ci(release): gate the Surface ./signals subpath (follow-up to #677) by miyaontherelay · Pull Request #680 · AgentWorkforce/flows

miyaontherelay · 2026-10-19T10:41:26Z

Follow-up to #677, kept separate because flows AGENTS.md says never edit a gate that judges your own work (Capy's finding on #677).

scripts/pack-release.mjs requires dist/signals.js and dist/signals.d.ts in the Surface tarball.
scripts/surface-package-gate.sh checks that @relayflows/surface/signals resolves from the packed tarball and imports only Node built-ins.

These are the exact gate edits that were removed from #677 at da059aa; the implementation they check is already on main.

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Note

Low Risk
Changes only affect release/pack validation scripts and tests; no runtime product behavior is modified.

Overview
Release CI now enforces that the @relayflows/surface tarball ships and self-containedly exposes the hosted signal helper added in #677.

pack-release.mjs treats dist/signals.js and dist/signals.d.ts as required Surface artifacts alongside the existing runtime outputs. publish.test.mjs asserts packing fails until those files exist.

surface-package-gate.sh gains a packed-tarball check that @relayflows/surface/signals resolves, imports only node: built-ins, uses hosted env defaults for waitForSignal, and rejects invalid signal names. The TypeScript consumer fixture also imports the signals API so types resolve from the packed package.

^{Reviewed by Cursor Bugbot for commit d76ac93. Bugbot is set up for automated code reviews on this repo. Configure here.}

Agent Relay sessions

claude session 28cd20e0 · opened via gh pr create · last active 2026-10-19

Follow-up to #677 (kept separate per AGENTS.md: never edit a gate that judges your own work). pack-release.mjs requires dist/signals.js and dist/signals.d.ts in the Surface tarball, and surface-package-gate.sh checks the subpath resolves from the packed tarball and imports only Node built-ins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

greptile-apps

miyaontherelay has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

coderabbitai · 2026-10-19T10:41:34Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: f3e25b78-f061-4b37-bc74-1613c8c937b8

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

capy-ai

Capy found 1 potential issue (1 medium).

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 905ac31. Configure here.}

The release test now asserts packing fails without dist/signals.js and succeeds once the hosted signal helper files are present. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

capy-ai · 2026-10-21T04:15:01Z

Capy couldn't review this pull request because Agent Relay is out of credits, add credits or enable auto-reload to resume automatic reviews.

greptile-apps · 2026-10-21T04:17:54Z

Confidence Score: 4/5

[High impact] Release packaging now requires signal helper files.

The PR appears safe to merge, with two non-blocking improvements to the new gate.

Findings

Bare imports escape the gate ▶
Local settings fail the gate ▶

Fix with agent prompt

### Issue 1
scripts/surface-package-gate.sh:122
The regex skips imports such as `import "ai-hist";` because it requires either `from` or `import(...)`. The existing `node:timers/promises` import keeps `specifiers` nonempty, so adding that dependency would still pass. The packed consumer installs dependencies, so loading the module would not catch it either.

Include side-effect imports in the check and add a test that rejects one.

### Issue 2
scripts/surface-package-gate.sh:112-113
If the shell has `FLOWS_CLOUD_URL` set to another endpoint, `waitForSignal` uses it, but this smoke test always expects the production URL. That makes a correct package fail the gate.

Unset `FLOWS_CLOUD_URL` for this Node process so the test actually checks the fallback.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds release checks for the existing @relayflows/surface/signals subpath.

Surface release checks now require and exercise the signals subpath.

_{Reviews (1) · Last reviewed commit: "Mirror the signals tarball requirement i..." · Reviewed by Greptile}

greptile-apps · 2026-10-21T04:17:57Z

+const entry = require.resolve('@relayflows/surface/signals');
+// Statement-level only: the module's doc comment shows an example import.
+const specifiers = [...readFileSync(entry, 'utf8')
+  .matchAll(/^\s*(?:import|export)\b[^;]*?\bfrom\s+["']([^"']+)["']|\bimport\s*\(\s*["']([^"']+)["']/gm)]


Bare imports escape the gate

The regex skips imports such as import "ai-hist"; because it requires either from or import(...). The existing node:timers/promises import keeps specifiers nonempty, so adding that dependency would still pass. The packed consumer installs dependencies, so loading the module would not catch it either.

Include side-effect imports in the check and add a test that rejects one.

Prompt To Fix With AI

This is a comment left during a code review. Path: scripts/surface-package-gate.sh Line: 122 Comment: **Bare imports escape the gate** The regex skips imports such as `import "ai-hist";` because it requires either `from` or `import(...)`. The existing `node:timers/promises` import keeps `specifiers` nonempty, so adding that dependency would still pass. The packed consumer installs dependencies, so loading the module would not catch it either. Include side-effect imports in the check and add a test that rejects one. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-21T04:17:57Z

+RELAYFLOW_V2_CLOUD_RUN_ID=packed-run RELAYFLOW_V2_SIGNAL_READ_TOKEN=packed-read RELAYFLOW_RUN_ID=engine-run \
+  node --input-type=module - <<'NODE'


Local settings fail the gate

If the shell has FLOWS_CLOUD_URL set to another endpoint, waitForSignal uses it, but this smoke test always expects the production URL. That makes a correct package fail the gate.

Unset FLOWS_CLOUD_URL for this Node process so the test actually checks the fallback.

Prompt To Fix With AI

This is a comment left during a code review. Path: scripts/surface-package-gate.sh Line: 112-113 Comment: **Local settings fail the gate** If the shell has `FLOWS_CLOUD_URL` set to another endpoint, `waitForSignal` uses it, but this smoke test always expects the production URL. That makes a correct package fail the gate. Unset `FLOWS_CLOUD_URL` for this Node process so the test actually checks the fallback. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps Bot reviewed Oct 19, 2026

View reviewed changes

capy-ai Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread scripts/pack-release.mjs

cursor Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread scripts/pack-release.mjs

Mirror the signals tarball requirement in the publish test fixture

d76ac93

The release test now asserts packing fails without dist/signals.js and succeeds once the hosted signal helper files are present. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

greptile-apps Bot reviewed Oct 21, 2026

View reviewed changes

Navigation Menu

Repository navigation

ci(release): gate the Surface ./signals subpath (follow-up to #677) - #680

ci(release): gate the Surface ./signals subpath (follow-up to #677)#680
miyaontherelay wants to merge 2 commits into
mainfrom
ms-lead/surface-signals-gates

miyaontherelay commented Oct 19, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot left a comment

Uh oh!

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

capy-ai Bot left a comment

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

capy-ai Bot commented Oct 21, 2026

Uh oh!

greptile-apps Bot commented Oct 21, 2026 •

edited

Loading

Summary

Uh oh!

greptile-apps Bot Oct 21, 2026

Uh oh!

greptile-apps Bot Oct 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		RELAYFLOW_V2_CLOUD_RUN_ID=packed-run RELAYFLOW_V2_SIGNAL_READ_TOKEN=packed-read RELAYFLOW_RUN_ID=engine-run \
		node --input-type=module - <<'NODE'

Conversation

miyaontherelay commented Oct 19, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

capy-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

capy-ai Bot commented Oct 21, 2026

Uh oh!

greptile-apps Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

greptile-apps Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

miyaontherelay commented Oct 19, 2026 •

edited by cursor Bot

Loading

coderabbitai Bot commented Oct 19, 2026 •

edited

Loading

greptile-apps Bot commented Oct 21, 2026 •

edited

Loading