Harden sample replay JSON-RPC framing and move shim logs off stdout

[Copilot]

apply_samples.cjs could crash during sample replay when the safe-outputs MCP path emitted [debug] ... lines on stdout, causing sendJsonRpc to parse non-JSON text as a protocol frame. This blocked --use-samples replay for PR-creating tools.

• Protocol-safe logging for shimmed actions context

  • Updated actions/setup/js/shim.cjs so shimmed core.* logging writes to stderr via process.stderr.write(...) instead of console stdout paths.
  • Keeps MCP server stdout reserved for JSON-RPC frames.

• Defensive JSON-RPC parsing in replay driver

  • Updated actions/setup/js/apply_samples.cjs::sendJsonRpc to read line-by-line until a JSON object frame is found.
  • Non-JSON stdout lines are ignored; malformed JSON frames now raise a targeted parse error including request id/context.

• Focused regression coverage

  • Added sendJsonRpc unit tests in actions/setup/js/apply_samples.test.cjs for:
    • skipping interleaved debug lines before a valid JSON-RPC response
    • clear failure on malformed JSON-looking protocol lines

// apply_samples.cjs
while (true) {
  const { value, done } = await responseIterator.next();
  if (done) throw new Error(`...request id=${request.id}`);
  const line = typeof value === "string" ? value.trim() : "";
  if (!line) continue;
  if (!line.startsWith("{")) continue; // ignore interleaved debug/status lines
  return JSON.parse(line);
}

[Copilot]

Pull request overview

This PR hardens the deterministic sample replay driver (apply_samples.cjs) against non-protocol stdout output during MCP JSON-RPC exchanges, and adjusts the GitHub Actions core.* shim so diagnostic logging won’t corrupt JSON-RPC framing when MCP servers speak over stdout.

Changes:

• Redirected shimmed core.* logging in actions/setup/js/shim.cjs from console.* (stdout-mixed) to process.stderr.write(...) to keep stdout protocol-safe.
• Made apply_samples.cjs::sendJsonRpc more defensive by skipping non-JSON lines and surfacing targeted parse errors.
• Added focused unit tests for sendJsonRpc behavior around interleaved debug lines and malformed JSON frames.

Show a summary per file

File	Description
actions/setup/js/shim.cjs	Routes shim core.* logs to stderr to avoid stdout protocol corruption for JSON-RPC-speaking processes.
actions/setup/js/apply_samples.cjs	Makes JSON-RPC response parsing more resilient to non-JSON stdout lines and improves parse error reporting.
actions/setup/js/apply_samples.test.cjs	Adds unit tests covering the new sendJsonRpc framing/parse defenses.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1