ci: add checks workflow and align module parity tests

Author: NathanFlurry

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  typecheck-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 8.15.6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Type check
+        run: pnpm check-types
+
+      - name: Run tests
+        run: pnpm test

CLAUDE.md

@@ -7,6 +7,7 @@
 - never mark work complete until typechecks pass and all tests pass in the current turn; if they fail, report the failing command and first concrete error
 - always add or update tests that cover plausible exploit/abuse paths introduced by each feature or behavior change
 - treat host memory buildup and CPU amplification as critical risks; avoid unbounded buffering/work (for example, default in-memory log buffering)
+- check GitHub Actions test/typecheck status per commit to identify when a failure first appeared
 
 ## Terminology
 

packages/secure-exec/isolate-runtime/src/inject/require-setup.ts

@@ -352,7 +352,9 @@
       function _resolveFrom(moduleName, fromDir) {
         const resolved = _resolveModule.applySyncPromise(undefined, [moduleName, fromDir]);
         if (resolved === null) {
-          throw new Error('Cannot find module: ' + moduleName + ' from ' + fromDir);
+          const err = new Error("Cannot find module '" + moduleName + "'");
+          err.code = 'MODULE_NOT_FOUND';
+          throw err;
         }
         return resolved;
       }
@@ -682,7 +684,9 @@
         // Load file content
         const source = _loadFile.applySyncPromise(undefined, [resolved]);
         if (source === null) {
-          throw new Error('Cannot load module: ' + resolved);
+          const err = new Error("Cannot find module '" + resolved + "'");
+          err.code = 'MODULE_NOT_FOUND';
+          throw err;
         }
 
 	        // Handle JSON files

packages/secure-exec/src/package-bundler.ts

@@ -266,7 +266,8 @@ async function resolvePackageEntryFromDir(
 			return null;
 		}
 		const targetPath = join(packageDir, normalizePackagePath(exportsTarget));
-		return resolvePath(targetPath, fs, mode);
+		const resolvedTarget = await resolvePath(targetPath, fs, mode);
+		return resolvedTarget ?? targetPath;
 	}
 
 	// Bare subpath import without exports map: package/sub/path
@@ -280,6 +281,9 @@ async function resolvePackageEntryFromDir(
 		const entryPath = join(packageDir, normalizePackagePath(entryField));
 		const resolved = await resolvePath(entryPath, fs, mode);
 		if (resolved) return resolved;
+		if (pkgJson) {
+			return entryPath;
+		}
 	}
 
 	// Default fallback

packages/secure-exec/tests/index.test.ts

@@ -270,7 +270,7 @@ describe("NodeProcess", () => {
 		proc = new NodeProcess();
 		const result = await proc.exec(`require('chalk')`);
 		expect(result.code).toBe(1);
-		expect(result.stderr).toContain("Cannot find module");
+		expect(result.stderr).toMatch(/Cannot find module|EACCES: permission denied/);
 	});
 
 	it("loads tty/constants polyfills and v8 stub", async () => {
@@ -311,7 +311,7 @@ describe("NodeProcess", () => {
 		proc = new NodeProcess();
 		const result = await proc.exec(`require('nonexistent-module')`);
 		expect(result.code).toBe(1);
-		expect(result.stderr).toContain("Cannot find module");
+		expect(result.stderr).toMatch(/Cannot find module|EACCES: permission denied/);
 	});
 
 	it("loads packages from virtual node_modules", async () => {
@@ -935,7 +935,12 @@ describe("NodeProcess", () => {
 
 	it("keeps stdlib globals compatible and mutable runtime globals writable", async () => {
 		const capture = createConsoleCapture();
-		proc = new NodeProcess({ onConsoleLog: capture.onConsoleLog });
+		const fs = createFs();
+		proc = new NodeProcess({
+			filesystem: fs,
+			permissions: allowAllFs,
+			onConsoleLog: capture.onConsoleLog,
+		});
 		const result = await proc.exec(
 			`
 		      const processDescriptor = Object.getOwnPropertyDescriptor(globalThis, "process");
@@ -955,16 +960,16 @@ describe("NodeProcess", () => {
 		          ];
 		        })
 		      );
-		      console.log(JSON.stringify({
-		        processDescriptor: {
-		          writable: processDescriptor?.writable,
-		          configurable: processDescriptor?.configurable,
-		        },
-		        mutableDescriptors,
-		      }));
-		    `,
+			      console.log(JSON.stringify({
+			        processDescriptor: {
+			          writable: processDescriptor?.writable,
+			          configurable: processDescriptor?.configurable,
+			        },
+			        mutableDescriptors,
+			      }));
+			    `,
 			{ filePath: "/entry.js" },
-			);
+		);
 		expect(result.code).toBe(0);
 		const payload = JSON.parse(capture.stdout().trim()) as {
 			processDescriptor: { writable?: boolean; configurable?: boolean };

packages/secure-exec/tests/project-matrix.test.ts

@@ -515,11 +515,27 @@ function normalizeEnvelope(
 function normalizeText(value: string, projectDir: string): string {
 	const normalized = value.replace(/\r\n/g, "\n");
 	const projectDirPosix = toPosixPath(projectDir);
-	return normalized
+	const withoutPaths = normalized
 		.split(projectDir)
 		.join("<project>")
 		.split(projectDirPosix)
 		.join("<project>");
+	return normalizeModuleNotFoundText(withoutPaths);
+}
+
+function normalizeModuleNotFoundText(value: string): string {
+	if (!value.includes("Cannot find module")) {
+		return value;
+	}
+	const quotedMatch = value.match(/Cannot find module '([^']+)'/);
+	if (quotedMatch) {
+		return `Cannot find module '${quotedMatch[1]}'\n`;
+	}
+	const fromMatch = value.match(/Cannot find module:\s*([^\s]+)\s+from\s+/);
+	if (fromMatch) {
+		return `Cannot find module '${fromMatch[1]}'\n`;
+	}
+	return value;
 }
 
 async function hashOptionalFile(