fix(worker): boot ingestion worker through the server-only-aware tsx runner

[BigSimmo]

Summary

Follow-up to #488. That PR marked src/lib/env.ts with import "server-only", but Dockerfile.worker still boots the ingestion worker under bare tsx, which throws on that import — so the production worker container crash-loops on startup.

Crash chain (on main today):

• Dockerfile.worker → CMD ["node", "node_modules/tsx/dist/cli.mjs", "worker/index.ts"] (bare tsx, no server-only stub)
• worker/index.ts → await import("./main") → worker/main.ts → import { env } from "../src/lib/env"
• src/lib/env.ts:1 → import "server-only" → throws under plain tsx → startWorker().catch(… process.exit(1)) → boot fails.

Fix

Route the worker entrypoint through scripts/run-tsx.mjs (already used by every npm tsx script since #488), which registers the server-only stub hook so the import resolves outside the Next bundler:

-CMD ["node", "node_modules/tsx/dist/cli.mjs", "worker/index.ts"]
+CMD ["node", "scripts/run-tsx.mjs", "worker/index.ts"]

All three helper scripts (run-tsx.mjs, enable-server-only-stub.mjs, register-server-only.mjs) and the devDependency tsx are already present in the worker image (COPY . . + dev-inclusive npm ci), so no other image change is needed. A CMD-level comment documents why, to prevent a "simplify back to bare tsx" regression.

Guard

Extended tests/tsx-server-only-runner.test.ts to assert Dockerfile.worker's CMD routes through scripts/run-tsx.mjs, runs worker/index.ts, and never invokes tsx/dist/cli.mjs. This fails on the old line and passes on the new one.

Verification

• tests/tsx-server-only-runner.test.ts — 4/4 pass (incl. the new worker-boot guard)
• tsc --noEmit clean; eslint + prettier --check clean on the changed test file
• Confirmed Dockerfile.worker is the only bare-tsx entrypoint in the repo (all npm scripts already route through run-tsx.mjs)

Container boot was verified by static import-chain analysis, not by building the image (no Docker in this environment); CI's Build lane exercises the image build.

Clinical Governance Preflight

Not applicable — build/runtime entrypoint only; no change to clinical output, retrieval, data access, or privacy surfaces.

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

📝 Walkthrough

Walkthrough

The worker Docker command now invokes worker/index.ts through scripts/run-tsx.mjs, and a Vitest test verifies the exact JSON exec-form command.

Changes

Worker startup

Layer / File(s)	Summary
Route worker startup through the custom runner Dockerfile.worker, tests/tsx-server-only-runner.test.ts	The worker container starts through scripts/run-tsx.mjs, while the test verifies the exact node scripts/run-tsx.mjs worker/index.ts command.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Verification Claims	❌ Error	PR notes claim tests/tsc/eslint/prettier verification passed, but they don’t name the exact commands and results.	Rewrite verification as explicit checks, e.g. Ran npm test -- tests/tsx-server-only-runner.test.ts: passed; Ran npm run tsc --noEmit: passed; or Not run: reason.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the worker startup fix and the server-only-aware tsx runner change.
Description check	✅ Passed	The description covers the required summary, verification, and governance context with clear implementation and test details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Generated And Sensitive Files	✅ Passed	Only tests/tsx-server-only-runner.test.ts changed; no secrets, credentials, generated artifacts, or local-machine files were committed.
Risky Git Or Deployment Actions	✅ Passed	PASS: The diff only tightens a test for Dockerfile.worker; no new force-push, reset, branch-delete, destructive-clean, or deployment instructions were added.
Supabase Project And Schema Safety	✅ Passed	Only Dockerfile.worker and a regression test changed; no Supabase project refs, env examples, migrations, RLS, or schema/data files were touched.
Runtime And Package Manager Integrity	✅ Passed	The PR only changes a test; package.json, lockfile, .npmrc, and Dockerfile.worker keep the Node 24/npm 11 + npm ci workflow unchanged.
Api Route Failure Handling	✅ Passed	PASS: PR only reroutes worker startup through an existing fail-closed runner and adds a guard test; no API/route/provider logic changes or new silent-failure paths.

✨ Finishing Touches

📝 Generate docstrings

• ✅ Generated successfully - (🔄 Check to regenerate)
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/worker-server-only-boot

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/worker-server-only-boot

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/tsx-server-only-runner.test.ts`:
- Around line 21-28: Update the Dockerfile command assertion in the test to
parse the JSON CMD declaration and compare the complete command vector against
["node", "scripts/run-tsx.mjs", "worker/index.ts"]. Replace the substring-based
checks around cmdLine so direct tsx invocations cannot satisfy the startup
contract.

🪄 Autofix (Beta)

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d065acc1-8106-45da-8a66-7b5af2302cab

📥 Commits

Reviewing files that changed from the base of the PR and between 70ec640 and e5daafd.

📒 Files selected for processing (2)

• Dockerfile.worker
• tests/tsx-server-only-runner.test.ts

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[coderabbitai]

Caution

Docstrings generation - FAILED

No docstrings were generated.

Ok