fix(coverage): install npm workspaces from root lock

[seonghobae]

Summary

• Resolve the nearest regular, non-symlink npm lock at or below the validated coverage worktree root.
• Run trusted offline npm ci from that lock project while keeping coverage scripts scoped to the changed nested package.
• Add a workspace regression test and update the reviewed workflow blob pin.

Root cause

Central coverage discovered apps/desktop as the JavaScript package for ContextualWisdomLab/bandscope#1057, then looked for package-lock.json only in that directory. BandScope owns the lock at the repository root, so coverage failed before vitest could resolve from the workspace install.

Verification

• python3 -m pytest -q — 1874 passed, 1 skipped, 17 subtests passed.
• python3 -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py — 31 passed, 1 skipped.
• bash -n scripts/ci/test_strix_quick_gate.sh — passed.
• actionlint was attempted with a 30-second bound but did not complete; it is not claimed as passing evidence.

Security Notes

• The workflow still requires a regular non-symlink lock, exact current-head blob equality, and the existing trusted materialization manifest before offline installation.
• Dependency installation remains offline with lifecycle scripts disabled and the unprivileged sandbox boundary unchanged.
• The new ancestor search is bounded to COVERAGE_SOURCE_WORKDIR and fails closed if the package path escapes it or no lock is present.
• No runtime product, URL, subprocess, IPC, model, or export boundary changed.

---

Summary by CodeRabbit

• 개선 사항

  • 중첩된 npm 워크스페이스에서도 상위 프로젝트의 검증된 lock 파일을 자동으로 찾아 의존성을 설치합니다.
  • 오프라인 npm 설치 및 캐시 검증이 올바른 워크스페이스 범위에서 수행됩니다.

• 버그 수정

  • 패키지 디렉터리에 lock 파일이 없는 npm 워크스페이스의 커버리지 설치 문제를 해결했습니다.

• 테스트

  • 상위 lock 파일 탐색과 워크스페이스 커버리지 설치에 대한 회귀 테스트를 추가했습니다.

• 문서

  • npm 워크스페이스 커버리지 설치 동작 변경 사항을 변경 로그에 기록했습니다.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

📝 Walkthrough

Walkthrough

중첩된 npm 워크스페이스 패키지가 가장 가까운 검증된 조상 lock 파일을 사용하도록 설치 경로를 변경했습니다. 워크플로 검사 헬퍼와 관련 계약 검사를 갱신했습니다.

Changes

npm 워크스페이스 커버리지 설치

Layer / File(s)	Summary
상위 npm lock 파일 탐색 .github/workflows/opencode-review-dispatch.yml, tests/test_opencode_agent_contract.py	npm_lock_project_dir가 검증된 커버리지 워크트리 안에서 일반 npm-shrinkwrap.json 또는 package-lock.json을 찾습니다. 중첩 패키지와 워크트리 밖 실행의 동작을 검증합니다.
해석된 디렉터리에서 의존성 설치 .github/workflows/opencode-review-dispatch.yml, CHANGELOG.md, tests/test_pr_review_autofix_nvidia_nim_contract.py	npm 설치가 lock 디렉터리로 이동한 뒤 lock 검증, 캐시 준비, 오프라인 npm ci를 실행하고 원래 디렉터리로 복귀합니다. 변경 로그와 워크플로 blob SHA를 갱신했습니다.
워크플로 검사 검증 scripts/ci/test_strix_quick_gate.sh	required_workflow_bootstrap_has_if가 큰 required-workflow-bootstrap: 잡 블록에서도 if: 조건을 검사합니다. 관련 quick gate 검사가 새 헬퍼를 사용합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to 17f3c

The PR fixes workspace-root npm installation while preserving the existing trust and offline-installation safeguards. A quick-gate pattern may still falsely reject valid workflows by matching nested step conditions, so the change is mergeable with explicit follow-up to narrow that match.

Sequence Diagram(s)

sequenceDiagram
  participant CoverageStep
  participant npm_lock_project_dir
  participant LockProject
  participant npm
  CoverageStep->>npm_lock_project_dir: npm lock 프로젝트 디렉터리 해석
  npm_lock_project_dir->>LockProject: 일반 lock 파일 확인
  LockProject-->>CoverageStep: 프로젝트 디렉터리 반환
  CoverageStep->>npm: 해당 디렉터리에서 오프라인 npm ci 실행
  npm-->>CoverageStep: 설치 완료 후 원래 디렉터리 복귀

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 중첩된 npm 워크스페이스가 루트 lock 파일을 사용하도록 의존성 설치 경로를 수정하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (3 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (3 skipped: 2 unsupported, 1 too large.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/opencode-npm-workspace-coverage

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Resolved the stale merge conflict against current main and pushed a merge commit (4d5559b7).

Conflicts, both mechanical (no design decision involved):

1. CHANGELOG.md — both this PR and main (independently, via fix(sidecar): give the gateway preflight probe a real reasoning budget #1436/fix(ci): gate Strix's orchestrator/free access on live diversity evidence #1437-class fixes landing after this PR was opened) appended distinct ## [Unreleased] bullets with no textual overlap. Resolved by keeping both entries, this PR's npm-workspace-lock entry first, followed by main's sidecar/Strix/ZDR entries unchanged.
2. tests/test_pr_review_autofix_nvidia_nim_contract.py — REVIEW_DISPATCH_BLOB_SHA is a pinned git blob SHA of .github/workflows/opencode-review-dispatch.yml. Both sides had bumped it independently (this PR's npm_lock_project_dir() helper vs. main's unrelated changes to the same workflow file), so the constant necessarily diverged. Recomputed the correct post-merge value directly: git hash-object .github/workflows/opencode-review-dispatch.yml → 256228eb7fc8f0c1613fbb7ec48effc8d6322c1b, and used that (no other file references the stale SHAs).

The workflow file itself (.github/workflows/opencode-review-dispatch.yml) auto-merged cleanly — this PR's npm_lock_project_dir() ancestor-lock-search helper and main's unrelated edits didn't textually overlap.

Test evidence (post-merge, in an isolated worktree):

• PYTHONPATH=. python3 -m pytest tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py -q → 78 passed
• PYTHONPATH=. python3 -m pytest tests -q (full suite) → 1898 passed, 1 skipped, 21 subtests passed
• coverage run -m pytest tests -q && coverage report --show-missing → 100% (10072/10072 not applicable here; scripts/ci is untouched by this PR's diff, full-repo scripts/ci coverage remains 100%)
• interrogate (repo-configured, tests/ excluded) → PASSED, 100%
• git diff --check origin/main...HEAD → clean
• Python ast.parse on both touched test files → syntax OK

No scripts/ci/*.py files are touched by this PR's own diff, so the 100% coverage/docstring gates are satisfied trivially by the unrelated files remaining at 100% as before.

---

Generated by Claude Code

[seonghobae]

Codex is reconciling this PR with current main and revalidating its exact-head coverage/review gates. Started 2026-08-31 23:05 KST; working in an isolated worktree and preserving the existing checkout.

[seonghobae]

Reconciled current main at exact head 17f3cf10f42ae831abfc025f80458a54b106b069. The PR is now GitHub-mergeable. Preserved the npm-workspace fix and current-main changelog entries; also ported the same source-branch quick-gate correction proven in #1506 because exact-head-path-policy checks out each PR head. Fresh local focused evidence: PYTHONPATH=. python3 -m pytest -q tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py → 78 passed; workflow blob pin remains exact. The full quick-gate run was interrupted after 15 minutes and is not claimed as passing evidence; hosted exact-head checks are authoritative and now queued.

[seonghobae]

Current exact-head verification for 17f3cf10f42ae831abfc025f80458a54b106b069: PYTHONPATH=. python3 -m pytest -q completed successfully — 2127 passed, 1 skipped, 21 subtests passed in 170.24s. Hosted Strix Changed Path Quality CI / exact-head-path-policy also succeeded on this head.

[seonghobae]

Addressed CodeRabbit’s exact-head finding in bc965eae: the shell contract now matches only exactly four-space-indented job-level if: keys, consistent with the Python contract, so nested step-level conditions cannot cause a false positive. Revalidated: git diff --check; focused contracts 78 passed.

[seonghobae]

Fresh full-suite verification on current exact HEAD bc965eae: PYTHONPATH=. python3 -m pytest -q — 2127 passed, 1 skipped, 21 subtests passed in 184.18s. The prior-head evidence is superseded by this run.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Current exact-head evidence for e09206b1: fixed the Noema concurrency root cause where a cancelled OpenCode/Strix workflow_run could evict an actionable review before its job-level guard skipped the cancelled event. Cancelled workflow-run events now use their unique run ID; actionable triggers still serialize by PR. Validation: focused Noema/required-workflow contracts 114 passed; full suite 2127 passed, 1 skipped, 21 subtests passed in 210.36s.

[seonghobae]

@opencode-agent Review exact current head e09206b15f245c1053bbfbed6135be1edf1e7475 only. Recompute the formal verdict from current hosted evidence; do not reuse predecessor reviews. The previous required watcher timed out without an authenticated current-head verdict.

[seonghobae]

Resolved the merge conflict against current main (fb2ae81d) and pushed a non-force merge commit, e09206b1..b3a9b6f7. Five files conflicted; how each was resolved and why:

1. .github/workflows/noema-review.yml and tests/test_required_workflow_queue_contract.py — took main. This branch's e09206b1 keyed Noema's concurrency group on cancelled workflow_run events so a cancelled OpenCode/Strix run could not evict an actionable review. main has since removed the workflow_run trigger from noema-review.yml altogether (Noema now reviews PRs standalone; the queue contract asserts workflow_run: is absent from the concurrency block and github.event.workflow_run is absent from the workflow). With no workflow_run trigger there is no cancelled-run eviction left to isolate, so the branch's change had no remaining object. Both files are now byte-identical to main.
2. scripts/ci/test_strix_quick_gate.sh — both sides had independently added required_workflow_bootstrap_has_if (this branch ported it from #1506, main landed #1506 itself); the only difference was the regex. Kept this branch's exactly-four-space grep '^ if:' (job-level keys only — the narrowing from bc965eae that answered CodeRabbit's nested-step false-positive finding) over main's '^[[:space:]]*if:', and took main's SIGPIPE explanatory comment and its #1848 concurrency assertions. main's 20 000-line pipe-buffer fixture uses a four-space if:, so both of main's own checks still pass under the stricter match.
3. tests/test_pr_review_autofix_nvidia_nim_contract.py — REVIEW_DISPATCH_BLOB_SHA recomputed from the merged workflow: git hash-object .github/workflows/opencode-review-dispatch.yml → fc05ee039cece35a0359d65d7381574d3574504d. Neither side's value could be right because both sides edit that workflow and git auto-merged it without a marker.
4. CHANGELOG.md — kept both sides' [Unreleased] bullets.

The branch's delta against main is now exactly its stated scope: the npm_lock_project_dir ancestor-lock search in opencode-review-dispatch.yml (+38), its contract tests (+61), the one quick-gate regex line, the blob pin, and one CHANGELOG bullet.

Verification on the merged tree: touched contracts (test_opencode_agent_contract, test_pr_review_autofix_nvidia_nim_contract, test_required_workflow_queue_contract, test_noema_orchestrator_workflow_contract, test_opencode_rust_coverage_toolchain_contract, test_contextual_orchestrator_review_sidecar_contract) 184 passed, 1 skipped; full suite under GITHUB_ACTIONS=true 2921 passed, 1 skipped, 21 subtests; bash scripts/ci/test_strix_quick_gate.sh → test_strix_quick_gate: PASS; git diff --check origin/main clean. No history rewritten.

Left as Draft: the 2026-09-05 02:27Z Draft conversion (which retired this head's queued review scans) was not mine, so whether to mark it ready is the owner's call — it is mergeable now.

---

Generated by Claude Code

[seonghobae]

Both review failures on b3a9b6f7 are the pool's current capacity state, not this diff, and neither is re-run now.

noema-review (job 101453707588, 08:53–08:55Z) and strix (job 101453993157, 09:02–09:08Z) both failed at Provision contextual-orchestrator review sidecar, before any review or scan request was made. Both vendored contextual-orchestrator @ 414f2297… and both report identical preflight evidence:

candidate_count 24, probe_budget 16, target_ready 8,
probed 6, ready 0, rejected 6, deferred 0, skipped 18

The six rejections are 429 from nvidia_nim and nvidia_nim_sub on deepseek-v4-flash and deepseek-v4-pro, and from two OpenRouter free routes — every one answered within 90 ms, after which #1949's account skip (two consecutive 429s per account) retired the remaining 18 candidates. noema-review's stderr also carries provider_discovery_failed provider=bytez code=http_status_500, which costs a provider but not the outcome here.

Three other heads hit the same wall in the same 45 minutes: #1187 noema-review at 08:29Z and #1884 noema-review at 09:11Z, byte-identical counts. Classification per #1948: preflight-fail (capacity) — the levers are that issue's (per-key budgets shared across concurrently booting sidecars), and nothing inside this PR's scope changes it.

The two CodeQL compatibility failures are the designed dispatch-pending state (the dispatch workflow will rerun this failed job after publishing an authenticated exact-head verdict), not defects.

Holding this head's re-runs: a re-run now would spend six more probes against the same exhausted keys, which is why other lanes are holding theirs too. I will spend one when an artifact on this pool shows ready_count ≥ 1. The merge itself is verified locally on this head — 184 contract tests, full suite 2921 passed, bash scripts/ci/test_strix_quick_gate.sh PASS, git diff --check clean — and the PR stays Draft pending its owner's call.

---

Generated by Claude Code

[seonghobae]

Standing down on CodeQL compatibility analysis (actions) at f029a476 — pending handshake, not a defect. Recorded once so the red mark is not re-investigated here.

Read from this PR's own job (34036280094, job 101503037117, 15:07:51Z) rather than inferred from the sibling PR:

LANGUAGE:         actions
DISPATCH_OUTCOME: success
VERDICT_STATE:    pending
##[error]CodeQL scan dispatched. The dispatch workflow will rerun this
         exact failed CodeQL job after publishing its terminal verdict.

The dispatch succeeded; only the terminal exact-head verdict is outstanding, and the shard fails closed while it waits. The pending branch is written to be re-run by the dispatch workflow itself once that verdict lands. Nothing to root-cause, no patch to propose.

No manual re-run — it would re-enter the same pending branch and spend this PR's one sanctioned re-run on a state that clears itself. Same treatment as #1187 (comment 5560124615), where the identical class was verified independently.

PR state is otherwise clean: f029a476 is synced with main@dd0b96fe, the REVIEW_DISPATCH_BLOB_SHA pin was recomputed from the merged workflow (a9b57d28…) rather than picked from either side of the conflict, full suite 2957 passed / 1 skipped / 21 subtests, bash -n scripts/ci/test_strix_quick_gate.sh clean.

Still a draft deliberately: the central review path (orchestrator/free) is the org-wide bottleneck right now and CodeRabbit's OSS allowance is roughly one review per hour, so this PR stays out of that queue until #1967, #1884 and #1187 clear. It is code-complete, not blocked on itself.

---

Generated by Claude Code

[seonghobae]

strix failed at 17:40Z on f029a476. It found nothing — findings.sarif has 0 results — and the failure is the gateway. Second check class recorded on this PR (the first was CodeQL, 5560138410).

I read the strix-reports artifact (9994051950) rather than the summary line, because this PR does touch security-relevant logic — offline npm ci, ancestor lock resolution, the regular-non-symlink lock requirement — so a genuine finding was plausible here in a way it was not on a docs PR:

run.json:       status failed, 15:35:13 → 17:39:59 (7,486s ≈ 125 min), scan_mode quick
findings.sarif: results: 0            ← no security finding against this diff
preflight:      ready_count 6 of 24, rejected 8, deferred 2, skipped 4
verdict:        STRIX_PROVIDER_UNAVAILABLE: orchestrator/free exhausted

Two hours of scanning across the changed scope, zero findings, then failed closed on provider exhaustion. The lock-resolution and symlink controls this PR adds were not implicated.

Failure class: contextual-orchestrator#1082 (tool-bearing passthrough walk). Sidecar stderr: provider_attempt 126, provider_attempt_failed 90, error_type=TimeoutError 71, HTTPError 19, request_failed status=500 code=internal_error 67, plus two 429 rate_limit_exceeded; circuit_failure 13, circuit_opened 2.

Taken with the same measurement on #1967 and the two samples in #1082's own body, the relationship is now consistent across four runs at pin 414f2297:

run	ready	TimeoutError	500	circuit_failure	HTTPError
#1930	4/12	48	48	6	14
#1916	4/12	63	63	13	23
#1967	6/24	52	48	5	11
#1411	6/24	71	67	13	19

circuit_failure tracks the HTTPError count in every run and never approaches the timeout count — the breaker is told about HTTP failures and not about timeouts, which is exactly the unreached _record_failure that #1082 fixes.

No fix pushed and no re-run spent. The scan found nothing to fix, a re-run re-enters the same walk, and the upstream fix is #1082 — unmerged, another lane's. This PR stays a draft deliberately while the review queue is the org bottleneck; it is code-complete at f029a476 (blob pin a9b57d28… recomputed from the merged workflow, full suite 2957 passed).

---

Generated by Claude Code