fix: PR #2 レビュー指摘の修正

- session DELETE を 204 bodyless レスポンスに修正
- DALL-E 2 マスク方向を反転（境界辺を保持側に）
- OPENAI_API_KEY 未設定時にコンストラクタで早期エラー
- EventEmitter に setMaxListeners(0) を追加
- SSE controller.close() を try-catch で保護
- SESSION_SECRET 検証をモジュールトップレベルへ移動
- CI に SESSION_SECRET / DATABASE_URL 環境変数を追加
- expansion-panel.tsx の body インデントを修正
- AGENTS.md の Testing Guidelines を Vitest に更新

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kwrkb

.github/workflows/ci.yml

@@ -15,3 +15,6 @@ jobs:
       - run: npx tsc --noEmit
       - run: npm run build
       - run: npm test
+        env:
+          SESSION_SECRET: test-secret-at-least-32-characters-long
+          DATABASE_URL: file:./test.db

AGENTS.md

@@ -25,10 +25,10 @@
 - Prefer `@/*` path alias imports over deep relative paths.
 
 ## Testing Guidelines
-- No dedicated test framework is configured yet.
+- Use Vitest for unit and integration tests. Run tests with `npm run test`.
 - Before opening a PR, run `npx tsc --noEmit` and `npm run build`.
 - Validate core flows manually: user setup, room creation, expansion run/adopt/reject, and lock behavior.
-- If adding tests, colocate near source as `*.test.ts` / `*.test.tsx` and document the run command in your PR.
+- Colocate tests near source as `*.test.ts` / `*.test.tsx`.
 
 ## Commit & Pull Request Guidelines
 - Follow concise, imperative commit messages; `fix: ...` style (Conventional Commit prefix) is preferred.

src/app/api/rooms/[id]/events/route.ts

@@ -33,7 +33,11 @@ export async function GET(
       const onAbort = () => {
         clearInterval(keepAlive);
         unsubscribe();
-        controller.close();
+        try {
+          controller.close();
+        } catch {
+          // already closed
+        }
       };
 
       req.signal.addEventListener("abort", onAbort, { once: true });

src/app/api/session/route.ts

@@ -13,7 +13,7 @@ export async function GET(req: NextRequest) {
 }
 
 export async function DELETE() {
-  const response = NextResponse.json(null, { status: 204 });
+  const response = new NextResponse(null, { status: 204 });
   destroySession(response);
   return response;
 }

src/components/expansion/expansion-panel.tsx

@@ -68,14 +68,14 @@ export function ExpansionPanel({
       const expRes = await fetch(`/api/rooms/${roomId}/expansions`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            fromTileId: fromTile.id,
-            targetX,
-            targetY,
-            direction,
-            promptJson: { text: promptText.trim() },
-          }),
-        });
+        body: JSON.stringify({
+          fromTileId: fromTile.id,
+          targetX,
+          targetY,
+          direction,
+          promptJson: { text: promptText.trim() },
+        }),
+      });
 
       if (!expRes.ok) {
         const data = await expRes.json().catch(() => ({}));

src/lib/image-gen/dalle2-provider.ts

@@ -40,10 +40,12 @@ function createMaskBuffer(size: number, direction: Direction): Buffer {
       const offset = (y * size + x) * channels;
       let shouldEdit = false;
 
-      if (direction === "E") shouldEdit = x >= size / 2;
-      if (direction === "W") shouldEdit = x < size / 2;
-      if (direction === "S") shouldEdit = y >= size / 2;
-      if (direction === "N") shouldEdit = y < size / 2;
+      // 透明部分（AIが生成する）は新タイルと接しない辺側。
+      // 保持部分（不透明）は元タイルの境界辺側として残し、AIの継ぎ目生成に利用する。
+      if (direction === "E") shouldEdit = x < size / 2;
+      if (direction === "W") shouldEdit = x >= size / 2;
+      if (direction === "S") shouldEdit = y < size / 2;
+      if (direction === "N") shouldEdit = y >= size / 2;
 
       if (shouldEdit) {
         data[offset] = 0;
@@ -66,9 +68,11 @@ export class DallE2ImageGenProvider implements ImageGenProvider {
   private client: OpenAI;
 
   constructor() {
-    this.client = new OpenAI({
-      apiKey: process.env.OPENAI_API_KEY,
-    });
+    const apiKey = process.env.OPENAI_API_KEY;
+    if (!apiKey) {
+      throw new Error("OPENAI_API_KEY environment variable is not set");
+    }
+    this.client = new OpenAI({ apiKey });
   }
 
   async generate(input: GenerateInput): Promise<GenerateOutput> {

src/lib/session.ts

@@ -9,28 +9,28 @@ export interface SessionUser {
   displayName: string;
 }
 
-function getSessionSecret(): string {
+const SESSION_SECRET = (() => {
   const secret = process.env.SESSION_SECRET;
   if (!secret || secret.length < 32) {
     throw new Error("SESSION_SECRET must be set and at least 32 characters long");
   }
   return secret;
-}
+})();
 
 export async function getSession(req: NextRequest): Promise<SessionUser | null> {
   const sealed = req.cookies.get(SESSION_COOKIE_NAME)?.value;
   if (!sealed) return null;
 
   try {
-    return await unsealData<SessionUser>(sealed, { password: getSessionSecret() });
+    return await unsealData<SessionUser>(sealed, { password: SESSION_SECRET });
   } catch {
     return null;
   }
 }
 
 export async function setSession(res: NextResponse, user: SessionUser) {
   const sealed = await sealData(user, {
-    password: getSessionSecret(),
+    password: SESSION_SECRET,
     ttl: SESSION_TTL_SECONDS,
   });
 

src/lib/sse-emitter.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from "events";
 
 const emitter = new EventEmitter();
+emitter.setMaxListeners(0);
 
 function roomEventKey(roomId: string) {
   return `room:${roomId}`;