet as future work (D9)
- three-phase rollout: hygiene -> per-package test flips -> atomic
  toolchain cutover -> release-continuity proof (D15)

* [US-001] chore(open-knowledge): phase-0 import hygiene and suite re-census

Extensionless-import .ts hygiene across app perf fixtures/scenarios, the
load-bearing core/constants/upload.ts re-export, and the core list.test.ts
CJS-require-to-ESM codemod. Adds the phase-0 per-package suite census as
migration evidence for later parity checks. No runtime behavior change.

* [US-002] test(open-knowledge): land vitest infra (shim, facade, shared config) + dual-vocabulary meta-guard

Add vitest 4.1 plus the bun:test compatibility shim, the Bun.* facade, and a
shared vitest base config as test infrastructure (no package flipped yet), and
open the CI meta-guard's dual-vocabulary window so per-package flips become
mechanical script swaps.

- test-support/bun-test-shim.ts: the 14-symbol bun:test surface (hooks, expect,
  describe, test, it, spyOn, mock, jest, vi, Mock, setDefaultTimeout) with a
  vi.doMock-based mock.module facade
- test-support/bun-global-shim.ts: Bun.* facade (file, sleep, which, spawnSync
  via node:child_process, Glob, TOML, gc, resolveSync, CryptoHasher)
- test-support/vitest.base.ts: shared config pinning ssr.resolve.conditions
  ['development'], testTimeout 30000, and the import.meta.dir transform plugin
- vitest.config.ts and self-tests proving bun:test imports resolve, the mock
  facade mocks a dynamic import, and the Bun facade behaves on Node
- scripts/check-ok-ci-test-coverage.mjs: accept both bun --timeout and vitest
  config-based testTimeout; truth-table test extended in lock-step

Deps: vitest and smol-toml (backs the TOML facade). No package test script is
flipped; that is US-004 onward.

* [US-003] docs(open-knowledge): mock.module retro-patch taxonomy

* [US-004] test(open-knowledge): flip core test tiers to vitest + SB-1 resolved-path proof

* [US-005] test(open-knowledge): flip md-conformance test tier to vitest

* [US-006] test(open-knowledge): flip docs test tier to vitest

Flip docs test script (bun test src -> bunx vitest run src) and add
docs/vitest.config.ts spreading the shared base with the docs @->src alias.
15 files / 197 tests, exact parity, zero skipped/deleted. cli flip split to
a follow-up iteration (inventory in the remove-bun mock-taxonomy evidence).

* [SRC-COMPANION] docs(open-knowledge): production-src bun-ism sweep for companion PR

* [SRC-COMPANION] fix(open-knowledge): sha256 doc-name hashing in bundle-redact (Node-compat; was blake2b512+outputLength which throws on Node)

ok diagnose --redact crashed on the published Node CLI with ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH because createHash('blake2b512', { outputLength: 32 }) rejects the outputLength option on Node's OpenSSL (bun returns a 32-byte digest). The doc-name token is ephemeral per bundle, so switching to sha256 truncated to 8 hex is safe. Rides a companion bug-fix PR, split from the test-runner migration.

* [US-006] test(open-knowledge): flip cli test tiers to vitest

Flip packages/cli off bun test: `test` -> `bun run build:schema && bunx vitest run`, `test:e2e:cli` -> `bunx vitest run --config vitest.e2e.config.ts` (the black-box spec omits the .test infix, so a bare positional collects nothing and a dedicated config pins include). Add vitest.config.ts (base spread) and vitest.e2e.config.ts. Exact census parity: 118 files / 1861 tests, zero skipped or deleted.

Six test-infra fix classes: spyOn on an ESM namespace -> mock.module + dynamic import (open-browser); a bun ?query dynamic-import cache-buster -> vi.resetModules (published-schema); dev-mode argv[1] stubs (pi-extension, project-integration-writers); a real fakeHome default + importActual factory (config/loader module-load crash); a Bun.Transpiler facade backed by node:module stripTypeScriptTypes (pi-extension); async Bun.spawn -> node:child_process spawn (project-anchor) and worker execPath -> explicit bun (keepalive-orphan-reaping emitted parent script).

The two suspected src-mechanism differences were both test-harness readiness races, not src behavior: pi-extension's rejects.toThrow was unawaited and lost to the finally shutdown; start.ts read degraded before awaiting booted.ready, so the async shadow-repo git init ran after PATH was restored. Both fixed by awaiting. No cli/src change (the bundle-redact Node-compat fix rode the separate SRC-COMPANION commit). Extends test-support/bun-global-shim.ts with Bun.Transpiler plus a self-test. cli test bodies are not copybara headDriftCheck anchors, so no manifest change.

* [SRC-COMPANION] fix(open-knowledge): duplicate-path returns 409 on Node when destination is occupied

Node's fs.cpSync throws ERR_FS_CP_DIR_TO_NON_DIR (or ERR_FS_CP_NON_DIR_TO_DIR)
when a directory copy collides with an existing file (or vice versa), where bun
throws EEXIST. isAlreadyExistsError only matched EEXIST / ERR_FS_CP_EEXIST, so on
the published Node server POST /api/duplicate-path returned 500 instead of 409
when the destination path was already taken by an incompatible type. Recognize
all four codes; behavior-neutral for same-type collisions.

* [US-007] test(open-knowledge): flip server test tier to vitest

Flip packages/server test from bun to vitest at exact census parity (316 files /
5098 tests). Add packages/server/vitest.config.ts. Rewrite the 21 Bun.serve test
servers to node:http via a shared fetch-test-server helper, and fix the Node-idiom
failures the flip surfaced: ESM-namespace spyOn on node builtins to mock.module +
dynamic import, require(biome.jsonc) to a JSONC-strip helper, Glob-from-bun to the
Bun.Glob facade, an SDK subpath specifier, import.meta.path and describe.if. Adjust
the collab close-code and handoff Host-header tests for Node runtime behavior. Add
Bun.file().stat() to the facade. build:skill-bundles stays on bun (US-014).

* [US-008] test(open-knowledge): flip app unit/conversion/fidelity tiers to vitest

* [US-009] test(open-knowledge): flip app integration tier (sharded) to vitest

* [US-010] test(open-knowledge): flip app DOM tier to a dedicated jsdom vitest project

* [US-011] test(open-knowledge): flip desktop test tier to vitest

* [US-012] test(open-knowledge): flip scripts and .github test tiers to a vitest .mjs project

* [US-013] chore(open-knowledge): knip vitest-aware, retire bun-test-blind allowlist rows

* [US-014] chore(open-knowledge): tsx script/shebang rewrites ahead of pnpm cutover (bun still installer)

* [US-014] feat(open-knowledge): cut toolchain over to pnpm 10 (workspace, lockfile, supply-chain posture; delete bun.lock/bunfig/.bun-version)

* [US-015] chore: retire bun from root OK integration (wrapper, guards, cross-harness) with D10 hybrid

* [US-016] ci(open-knowledge): swap validation + gate workflows to setup-node + pnpm (retry loop, shards, D12)

* [US-017] ci(open-knowledge): swap release spine to pnpm in-place (release.yml/desktop/promote/main-reset/compute-next-beta), preserve provenance

* [US-018] chore(open-knowledge): repoint public mirror to pnpm (manifest include/strip, overlay docs, regen)

* [US-019] docs(open-knowledge): rewrite governance docs + hooks to pnpm/vitest (CLAUDE/AGENTS/PRECEDENTS, root AGENTS/CI, .claude hooks)

* [US-020] chore(open-knowledge): final bun-artifact sweep, residual token cleanup, migration changeset

* [US-014] fix(open-knowledge): hoist electron-builder native deps for pnpm-isolated packaging (keyring, native-config)

* ci(open-knowledge): correct stale bun references in validation workflow comments

* fix(open-knowledge): resolve @types/mdast via createRequire in md-audit enumerator (pnpm-isolated layout)

The catalog enumerator hardcoded a flat node_modules/@types/mdast path that
pnpm's isolated node_modules does not produce; resolve it through Node module
resolution instead. Same pnpm-isolation class as the catalog-fresh check fix.
Surfaced by the uninterrupted full-gate QA run.

* fix(open-knowledge): resolve remove-bun review-gate findings

Phase-6 local-review fixes for the Bun->pnpm migration:

- CI: restore the dropped space in `pnpm exec turbo run ${{ matrix.task }}`
  (validation.yml) so the 6 gated matrix cells stop hard-failing on
  `turbo runtypecheck` / `runtest:dom` / etc.
- Scripts-vitest gate: exclude measure-scripts-contract + cluster-strict-gate
  tests (both spawn bun, ENOENT on the bun-less Node runner) and include the
  test-support Bun-compat shim self-tests that were orphaned from the gate.
- resolved-path-conditions: plant a toBeDefined so the referential-identity
  fence cannot pass vacuously if a symbol resolves to undefined.
- parcel-watcher asarUnpack guard: resolve deps via createRequire so the walk
  descends pnpm's isolated node_modules instead of guessing nested/hoisted
  paths (which pnpm does not populate). No packaging gap surfaced.
- Copybara: convert the 5 check:full:parallel strip anchors to pnpm form and
  add headDriftCheck so the mirrored script stops referencing privatized
  scripts and future drift fails loud; regenerate .bara.sky.
- Clean remaining stale bun references in migration-touched scripts/comments.

* docs(open-knowledge): fix stale bun run check comment in check-no-major-changeset.sh

No-skimp do-now: completes the operative-path bun-comment sweep for a
mirror-shipped guard script (metric-1 residual).

* revert(open-knowledge): keep check-subtree-cwd.sh hook off the migration diff

Per maintainer request: the Bun->pnpm string update in the shared-body
check-subtree-cwd.sh hook forced a change into the public/agents colocated
copy (check-claude-hook-sync requires body-identity across subtrees). Revert
all 3 copies to origin/main so public/agents is untouched; the OK UI-primitives
reminder keeps its origin/main wording.

* fix(open-knowledge): regenerate markdownlint rule-catalog after main merge

The merge brought in main's markdownlint content-rules feature; its committed
rule-catalog.generated.ts was stale against a fresh regeneration from the merged
schema. Regenerated via generate:lint-catalog (tsx) so core's drift-check passes.

* fix(open-knowledge): resolve post-merge CI gate failures

- Monorepo Structural (headDriftCheck 'anchors exactly once'): remove the
  headDriftCheck:true I added in Phase 6 to the 5 check:full:parallel md-audit/
  conformance strips. Their before-anchors appear in multiple scripts (check,
  check:full:parallel) by design, so they can't be headDriftCheck rules; the
  bun->pnpm anchor conversion stays. Regenerated .bara.sky.
- cap-verdict-staleness gate: the gate hard-failed on bun.lock present in only
  one ref (the migration deleted it). Recognize the Bun->pnpm transition
  (bun.lock gone in HEAD + pnpm-lock.yaml present) and skip the dep major-bump
  arm for it, while still fail-closing on a genuine accidental rm.

* fix(open-knowledge): import prosemirror Plugin/PluginKey via @tiptap/pm/state

frozen-table-headers.ts (from main #2548) imported raw 'prosemirror-state', a
phantom dependency the app never declares. It resolves locally via hoisting but
not in the strict pnpm mirror export, breaking the app build there. Align to the
OK convention (69 other files use @tiptap/pm/state, which re-exports these).

* fix(open-knowledge): dedup @types/node and fix node-pty install flag for pnpm CI

Pin @types/node to ^24.7.0 via a pnpm override so a frozen install resolves
node's ambient ChildProcess and EventEmitter types consistently. The workspace
declared a mix (cli/desktop ^24.7.0, core/md-conformance ^25.6.0); under pnpm's
strict tree a fresh frozen resolution split ChildProcess from its EventEmitter
base, so child.on(...) failed to typecheck in the server src the app checks via
the development condition. It was green under bun's flat dedup but red on CI
test:dom, test, typecheck, and the mirror export.

Also drop the unsupported --config.save=false flag from the node-pty rebuild
step in the validation workflow; pnpm add rejects it with
ERR_PNPM_OPTION_NOT_SUPPORTED.

* fix(open-knowledge): resolve pnpm-strict CI failures (phantom deps, tooling scope)

Five migration-completion fixes for the OK validation matrix, all failures
that bun's flat node_modules hid and pnpm's strict tree surfaces:

- typecheck: the node-pty re-materialize step used a bare `pnpm add` at the
  workspace root, which pnpm refuses (ERR_PNPM_ADDING_TO_ROOT). Add -w.
- lint: scripts/comment-identity.mjs and cluster-strict-gate.mjs import ts-morph
  from the OK root, but ts-morph was declared only in app/server/md-conformance.
  Declare it at the root.
- a11y and playwright: `pnpm exec playwright install` from the root cannot
  resolve the app-scoped @playwright/test bin. Scope the install to the app.
- test: the native-config load probe used a bare workspace specifier the root
  cannot resolve under pnpm strict. Use a relative require.
- desktop-smoke: the desktop electron-vite config transitively imports culori
  (app chrome-tokens plugin into core chrome-resolver); culori was only core's
  dep. Declare it in desktop so the externalized config .mjs resolves it.

The size cell (bundle drift) and preflight-macos are still being investigated.

* fix(open-knowledge): clear lint (knip), mirror-runnable, and structural gates

Three more pnpm-strict migration fixes:

- mirror-runnable: packages/core/src/y-prosemirror-patch.test.ts resolves
  @tiptap/y-tiptap via require.resolve to verify the destructive-delete patch,
  but core did not declare it (only app/server do). Declare it in core.
- lint (knip): declaring ts-morph at the root lets comment-identity.mjs resolve
  it, so ts-morph is now a used and declared dep and its knip ignore is removed.
  The two new resolution-only deps (@tiptap/y-tiptap in core via require.resolve,
  culori in desktop via the electron-vite build config) have no static specifier
  knip can trace, so they move to their workspaces' ignoreDependencies.
- Monorepo Structural Validation: the lockfile regen changed md-conformance's
  resolved @types/node (25.9.5 to 24.13.3, from the new @types/node override),
  so the copybara manifest literal strip anchor drifted. Re-sync the anchor and
  regenerate public-open-knowledge.bara.sky.

* fix(open-knowledge): clear comment-leak, size, and preflight-macos gates

- lint (comment-leak): the @types/node override comment in pnpm-workspace.yaml
  named the private, mirror-excluded md-conformance package, which the export
  leak check flags on the public mirror. Reword to not name any private package.
- size: a fresh pnpm resolution floats several bundled deps to newer patches
  within their existing caret ranges than the bun lockfile had pinned (dep
  declarations unchanged, no duplicate versions). Raise the combined-chunks
  budget 3.17 to 3.3 MB (measured 3.28) and main CSS 54 to 55 kB (measured 54.4);
  diffuse migration drift with no single reclaimable source.
- preflight (macos-latest): git-preflight-boot.test.ts seeds contentDir with a
  bare mkdtemp under /var (a macOS symlink to /private/var). When @parcel/watcher
  falls back to chokidar on CI, chokidar realpaths its root and feeds /private/var
  paths to the ignore filter, so relative(contentDir, ...) yields a ".." string
  the ignore lib rejects. realpath the temp dir, matching the precedent in
  file-watcher.test.ts and file-watcher-allfiles.test.ts.

* fix(open-knowledge): clear a11y/playwright, desktop-smoke, mirror-runnable, AC-1.8

Five more pnpm-migration fixes across the remaining OK validation cells:

- a11y and playwright: the per-worker dev-server fixtures spawned `bun run dev`,
  but the pnpm-migrated runners have no bun (spawn bun ENOENT), so the dev server
  never booted and every test timed out on "did not become ready". Spawn
  `pnpm run dev` instead (drops bun's --silent; NO_COLOR already quiets output).
- desktop-smoke: the runner image sets ELECTRON_SKIP_BINARY_DOWNLOAD, so
  electron's install.js exits 0 without fetching the runtime binary and
  _electron.launch fails; the packaging steps then skip and the floor gate reds
  "no .app bundle". Clear the skip, force the download, and assert path.txt.
- mirror-runnable (core-tests): core passes 2243 tests, but turbo colorizes the
  vitest summary it wraps, so the guard's /Tests N passed/ regex missed the
  ANSI-wrapped line and reported "tests did not actually run". Strip ANSI in the
  leg output before the shape assertions.
- mirror-runnable (core y-prosemirror): the R13 patch test import.meta.resolves
  y-prosemirror@1.3.7 (a patched dep) alongside @tiptap/y-tiptap; core declared
  neither. Declare y-prosemirror in core + knip ignore.
- lint (AC-1.8 perf gate): the comment-discipline perf gate ran under bun's test
  runner (~1.0-1.2s warm); Node plus vitest roughly doubles it (~2.3s on a loaded
  CI runner), exceeding the 2s budget. Raise warm 2->4s and cold 5->7s.

* fix(open-knowledge): pin Playwright + fix tsx PATH and remaining bun dev-spawns

- lint: check-schema-snapshot-clean.sh called a bare `tsx`, which is not on PATH
  in a plain CI shell under pnpm (bun provided a global shim). Use `pnpm exec tsx`.
- playwright (spawn bun ENOENT): two more per-spec dev-server boots in the
  init-load-byte-stable and single-file-ephemeral private e2e specs still spawned
  `bun run dev`; switch to `pnpm run dev` like the shared fixtures.
- playwright (QA-037 spoken-accelerator aria-label): a fresh pnpm resolution
  floated @playwright/test 1.59.1 to 1.61.1, whose newer Chromium no longer
  derives navigator.platform from a spoofed Mac userAgent. @tiptap/core's
  isMacOS() reads navigator.platform, so the toggle aria-labels flipped to the
  windows/linux accelerator form. Pin Playwright to the bun-resolved 1.59.1.

* fix(open-knowledge): harden electron binary install for desktop-smoke

The step-level empty-string ELECTRON_SKIP_BINARY_DOWNLOAD override did not take
effect on the mac runner (install.js still exited without fetching the binary
and no path.txt was written). Use `env -u` to remove the var entirely for the
node child, rm -rf dist so isInstalled() returns false and re-fetches, and add
set -x plus an echo of the var so a residual skip is diagnosable. desktop-smoke
is an advisory cell (not in the required gate needs).

* fix(open-knowledge): fix playwright browser-cache key + QA-037 platform spoof

The a11y and playwright cells derived their Playwright browser-cache key from
`grep -oE 'playwright@X.Y.Z' pnpm-lock.yaml | head -1`, which matched
@axe-core/playwright@4.12.1 before the real @playwright/test entry. The cache
was keyed on 4.12.1, so a stale entry hit exactly, the browser install was
skipped, and the tests could not find the chromium_headless_shell build for the
actual Playwright version. Anchor the grep on @playwright/test.

Also make QA-037 (spoken-accelerator aria-label) robust: @tiptap/core's
isMacOS() reads navigator.platform, which the describe-level Mac userAgent spoof
does not set, so the assertion depended on the bundled Chromium deriving
platform from the UA. Spoof navigator.platform=MacIntel in the test.

Drop the temporary @playwright/test override; the minimumReleaseAge cooldown
already holds it at the bun-resolved 1.59.1, and the cache-key fix is what makes
the correct chromium install.

* ci: run private-pr-validation on Node 24 for the OK format:check leg

The Monorepo Structural Validation job's `pnpm format:check` fan-out includes
format:check:open-knowledge, which runs OK's lint. The Open Knowledge workspace
now pins engines.node >= 24 with engine-strict (bun to pnpm migration), so on
the job's Node 22 OK's pnpm fails loud with "Expected version: >=24", which
trips concurrently --kill-others-on-fail and SIGTERMs every other format:check
leg. Bump the job to Node 24; the structural guards and actionlint are
Node-agnostic and run fine on 24.

* ci: run ok-marketing validation on Node 24 for the OK-core derive

ok-marketing's build/test hooks run vercel-derive-core-dist.sh, which invokes
pnpm inside the OK subtree (a pnpm workspace pinning engines.node >= 24 with
engine-strict, post bun->pnpm migration). The _subtree-validation reusable and
its composite install action both hardcoded Node 22, so the derive failed with
ERR_PNPM_UNSUPPORTED_ENGINE. Thread a node-version input (default 22) through the
reusable and the composite install action, and have the ok-marketing caller pass
24. Other subtree callers keep the Node 22 default unchanged.

* fix(open-knowledge): add setSystemTime to the bun:test shim

Several app suites (e.g. source-editor-navigation pending-intent expiry) import
`setSystemTime` from bun:test to time-travel the wall clock. The vitest shim did
not re-export it, so those tests failed under the migrated runner. Map bun's
clock-only mock to Vitest fake timers scoped to Date (a no-arg call restores the
real clock, matching bun's reset semantics).

* fix(open-knowledge): green the base test cell under Node 24 + pnpm

The `test` matrix cell surfaced four Node-vs-bun / pnpm-vs-bun gaps the
migration exposed. Each is a runtime/toolchain difference, not a code defect.

- Pin .node-version to 24.18.0. `actions/setup-node` resolved bare `24` to
  24.13.0, which has an fs.rmSync regression that follows the final symlink
  and throws ERR_FS_EISDIR on rmSync(symlink-to-dir, {force}). That broke the
  cli init.test cleanup and the server skill-projection/skill-reconcile
  symlink tests (dangling-link removal). 24.18.0 restores correct behavior;
  verified empirically on both versions.
- Add test.if / it.if to the bun:test shim, aliased to Vitest's runIf. The
  server markdownlint discovery/write suites use bun's test.if(cond) and were
  failing to collect with "test.if is not a function".
- crash-detection: assert no NET uncaughtException listener from
  createCrashDetection rather than an absolute count of zero. The Vitest
  worker installs its own handler, so the baseline is nonzero under the
  runner (it was zero under bun's).
- Add node-pty to pnpm onlyBuiltDependencies. node-pty has no Linux prebuild,
  so its install script must run to compile pty.node from source for the
  Node-runtime pty tests; pnpm gates build scripts by default where bun did
  not. No lockfile change (onlyBuiltDependencies is not lockfile-tracked).

* fix(open-knowledge): clear dirty-shutdown sentinel between QA-011 relaunches

desktop-smoke's QA-011/016 was the last red required cell. Its teardown
SIGKILLs app1 via closeAppBounded (it never sends app.quit()), so app1 never
reaches `will-quit` and markCleanQuit() never clears the boot dirty-shutdown
sentinel. app2 then relaunches on the same userData, detectBootCrash() sees the
stale sentinel, and opens a crash-invite dialog that stacks over the
create-project dialog and intercepts the click on create-advanced-trigger. The
click times out and fails all retries, which cascades to the "no .app bundle"
floor gate (build:mac:unsigned is skipped after the Playwright step fails).

The SIGKILL models a clean close, not a crash, so clear the sentinel between
the two launches. This is a pre-existing latent break from #2571; the migration
PR is simply the first CI run to actually exercise desktop-smoke's relaunch path
(it skips on main merges). Test-only, no product-code change.

* fix(open-knowledge): mirror .npmrc so the export hoists @napi-rs/keyring

desktop-smoke builds and packages the materialized public mirror export. The
migration added public/open-knowledge/.npmrc (public-hoist-pattern for
@napi-rs/keyring* + @parcel/watcher, plus D16 engine-strict) but did not add it
to the copybara manifest, so the export lacked it. Without the hoist, the
export's frozen install leaves @napi-rs/keyring-darwin-arm64 under .pnpm/ rather
than the top-level node_modules where prepare-universal.mjs and
electron-builder.yml's extraResources look. prepare-universal.mjs then aborted
with "@napi-rs/keyring-darwin-arm64 not present ... Run bun install first", so
build:mac:unsigned never ran and the "no .app bundle" floor gate failed.

Add .npmrc to the manifest include[] and regenerate the .bara.sky. The public
repo needs it too (its own DMG packaging hoists the same natives). Verified the
materialized export now contains .npmrc and a source install hoists keyring to
node_modules/@napi-rs/keyring-darwin-arm64.

* fixup! local-review: baseline (pre-review state)

* fix(open-knowledge): pin @codemirror to the bun baseline in pnpm overrides

The migration's editor-stack freeze pins TipTap/ProseMirror/React to their
bun-resolved versions in pnpm-workspace.yaml overrides, but @codemirror/state
(6.6.0) and @codemirror/view (6.43.3) lived only in a top-level `overrides`
block in package.json, which pnpm ignores (it reads pnpm.overrides or the
pnpm-workspace.yaml overrides key). So pnpm floated the source-mode editor core
to 6.7.1 / 6.43.6 within the app's carets, off the bun baseline the freeze is
meant to hold.

Move the two CodeMirror pins into pnpm-workspace.yaml alongside the rest of the
editor graph and regenerate the lockfile (now resolves 6.6.0 / 6.43.3), and
remove the now-inert top-level `overrides` block from package.json
(mdast-util-mdx-jsx there was already declared in pnpm-workspace.yaml). App
typecheck passes against the re-pinned versions.

* chore(open-knowledge): refresh THIRD_PARTY_NOTICES for the codemirror pin

Pinning @codemirror/state 6.7.1 to 6.6.0 and @codemirror/view 6.43.6 to
6.43.3 changed the captured license/homepage text, so the drift-checked
THIRD_PARTY_NOTICES.md (check-notices-clean.sh, run in the lint gate) went
stale. Regenerated via `pnpm run notices`.

* chore(open-knowledge): address local-review minors

Stale-bun sweep: PRECEDENTS.md #13(d)/#26/#47 bun-run invocations corrected to
pnpm with post-remove-bun corrigenda; api-extension.ts event-loop and dev-argv
JSDoc comments corrected to Node; check-monorepo-traps.mjs's stale "5+ bun run
references" justification corrected; comment-discipline-budgets.ts bun-run-check
comment corrected to pnpm.

Changeset: note the two shipped behavioral deltas (sha256 redaction tokens, and
ERR_FS_CP_* mapped to 409) instead of claiming zero runtime behavior change.

md-audit discovery.ts: the root scan-dir read now propagates instead of being
swallowed, so a wrong or inaccessible root can no longer make freshness gates
pass vacuously on an empty scan (subdirectory read failures still swallow).

Dedup the four byte-identical read-biome-config.test-helper.ts copies into
test-support/ and repoint the importers.

* test(open-knowledge): harden the bun:test shim (review Major 2 + Bun.Glob)

The bun:test/Bun.* compatibility shim underwrites the whole flipped ~1,650-test
suite, so add direct behavioral coverage and make its silent fallbacks loud.

- Behavioral tests: test.if (run/skip + falsy coercion), Bun.CryptoHasher
  (known-vector digest + update chaining), setSystemTime (Date frozen, real
  setTimeout intact, no-arg reset restores the wall clock), a cross-directory
  mock.module fixture that genuinely exercises callerFile()/absolutize(), and a
  vitest-version-pinned __vitest_mocker__.queueMock canary that trips if that
  internal moves.
- Bun.Glob facade: add the dot:false dotfile skip in scanSync (Minor 1),
  matching real Bun.Glob and md-audit discovery.ts.
- Observable fallbacks: console.warn on the absolutize()/mockBareSpecifier()
  degraded paths; narrow resolveAny's catch to the ESM-resolver-fallback code
  set, re-throwing genuinely-broken package configs instead of swallowing all.
- Header: reclassify the native-import codemod as tracked Future Work with a
  concrete trigger (before the next Vitest major).

* fix(open-knowledge): repoint the last read-biome-config helper importer

The helper dedup missed one importer whose specifier was
`./lint-plugins/read-biome-config.test-helper.ts` (a packages/server/src test
importing from its own lint-plugins subdir at depth 3, not the depth-4 shape the
other importers used), leaving a dangling import after the file moved to
test-support/. knip flagged it in the lint cell and the server test package
failed to load it in the test cell. Repoint it to
../../../test-support/read-biome-config.test-helper.

GitOrigin-RevId: 9f820ec4591684cbb58fa1bbe366237a56313b89
@inkeep-oss-sync
inkeep-oss-sync Bot requested a review from nick-inkeep as a code owner July 17, 2026 04:39
@inkeep-oss-sync
inkeep-oss-sync Bot merged commit 3910548 into main Jul 17, 2026
@inkeep-oss-sync
inkeep-oss-sync Bot deleted the copybara/sync branch July 17, 2026 04:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant