Repository navigation
ruvbot 0.3.6: fix ESM import; web UI sends the API key - #1356
Merged
Merged
Conversation
ESM: `import('ruvbot')` failed in 0.3.4/0.3.5 for two reasons. dist/esm had
no package.json with {"type":"module"} (the package root is CommonJS), and
src/core/index.ts and src/integration/index.ts used directory re-exports
('./agent', './slack', ...) that tsc's "bundler" resolution accepts but Node
ESM rejects ("Directory import ... is not supported"). The re-exports now
name '/index.js', and scripts/fix-esm.js runs after build:esm: it writes
dist/esm/package.json and fails the build if any relative ESM specifier does
not resolve to a file.
UI: when RUVBOT_API_KEY is set, /api/* needs "Authorization: Bearer <key>",
which the bundled chat UI never sent. Its /api calls now go through a small
client that, on a 401, asks for the key once, keeps it in sessionStorage and
sends it as a Bearer header (never in a URL). With no key set server-side
the UI behaves as before.
Tests: tests/integration/package/pack-exports.test.ts packs the tarball,
installs it in a scratch project and loads ruvbot, ./core, ./learning,
./integrations/slack and ./integrations/webhooks through require() and
import(). tests/unit/api/ui-api-client.test.ts runs the UI client from the
shipped index.html against a fake server.
Co-Authored-By: claude-flow <ruv@ruv.net>
build:esm now runs scripts/fix-esm.js, so the builder stage copies it. npm ci needs --legacy-peer-deps (vitest 4 vs @vitest/coverage-v8 3 peer range), and a .dockerignore keeps node_modules/dist out of the context. Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
import('ruvbot')threw in 0.3.4/0.3.5 (requireworked). Two causes:dist/esmhad nopackage.jsonwith{"type":"module"}(the package root is CommonJS), andsrc/core/index.ts/src/integration/index.tsre-exported directories ('./agent','./slack', …). tsc'sbundlerresolution allows that, but Node ESM rejects it ("Directory import … is not supported"). The re-exports now point at/index.js. A new post-build step,scripts/fix-esm.js, writesdist/esm/package.jsonand fails the build if any relative ESM specifier doesn't resolve to a file.RUVBOT_API_KEY. Since 0.3.4,/api/*requiresAuthorization: Bearer <key>when the key is set, and the bundled chat UI never sent it. Its/apicalls now go through a small client. On a 401 it asks for the key once, keeps it insessionStorageand sends it as a Bearer header. The key never goes in a URL, and there is no EventSource. With no key set on the server, the UI works as before.Tests
tests/integration/package/pack-exports.test.tsbuilds the package, runsnpm pack, installs the tarball into a scratch project, and loadsruvbot,ruvbot/core,ruvbot/learning,ruvbot/integrations/slackandruvbot/integrations/webhooksthrough bothrequire()andimport(). It also checks that the ESM and CJS roots export the same runtime keys. It fails on the 0.3.5 build and passes with this change.tests/unit/api/ui-api-client.test.ts(9 tests) pulls the client out of the shippedindex.htmland runs it against a fake server. It covers the header being attached, prompting once then reusing the key, the key never appearing in a URL, a single shared prompt for concurrent 401s, cancelling, re-prompting after a rejected key, no-op behaviour with no key, and that no barefetch('/api…')calls remain.main(byzantine-consensus, bm25, hybrid-search, plugin-manager IPFS, wasm bindings); none are related to this change.tsc --noEmitpasses.Tarball
Compared with
ruvbot@0.3.5, the only added files aredist/esm/package.jsonandscripts/fix-esm.js. Nothing was removed.🤖 Generated with claude-flow