Feature/scheduled agents update

[AndreiDrang]

No description provided.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[github-actions]

Z.ai Code Review

## 🔍 Review Summary
This PR introduces a robust scheduled task feature that allows the bot to autonomously generate and update AGENTS.md files based on Gist content and AI prompts. The architecture is generally well-thought-out, featuring modular configuration handling and extensible task handlers. However, the implementation contains critical runtime errors related to variable scope and flawed error handling logic that poses a risk to data integrity.

## 🚨 Critical Issues & Bugs

• src/lib/handlers/scheduled.js: Critical Runtime Error (Undefined logger)
  Several exported utility functions (fetchFromUrl, callZaiApiWithRetry, createPR) attempt to use a logger variable. However, logger is defined as a local constant within handleScheduledEvent and is not accessible in the module scope where these functions are defined. This will cause an immediate ReferenceError crash when any scheduled task runs.

  • Fix: Pass logger as a parameter to these functions or wrap them in a class/context.

  // Example Fix for createPR
  async function createPR(octokit, owner, repo, { title, body, base, files, commitMessage }, logger) { // Add logger arg
    // ... inside function
    logger.info(`Creating branch ${branchName} from ${base}`);
    // ...
  }

• src/lib/handlers/scheduled.js: Unsafe Error Handling Leading to Data Loss
  In parseFileUpdatesFromResponse (inside handleUpdateAgentsTask), the code catches errors when fetching existing file content. If a fetch fails (e.g., network blip, API rate limit), it defaults isNew: true and assumes the file does not exist. This logic is dangerous as it may attempt to overwrite existing files or create duplicates based on transient failures rather than actual absence.

  // Current risky code:
  } catch (error) {
    // If this is a 500 error, file might still exist!
    fileUpdates.push({ file: filePath, oldContent: null, newContent, changed: true, isNew: true });
  }

  • Fix: Distinguish between 404 (Not Found) and other errors. Only assume isNew: true on 404.

• src/lib/config/scheduled-config.js: Incorrect Environment Variable Lookup
  The function loadScheduledConfig attempts to read process.env.ZAI_SCHEDULED_CONFIG_PATH. In GitHub Actions, inputs defined in action.yml are mapped to process.env.INPUT_<NAME>. Accessing the undecorated variable name will likely return undefined, forcing the code to always use the hardcoded default .zai-scheduled.yml and ignoring user inputs.

  • Fix: Use core.getInput('ZAI_SCHEDULED_CONFIG_PATH') or pass the path explicitly from src/index.js.

• src/lib/handlers/scheduled.js: Branch Creation Race Condition
  The branch naming strategy uses minute-level precision (YYYY.MM.DD_HH.MM). If the bot runs multiple times within the same minute (e.g., manual trigger during a scheduled run), the second execution will catch the 422 error (branch exists) and reuse the branch. This leads to a race condition where two processes attempt to commit to the same branch simultaneously, resulting in an undefined final state and potential commit conflicts.

  • Fix: Include milliseconds or a UUID in the branch name to ensure uniqueness.

## 💡 Suggestions & Best Practices

• src/lib/handlers/scheduled.js: Modularization
  The file is over 1000 lines long and mixes concerns (HTTP fetching, GitHub API interactions, AI logic, and Git operations). Consider splitting this into:

  1. utils/http.js (for fetchFromUrl, callZaiApiWithRetry)
  2. utils/github.js (for createPR, updateFileInRepo)
  3. tasks/update-agents.js (specific logic for the agents task)

• src/index.js: Dependency Injection Consistency
  The update-agents command case manually requires handleUpdateAgentsTask and constructs mocks for dependencies (fetchFile, createPullRequest). This creates tight coupling and makes testing difficult. Consider refactoring handleUpdateAgentsTask to accept a generic context object (similar to how the scheduled handler does it) rather than constructing it ad-hoc in the switch statement.

• src/lib/handlers/scheduled.js: Use Action-Specific HTTP Libraries
  Instead of using the raw node:https module, utilize @actions/http-client or @actions/core's built-in utilities if available. This provides better proxy support, user-agent handling, and retry logic consistent with the GitHub Actions environment.

• src/lib/handlers/scheduled.js: Input Validation
  The fetchFromUrl function accepts arbitrary URLs. While the bot runs on user repos, it's good practice to validate that the URL protocol is https and potentially restrict domains if the intention is only to support Gists, to prevent SSRF (Server-Side Request Forgery) vulnerabilities.

## 📊 Final Assessment

• Rating: Normal
• Reason: The feature architecture is solid and the code follows the project's existing patterns, but the PR introduces critical runtime errors (variable scope issues) and risky logic in error handling that will lead to crashes and potential data corruption. These must be resolved before merging.