Add CI workflows, CodeQL scanning, and convergence tests (#9)

* Add CI workflows, CodeQL scanning, and convergence tests

- GitHub Actions CI: build + typecheck + test on Node 22/24
- CodeQL security scanning on push/PR + weekly schedule
- 9 unit tests for convergence analysis and recommendation scoring
- Update test script to use tsx for direct TS execution

Closes #5

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Remove continue-on-error from test step — tests should fail the build

---------

Co-authored-by: unknown <that-github-user@github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [22, 24]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Check types
+        run: npx tsc --noEmit
+
+      - name: Test
+        run: npm test

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

package.json

@@ -9,7 +9,7 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsx src/cli.ts",
-    "test": "node --test dist/**/*.test.js"
+    "test": "tsx --test src/**/*.test.ts"
   },
   "keywords": ["ai", "coding", "ensemble", "claude", "claude-code", "consensus"],
   "author": "",

src/scoring/convergence.test.ts

@@ -0,0 +1,125 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { analyzeConvergence, recommend } from "./convergence.js";
+import type { AgentResult } from "../types.js";
+
+function makeAgent(overrides: Partial<AgentResult> & { id: number }): AgentResult {
+  return {
+    worktree: `/tmp/agent-${overrides.id}`,
+    status: "success",
+    exitCode: 0,
+    duration: 5000,
+    output: "",
+    diff: "some diff",
+    filesChanged: ["src/index.ts"],
+    linesAdded: 10,
+    linesRemoved: 5,
+    ...overrides,
+  };
+}
+
+describe("analyzeConvergence", () => {
+  it("returns empty for no agents", () => {
+    const result = analyzeConvergence([]);
+    assert.deepEqual(result, []);
+  });
+
+  it("returns empty when all agents failed", () => {
+    const agents = [
+      makeAgent({ id: 1, status: "error", diff: "" }),
+      makeAgent({ id: 2, status: "timeout", diff: "" }),
+    ];
+    const result = analyzeConvergence(agents);
+    assert.deepEqual(result, []);
+  });
+
+  it("groups agents that changed the same files", () => {
+    const agents = [
+      makeAgent({ id: 1, filesChanged: ["a.ts", "b.ts"] }),
+      makeAgent({ id: 2, filesChanged: ["a.ts", "b.ts"] }),
+      makeAgent({ id: 3, filesChanged: ["c.ts"] }),
+    ];
+    const groups = analyzeConvergence(agents);
+
+    assert.equal(groups.length, 2);
+    assert.deepEqual(groups[0]!.agents, [1, 2]);
+    assert.ok(groups[0]!.similarity > groups[1]!.similarity);
+    assert.deepEqual(groups[1]!.agents, [3]);
+  });
+
+  it("handles file order differences", () => {
+    const agents = [
+      makeAgent({ id: 1, filesChanged: ["b.ts", "a.ts"] }),
+      makeAgent({ id: 2, filesChanged: ["a.ts", "b.ts"] }),
+    ];
+    const groups = analyzeConvergence(agents);
+
+    assert.equal(groups.length, 1);
+    assert.deepEqual(groups[0]!.agents, [1, 2]);
+    assert.equal(groups[0]!.similarity, 1);
+  });
+
+  it("labels strong consensus at 80%+", () => {
+    const agents = [
+      makeAgent({ id: 1, filesChanged: ["a.ts"] }),
+      makeAgent({ id: 2, filesChanged: ["a.ts"] }),
+      makeAgent({ id: 3, filesChanged: ["a.ts"] }),
+      makeAgent({ id: 4, filesChanged: ["a.ts"] }),
+      makeAgent({ id: 5, filesChanged: ["b.ts"] }),
+    ];
+    const groups = analyzeConvergence(agents);
+
+    assert.ok(groups[0]!.description.includes("Strong consensus"));
+    assert.ok(groups[1]!.description.includes("Divergent"));
+  });
+});
+
+describe("recommend", () => {
+  it("returns null for no completed agents", () => {
+    const agents = [makeAgent({ id: 1, status: "error", diff: "" })];
+    assert.equal(recommend(agents, [], []), null);
+  });
+
+  it("prefers agents that pass tests", () => {
+    const agents = [
+      makeAgent({ id: 1, linesAdded: 20, linesRemoved: 10 }),
+      makeAgent({ id: 2, linesAdded: 5, linesRemoved: 2 }),
+    ];
+    const tests = [
+      { agentId: 1, passed: true },
+      { agentId: 2, passed: false },
+    ];
+    const convergence = analyzeConvergence(agents);
+
+    assert.equal(recommend(agents, tests, convergence), 1);
+  });
+
+  it("prefers agents in larger convergence group when tests are equal", () => {
+    const agents = [
+      makeAgent({ id: 1, filesChanged: ["a.ts"], linesAdded: 10, linesRemoved: 5 }),
+      makeAgent({ id: 2, filesChanged: ["a.ts"], linesAdded: 10, linesRemoved: 5 }),
+      makeAgent({ id: 3, filesChanged: ["b.ts"], linesAdded: 10, linesRemoved: 5 }),
+    ];
+    const tests = [
+      { agentId: 1, passed: true },
+      { agentId: 2, passed: true },
+      { agentId: 3, passed: true },
+    ];
+    const convergence = analyzeConvergence(agents);
+    const rec = recommend(agents, tests, convergence);
+
+    // Should pick agent 1 or 2 (in the majority group), not 3
+    assert.ok(rec === 1 || rec === 2);
+  });
+
+  it("prefers smaller diffs as tiebreaker", () => {
+    const agents = [
+      makeAgent({ id: 1, filesChanged: ["a.ts"], linesAdded: 50, linesRemoved: 20 }),
+      makeAgent({ id: 2, filesChanged: ["a.ts"], linesAdded: 5, linesRemoved: 2 }),
+    ];
+    const convergence = analyzeConvergence(agents);
+
+    // No test results — convergence is equal, so diff size decides
+    assert.equal(recommend(agents, [], convergence), 2);
+  });
+});