chore: sync fork to upstream protoAgent v0.104.5 (379 commits)

.dockerignore

@@ -53,7 +53,7 @@ node_modules/
 
 # Seccomp profile — Docker reads this on the host at runtime
 # (via docker-compose security_opt), NOT from inside the image
-seccomp-profile.json
+deploy/seccomp-profile.json
 
 # OS junk
 .DS_Store

.github/ISSUE_TEMPLATE/bug.yml

@@ -24,20 +24,13 @@ body:
       description: Minimal steps, logs, or a stack trace that demonstrate it.
     validations:
       required: true
-  - type: textarea
-    id: expected-actual
-    attributes:
-      label: Expected vs. actual
-      description: What you expected to happen, and what actually happened.
-    validations:
-      required: true
   - type: textarea
     id: acceptance
     attributes:
       label: Acceptance
       description: How we'll know it's fixed — verifiable criteria.
     validations:
-      required: true
+      required: false
   - type: input
     id: env
     attributes:

.github/workflows/checks.yml

@@ -25,6 +25,12 @@ jobs:
         with:
           node-version: "20"
       - name: Verify workspace config (.beads / .automaker / owned runners)
+        # Fork-friendly (#1534): the .beads/.automaker/owned-runner baseline is the
+        # protoLabs *fleet* standard, so it runs across the fleet (protoLabsAI/*) —
+        # keeping gina/protoTrader/roxy conformant — but is skipped on external forks,
+        # which are free to diverge. The job stays green either way (the server.py
+        # guard below still runs everywhere).
+        if: startsWith(github.repository, 'protoLabsAI/')
         # The npm package is still 1.0.0 (predates verify-workspace-config),
         # so run the script directly. It's zero-dependency (node builtins
         # only), so no `npm install` is needed. Switch to
@@ -83,6 +89,35 @@ jobs:
         run: |
           pip install import-linter==2.11
           lint-imports
+      - name: Third-party attribution in sync
+        # THIRD_PARTY_LICENSES.md is generated from uv.lock + package-lock.json
+        # by scripts/gen_attribution.py. This gate re-derives the dependency
+        # inventory from those committed lockfiles and fails if the manifest
+        # drifted — i.e. someone bumped a dep without regenerating attribution.
+        # Reads only committed files (stdlib-only, no `uv sync` / `npm ci`), so
+        # it's fast and can't flake on platform differences. To fix a failure:
+        # `uv sync && uv run python scripts/gen_attribution.py`.
+        run: python scripts/gen_attribution.py --check
+      - uses: astral-sh/setup-uv@v6
+        with:
+          # Pinned like ruff/import-linter above, and for a sharper reason: uv's lock
+          # OUTPUT is version-dependent. 0.11.29 and 0.11.13 disagree about how to record
+          # dependency markers (0.11.29 drops `python_full_version < '3.13'` from aiologic
+          # /culsans), so an unpinned `latest` rewrites uv.lock whenever uv ships — the
+          # file then thrashes based on whose uv ran last, and this gate is the thing that
+          # notices. 0.11.29 produced the lock currently on main.
+          # To bump: change BOTH here and in prepare-release.yml (they must match), then
+          # run `uv lock` once and commit the result.
+          version: "0.11.29"
+      - name: Lockfile in sync with pyproject
+        # uv.lock silently rotted for a full release cycle (#1998): it kept a
+        # `git+https` ref for protolabs-a2a after pyproject moved to the PyPI range,
+        # and — because that project's 0.2.0/0.2.1 ship different APIs — any
+        # `--frozen`/`--locked` install pulled a build the runtime can't call. Nothing
+        # caught it: the CI jobs install with plain `pip`, so uv.lock is only read by
+        # the attribution gate above (which tolerates a stale project version).
+        # Fails when pyproject.toml and uv.lock disagree. To fix: `uv lock`.
+        run: uv lock --check
 
   tests:
     name: Python tests
@@ -176,6 +211,11 @@ jobs:
         with:
           node-version: "20"
           cache: npm
+      # The lockfile is npm-11-shaped (PROTO.md: npm-10 arborist no-ops workspace
+      # dep bumps and disagrees with 11 about peer-stub reachability, so its `ci`
+      # rejects an 11-generated lock). Pin every root `npm ci`/`install` to 11.
+      - name: Use npm 11
+        run: npm install -g npm@11
       - name: Install dependencies
         run: npm ci
       - name: Run unit tests (vitest)

.github/workflows/desktop-build.yml

@@ -19,26 +19,35 @@ name: Desktop Build
 # updater bundles, and the updater-manifest fan-in job composes latest.json
 # (the manifest the in-app updater polls) onto the release — uploaded last.
 #
-# Fires on EVERY semver tag push (patch included) alongside release.yml's Docker build,
-# and on manual dispatch. Patches used to be skipped to save CI minutes, but this repo is
-# public so GitHub-hosted runners (incl. the 10×/2× macOS/Windows legs) are free +
-# unlimited — so every release, patch or minor, ships fresh desktop binaries and an
-# updated latest.json (no more hand-attaching a patch's binaries). macOS builds are signed
-# only when the full Apple secret set is present; Linux/Windows are always unsigned. See
-# ADR 0010 (UI tiers / desktop).
+# Runs on MANUAL DISPATCH ONLY (workflow_dispatch) — deliberately NOT on tag pushes.
+# The macOS (10×) and Windows (2×) legs are this repo's only paid CI, and building the
+# full matrix on EVERY semver tag (dozens/month at current release cadence) was the
+# dominant cost — so desktop drops are now on-demand instead of per-release. Tag pushes
+# still ship the Docker image + a (non-Latest) GitHub Release via release.yml; only the
+# desktop binaries wait for a dispatch.
+#
+# Two dispatch modes, keyed off the `tag` input:
+#   • WITH a `tag` (a vX.Y.Z) → a real desktop RELEASE: binaries attach to that GitHub
+#     Release, the fan-in composes latest.json, and the release is promoted to 'Latest'
+#     (release.yml creates releases --latest=false; the promotion happens here). This is
+#     how a desktop update reaches users' in-app updater.
+#   • WITHOUT a tag (dispatched from a branch) → a TEST build: bundles upload as workflow
+#     artifacts only; no release, no latest.json, no 'Latest' change.
+#
+# macOS builds are signed only when the full Apple secret set is present; Linux/Windows
+# are always unsigned. The repo guard keeps forks from running the matrix. See ADR 0010
+# (UI tiers / desktop) and docs/guides/releasing.md § Desktop.
 
 on:
-  push:
-    tags:
-      - 'v*.*.*'
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Tag/ref to build against (blank = current ref)'
+        description: 'Tag to publish a desktop release for (vX.Y.Z). Blank = test build (artifacts only, no release).'
         required: false
 
 concurrency:
-  group: desktop-build-${{ github.ref }}
+  # Keyed on the dispatched tag (or ref) so two release dispatches don't collide.
+  group: desktop-build-${{ inputs.tag || github.ref }}
   cancel-in-progress: false
 
 permissions:
@@ -47,12 +56,11 @@ permissions:
 jobs:
   build:
     name: ${{ matrix.target }}
-    # Build on every semver tag push (patch included) + any manual dispatch. The old
-    # patch-skip was a CI-cost guard; it's unnecessary on a public repo where GH-hosted
-    # runners are free, and it meant patch desktop fixes never reached users (their
-    # binaries weren't attached and latest.json kept pointing at the last minor). The
-    # repo guard keeps forks from running the matrix.
-    if: github.repository == 'protoLabsAI/protoAgent'
+    # Manual dispatch only (see the `on:` block) — the tag-push trigger was retired
+    # because the macOS/Windows matrix on every release was the repo's dominant CI cost.
+    # Fork-friendly (#1534): a fork can dispatch its own (unsigned) build; the repo
+    # clause keeps forks from auto-building should a tag trigger ever return.
+    if: github.repository == 'protoLabsAI/protoAgent' || github.event_name == 'workflow_dispatch'
     # Per-leg runner, overridable by repo variable so the expensive macOS/Windows
     # legs can move off GitHub-hosted runners (10×/2× billing multipliers) onto
     # Namespace profiles WITHOUT editing this file — the moment the org provisions
@@ -143,6 +151,7 @@ jobs:
         # desktop. Generate it now (into public/_ds) so build_sidecar can bundle it. The
         # root install also wires the @protoagent/web workspace for the tauri build below.
         run: |
+          npm install -g npm@11  # npm-11-shaped lockfile — npm 10's `ci` rejects it (see PROTO.md)
           npm ci
           node apps/web/scripts/copy-plugin-kit.mjs
           ls -la apps/web/public/_ds/
@@ -199,8 +208,8 @@ jobs:
           SIGNED="unsigned (dev)"
           if [ "${RUNNER_OS}" = "macOS" ]; then
             # tauri-bundler signs as soon as *any* Apple secret is set, then fails
-            # if the set is incomplete. Require the full set; otherwise unset all so
-            # a dispatch build falls back cleanly to unsigned.
+            # if the set is incomplete. Require the full set for a tagged (publish)
+            # dispatch; a test build (no tag) unsets all and falls back to unsigned.
             if [ -n "${APPLE_CERTIFICATE}" ] && [ -n "${APPLE_CERTIFICATE_PASSWORD}" ] \
                && [ -n "${APPLE_SIGNING_IDENTITY}" ] && [ -n "${APPLE_API_ISSUER}" ] \
                && [ -n "${APPLE_API_KEY}" ] && [ -n "${APPLE_API_KEY_BASE64}" ] \
@@ -210,8 +219,8 @@ jobs:
               python3 -c 'import base64,os,sys; open(sys.argv[1],"wb").write(base64.b64decode(os.environ["APPLE_API_KEY_BASE64"]))' "$KEYFILE"
               export APPLE_API_KEY_PATH="${KEYFILE}"
               SIGNED="Developer ID (signed + notarized)"
-            elif [ "${{ github.event_name }}" = "push" ]; then
-              echo "::error::Semver-tag desktop releases require the full Apple signing secret set."
+            elif [ -n "${{ inputs.tag }}" ]; then
+              echo "::error::A tagged desktop release (tag=${{ inputs.tag }}) requires the full Apple signing secret set."
               exit 2
             else
               unset APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY \
@@ -335,45 +344,45 @@ jobs:
           if [ "${{ steps.build.outputs.signed }}" = "true" ]; then FLAG="--require-signed"; fi
           scripts/verify-macos-desktop.sh $FLAG dist-desktop/*.dmg
 
-      - name: Upload dispatch artifact
-        if: github.event_name == 'workflow_dispatch'
+      - name: Upload test-build artifact
+        # No tag → a test build: bundles are downloadable workflow artifacts only.
+        if: inputs.tag == ''
         uses: actions/upload-artifact@v6
         with:
           name: protoAgent-${{ steps.version.outputs.version }}-${{ matrix.target }}
           path: dist-desktop/*
 
       - name: Attach to release
-        if: github.event_name == 'push'
+        # A tag → publish: attach binaries to that GitHub Release (fan-in adds latest.json).
+        if: inputs.tag != ''
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload "${{ steps.version.outputs.tag }}" dist-desktop/* --clobber
 
   # Fan-in: compose latest.json from every leg's signed updater bundle and
   # upload it LAST, so the manifest never points at assets that don't exist
-  # yet. Runs only on semver tags, and only once ALL legs succeeded (a partial
-  # manifest would skew versions across platforms). If the release carries no
-  # updater bundles (key wasn't present), it skips — in-app updates are simply
-  # disabled for that release.
+  # yet. Runs only for a tagged (publish) dispatch, and only once ALL legs
+  # succeeded (a partial manifest would skew versions across platforms). If the
+  # release carries no updater bundles (key wasn't present), it skips — in-app
+  # updates are simply disabled for that release.
   updater-manifest:
     name: updater manifest (latest.json)
     needs: build
-    # Runs on every tag push (patch included) so the in-app updater's latest.json is
-    # refreshed for every release. Gated to `push` so a manual dispatch (which builds
-    # artifacts, with no release to attach to) doesn't try to compose a manifest;
-    # `needs: build` ties it to a successful matrix.
+    # Only for a publish dispatch (a `tag` was supplied) — a test build (no tag) has no
+    # release to attach a manifest to. `needs: build` ties it to a successful matrix.
     if: >-
-      github.event_name == 'push' && github.repository == 'protoLabsAI/protoAgent'
+      inputs.tag != '' && github.repository == 'protoLabsAI/protoAgent'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 10
     steps:
       # Checkout at the tag so we can read the rolled CHANGELOG.md section for the
-      # in-app updater notes (below). By tag-push time CHANGELOG.md already holds the
+      # in-app updater notes (below). By publish time CHANGELOG.md already holds the
       # dated `## [VERSION]` section — the bump PR (prepare-release.yml) merged before
       # the tag. Without this the job has no working tree (it only `gh release`s).
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.ref_name }}
+          ref: ${{ inputs.tag }}
 
       - name: Setup Node
         uses: actions/setup-node@v5
@@ -386,7 +395,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          TAG="${{ github.ref_name }}"
+          TAG="${{ inputs.tag }}"
           VERSION="${TAG#v}"
           mkdir -p updater-dist
           gh release download "$TAG" --repo "${{ github.repository }}" --dir updater-dist \
@@ -397,12 +406,19 @@ jobs:
             exit 0
           fi
           # Updater notes, best → worst source:
-          #   1. The curated CHANGELOG.md section for this version (the human-written
-          #      "### Added/Changed/Fixed" markdown) — what the in-app UpdateNotice renders.
-          #   2. The GitHub Release body (auto-generated commit subjects) — used when the
-          #      CHANGELOG section is empty (e.g. a patch with no [Unreleased] bullets).
-          #   3. A generic placeholder, if both are empty.
-          NOTES="$(python3 scripts/changelog.py notes "$VERSION" 2>/dev/null || true)"
+          #   1. The LLM-themed notes posted to Discord — release.yml uploads them as the
+          #      `release-notes.md` asset, so the in-app UpdateNotice renders the SAME text as
+          #      the Discord embed (one changelog, one voice — #1516).
+          #   2. The curated CHANGELOG.md section for this version (the human-written
+          #      "### Added/Changed/Fixed" markdown) — used when the LLM step didn't run
+          #      (e.g. a fork with no gateway key, or the Discord step failed).
+          #   3. The GitHub Release body (auto-generated commit subjects) — if both are empty.
+          #   4. A generic placeholder, if all are empty.
+          NOTES=""
+          if gh release download "$TAG" --repo "${{ github.repository }}" -p release-notes.md -D "$RUNNER_TEMP" --clobber 2>/dev/null; then
+            NOTES="$(cat "$RUNNER_TEMP/release-notes.md" 2>/dev/null || true)"
+          fi
+          [ -z "$NOTES" ] && NOTES="$(python3 scripts/changelog.py notes "$VERSION" 2>/dev/null || true)"
           [ -z "$NOTES" ] && NOTES="$(gh release view "$TAG" --repo "${{ github.repository }}" --json body -q .body 2>/dev/null || true)"
           [ -z "$NOTES" ] && NOTES="protoAgent ${TAG} — see the GitHub Release for details."
           npx --yes -p '@protolabsai/release-tools@latest' build-updater-manifest \

.github/workflows/docker-publish.yml

@@ -24,11 +24,16 @@ permissions:
 env:
   REGISTRY: ghcr.io
   # Normalise the image name — GHCR paths are case-sensitive and Docker refuses
-  # uppercase; github.repository would otherwise yield a mixed-case value.
-  IMAGE_NAME: protolabsai/leadengineer
+  # uppercase; github.repository would otherwise yield a mixed-case value. A fork
+  # that opts in (see the job guard) sets its own `IMAGE_NAME` repo variable.
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || 'protolabsai/protoagent' }}
 
 jobs:
   build-and-push:
+    # Fork-friendly (#1534): the hardcoded default pushes to protoLabs' GHCR, which
+    # forks can't write to. Only the canonical repo runs by default; a fork opts in
+    # by setting the `DOCKER_PUBLISH_ENABLED` repo variable (+ its own `IMAGE_NAME`).
+    if: github.repository == 'protoLabsAI/protoAgent' || vars.DOCKER_PUBLISH_ENABLED == 'true'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 30
 
@@ -55,8 +60,8 @@ jobs:
             type=raw,value=latest
             type=sha,prefix=sha-,format=short
           labels: |
-            org.opencontainers.image.title=leadengineer
-            org.opencontainers.image.description=leadEngineer — protoAgent Lead Engineer team bundle
+            org.opencontainers.image.title=protoagent
+            org.opencontainers.image.description=protoAgent — LangGraph + A2A template
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
 

.github/workflows/docs.yml

@@ -7,8 +7,11 @@ on:
   # PR-level gate (#976): vitepress fails the build on parse errors AND dead links,
   # so running docs:build here catches doc breakage at review time instead of letting
   # it merge green and only go red on the main-only deploy. Build-only — no deploy.
+  # Unfiltered on purpose: `build` is a REQUIRED check in the main ruleset, and a
+  # path-filtered required check never reports on non-matching PRs, blocking them
+  # forever. Running everywhere (~30s) is the price of making red docs unmergeable
+  # (a dead link once automerged and froze the Pages deploy on every main push).
   pull_request:
-    paths: ['docs/**', 'package.json', 'package-lock.json', '.github/workflows/docs.yml']
   workflow_dispatch:
 
 permissions:
@@ -31,6 +34,7 @@ jobs:
         with:
           node-version: 20
           cache: npm
+      - run: npm install -g npm@11  # keep resolution npm-11-consistent with the lockfile (see PROTO.md)
       - run: npm install
       - run: npm run docs:build
       - uses: actions/upload-pages-artifact@v5
@@ -41,8 +45,11 @@ jobs:
 
   deploy:
     needs: build
-    # Never deploy from a PR — PRs only validate the build above.
-    if: github.event_name != 'pull_request'
+    # Never deploy from a PR — PRs only validate the build above. Fork-friendly
+    # (#1534): deploys to protoLabs' GitHub Pages, so only the canonical repo runs
+    # it — a fork without Pages configured would otherwise get a deploy error. The
+    # `build` job above is unguarded on purpose: forks want it (catches VitePress breakage).
+    if: github.event_name != 'pull_request' && github.repository == 'protoLabsAI/protoAgent'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     environment:
       name: github-pages

.github/workflows/issue-gate.yml

@@ -61,9 +61,9 @@ jobs:
 
             const text = body.replace(/\s+/g, ' ').trim();
             const longEnough = text.length >= 80;
-            const hasProblem = hasSection(/problem|what'?s? wrong|motivation|background|context|summary/i);
-            const hasRepro = hasSection(/repro|reproduce|steps|evidence|expected|actual|observed/i);
-            const hasProposal = hasSection(/propos|solution|approach|direction|fix|design/i);
+            const hasProblem = hasSection(/problem|what'?s? wrong|motivation|background|context|summary|observed|symptom|idea|current behavior|\bwhat\b/i);
+            const hasRepro = hasSection(/repro|reproduce|steps|evidence|expected|actual|observed|symptom|root cause/i);
+            const hasProposal = hasSection(/propos|solution|approach|direction|fix|design|\bwork\b|plan/i);
             const hasAcceptance = hasSection(/acceptance|done when|success criteria|definition of done/i);
 
             const missing = [];