ci: address review on OpenAPI contract checks (#37)

- Use fileURLToPath(import.meta.url) for REPO_ROOT in both scripts
  (portable on Windows and paths with spaces).
- Guard that the parsed spec is a non-null object before accessing
  properties, so `null`/array JSON yields a clean validation error
  instead of a TypeError crash. Covered by a new regression test.

Author: linfangw

scripts/test-openapi-contract.mjs

@@ -10,8 +10,9 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
+import { fileURLToPath } from "node:url";
 
-const REPO_ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), "..");
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const VALIDATOR = path.join(REPO_ROOT, "scripts/validate-openapi-contract.mjs");
 const REAL_SPEC = path.join(REPO_ROOT, "docs/openapi/qveris-public-api.openapi.json");
 const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "qveris-openapi-contract-"));
@@ -46,6 +47,13 @@ const tests = [
     assert.equal(result.status, 1);
     assert.match(result.stderr, /not valid JSON/);
   }],
+  ["rejects valid JSON that is not an object", () => {
+    const target = path.join(tmpRoot, "null.json");
+    fs.writeFileSync(target, "null");
+    const result = run(target);
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, /not a valid OpenAPI object/);
+  }],
   ["rejects missing info.version", () => {
     const target = writeSpec("no-version.json", (spec) => {
       delete spec.info.version;

scripts/validate-openapi-contract.mjs

@@ -12,8 +12,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
+import { fileURLToPath } from "node:url";
 
-const REPO_ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), "..");
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const DEFAULT_SPEC = path.join("docs", "openapi", "qveris-public-api.openapi.json");
 
 // Core agent-path endpoints the toolkit calls. Listed in the issue.
@@ -73,6 +74,11 @@ function main() {
     return;
   }
 
+  if (!spec || typeof spec !== "object" || Array.isArray(spec)) {
+    fail([`${rel} is not a valid OpenAPI object`]);
+    return;
+  }
+
   if (typeof spec.openapi !== "string" || !spec.openapi) {
     errors.push("missing top-level `openapi` version string");
   }