Skip to content

Fix/setup script#37

Merged
djanogly merged 4 commits intodevfrom
fix/setup-script
Apr 24, 2026
Merged

Fix/setup script#37
djanogly merged 4 commits intodevfrom
fix/setup-script

Conversation

@djanogly
Copy link
Copy Markdown
Contributor

This pull request significantly improves the developer onboarding experience and documentation for setting up and configuring Opencom, both for local development and self-hosting. The changes clarify and streamline the quick start process, update environment variable handling for Convex Auth, and enhance the .env.example files across all apps. The documentation now emphasizes a one-command bootstrap script, provides clearer manual setup steps, and details new environment variable requirements for Convex Auth integration.

Onboarding and Setup Improvements:

  • The README.md and setup docs now emphasize the use of the ./scripts/setup.sh bootstrap script, which automates dependency installation, Convex deployment configuration, Convex Auth setup, workspace creation, and .env.local file generation. The process is more robust, non-destructive to unrelated env keys, and supports rerun flags for reconfiguration or workspace creation. [1] [2] [3] [4] [5] [6]

  • Manual setup instructions are improved, clarifying when and how to use them, and providing step-by-step commands for Convex Auth configuration and environment propagation. [1] [2] [3]

Convex Auth and Environment Variable Updates:

  • Environment variable names and requirements are updated throughout the documentation and example files to use JWT_PRIVATE_KEY and JWKS for Convex Auth JWT signing and verification, replacing the legacy AUTH_SECRET. The docs now clearly distinguish between required and optional variables for different features (e.g., email, test data). [1] [2] [3]

  • The .env.example files for all apps (web, widget, mobile, landing) are updated to reflect the new variable names, clarify which are auto-filled by setup scripts, and provide better guidance for manual configuration. [1] [2] [3] [4]

Developer Experience Enhancements:

  • The docs introduce a disposable container "smoke path" for testing setup flows in a clean environment, and provide troubleshooting tips for common setup issues. [1] [2]

  • The setup scripts now preserve unrelated keys and comments in .env.local files, reducing friction for developers with custom configurations.

Summary of Most Important Changes:

1. Onboarding & Setup Automation

  • Emphasized and improved the ./scripts/setup.sh bootstrap script for one-command setup, including dependency install, Convex deployment, Convex Auth, workspace creation, and .env.local management. Added rerun flags and clarified prerequisites. [1] [2] [3] [4]
  • Improved manual setup instructions with explicit steps for Convex Auth configuration and environment propagation. [1] [2] [3]

2. Convex Auth Integration & Env Vars

  • Updated all documentation and example files to use JWT_PRIVATE_KEY and JWKS for Convex Auth JWT signing/verification, replacing AUTH_SECRET. Clarified which variables are required for which features and deployments. [1] [2] [3]
  • Updated backend, web, mobile, and widget .env.example files to match the new variable names and provide setup guidance. [1] [2] [3] [4]

3. Developer Experience & Troubleshooting

  • Enhanced .env.local management to preserve unrelated keys/comments on rerun, and added troubleshooting and smoke-testing instructions for disposable environments. [1] [2] [3]

These changes make Opencom significantly easier to set up, configure, and maintain for both new and advanced users.

@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 24, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
opencom-landing Ready Ready Preview, Comment Apr 24, 2026 11:29pm
opencom-web Ready Ready Preview, Comment Apr 24, 2026 11:29pm

@qodo-code-review
Copy link
Copy Markdown

Review Summary by Qodo

Foolproof Local Convex Setup with Node.js Orchestration and Convex Auth Integration

✨ Enhancement 🧪 Tests 📝 Documentation

Grey Divider

Walkthroughs

Description
  **Core Setup Infrastructure Overhaul:**
• Replaced 350-line bash setup script with a robust 1558-line Node.js orchestration module
  (scripts/local-convex-setup.js) that handles env file parsing/merging, JWT key pair generation,
  Convex deployment configuration, workspace creation/selection, and local env propagation
• Implemented comprehensive test suite (579 lines, 8 test cases) covering clean setup, reruns, JWT
  regeneration, malformed JWKS handling, and env file preservation
• Created setup contract manifest (local-convex-setup-manifest.js) defining required core backend
  env, optional feature profiles, and app-specific .env.local targets
  **Environment Variable and Auth Updates:**
• Replaced deprecated AUTH_SECRET with JWT_PRIVATE_KEY and JWKS for Convex Auth JWT
  signing/verification across all documentation and example files
• Updated all Convex CLI commands to use pnpm exec prefix and modern convex auth add flow
  instead of manual env setting
• Added new environment variables for web app (E2E_BACKEND_URL, NEXT_PUBLIC_TEST_WORKSPACE_ID)
  and mobile app (EXPO_PUBLIC_CONVEX_URL, EXPO_PUBLIC_WORKSPACE_ID)
  **Documentation and Developer Experience:**
• Expanded setup documentation with clear one-command bootstrap flow, rerun flags (--reconfigure,
  --create-workspace, --non-interactive), and manual setup escape hatches
• Added comprehensive design document, specification, and proposal explaining structural
  improvements and validation strategy
• Created .env.example files for all apps (web, mobile, widget, RN SDK) with setup script
  references
• Added "Disposable Container Smoke Path" section with Docker-based testing instructions
• Clarified that setup scripts preserve unrelated user-managed keys and comments during reruns
  **Shell Script Simplification:**
• Reduced setup.sh from 350 to 24 lines and update-env.sh from 133 to 13 lines, now thin
  wrappers validating prerequisites and delegating to Node.js implementations
• Added update-local-env.js entry point for env update command
Diagram
flowchart LR
  A["Shell Wrapper<br/>setup.sh"] -->|delegates| B["Node.js Orchestration<br/>local-convex-setup.js"]
  B -->|uses| C["Setup Manifest<br/>local-convex-setup-manifest.js"]
  B -->|generates| D["JWT Keys<br/>JWT_PRIVATE_KEY<br/>JWKS"]
  B -->|configures| E["Convex Deployment<br/>Backend Config"]
  B -->|creates/selects| F["Workspace<br/>Resolution"]
  B -->|updates| G["App .env.local Files<br/>Non-destructive"]
  H["Test Suite<br/>local-convex-setup.test.js"] -->|validates| B
  I["Documentation<br/>README, Design, Spec"] -->|guides| A
Loading

Grey Divider

File Changes

1. scripts/local-convex-setup.js ✨ Enhancement +1558/-0

Complete Node.js setup orchestration with env management

• New 1558-line Node.js module implementing the complete setup orchestration logic, replacing the
 bash script implementation
• Provides core functions for env file parsing/merging, JWT key pair generation, Convex deployment
 configuration, backend env validation, workspace creation/selection, and local env file propagation
• Includes terminal UI helpers for interactive prompts (ask, askSecret, confirm, select) and a
 runtime abstraction for testability
• Exports both runSetup and runUpdateEnv functions plus CLI entry points for use by shell
 wrapper scripts

scripts/local-convex-setup.js


2. scripts/tests/local-convex-setup.test.js 🧪 Tests +579/-0

Deterministic test suite for setup orchestration

• New 579-line test suite with 8 comprehensive test cases covering the setup flow
• Tests include clean environment setup, rerun with existing deployment, JWT key pair regeneration,
 malformed JWKS handling, auth error surfaces, and env file merging
• Uses temporary directories and stubbed Convex CLI/auth responses to enable deterministic testing
 without real cloud accounts
• Validates that unrelated env entries and comments are preserved during reruns

scripts/tests/local-convex-setup.test.js


3. scripts/lib/local-convex-setup-manifest.js ⚙️ Configuration changes +172/-0

Setup contract manifest for env and features

• New 172-line manifest defining the setup contract: required core backend env, optional feature
 profiles, and local env file targets
• CORE_BACKEND_ENV specifies JWT_PRIVATE_KEY/JWKS generation and SITE_URL defaults as required for
 Convex Auth
• OPTIONAL_BACKEND_PROFILES describe email, AI, and test/demo features with validation checks
• LOCAL_ENV_TARGETS map backend URL and workspace ID to 6 app-specific .env.local files with
 managed comment blocks

scripts/lib/local-convex-setup-manifest.js


View more (22)
4. scripts/update-local-env.js ✨ Enhancement +7/-0

CLI entry point for env update command

• New 7-line entry point script that delegates to runUpdateEnvCli from the main setup module
• Allows ./scripts/update-env.sh to invoke the Node.js env update logic

scripts/update-local-env.js


5. scripts/setup.sh Refactoring +9/-335

Simplified shell wrapper delegating to Node.js

• Reduced from 350 lines to 24 lines, now a thin shell wrapper that validates Node.js/PNPM
 prerequisites and delegates to scripts/local-convex-setup.js
• Removes all bash-based Convex CLI interaction, env file generation, and auth logic in favor of the
 Node.js implementation
• Preserves the shell entrypoint for compatibility and simple prerequisite checks

scripts/setup.sh


6. scripts/update-env.sh Refactoring +4/-124

Simplified shell wrapper for env updates

• Reduced from 133 lines to 13 lines, now a thin shell wrapper that validates Node.js prerequisites
 and delegates to scripts/update-local-env.js
• Removes all bash-based env file generation and prompting logic

scripts/update-env.sh


7. openspec/changes/foolproof-local-convex-setup/design.md 📝 Documentation +266/-0

Design document for foolproof local setup

• New 266-line design document explaining the structural problems with the current setup flow and
 the proposed solution
• Details 6 key decisions: keeping shell entrypoint while moving orchestration to Node, using
 packages/convex/.env.local as canonical source, modeling setup as required+optional profiles,
 defaulting to reuse on reruns, managing env files with explicit blocks, and testing in layers
• Describes the 6-phase proposed flow (preflight, Convex config, backend env, workspace resolution,
 local env propagation, validation) and validation/error handling strategy

openspec/changes/foolproof-local-convex-setup/design.md


8. README.md 📝 Documentation +50/-29

Updated docs for new setup flow and Convex Auth

• Added "Quick Start" section at the top emphasizing the one-command ./scripts/setup.sh flow
• Updated "Quick Start (Self-Hosters)" section to clarify the bootstrap script handles deployment
 config, auth env validation, workspace creation/reuse, and env file generation
• Replaced references to AUTH_SECRET with JWT_PRIVATE_KEY and JWKS throughout the environment
 variables section
• Updated manual setup instructions to reference convex auth add and clarify the escape-hatch
 nature of manual steps
• Updated deployment and security sections to use the new Convex Auth env variable names
• Updated troubleshooting to reference the new setup flow

README.md


9. apps/mobile/.env.example ⚙️ Configuration changes +6/-0

Mobile app env example file

• New 6-line example env file for the mobile app showing required local defaults
• Includes EXPO_PUBLIC_CONVEX_URL, EXPO_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL, and
 EXPO_PUBLIC_WORKSPACE_ID placeholders
• References the setup script and update-env.sh for automated configuration

apps/mobile/.env.example


10. docs/open-source/setup-self-host-and-deploy.md 📝 Documentation +94/-31

Comprehensive setup documentation and environment variable updates

• Expanded the fastest setup path documentation to detail what ./scripts/setup.sh now does,
 including Convex configuration, JWT key generation, password auth flow, workspace resolution, and
 non-destructive env file updates
• Added helpful rerun flags (--reconfigure, --create-workspace, --non-interactive) with
 examples
• Updated manual setup instructions to use convex dev --once and convex auth add commands, and
 clarified when to use manual vs automated setup
• Replaced deprecated AUTH_SECRET with JWT_PRIVATE_KEY and JWKS in the Convex backend
 environment variables table, updated descriptions for SITE_URL and CONVEX_SITE_URL
• Added new environment variables for web app (E2E_BACKEND_URL) and mobile app
 (EXPO_PUBLIC_CONVEX_URL, EXPO_PUBLIC_WORKSPACE_ID)
• Added section documenting which files are managed by setup scripts and that unrelated
 keys/comments are preserved
• Added new "Disposable Container Smoke Path" section with Docker-based testing instructions

docs/open-source/setup-self-host-and-deploy.md


11. openspec/changes/foolproof-local-convex-setup/spec.md 📝 Documentation +0/-0

Setup bootstrap requirements and validation specifications

• Defined requirements for rerun-safe local Convex setup bootstrap with scenarios for first-time and
 existing configurations
• Specified validation requirements for backend auth bootstrap contract with error handling guidance
• Documented workspace resolution requirements to prevent duplicate creation by default
• Defined non-destructive env file update requirements that preserve unrelated user-managed keys
• Specified automated verification requirements for clean-environment and rerun scenarios

openspec/changes/foolproof-local-convex-setup/spec.md


12. docs/scripts-reference.md 📝 Documentation +25/-19

Scripts reference updates for new setup behavior

• Updated setup.sh documentation to reflect new orchestration steps: Convex dev deployment
 configuration, JWT key validation/generation, real auth flow usage, workspace resolution, and
 non-destructive env updates
• Added new flags: --reconfigure, --create-workspace, --start-dev
• Updated --workspace flag description to clarify it's for new workspace creation
• Updated update-env.sh description to clarify it refreshes Opencom-managed keys and preserves
 unrelated entries
• Fixed table formatting alignment in Quality section

docs/scripts-reference.md


13. openspec/changes/foolproof-local-convex-setup/proposal.md 📝 Documentation +41/-0

Setup bootstrap proposal and rationale

• Explained why current OSS setup is brittle: outdated Convex CLI commands, mismatched auth
 bootstrap path, destructive env file rewrites, and incomplete env contract documentation
• Outlined what changes: stateful rerun-safe bootstrap flow, Node-based implementation, canonical
 setup manifest, actual contract validation, and automated testing
• Listed new capability: local-convex-setup-bootstrap for rerun-safe local bootstrap with
 workspace resolution and non-destructive env updates
• Described impact on setup scripts, docs, verification, and contributor experience

openspec/changes/foolproof-local-convex-setup/proposal.md


14. openspec/changes/foolproof-local-convex-setup/tasks.md 📝 Documentation +24/-0

Setup bootstrap implementation tasks checklist

• Defined 4 task categories with 13 completed subtasks covering setup architecture, Convex
 configuration, local env safety, and verification
• Tasks include replacing Bash orchestration with Node bootstrap, implementing rerun handling,
 validating auth bootstrap, non-destructive env updates, and automated testing

openspec/changes/foolproof-local-convex-setup/tasks.md


15. package.json 🧪 Tests +1/-0

Add setup bootstrap test script

• Added new test script test:setup-bootstrap that runs scripts/tests/local-convex-setup.test.js
 using Node's test runner

package.json


16. packages/convex/.env.test.example 📝 Documentation +7/-6

Update test environment setup instructions

• Updated setup instructions to use pnpm exec convex dev --once --configure instead of `npx convex
 dev --project`
• Changed auth setup to use convex auth add instead of manual env setting
• Updated all Convex CLI commands to use pnpm exec prefix
• Clarified that setup.sh can be run or auth keys configured manually

packages/convex/.env.test.example


17. apps/landing/README.md 📝 Documentation +3/-1

Add setup script reference to landing app README

• Added note that ./scripts/update-env.sh automatically fills in environment values after repo
 bootstrap
• Fixed trailing whitespace in Knowledge Base table entry

apps/landing/README.md


18. apps/web/.env.example ⚙️ Configuration changes +14/-0

Create web app environment example file

• Created new .env.example file with documented environment variables for web dashboard
• Includes NEXT_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL, NEXT_PUBLIC_CONVEX_URL,
 NEXT_PUBLIC_TEST_WORKSPACE_ID, and E2E_BACKEND_URL
• Added comments directing users to use ./scripts/update-env.sh for automatic setup

apps/web/.env.example


19. apps/landing/.env.example 📝 Documentation +2/-0

Add setup script tips to landing environment example

• Added tips directing users to ./scripts/update-env.sh for automatic setup of
 NEXT_PUBLIC_CONVEX_URL and NEXT_PUBLIC_WORKSPACE_ID

apps/landing/.env.example


20. docs/testing.md 📝 Documentation +4/-6

Update test deployment setup instructions

• Updated test deployment setup instructions to use `pnpm --filter @opencom/convex exec convex dev
 --once --configure`
• Replaced separate login step with integrated convex auth add command for JWT key configuration
• Simplified instructions by removing project-specific flags

docs/testing.md


21. apps/widget/.env.example 📝 Documentation +2/-2

Add setup script reference to widget environment example

• Added tip directing users to ./scripts/update-env.sh for automatic setup
• Updated comment about workspace ID to reference local bootstrap or app settings

apps/widget/.env.example


22. packages/react-native-sdk/example/.env.example 📝 Documentation +1/-0

Add setup script reference to RN SDK example environment

• Added tip directing users to ./scripts/update-env.sh for automatic setup of environment
 variables

packages/react-native-sdk/example/.env.example


23. packages/react-native-sdk/example/README.md 📝 Documentation +2/-0

Add setup script reference to RN SDK example README

• Added note that ./scripts/update-env.sh automatically fills in environment values after repo
 bootstrap

packages/react-native-sdk/example/README.md


24. openspec/changes/foolproof-local-convex-setup/.openspec.yaml ⚙️ Configuration changes +2/-0

Add OpenSpec configuration for setup bootstrap change

• Created OpenSpec configuration file for the foolproof-local-convex-setup change specification
• Specifies schema as spec-driven and creation date

openspec/changes/foolproof-local-convex-setup/.openspec.yaml


25. openspec/changes/foolproof-local-convex-setup/specs/local-convex-setup-bootstrap/spec.md Additional files +70/-0

...

openspec/changes/foolproof-local-convex-setup/specs/local-convex-setup-bootstrap/spec.md


Grey Divider

Qodo Logo

@qodo-code-review
Copy link
Copy Markdown

qodo-code-review Bot commented Apr 24, 2026

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0)

Grey Divider


Action required

1. PNPM version not enforced🐞 Bug ☼ Reliability
Description
scripts/setup.sh claims PNPM 9+ is required but only checks that pnpm exists; it does not validate
the version even though the repo pins pnpm@9.0.0. This can lead to confusing downstream bootstrap
failures (install/filter/exec behavior) instead of an early actionable error.
Code

scripts/setup.sh[R13-16]

+if ! command -v pnpm >/dev/null 2>&1; then
+  echo "Error: pnpm is required. Install PNPM 9+ and rerun ./scripts/setup.sh." >&2
exit 1
fi
Evidence
The wrapper checks for pnpm presence but never checks pnpm -v. The repository explicitly pins pnpm 9
via packageManager, so running setup with older pnpm is a realistic misconfiguration that should be
caught up-front.

scripts/setup.sh[8-24]
package.json[79-82]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`scripts/setup.sh` enforces Node>=18 but does **not** enforce PNPM>=9, even though the repo pins PNPM 9 via `package.json#packageManager`. This can cause later bootstrap steps to fail with hard-to-diagnose pnpm/lockfile/filter issues.
### Issue Context
The wrapper already prints "Install PNPM 9+" in its error messaging; it should validate `pnpm -v` and fail fast.
### Fix Focus Areas
- scripts/setup.sh[8-24]
- package.json[79-82]
### Suggested change
After confirming `pnpm` exists, parse `pnpm -v` (major) and exit non-zero with a clear message when major < 9.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

2. Nonstandard # Tip: comments 📘 Rule violation ✧ Quality
Description
New .env.example comments introduce Tip:/Optional: tag prefixes instead of the standardized
uppercase comment tags. This breaks consistency and any tooling/review conventions that rely on
IMPORTANT:/NOTE:/WARNING:/TODO:/FIXME: prefixes.
Code

apps/landing/.env.example[12]

+# Tip: ./scripts/update-env.sh fills this in automatically for local setup
Evidence
PR Compliance ID 96867 requires special-purpose comment tags to start with one of IMPORTANT:,
NOTE:, WARNING:, TODO:, or FIXME:. The PR adds multiple new comments prefixed with Tip:
and Optional:, which are not in the allowed set.

Rule 96867: Standardize special-purpose code comment tags
apps/landing/.env.example[12-12]
apps/web/.env.example[10-13]
apps/widget/.env.example[4-4]
packages/react-native-sdk/example/.env.example[3-3]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
New `.env.example` comments use non-standard tag prefixes like `Tip:` and `Optional:`. Per compliance, special-purpose comment tags must start with one of: `IMPORTANT:`, `NOTE:`, `WARNING:`, `TODO:`, `FIXME:`.
## Issue Context
These comments are guidance/context for developers (special-purpose), so they should use the standardized tags to stay consistent and compatible with any future linting/automation.
## Fix Focus Areas
- apps/landing/.env.example[12-16]
- apps/web/.env.example[10-13]
- apps/widget/.env.example[4-7]
- packages/react-native-sdk/example/.env.example[1-3]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. update-env lacks Node version check🐞 Bug ☼ Reliability
Description
scripts/update-env.sh only checks that node exists, then executes update-local-env.js which imports
local-convex-setup.js. local-convex-setup.js uses Node-18+ modules (e.g., node:readline/promises),
so update-env can fail with a runtime module-load error on older Node instead of a clear
prerequisite failure.
Code

scripts/update-env.sh[R8-13]

+if ! command -v node >/dev/null 2>&1; then
+  echo "Error: node is required. Install Node.js 18+ and rerun ./scripts/update-env.sh." >&2
exit 1
fi
-echo ""
-echo -e "${YELLOW}Updating environment files...${NC}"
-
-cd "$ROOT_DIR"
-
-# Update or create apps/web/.env.local
-cat > apps/web/.env.local << EOF
-NEXT_PUBLIC_CONVEX_URL=$CONVEX_URL
-NEXT_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL=$CONVEX_URL
-EOF
-echo -e "  ${GREEN}✓${NC} Updated apps/web/.env.local"
-
-# Update or create apps/widget/.env.local
-cat > apps/widget/.env.local << EOF
-VITE_CONVEX_URL=$CONVEX_URL
-VITE_WORKSPACE_ID=$WORKSPACE_ID
-EOF
-echo -e "  ${GREEN}✓${NC} Updated apps/widget/.env.local"
-
-# Update or create apps/mobile/.env.local
-cat > apps/mobile/.env.local << EOF
-EXPO_PUBLIC_OPENCOM_DEFAULT_BACKEND_URL=$CONVEX_URL
-EXPO_PUBLIC_CONVEX_URL=$CONVEX_URL
-EXPO_PUBLIC_WORKSPACE_ID=$WORKSPACE_ID
-EOF
-echo -e "  ${GREEN}✓${NC} Updated apps/mobile/.env.local"
-
-# Update or create packages/react-native-sdk/example/.env.local
-cat > packages/react-native-sdk/example/.env.local << EOF
-EXPO_PUBLIC_CONVEX_URL=$CONVEX_URL
-EXPO_PUBLIC_WORKSPACE_ID=$WORKSPACE_ID
-EOF
-echo -e "  ${GREEN}✓${NC} Updated packages/react-native-sdk/example/.env.local"
-
-# Update or create packages/convex/.env.local
-cat > packages/convex/.env.local << EOF
-CONVEX_URL=$CONVEX_URL
-EOF
-echo -e "  ${GREEN}✓${NC} Updated packages/convex/.env.local"
-
-echo ""
-echo -e "${GREEN}Environment files updated successfully!${NC}"
-echo ""
-echo -e "${BLUE}Configuration:${NC}"
-echo -e "  Convex URL:    $CONVEX_URL"
-echo -e "  Workspace ID:  $WORKSPACE_ID"
-echo ""
+exec node "$ROOT_DIR/scripts/update-local-env.js" "$@"
Evidence
update-env.sh has no version guard, but the Node entrypoint it loads requires Node features/modules
consistent with the repo engines constraint (>=18). setup.sh already checks Node major; update-env
should mirror that behavior.

scripts/update-env.sh[8-13]
scripts/local-convex-setup.js[3-9]
package.json[79-82]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`./scripts/update-env.sh` only checks `node` is present. It then loads `scripts/update-local-env.js` → `scripts/local-convex-setup.js`, which imports `node:readline/promises` and assumes the Node>=18 runtime contract. On Node<18 this will crash with a module/runtime error rather than a clear prerequisite message.
### Issue Context
`./scripts/setup.sh` already checks Node major version. `update-env.sh` should be consistent, since it loads the same Node module.
### Fix Focus Areas
- scripts/update-env.sh[1-13]
- scripts/local-convex-setup.js[3-9]
### Suggested change
Add the same Node major version check used in `scripts/setup.sh` (or a shared helper snippet) before executing `node ...update-local-env.js`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

@qodo-code-review
Copy link
Copy Markdown

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: checks

Failed stage: Summarize check results [❌]

Failed test name: ""

Failure summary:

The action failed at the dependency vulnerability audit gate ([audit-gate]) because it detected
multiple high-severity security advisories for the dependency @xmldom/xmldom that were not
allowlisted
, causing the step to exit with code 1.
- Blocking advisories reported:
-
GHSA-2v35-w6hq-6mfw (Uncontrolled recursion in XML serialization leads to DoS)
-
GHSA-f6ww-3ggp-fr8h (XML injection through unvalidated DocumentType serialization)
-
GHSA-x6wf-f3px-wcqx (XML node injection through unvalidated processing instruction serialization)

- GHSA-j759-j44w-7fr8 (XML node injection through unvalidated comment serialization)
- The workflow
summary confirms: Dependency audit gate failed (exit code 1).

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

200:  packages/types lint: Warning: React version was set to "detect" in eslint-plugin-react settings, but the "react" package is not installed. Assuming latest React version for linting.
201:  packages/ui lint: Done
202:  packages/types lint: Done
203:  apps/landing lint$ next lint
204:  packages/convex lint$ eslint convex scripts tests --ext .ts
205:  apps/landing lint: `next lint` is deprecated and will be removed in Next.js 16.
206:  apps/landing lint: For new projects, use create-next-app to choose your preferred linter.
207:  apps/landing lint: For existing projects, migrate to the ESLint CLI:
208:  apps/landing lint: npx @next/codemod@canary next-lint-to-eslint-cli .
209:  packages/convex lint: Warning: React version was set to "detect" in eslint-plugin-react settings, but the "react" package is not installed. Assuming latest React version for linting.
210:  apps/landing lint:  ⚠ The Next.js plugin was not detected in your ESLint configuration. See https://nextjs.org/docs/app/api-reference/config/eslint#migrating-existing-config
211:  apps/landing lint: Attention: Next.js now collects completely anonymous telemetry regarding usage.
212:  apps/landing lint: This information is used to shape Next.js' roadmap and prioritize features.
213:  apps/landing lint: You can learn more, including how to opt-out if you'd not like to participate in this anonymous program, by visiting the following URL:
214:  apps/landing lint: https://nextjs.org/telemetry
215:  apps/landing lint: ✔ No ESLint warnings or errors
216:  apps/landing lint: Done
...

373:  packages/convex lint:   90:12  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
374:  packages/convex lint: /home/runner/work/opencom/opencom/packages/convex/tests/visitorDirectoryAuthorizationSemantics.test.ts
375:  packages/convex lint:    62:81  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
376:  packages/convex lint:    74:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
377:  packages/convex lint:    77:81  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
378:  packages/convex lint:    91:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
379:  packages/convex lint:   116:13  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
380:  packages/convex lint:   138:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
381:  packages/convex lint:   165:13  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
382:  packages/convex lint:   187:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
383:  packages/convex lint:   200:65  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
384:  packages/convex lint:   215:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
385:  packages/convex lint:   233:65  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
386:  packages/convex lint:   254:10  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
387:  packages/convex lint:   348:65  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
388:  packages/convex lint: ✖ 148 problems (0 errors, 148 warnings)
389:  packages/convex lint: Done
390:  apps/mobile lint$ eslint . --ext .ts,.tsx
391:  apps/web lint$ eslint src --ext .ts,.tsx
392:  apps/mobile lint: /home/runner/work/opencom/opencom/apps/mobile/src/contexts/BackendContext.tsx
393:  apps/mobile lint:   33:6  warning  React Hook useEffect has a missing dependency: 'loadBackendStorage'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
394:  apps/mobile lint: ✖ 1 problem (0 errors, 1 warning)
395:  apps/mobile lint: Done
396:  apps/web lint: /home/runner/work/opencom/opencom/apps/web/src/app/login/page.test.tsx
397:  apps/web lint:   45:42  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
398:  apps/web lint: /home/runner/work/opencom/opencom/apps/web/src/app/settings/MessengerSettingsSection.test.tsx
399:  apps/web lint:   24:61  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
400:  apps/web lint: /home/runner/work/opencom/opencom/apps/web/src/app/signup/page.test.tsx
401:  apps/web lint:   42:42  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
402:  apps/web lint: /home/runner/work/opencom/opencom/apps/web/src/components/ResponsiveLayout.tsx
403:  apps/web lint:   152:6  warning  React Hook useEffect has a missing dependency: 'closePanel'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
404:  apps/web lint: /home/runner/work/opencom/opencom/apps/web/src/contexts/BackendContext.tsx
405:  apps/web lint:   86:6  warning  React Hook useEffect has a missing dependency: 'loadBackendStorage'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
406:  apps/web lint: ✖ 5 problems (0 errors, 5 warnings)
407:  apps/web lint: Done
...

409:  apps/widget lint: /home/runner/work/opencom/opencom/apps/widget/src/components/ConversationView.test.tsx
410:  apps/widget lint:    53:6   warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
411:  apps/widget lint:    55:32  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
412:  apps/widget lint:    71:48  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
413:  apps/widget lint:    96:74  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
414:  apps/widget lint:   265:37  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
415:  apps/widget lint:   266:35  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
416:  apps/widget lint:   284:49  warning  Unexpected any. Specify a different type  @typescript-eslint/no-explicit-any
417:  apps/widget lint: /home/runner/work/opencom/opencom/apps/widget/src/components/ConversationView.tsx
418:  apps/widget lint:   162:6  warning  React Hook useEffect has missing dependencies: 'sessionTokenRef' and 'visitorId'. Either include them or remove the dependency array  react-hooks/exhaustive-deps
419:  apps/widget lint: /home/runner/work/opencom/opencom/apps/widget/src/components/HelpCenter.tsx
420:  apps/widget lint:   149:6  warning  React Hook useEffect has a missing dependency: 'setSelectedCollectionKey'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
421:  apps/widget lint:   158:6  warning  React Hook useEffect has a missing dependency: 'setSelectedCollectionKey'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
422:  apps/widget lint: /home/runner/work/opencom/opencom/apps/widget/src/hooks/useWidgetConversationFlow.ts
423:  apps/widget lint:   192:6  warning  React Hook useCallback has a missing dependency: 'visitorIdRef'. Either include it or remove the dependency array  react-hooks/exhaustive-deps
424:  apps/widget lint: ✖ 11 problems (0 errors, 11 warnings)
425:  apps/widget lint: Done
...

492:  > node scripts/ci-security-headers-check.js
493:  [security-headers-check] OK: web and landing header requirements validated.
494:  ##[group]Run pnpm test:convex
495:  �[36;1mpnpm test:convex�[0m
496:  shell: /usr/bin/bash -e {0}
497:  env:
498:  PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin
499:  ##[endgroup]
500:  > opencom@0.1.0 test:convex /home/runner/work/opencom/opencom
501:  > pnpm --filter @opencom/convex test
502:  > @opencom/convex@0.1.0 test /home/runner/work/opencom/opencom/packages/convex
503:  > vitest run
504:  �[1m�[46m RUN �[49m�[22m �[36mv4.0.17 �[39m�[90m/home/runner/work/opencom/opencom/packages/convex�[39m
505:  �[32m✓�[39m tests/runtimeTypeHardeningGuard.test.ts �[2m(�[22m�[2m26 tests�[22m�[2m)�[22m�[32m 35�[2mms�[22m�[39m
506:  �[32m✓�[39m tests/visitorDirectoryAuthorizationSemantics.test.ts �[2m(�[22m�[2m7 tests�[22m�[2m)�[22m�[32m 14�[2mms�[22m�[39m
507:  �[90mstderr�[2m | tests/aiAgentRuntimeSafety.test.ts�[2m > �[22m�[2maiAgentActions runtime safety�[2m > �[22m�[2mpersists a handoff message when generation fails
508:  �[22m�[39mAI generation error: Error: gateway timeout
509:  at �[90m/home/runner/work/opencom/opencom/packages/convex/�[39mtests/aiAgentRuntimeSafety.test.ts:696:40
510:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:145:11
511:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:915:26
512:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1243:20
513:  at new Promise (<anonymous>)
514:  at runWithTimeout (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1209:10)
515:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1653:37
516:  at Traces.$ (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/vitest@4.0.17_@opentelemetry+api@1.9.0_@types+node@20.19.30_@vitest+ui@4.0.18_jiti@1.21.7_jsd_znh4lc65ld7o7n72tbcfnzmloy/node_modules/�[4mvitest�[24m/dist/chunks/traces.CCmnQaNT.js:142:27)
517:  at trace (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/vitest@4.0.17_@opentelemetry+api@1.9.0_@types+node@20.19.30_@vitest+ui@4.0.18_jiti@1.21.7_jsd_znh4lc65ld7o7n72tbcfnzmloy/node_modules/�[4mvitest�[24m/dist/chunks/test.B8ej_ZHS.js:239:21)
518:  at runTest (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1653:12)
519:  �[90mstderr�[2m | tests/aiAgentRuntimeSafety.test.ts�[2m > �[22m�[2maiAgentActions runtime safety�[2m > �[22m�[2mfalls back to a persisted bot message if handoff fails after generation error
520:  �[22m�[39mAI generation error: Error: provider unavailable
521:  at �[90m/home/runner/work/opencom/opencom/packages/convex/�[39mtests/aiAgentRuntimeSafety.test.ts:774:40
522:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:145:11
523:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:915:26
524:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1243:20
525:  �[32m✓�[39m tests/aiAgentRuntimeSafety.test.ts �[2m(�[22m�[2m16 tests�[22m�[2m)�[22m�[32m 55�[2mms�[22m�[39m
526:  at new Promise (<anonymous>)
527:  at runWithTimeout (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1209:10)
528:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1653:37
529:  at Traces.$ (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/vitest@4.0.17_@opentelemetry+api@1.9.0_@types+node@20.19.30_@vitest+ui@4.0.18_jiti@1.21.7_jsd_znh4lc65ld7o7n72tbcfnzmloy/node_modules/�[4mvitest�[24m/dist/chunks/traces.CCmnQaNT.js:142:27)
530:  at trace (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/vitest@4.0.17_@opentelemetry+api@1.9.0_@types+node@20.19.30_@vitest+ui@4.0.18_jiti@1.21.7_jsd_znh4lc65ld7o7n72tbcfnzmloy/node_modules/�[4mvitest�[24m/dist/chunks/test.B8ej_ZHS.js:239:21)
531:  at runTest (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:1653:12)
532:  �[90mstderr�[2m | tests/aiAgentRuntimeSafety.test.ts�[2m > �[22m�[2maiAgentActions runtime safety�[2m > �[22m�[2mfalls back to a persisted bot message if handoff fails after generation error
533:  �[22m�[39mFailed to handoff after AI generation error: Error: handoff unavailable
534:  at �[90m/home/runner/work/opencom/opencom/packages/convex/�[39mtests/aiAgentRuntimeSafety.test.ts:804:15
535:  at Mock (file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+spy@4.0.17/node_modules/�[4m@vitest/spy�[24m/dist/index.js:285:34)
536:  at handleGenerationFailure �[90m(/home/runner/work/opencom/opencom/packages/convex/�[39mconvex/aiAgentActions.ts:645:31�[90m)�[39m
537:  �[90m    at processTicksAndRejections (node:internal/process/task_queues:95:5)�[39m
538:  at Function.handler [as _handler] �[90m(/home/runner/work/opencom/opencom/packages/convex/�[39mconvex/aiAgentActions.ts:816:14�[90m)�[39m
539:  at �[90m/home/runner/work/opencom/opencom/packages/convex/�[39mtests/aiAgentRuntimeSafety.test.ts:815:20
540:  at file:///home/runner/work/opencom/opencom/node_modules/�[4m.pnpm�[24m/@vitest+runner@4.0.17/node_modules/�[4m@vitest/runner�[24m/dist/index.js:915:20
541:  �[90mstderr�[2m | tests/notificationRouting.test.ts�[2m > �[22m�[2mnotification routing�[2m > �[22m�[2mremoves invalid agent and visitor tokens after transport errors
542:  �[22m�[39m[Push] Failed to send to ExponentPushToken[agent-invalid]: DeviceNotRegistered: The device is not registered
543:  [Push] Failed to send to ExponentPushToken[visitor-invalid]: DeviceNotRegistered: The device is not registered
544:  �[32m✓�[39m tests/auditLogs.test.ts �[2m(�[22m�[2m17 tests�[22m�[2m)�[22m�[32m 12�[2mms�[22m�[39m
...

674:  PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin
675:  ##[endgroup]
676:  [audit-gate] Blocking advisories detected:
677:  - [high] @xmldom/xmldom (id=1116960): xmldom: Uncontrolled recursion in XML serialization leads to DoS
678:  reason: not allowlisted
679:  advisory: https://github.com/advisories/GHSA-2v35-w6hq-6mfw
680:  - [high] @xmldom/xmldom (id=1116963): xmldom has XML injection through unvalidated DocumentType serialization
681:  reason: not allowlisted
682:  advisory: https://github.com/advisories/GHSA-f6ww-3ggp-fr8h
683:  - [high] @xmldom/xmldom (id=1116966): xmldom has XML node injection through unvalidated processing instruction serialization
684:  reason: not allowlisted
685:  advisory: https://github.com/advisories/GHSA-x6wf-f3px-wcqx
686:  - [high] @xmldom/xmldom (id=1116969): xmldom has XML node injection through unvalidated comment serialization
687:  reason: not allowlisted
688:  advisory: https://github.com/advisories/GHSA-j759-j44w-7fr8
689:  ##[error]Process completed with exit code 1.
690:  ##[group]Run failures=0
691:  �[36;1mfailures=0�[0m
692:  �[36;1m�[0m
693:  �[36;1mreport_blocking() {�[0m
694:  �[36;1m  name="$1"�[0m
695:  �[36;1m  outcome="$2"�[0m
696:  �[36;1m  if [ "$outcome" = "success" ]; then�[0m
697:  �[36;1m    echo "::notice::$name passed"�[0m
698:  �[36;1m  elif [ "$outcome" = "skipped" ]; then�[0m
699:  �[36;1m    echo "::warning::$name skipped"�[0m
700:  �[36;1m  else�[0m
701:  �[36;1m    echo "::error::$name failed"�[0m
702:  �[36;1m    failures=1�[0m
703:  �[36;1m  fi�[0m
704:  �[36;1m}�[0m
705:  �[36;1m�[0m
706:  �[36;1mreport_warning() {�[0m
707:  �[36;1m  name="$1"�[0m
708:  �[36;1m  outcome="$2"�[0m
709:  �[36;1m  if [ "$outcome" = "success" ]; then�[0m
710:  �[36;1m    echo "::notice::$name passed"�[0m
711:  �[36;1m  elif [ "$outcome" = "skipped" ]; then�[0m
712:  �[36;1m    echo "::warning::$name skipped"�[0m
713:  �[36;1m  else�[0m
714:  �[36;1m    echo "::warning::$name failed (warning only)"�[0m
715:  �[36;1m  fi�[0m
...

728:  �[36;1mif [ "$failures" -ne 0 ]; then�[0m
729:  �[36;1m  exit 1�[0m
730:  �[36;1mfi�[0m
731:  shell: /usr/bin/bash -e {0}
732:  env:
733:  PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin
734:  ##[endgroup]
735:  ##[notice]Lint passed
736:  ##[notice]Typecheck passed
737:  ##[notice]Convex raw auth guard passed
738:  ##[notice]Convex validator any guard passed
739:  ##[notice]Secret scan gate passed
740:  ##[notice]Security headers policy check passed
741:  ##[notice]Convex backend tests passed
742:  ##[notice]Web production build passed
743:  ##[error]Dependency audit gate failed
744:  ##[error]Process completed with exit code 1.
745:  Post job cleanup.

Comment thread scripts/setup.sh
@djanogly djanogly merged commit 0ac0c30 into dev Apr 24, 2026
4 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant