chore(repo): isolate default tests and add live-agent CI / 隔离默认测试并新增 live-agent CI

EN:
Isolate the default test entrypoint in scripts/test.mjs by clearing live agent
provider variables before node --test starts, and add a cross-platform
npm run test:live-agent script for explicit provider-backed runs.

Add GitHub Actions workflows that keep main CI on npm test while exposing a
manual live-agent workflow wired to repository secrets, and document the two
paths in the README so contributors know which gate is deterministic.

ZH:
在 scripts/test.mjs 中隔离默认测试入口，在启动 node --test 前清理
live agent 相关环境变量，并新增跨平台的 npm run test:live-agent
脚本，供显式的外部 provider 验证使用。

新增 GitHub Actions workflow：主 CI 继续只跑 npm test，另外提供一个
依赖仓库 secrets 的手动 live-agent workflow；同时在 README 中补充两条
测试路径的说明，明确默认门禁与真实集成验证的边界。

Author: Gan-Xing

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Run isolated test suite
+        run: npm test

.github/workflows/live-agent-tests.yml

@@ -0,0 +1,45 @@
+name: Live Agent Tests
+
+on:
+  workflow_dispatch:
+
+jobs:
+  live-agent:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CODEXBRIDGE_AGENT_API_KEY: ${{ secrets.CODEXBRIDGE_AGENT_API_KEY }}
+      CODEXBRIDGE_AGENT_BASE_URL: ${{ secrets.CODEXBRIDGE_AGENT_BASE_URL }}
+      CODEXBRIDGE_AGENT_API: ${{ secrets.CODEXBRIDGE_AGENT_API }}
+      CODEXBRIDGE_AGENT_MODEL: ${{ secrets.CODEXBRIDGE_AGENT_MODEL }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
+      OPENAI_API_BASE_URL: ${{ secrets.OPENAI_API_BASE_URL }}
+      OPENAI_MODEL: ${{ secrets.OPENAI_MODEL }}
+      MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Verify live-agent credentials are configured
+        run: |
+          if [ -z "${CODEXBRIDGE_AGENT_API_KEY}" ] && [ -z "${OPENAI_API_KEY}" ] && [ -z "${MINIMAX_API_KEY}" ]; then
+            echo "Missing live-agent credentials. Configure CODEXBRIDGE_AGENT_API_KEY, OPENAI_API_KEY, or MINIMAX_API_KEY as GitHub Actions secrets."
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Run live-agent test suite
+        run: npm run test:live-agent

README.md

@@ -311,6 +311,16 @@ npm test
 
 The validation suite is expected to pass on both Linux and Windows.
 
+`npm test` is the isolated default test entrypoint. It clears live agent provider variables such as `CODEXBRIDGE_AGENT_*`, `OPENAI_*`, and `MINIMAX_API_KEY` before starting `node --test`, so unit and integration tests stay deterministic even when the host shell, CI runner, or service manager exports real model credentials.
+
+When you intentionally want to keep live agent credentials and exercise the real external agent path, use the explicit opt-in script instead:
+
+```bash
+npm run test:live-agent
+```
+
+Keep `test:live-agent` separate from the main suite. It is for deliberate provider-backed verification, not for the default `npm test` gate.
+
 ## Deployment Quick Start
 
 ### Common Prerequisites
@@ -343,6 +353,7 @@ If `codex --version` still fails, fix that before attempting `weixin:login` or `
 npm install
 npm run typecheck
 npm test
+npm run test:live-agent
 codex --version
 npm run weixin:login
 npm run weixin:serve -- --cwd /absolute/path/to/workspace
@@ -358,6 +369,7 @@ Open PowerShell in the repo root and run:
 npm install
 npm run typecheck
 npm test
+npm run test:live-agent
 codex --version
 where codex
 npm run weixin:login

package.json

@@ -12,7 +12,8 @@
     "weixin:login": "tsx src/cli.ts weixin login",
     "weixin:clear-context": "tsx src/cli.ts weixin clear-context",
     "weixin:serve": "tsx src/cli.ts weixin serve",
-    "test": "node ./scripts/test.mjs"
+    "test": "node ./scripts/test.mjs",
+    "test:live-agent": "node --input-type=module -e \"process.env.CODEXBRIDGE_TEST_ALLOW_LIVE_AGENT='1'; await import('./scripts/test.mjs');\""
   },
   "engines": {
     "node": ">=24"

scripts/test.mjs

@@ -5,6 +5,25 @@ import { spawnSync } from 'node:child_process';
 const distTestDir = path.join(process.cwd(), 'dist', 'test');
 fs.rmSync(distTestDir, { recursive: true, force: true });
 
+const LIVE_AGENT_TEST_ENV_FLAG = 'CODEXBRIDGE_TEST_ALLOW_LIVE_AGENT';
+const isolatedEnv = { ...process.env };
+
+if (isolatedEnv[LIVE_AGENT_TEST_ENV_FLAG] !== '1') {
+  for (const key of [
+    'CODEXBRIDGE_AGENT_API_KEY',
+    'CODEXBRIDGE_AGENT_BASE_URL',
+    'CODEXBRIDGE_AGENT_API',
+    'CODEXBRIDGE_AGENT_MODEL',
+    'OPENAI_API_KEY',
+    'OPENAI_BASE_URL',
+    'OPENAI_API_BASE_URL',
+    'OPENAI_MODEL',
+    'MINIMAX_API_KEY',
+  ]) {
+    delete isolatedEnv[key];
+  }
+}
+
 function collectTestFiles(dir) {
   const entries = fs.readdirSync(dir, { withFileTypes: true });
   const files = [];
@@ -25,6 +44,7 @@ const testArgs =
   process.argv.length > 2 ? process.argv.slice(2) : collectTestFiles(path.join(process.cwd(), 'test'));
 
 const result = spawnSync(process.execPath, ['--import', 'tsx', '--test', ...testArgs], {
+  env: isolatedEnv,
   stdio: 'inherit',
 });