One-shot security scan of existing codebase

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "changelog": [
+    "@changesets/changelog-github",
+    { "repo": "cloudflare/agents" }
+  ],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "minor",
+  "ignore": ["@cloudflare/agents-*"],
+  "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
+    "onlyUpdatePeerDependentsWhenOutOfRange": true
+  }
+}

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,30 @@
+---
+name: Bug report
+about: Create a report to help us improve Agents SDK
+title: ""
+labels: ""
+assignees: ""
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Version:**
+What version of Agents SDK are you having issues with.
+
+**Additional context**
+Add any other context about the problem here.

.github/changeset-publish.ts

@@ -0,0 +1,8 @@
+import { execSync } from "node:child_process";
+
+execSync("npx tsx ./.github/resolve-workspace-versions.ts", {
+  stdio: "inherit"
+});
+execSync("npx changeset publish", {
+  stdio: "inherit"
+});

.github/changeset-version.ts

@@ -0,0 +1,13 @@
+import { execSync } from "node:child_process";
+
+// This script is used by the `release.yml` workflow to update the version of the packages being released.
+// The standard step is only to run `changeset version` but this does not update the package-lock.json file.
+// So we also run `npm install`, which does this update.
+// This is a workaround until this is handled automatically by `changeset version`.
+// See https://github.com/changesets/changesets/issues/421.
+execSync("npx changeset version", {
+  stdio: "inherit"
+});
+execSync("npm install", {
+  stdio: "inherit"
+});

.github/resolve-workspace-versions.ts

@@ -0,0 +1,89 @@
+// this looks for all package.jsons in /packages/**/package.json
+// and replaces it with the actual version ids
+
+import * as fs from "node:fs";
+import fg from "fast-glob";
+
+// we do this in 2 passes
+// first let's cycle through all packages and get thier version numbers
+
+/**
+ * Minimal interface for the subset of package.json fields this script reads
+ * and writes. The index signature allows dynamic access to dependency fields
+ * while the explicit properties give type-safe access to name/version.
+ */
+interface PackageJson {
+  name: string;
+  version: string;
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  [key: string]: unknown;
+}
+
+const packageJsons: Record<string, { file: string; packageJson: PackageJson }> =
+  {};
+
+for await (const file of await fg.glob(
+  "./(packages|examples|guides)/*/package.json"
+)) {
+  let packageJson: PackageJson;
+  try {
+    packageJson = JSON.parse(fs.readFileSync(file, "utf8")) as PackageJson;
+  } catch (err) {
+    console.error(`Failed to parse ${file}:`, err);
+    continue;
+  }
+  packageJsons[packageJson.name] = {
+    file,
+    packageJson
+  };
+}
+
+// then we'll revisit them, and replace any "workspace:*" references
+// with "^(actual version)"
+
+for (const [packageName, { file, packageJson }] of Object.entries(
+  packageJsons
+)) {
+  let changed = false;
+  const depFields = [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+  ] as const;
+  for (const field of depFields) {
+    const deps = packageJson[field];
+    if (!deps) continue;
+    for (const [dependencyName, currentRange] of Object.entries(deps)) {
+      if (dependencyName in packageJsons) {
+        // For peerDependencies, preserve intentionally wide ranges.
+        // Only rewrite workspace:* references or exact caret ranges
+        // that match the previous version (i.e. changesets-managed).
+        if (
+          field === "peerDependencies" &&
+          !currentRange.startsWith("workspace:") &&
+          !currentRange.startsWith("^")
+        ) {
+          continue;
+        }
+
+        let actualVersion = packageJsons[dependencyName].packageJson.version;
+        if (!actualVersion.startsWith("0.0.0-")) {
+          actualVersion = `^${actualVersion}`;
+        }
+
+        console.log(
+          `${packageName}: setting ${field}.${dependencyName} to ${actualVersion}`
+        );
+        deps[dependencyName] = actualVersion;
+        changed = true;
+      }
+    }
+  }
+  if (changed) {
+    fs.writeFileSync(file, `${JSON.stringify(packageJson, null, 2)}\n`);
+  }
+}

.github/version-script.ts

@@ -0,0 +1,27 @@
+import * as fs from "node:fs";
+import { execSync } from "node:child_process";
+async function main() {
+  try {
+    console.log("Getting current git hash...");
+    const stdout = execSync("git rev-parse --short HEAD").toString();
+    console.log("Git hash:", stdout.trim());
+
+    for (const path of [
+      "./packages/agents/package.json",
+      "./packages/hono-agents/package.json"
+    ]) {
+      const packageJson = JSON.parse(fs.readFileSync(path, "utf-8"));
+      packageJson.version = `0.0.0-${stdout.trim()}`;
+      fs.writeFileSync(path, `${JSON.stringify(packageJson, null, 2)}\n`);
+    }
+  } catch (error) {
+    console.error(error);
+    process.exit(1);
+  }
+}
+
+main().catch((err) => {
+  // Build failures should fail
+  console.error(err);
+  process.exit(1);
+});

.github/workflows/bonk.yml

@@ -0,0 +1,34 @@
+name: Bonk
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  bonk:
+    if: github.event.sender.type != 'Bot'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: false
+    permissions:
+      id-token: write
+      issues: write
+      pull-requests: write
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run Bonk
+        uses: ask-bonk/ask-bonk/github@main
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_AI_GATEWAY_ACCOUNT_ID }}
+          CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }}
+        with:
+          model: "cloudflare-ai-gateway/anthropic/claude-opus-4-6"
+          mentions: "/bonk,@ask-bonk"

.github/workflows/nightly.yml

@@ -0,0 +1,76 @@
+name: Nightly E2E
+
+on:
+  schedule:
+    # Every day at midnight UTC
+    - cron: "0 0 * * *"
+  # Allow manual trigger for debugging
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  e2e-ai-chat:
+    name: "E2E: ai-chat (Playwright)"
+    timeout-minutes: 15
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - run: npm ci
+      - run: npm run build
+
+      - name: Get Playwright version
+        id: playwright-version
+        run: echo "version=$(jq -r '.packages["node_modules/playwright"].version' package-lock.json)" >> $GITHUB_OUTPUT
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Run ai-chat e2e tests
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: npx playwright test --config e2e/playwright.config.ts
+        working-directory: packages/ai-chat
+
+  e2e-think:
+    name: "E2E: think (chat recovery)"
+    timeout-minutes: 10
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - run: npm ci
+      - run: npm run build
+
+      - name: Run think e2e tests
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: npm run test:e2e
+        working-directory: packages/think

.github/workflows/pullrequest.yml

@@ -0,0 +1,61 @@
+name: Pull Request
+
+on:
+  pull_request:
+    paths-ignore:
+      - "docs/**"
+      - "design/**"
+      - "*.md"
+      - ".changeset/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+
+jobs:
+  ci:
+    timeout-minutes: 20
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Cache Nx
+        uses: actions/cache@v5
+        with:
+          path: .nx/cache
+          key: ${{ runner.os }}-nx-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-nx-${{ hashFiles('package-lock.json') }}-
+            ${{ runner.os }}-nx-
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm run check
+
+      - name: Get Playwright version
+        id: playwright-version
+        run: echo "version=$(jq -r '.packages["node_modules/playwright"].version' package-lock.json)" >> $GITHUB_OUTPUT
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - run: CI=true npx nx run-many -t test
+      - run: npx pkg-pr-new publish --peerDeps ./packages/*