From f078eb24219fa86c53eae0b917f46923120f41f0 Mon Sep 17 00:00:00 2001 From: deepagent-ai Date: Mon, 28 Sep 2026 01:09:10 +0800 Subject: [PATCH 1/2] fix(deepagent-code): read MCP origin configs via Filesystem, not Bun.file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The desktop node-bundle guard (script/build-node.ts) fails the build on any Bun-only runtime API reachable from the sidecar bundle — the origin-file rewrite from the MCP secret migration used Bun.file, which is fine in the Bun CLI but broke the desktop build on every platform once merged (all desktop-build matrix jobs failed at the renderer build step with "Node server bundle contains Bun-only runtime APIs: Bun.file"). Swap to the Filesystem wrapper (node:fs) the CLI already uses for config file IO. Verified locally with the same build-node.ts guard, package typecheck, and the MCP secret migration tests (11/11). --- packages/deepagent-code/src/mcp/index.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/packages/deepagent-code/src/mcp/index.ts b/packages/deepagent-code/src/mcp/index.ts index 147fc873c..781ebec41 100644 --- a/packages/deepagent-code/src/mcp/index.ts +++ b/packages/deepagent-code/src/mcp/index.ts @@ -37,6 +37,7 @@ import { InstanceState } from "@/effect/instance-state" import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process" import { CrossSpawnSpawner } from "@deepagent-code/core/cross-spawn-spawner" import { applyEdits, modify, parse } from "jsonc-parser" +import { Filesystem } from "@/util/filesystem" const log = Log.create({ service: "mcp" }) const DEFAULT_TIMEOUT = 30_000 @@ -48,16 +49,17 @@ const TolerantListToolsResultSchema = ListToolsResultSchema.extend({ // Replace one server entry in a jsonc config file in place, keeping comments and sibling keys // intact. Returns false when the file is absent or no longer declares that server (raced removal // or a shadowed origin) so the caller can surface that the plaintext may still live there. +// Filesystem (node:fs) rather than Bun.file: this module is also bundled into the desktop's +// Node sidecar, whose build fails on any Bun-only runtime API. export async function rewriteMcpEntry(origin: string, server: string, entry: ConfigMCPV1.Info): Promise { - const file = Bun.file(origin) - if (!(await file.exists())) return false - const text = await file.text() + if (!(await Filesystem.exists(origin))) return false + const text = await Filesystem.readText(origin) const parsed = parse(text) as { mcp?: Record } | undefined if (!parsed || typeof parsed !== "object" || !parsed.mcp || !(server in parsed.mcp)) return false const edits = modify(text, ["mcp", server], structuredClone(entry), { formattingOptions: { tabSize: 2, insertSpaces: true }, }) - await Bun.file(origin).write(applyEdits(text, edits)) + await Filesystem.write(origin, applyEdits(text, edits)) return true } From 156c9b1461b1b64e8aeb12502d6bfd861c0e9598 Mon Sep 17 00:00:00 2001 From: deepagent-ai Date: Mon, 28 Sep 2026 01:12:45 +0800 Subject: [PATCH 2/2] chore(ci): converge all triggers to dev->main merges only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The actions list was dominated by non-build noise: hourly/daily schedules (beta, compliance-close every 30 minutes, docs-update, stats, close-issues, close-prs), PR hygiene bots (pr-routing, pr-standards, pr-management, duplicate-issues), and push-to-dev fan-out firing ~10 workflows per merge. Build and CI workflows (publish, desktop-build, test, typecheck, branding, generate, storybook, nix-*, containers, deploy, docs-locale-sync, release-github-action) now trigger only on push to main — i.e. the dev->main merge — plus manual dispatch. Scheduled and PR-bot workflows keep manual workflow_dispatch only. Untouched: comment-triggered agent workflows (they only run when explicitly invoked), release-event notify, and tag-publishers. Note: PRs no longer run test/typecheck checks; verification happens at the dev->main merge instead. --- .github/workflows/beta.yml | 2 -- .github/workflows/branding-check.yml | 3 +-- .github/workflows/close-issues.yml | 2 -- .github/workflows/close-prs.yml | 2 -- .github/workflows/compliance-close.yml | 3 --- .github/workflows/containers.yml | 2 +- .github/workflows/deploy.yml | 3 +-- .github/workflows/desktop-build.yml | 6 +----- .github/workflows/docs-locale-sync.yml | 2 +- .github/workflows/docs-update.yml | 2 -- .github/workflows/duplicate-issues.yml | 3 +-- .github/workflows/generate.yml | 3 ++- .github/workflows/nix-eval.yml | 4 +--- .github/workflows/nix-hashes.yml | 2 +- .github/workflows/pr-management.yml | 3 +-- .github/workflows/pr-routing.yml | 3 +-- .github/workflows/pr-standards.yml | 3 +-- .github/workflows/publish.yml | 8 +++----- .github/workflows/release-github-action.yml | 2 +- .github/workflows/stats.yml | 4 +--- .github/workflows/storybook.yml | 10 +--------- .github/workflows/test.yml | 3 +-- .github/workflows/typecheck.yml | 6 ++---- 23 files changed, 22 insertions(+), 59 deletions(-) diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml index 35303a25c..a54a8c69f 100644 --- a/.github/workflows/beta.yml +++ b/.github/workflows/beta.yml @@ -2,8 +2,6 @@ name: beta on: workflow_dispatch: - schedule: - - cron: "0 * * * *" jobs: sync: diff --git a/.github/workflows/branding-check.yml b/.github/workflows/branding-check.yml index ea0220bf0..065d23c04 100644 --- a/.github/workflows/branding-check.yml +++ b/.github/workflows/branding-check.yml @@ -4,8 +4,7 @@ on: push: branches: - main - - dev - pull_request: + workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml index b8a2e3f57..e0220add6 100644 --- a/.github/workflows/close-issues.yml +++ b/.github/workflows/close-issues.yml @@ -1,8 +1,6 @@ name: close-issues on: - schedule: - - cron: "0 2 * * *" # Daily at 2:00 AM workflow_dispatch: jobs: diff --git a/.github/workflows/close-prs.yml b/.github/workflows/close-prs.yml index a1e603a88..3131a08d4 100644 --- a/.github/workflows/close-prs.yml +++ b/.github/workflows/close-prs.yml @@ -1,8 +1,6 @@ name: close-prs on: - schedule: - - cron: "0 22 * * *" # Daily at 10:00 PM UTC workflow_dispatch: inputs: dry-run: diff --git a/.github/workflows/compliance-close.yml b/.github/workflows/compliance-close.yml index 14e68701e..aae8ea6ff 100644 --- a/.github/workflows/compliance-close.yml +++ b/.github/workflows/compliance-close.yml @@ -1,9 +1,6 @@ name: compliance-close on: - schedule: - # Run every 30 minutes to check for expired compliance windows - - cron: "*/30 * * * *" workflow_dispatch: permissions: diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml index 15bf07831..a99e8df6b 100644 --- a/.github/workflows/containers.yml +++ b/.github/workflows/containers.yml @@ -3,7 +3,7 @@ name: containers on: push: branches: - - dev + - main paths: - packages/containers/** - .github/workflows/containers.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 73b79b76b..f79098a1b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -3,8 +3,7 @@ name: deploy on: push: branches: - - dev - - production + - main workflow_dispatch: concurrency: ${{ github.workflow }}-${{ github.ref }} diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml index e95d8e742..36217650e 100644 --- a/.github/workflows/desktop-build.yml +++ b/.github/workflows/desktop-build.yml @@ -9,14 +9,10 @@ name: desktop-build # Linux packages are unsigned here. on: + # Only the dev->main merge (push to main); ad-hoc runs via workflow_dispatch. push: branches: - main - # W-01 §2.2.6 trigger extension: exercise the Windows packaging path on - # the dev mainline too (windows targets only, no release publishing — the - # release job stays main-only), so NSIS + Trusted Signing + the packaged - # smoke regress on every dev push instead of only at release time. - - dev workflow_dispatch: inputs: channel: diff --git a/.github/workflows/docs-locale-sync.yml b/.github/workflows/docs-locale-sync.yml index 1a8104959..573c46948 100644 --- a/.github/workflows/docs-locale-sync.yml +++ b/.github/workflows/docs-locale-sync.yml @@ -3,7 +3,7 @@ name: docs-locale-sync on: push: branches: - - dev + - main paths: - packages/web/src/content/docs/*.mdx diff --git a/.github/workflows/docs-update.yml b/.github/workflows/docs-update.yml index ffc95c840..8d0702b65 100644 --- a/.github/workflows/docs-update.yml +++ b/.github/workflows/docs-update.yml @@ -1,8 +1,6 @@ name: docs-update on: - schedule: - - cron: "0 */12 * * *" workflow_dispatch: env: diff --git a/.github/workflows/duplicate-issues.yml b/.github/workflows/duplicate-issues.yml index 7ee900bc0..5cbcc39ae 100644 --- a/.github/workflows/duplicate-issues.yml +++ b/.github/workflows/duplicate-issues.yml @@ -1,8 +1,7 @@ name: duplicate-issues on: - issues: - types: [opened, edited] + workflow_dispatch: jobs: check-duplicates: diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml index 18baa4fc9..c90614d9f 100644 --- a/.github/workflows/generate.yml +++ b/.github/workflows/generate.yml @@ -3,7 +3,8 @@ name: generate on: push: branches: - - dev + - main + workflow_dispatch: jobs: generate: diff --git a/.github/workflows/nix-eval.yml b/.github/workflows/nix-eval.yml index f2402ab40..c989b6eb8 100644 --- a/.github/workflows/nix-eval.yml +++ b/.github/workflows/nix-eval.yml @@ -2,9 +2,7 @@ name: nix-eval on: push: - branches: [dev] - pull_request: - branches: [dev] + branches: [main] workflow_dispatch: concurrency: diff --git a/.github/workflows/nix-hashes.yml b/.github/workflows/nix-hashes.yml index 0e13462ae..2ff8285bd 100644 --- a/.github/workflows/nix-hashes.yml +++ b/.github/workflows/nix-hashes.yml @@ -6,7 +6,7 @@ permissions: on: workflow_dispatch: push: - branches: [dev, beta] + branches: [main] paths: - "bun.lock" - "package.json" diff --git a/.github/workflows/pr-management.yml b/.github/workflows/pr-management.yml index d96fe905a..26c3218ce 100644 --- a/.github/workflows/pr-management.yml +++ b/.github/workflows/pr-management.yml @@ -1,8 +1,7 @@ name: pr-management on: - pull_request_target: - types: [opened] + workflow_dispatch: jobs: add-contributor-label: diff --git a/.github/workflows/pr-routing.yml b/.github/workflows/pr-routing.yml index 0791d334f..eb0e591cd 100644 --- a/.github/workflows/pr-routing.yml +++ b/.github/workflows/pr-routing.yml @@ -1,8 +1,7 @@ name: pr-routing on: - pull_request_target: - types: [opened, reopened, edited, synchronize, ready_for_review] + workflow_dispatch: permissions: contents: read diff --git a/.github/workflows/pr-standards.yml b/.github/workflows/pr-standards.yml index 2faf3a478..0a39250b2 100644 --- a/.github/workflows/pr-standards.yml +++ b/.github/workflows/pr-standards.yml @@ -1,8 +1,7 @@ name: pr-standards on: - pull_request_target: - types: [opened, edited, synchronize] + workflow_dispatch: jobs: check-standards: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 96ee12779..51314b732 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -2,13 +2,11 @@ name: publish run-name: "${{ format('release {0}', inputs.bump) }}" on: + # Only the dev->main merge (push to main) builds; releases themselves are + # workflow_dispatch with an explicit version. push: branches: - - ci - - dev - - beta - - fix/npm-native-binary-install - - snapshot-* + - main workflow_dispatch: inputs: bump: diff --git a/.github/workflows/release-github-action.yml b/.github/workflows/release-github-action.yml index 833c13331..6ca535d85 100644 --- a/.github/workflows/release-github-action.yml +++ b/.github/workflows/release-github-action.yml @@ -3,7 +3,7 @@ name: release-github-action on: push: branches: - - dev + - main paths: - "github/**" diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml index ba8557288..e35c4a677 100644 --- a/.github/workflows/stats.yml +++ b/.github/workflows/stats.yml @@ -1,9 +1,7 @@ name: stats on: - schedule: - - cron: "0 12 * * *" # Run daily at 12:00 UTC - workflow_dispatch: # Allow manual trigger + workflow_dispatch: concurrency: ${{ github.workflow }}-${{ github.ref }} diff --git a/.github/workflows/storybook.yml b/.github/workflows/storybook.yml index 1e652104d..ddea0c282 100644 --- a/.github/workflows/storybook.yml +++ b/.github/workflows/storybook.yml @@ -2,15 +2,7 @@ name: storybook on: push: - branches: [dev] - paths: - - ".github/workflows/storybook.yml" - - "package.json" - - "bun.lock" - - "packages/storybook/**" - - "packages/ui/**" - pull_request: - branches: [dev] + branches: [main] paths: - ".github/workflows/storybook.yml" - "package.json" diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 29e8034a0..ce658d5a5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -3,8 +3,7 @@ name: test on: push: branches: - - dev - pull_request: + - main workflow_dispatch: concurrency: diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml index 03128b4db..9a696aa35 100644 --- a/.github/workflows/typecheck.yml +++ b/.github/workflows/typecheck.yml @@ -2,10 +2,8 @@ name: typecheck on: push: - branches: [dev] - # Gate every PR regardless of target branch: the typecheck baseline is easily polluted by stale - # worktrees/generated files, so keep it required and branch-agnostic. - pull_request: + branches: + - main workflow_dispatch: jobs: