✨ feat: runtime, env, and headers for site scripts#14
Conversation
- Add EnvDef/Env to script Meta with ValidateEnv and ResolveHeaders - Add runtime-based engine routing (http → QuickJS, browser → Browser) - Inject resolved headers into QuickJS fetch and Browser CDP - Update CLI info/list commands to display runtime/env/headers - Add full metadata to exa/search sample script
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
tap | 832d2cc | May 12 2026, 04:08 AM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5861896d6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return script.NewRegistry( | ||
| script.Source{Path: cacheDir, Type: script.ScriptSourceCache}, | ||
| script.Source{FS: sites.FS, Type: script.ScriptSourceBuiltin}, | ||
| script.Source{Path: overrideDir, Type: script.ScriptSourceOverride}, |
There was a problem hiding this comment.
DefaultRegistry always injects sites.FS, so callers cannot construct a registry from only one filesystem path. In cmd/tap/main.go, --local-only sets WithSitesDir(localOverrideDir) specifically to expose only local override scripts, but this change now still loads embedded scripts as well, violating the flag’s documented behavior and causing site list/script resolution to include non-local entries.
Useful? React with 👍 / 👎.
- Narrow embed pattern to */*.js (exclude markdown files from binary) - Remove lightpanda from runtime routing (needs --lightpanda CLI flag) - Sort ValidateEnv error output for deterministic messages - Fix siteInfoCmd formatting consistency (spacing, no header masking)
Sync script now accepts multiple directories; later dirs override earlier ones by script name, matching the CLI registry priority.
- Add lightpanda as explicit browser runtime instead of falling through - forceBrowser now returns only browser engines, not the full list - Mask env-interpolated header values in site info output - Fix const alignment in ScriptSource block
- Add twitter/{getxapi-tweet-detail,getxapi-article,post-tweet} scripts
- Fix auth bug: remove redundant authorization header from fetch() calls;
meta headers are injected automatically by the engine
- Add field-level godoc to Meta struct in script/parser.go
- Add sites/CLAUDE.md explaining script structure and key rules
1 participant
Summary
Adds per-script metadata for declaring execution environment, environment variable dependencies, and HTTP headers. This enables:
runtime: "http")headers: {"X-API-Key": "${EXA_API_KEY}"})Phases implemented
Phase 1 — Type changes and env validation
EnvDefstruct (mirrorsArgDef) andEnv map[string]EnvDeftoMetaValidateEnv()— checks required env vars are set, lists all missingResolveHeaders()— interpolates${ENV_VAR}viaos.LookupEnv, skips headers with unset optional varsValidateEnv()intoClient.RunScriptbefore engine dispatchPhase 2 — Runtime routing
enginesByRuntime()onClient— filters engine list by script-declared runtime"http"→ QuickJS only,"browser"/"lightpanda"→ Browser only,"auto"/""→ fallback chainforceBrowseruser override (all runtimes return browser-only)Phase 3 — Header injection in engines
RunOpts{Headers}struct; changedEngine.Runsignature to accept itQuickJS.injectFetch: meta headers set first, JS-level headers override themtransport.BrowseEvalWithPause: injectsnetwork.SetExtraHTTPHeadersbeforeNavigatewhen headers are non-emptyClient.RunScriptresolves headers vias.Meta.ResolveHeaders()and passes them asRunOpts.HeadersPhase 4 — CLI display and sample script
site infoshows Runtime, Env (with required/optional badges), and Headers (masked)site listshows runtime badges (e.g.,[http]) after descriptionssites/exa/search.jswithruntime: "http", optionalEXA_API_KEY, andX-API-KeyheaderDeferred (not in this PR)
authRequiredcookie store checkVerification
mise run test— all packages passmise run lint— 0 issues