feat(global): rebuild auto-brain as a Node 26 TypeScript monorepo

[SamHatoum]

Replaces the auto-agent plugin with the iteration-zero foundation for auto-brain: a Node server runtime, packaged as one container image that runs on Cloudflare Containers (the public offering) and on-prem.

The plugin's last state is preserved in BeOnAuto/auto-agent-backup at e50f420.

Layout

Path	Package	What it is
apps/server	@beonauto/server	Node HTTP server: GET /health, graceful shutdown on SIGTERM
apps/cloudflare	@beonauto/cloudflare	Worker + Durable Object that fronts the server container (@cloudflare/containers)
packages/config	@beonauto/config	Reads HOST/PORT from the environment

Toolchain

• Node 26.10, running .ts directly (native type stripping). No build step for the server or internal packages; workspace packages export src/index.ts.
• TypeScript 7.0.2 for type-checking: strict, plus noUncheckedIndexedAccess, exactOptionalPropertyTypes and erasableSyntaxOnly.
• Oxlint 1.86 with type-aware rules. Covers every rule from the old ESLint config, and adds:
  • no as assertions or any
  • no disable directives
  • no coverage-ignore comments
• Oxfmt for formatting.
• Vitest 5, with 100% coverage enforced per file. Tests run on Node's native loader, so they execute exactly what production runs. main.ts is covered by spawning the real process.
• Turborepo 2.11 for caching. A transit-node task makes a dependency's source change re-run its dependents' lint, type-check and tests. This is verified by hash comparison.
• pnpm 12, with catalogs, a 24-hour minimum release age, trustPolicy: no-downgrade, and an explicit allowBuilds list.
• Guardrails:
  • lefthook runs Oxfmt and Oxlint on staged files, commitlint on commit messages, and the affected gate on push.
  • Commit scopes come from workspace names; czg provides the guided prompt (pnpm commit).
  • knip and sherif check for unused code and dependency consistency.

Container

• One Dockerfile, multi-arch (amd64 + arm64). It runs as the non-root node user, contains no test files, and is 249 MB.
• Dependencies resolve in a build-platform stage, so the arm64 build needs no emulation.
• It exits 0 on SIGTERM, which is how Cloudflare stops instances.

CI/CD

• ci.yml runs on PRs, the merge queue and main. It contains:

  • pnpm check
  • a container build plus smoke test
  • a commitlint check on the PR title
  • a zizmor audit of the workflow files

  All of these sit behind one required check, ci-ok. Every action is pinned by SHA, and the repo now enforces that.

• release.yml: release-please maintains a release PR using a short-lived BeOnAutoBot token. Merging it tags vX.Y.Z and then:

  • publishes the multi-arch image to ghcr.io/beonauto/auto-brain, with provenance and an SBOM, and also to Docker Hub once it is configured;
  • copies the amd64 manifest byte for byte into Cloudflare's registry. Cloudflare can't pull from GHCR;
  • deploys the Worker pinned to that digest.

  Both the Docker Hub and the Cloudflare steps stay off until their credentials exist.

• Renovate handles dependency updates, grouped for non-major bumps and held back by a one-day minimum release age.

Verified locally

• pnpm check: all 13 tasks green, about 0.5 s cold.
• docker build plus a smoke test: health returns 200, the process runs as node, and it exits 0 on stop.
• wrangler deploy --dry-run builds the Worker bundle and the image.
• zizmor reports no findings.
• Save-to-signal timings:
  • pnpm dev reload: 288 ms
  • root Vitest run: 191 ms
  • TypeScript 7 full type-check: 0.6 s

🤖 Generated with Claude Code