fix(runtime): restore OAuth tool execution and transcript visibility

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.wasm binary
+*.zip binary
+*.tgz binary
+*.tar.gz binary

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [develop, beta, main]
   pull_request:
-    branches: [main]
+    branches: [develop, beta, main]
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -19,7 +19,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     env:
-      KODE_SKIP_BINARY_DOWNLOAD: "1"
+      KODE_SKIP_BINARY_DOWNLOAD: '1'
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout
@@ -28,21 +28,85 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: '1.3.14'
 
       - name: Install
-        run: bun install
+        run: bun install --frozen-lockfile
+
+      - name: Dependency audit
+        if: runner.os == 'Linux'
+        run: bun run security:audit
 
       - name: Format
         run: bun run format:check
         shell: bash
 
+      - name: Lint
+        run: bun run lint
+
       - name: Typecheck
         run: bun run typecheck
 
       - name: Test
-        run: bun test
+        run: bun run test
+        env:
+          # Each file still runs in its own Bun process. Three workers shorten
+          # the CI critical path while remaining below the local default of four.
+          KODE_TEST_CONCURRENCY: '3'
+
+      - name: Unit coverage gate
+        if: runner.os == 'Linux'
+        run: bun run test:unit:coverage
 
       - name: Build
         run: bun run build
 
+      - name: Performance gates
+        if: runner.os == 'Linux'
+        run: bun run perf:gate
+
+  kode-agent-sdk:
+    name: Kode Agent SDK
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: kode-agent-sdk
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: testpass123
+          POSTGRES_DB: kode_test
+        ports:
+          - 5433:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.19.0'
+          cache: npm
+          cache-dependency-path: kode-agent-sdk/package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Unit tests
+        run: npm run test:unit
+        env:
+          POSTGRES_HOST: localhost
+          POSTGRES_PORT: 5433
+          POSTGRES_DB: kode_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: testpass123

.github/workflows/dev-release.yml

@@ -6,9 +6,43 @@ on:
 
 concurrency:
   group: dev-release-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
+  verify:
+    runs-on: ubuntu-latest
+    env:
+      KODE_SKIP_BINARY_DOWNLOAD: '1'
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.3.14'
+
+      - name: Install
+        run: bun install --frozen-lockfile
+
+      - name: Dependency audit
+        run: bun run security:audit
+
+      - name: Format
+        run: bun run format:check
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Test
+        run: bun run test
+
   compute-version:
     runs-on: ubuntu-latest
     outputs:
@@ -17,11 +51,13 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.18.1'
+          node-version: '20.19.0'
 
       - name: Compute dev version
         id: version
@@ -33,108 +69,83 @@ jobs:
           echo "Dev version: ${DEV_VERSION}"
 
   build-binaries:
-    needs: compute-version
+    needs: [verify, compute-version]
     strategy:
       fail-fast: false
       matrix:
         include:
           - os: ubuntu-latest
-            target: bun-linux-x64
-            asset: kode-linux-x64
-          - os: ubuntu-latest
-            target: bun-linux-arm64
-            asset: kode-linux-arm64
-          - os: macos-latest
-            target: bun-darwin-x64
-            asset: kode-darwin-x64
           - os: macos-latest
-            target: bun-darwin-arm64
-            asset: kode-darwin-arm64
           - os: windows-latest
-            target: bun-windows-x64
-            asset: kode-win32-x64.exe
     runs-on: ${{ matrix.os }}
-    env:
-      KODE_SKIP_BINARY_DOWNLOAD: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.18.1'
+          node-version: '20.19.0'
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: '1.3.14'
 
       - name: Install
-        run: bun install
-
-      - name: Set package.json version (dev)
-        run: node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json'));p.version='${{ needs.compute-version.outputs.dev_version }}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
-
-      - name: Build binary
-        run: bun build src/entrypoints/index.ts --compile --target=${{ matrix.target }} --format=esm --outfile=${{ matrix.asset }}
+        run: bun install --frozen-lockfile
 
-      - name: Make binary executable
-        if: runner.os != 'Windows'
-        run: chmod +x ${{ matrix.asset }}
+      - name: Build Linux seccomp assets (Unix socket blocking)
+        if: runner.os == 'Linux'
+        run: node scripts/build-seccomp-assets.mjs --require --verbose
 
-      - name: Upload binary artifact
+      - name: Stage seccomp assets for publishing
+        if: runner.os == 'Linux'
+        run: |
+          set -euo pipefail
+          ARCH="$(node -p 'process.arch')"
+          mkdir -p "seccomp-assets/linux-${ARCH}"
+          cp "vendor/seccomp/${ARCH}/apply-seccomp" "seccomp-assets/linux-${ARCH}/apply-seccomp"
+          cp "vendor/seccomp/${ARCH}/unix-block.bpf" "seccomp-assets/linux-${ARCH}/unix-block.bpf"
+          chmod 755 "seccomp-assets/linux-${ARCH}/apply-seccomp" || true
+
+      - name: Upload seccomp assets artifact
+        if: runner.os == 'Linux'
         uses: actions/upload-artifact@v4
         with:
-          name: ${{ matrix.asset }}
-          path: ${{ matrix.asset }}
+          name: seccomp-linux-${{ matrix.os }}
+          path: seccomp-assets/**
           if-no-files-found: error
 
-  publish-npm:
-    needs: compute-version
-    runs-on: ubuntu-latest
-    env:
-      KODE_SKIP_BINARY_DOWNLOAD: "1"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20.18.1'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Install
-        run: bun install
-
       - name: Set package.json version (dev)
-        run: node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json'));p.version='${{ needs.compute-version.outputs.dev_version }}';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
+        run: node scripts/set-root-package-version.mjs
+        env:
+          DEV_VERSION: ${{ needs.compute-version.outputs.dev_version }}
 
-      - name: Typecheck
-        run: bun run typecheck
+      - name: Build (assets needed for standalone binary)
+        run: bun run build
 
-      - name: Test
-        run: bun test
+      - name: Ensure bundled ripgrep (current platform only)
+        run: bun run scripts/ensure-ripgrep.mjs --current-only
 
-      - name: Build (npm)
-        run: bun run build:npm
+      - name: Build binary
+        run: bun run build:binary
 
-      - name: Prepublish check
-        run: bun run scripts/prepublish-check.js
+      - name: Prepare release asset
+        id: asset
+        run: node scripts/prepare-release-asset.mjs
 
-      - name: "Publish npm (dist-tag: dev)"
-        run: npm publish --tag dev --access public --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.asset.outputs.asset }}
+          path: ${{ steps.asset.outputs.asset }}
+          if-no-files-found: error
 
   prerelease:
-    needs: [compute-version, build-binaries, publish-npm]
+    needs: [compute-version, build-binaries]
     runs-on: ubuntu-latest
     permissions:
       contents: write