Skip to content

feat: markdown-it transcript, pierre diffs, oxlint, vitest lanes, adrs - #11

Merged
johnnyhuy merged 5 commits into
mainfrom
feat/markdown-it-pierre-diffs-tests
Jul 19, 2026
Merged

feat: markdown-it transcript, pierre diffs, oxlint, vitest lanes, adrs#11
johnnyhuy merged 5 commits into
mainfrom
feat/markdown-it-pierre-diffs-tests

Conversation

@johnnyhuy

Copy link
Copy Markdown
Contributor

Summary

  • Swap marked + DOMPurify for markdown-it (safe by default) for the agent transcript renderer
  • Add @pierre/diffs as the diff engine, wired into a Fig. 02 probe in the empty state
  • Set up three Vitest lanes (unit, integration, e2e) plus oxlint with correctness-as-error
  • Split CI into lint / typecheck / unit / integration / build jobs; add macos-only e2e.yml
  • Record nine architecture decisions in docs/adr/ and index them in docs/adr/README.md
  • Add three agent skills under ~/.agents/skills/: openpi-test, openpi-adr, openpi-release

Test plan

  • Unit: bun run test:unit — 26 tests
  • Integration: bun run test:integration — 8 tests
  • E2E: bun run test:e2e on macos
  • Lint: bun run lint
  • Typecheck: bun run typecheck (renderer+tests, main, preload)
  • Build: mise run build (runs lint → typecheck → unit → integration → build)

Consequences

  • Drops DOMPurify dependency, smaller bundle
  • Shiki language packs inflate the bundle (~1MB); to be code-split later
  • Bundle warning expected for > 500 kB chunk until Shiki languages are lazy-loaded
  • E2E requires pi runtime on PATH; CI installs @earendil-works/pi-coding-agent for macos runners

ADRs

0001 markdown-it, 0002 pierre-diffs, 0003 pretext-measurement, 0004 three-lane-testing, 0005 oxlint, 0006 pi-runtime-rpc, 0007 native-tab-bar, 0008 pi-dev-design-system, 0009 calver-releases.

Replace marked + DOMPurify with markdown-it (safe by default) for the
agent transcript renderer. Add @pierre/diffs as the diff engine wired
into a Fig. 02 probe in the empty state, with a tiny LCS unified-patch
generator so the React API is <PierreDiff oldFile newFile>.

Set up three Vitest lanes: unit (node, timeline + sessions parser),
integration (jsdom + RTL, Markdown component), and e2e (Playwright
Electron, mac only via workflow_dispatch). Add oxlint with correctness
as error and the rest allowed. Split ci.yml into lint / typecheck /
unit / integration / build jobs; add e2e.yml for the macos-only lane.

Record nine architecture decisions under docs/adr/, indexed in a
README. Includes three new agent skills under ~/.agents/skills/ for
test lanes, ADRs, and the calver release flow.

Co-authored-by: opencode-agent <hello@sst.dev>
@socket-security

socket-security Bot commented Jul 19, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Jul 19, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm css-tree is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/jsdom@29.1.1npm/css-tree@3.2.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm data-urls is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/jsdom@29.1.1npm/data-urls@7.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@7.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/jsdom@29.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.jsonnpm/jsdom@29.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Comment thread .github/workflows/ci.yml
Comment on lines +10 to +20
name: oxlint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
with:
install: true
- run: bun install --frozen-lockfile
- run: bun run lint

typecheck:
Comment thread .github/workflows/ci.yml
Comment on lines +21 to +31
name: typecheck
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
with:
install: true
- run: bun install --frozen-lockfile
- run: bun run typecheck

unit:
Comment thread .github/workflows/ci.yml
Comment on lines +32 to +42
name: unit tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
with:
install: true
- run: bun install --frozen-lockfile
- run: bun run test:unit

integration:
Comment thread .github/workflows/ci.yml
Comment on lines 54 to +65
@@ -15,3 +60,11 @@ jobs:
install: true
- run: bun install --frozen-lockfile
- run: mise run build

all:
name: all checks pass
Comment thread .github/workflows/ci.yml Outdated
Comment thread .github/workflows/e2e.yml Fixed
johnnyhuy and others added 2 commits July 20, 2026 09:25
vitest's --project flag filters by name from the projects[] array in
the loaded config; since vitest.e2e.config.ts is a separate file (not
listed as a project in vitest.config.ts), --project e2e finds nothing.
Switch to --config vitest.e2e.config.ts.

Co-authored-by: opencode-agent <hello@sst.dev>
The e2e tests assume the renderer is reachable on localhost:5173
(isDev path in main/index.ts). Build the renderer, start vite in the
background, wait for it, then run the e2e lane.

Co-authored-by: opencode-agent <hello@sst.dev>
Comment thread .github/workflows/e2e.yml
Comment on lines +9 to +34
name: electron e2e
runs-on: macos-latest
env:
NODE_ENV: development
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
with:
install: true
- run: bun install --frozen-lockfile
- run: npm install -g @earendil-works/pi-coding-agent
- run: bunx tsc -p tsconfig.main.json
- run: bunx tsc -p tsconfig.preload.json
- run: bunx vite build
- run: mise run dev:vite &
- run: bunx wait-on http://localhost:5173
- run: mise run test:e2e
- name: upload test artefacts
if: always()
uses: actions/upload-artifact@v4
with:
name: openpi-e2e
path: |
/tmp/pidex-*.png
test-results/
if-no-files-found: ignore No newline at end of file
johnnyhuy and others added 2 commits July 20, 2026 09:30
macos github runners install globally under /usr/local/bin (not
/opt/homebrew/bin where Homebrew would put it). Add the additional
candidates so spawn finds pi after npm install -g.

Co-authored-by: opencode-agent <hello@sst.dev>
The macos github runner has no ~/.pi sessions to import, so the
workspaces list is empty and no auto-opened first session tab exists.
Trim the e2e lane to assertions that don't require fixture data:
renderer shell mounts, document scroll is locked, preload bridge
exposes versions, and no white button borders leak.

Co-authored-by: opencode-agent <hello@sst.dev>
@johnnyhuy
johnnyhuy merged commit 449e515 into main Jul 19, 2026
13 checks passed
@johnnyhuy
johnnyhuy deleted the feat/markdown-it-pierre-diffs-tests branch July 19, 2026 23:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants