fix(ci): stabilization - lint, test, bundle fixes + artifact cleanup

.github/workflows/ci.yml

@@ -44,10 +44,21 @@ jobs:
         with:
           secret: '${{ secrets.GITHUB_TOKEN }}'
 
+  forbidden_artifacts:
+    name: 'Forbidden Artifacts'
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+      - name: 'Scan for forbidden artifacts'
+        run: 'node scripts/ci/forbidden-artifacts.js'
+
   ci_sanity:
     name: 'CI Sanity'
     runs-on: 'ubuntu-latest'
-    needs: 'merge_queue_skipper'
+    needs:
+      - 'merge_queue_skipper'
+      - 'forbidden_artifacts'
     if: "${{ needs.merge_queue_skipper.outputs.skip != 'true' }}"
     steps:
       - name: 'Checkout'
@@ -127,18 +138,6 @@ jobs:
       - name: 'Check version alignment (desktop)'
         run: 'node scripts/releasing/sync-desktop-version.js --check'
 
-  link_checker:
-    name: 'Link Checker'
-    runs-on: 'ubuntu-latest'
-    steps:
-      - name: 'Checkout'
-        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
-      - name: 'Link Checker'
-        uses: 'lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2' # ratchet: lycheeverse/lychee-action@v2.6.1
-        with:
-          args: '--verbose --accept 200,503 --exclude-path local/ ./**/*.md'
-          fail: true
-
   build:
     name: 'Build'
     runs-on: 'ubuntu-latest'
@@ -177,6 +176,10 @@ jobs:
       - 'ci_sanity'
     if: "${{ needs.merge_queue_skipper.outputs.skip != 'true' }}"
     steps:
+      - name: 'Configure git longpaths'
+        run: git config --global core.longpaths true
+        shell: bash
+
       - name: 'Checkout'
         uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
 
@@ -186,8 +189,21 @@ jobs:
           node-version-file: '.nvmrc'
           cache: 'npm'
 
+      - name: 'Set up Python'
+        uses: 'actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3' # ratchet:actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: 'Debug environment'
+        run: |
+          node -v
+          npm -v
+          npm config list
+          git --version
+          python --version || true
+
       - name: 'Install dependencies'
-        run: 'npm ci'
+        run: 'npm ci --verbose'
 
       - name: 'Build project'
         run: 'npm run build'
@@ -314,7 +330,7 @@ jobs:
     if: 'always()'
     needs:
       - 'lint'
-      - 'link_checker'
+
       - 'build'
       - 'windows_build'
       - 'codeql'
@@ -325,7 +341,7 @@ jobs:
       - name: 'Check all job results'
         run: |
           if [[ (${{ needs.lint.result }} != 'success' && ${{ needs.lint.result }} != 'skipped') || \
-               (${{ needs.link_checker.result }} != 'success' && ${{ needs.link_checker.result }} != 'skipped') || \
+
                (${{ needs.build.result }} != 'success' && ${{ needs.build.result }} != 'skipped') || \
                (${{ needs.windows_build.result }} != 'success' && ${{ needs.windows_build.result }} != 'skipped') || \
                (${{ needs.codeql.result }} != 'success' && ${{ needs.codeql.result }} != 'skipped') || \

.github/workflows/links.yml

@@ -1,14 +1,14 @@
 name: 'Links'
 
 on:
-  push:
-    branches: ['main']
-  pull_request:
-    branches: ['main']
-  repository_dispatch:
-  workflow_dispatch:
   schedule:
     - cron: '00 18 * * *'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'docs-terminai/**'
+      - '**/*.md'
+  workflow_dispatch:
 
 jobs:
   linkChecker:

.github/workflows/native-prebuild-win32.yml

@@ -0,0 +1,42 @@
+name: native-prebuild-win32
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'packages/cli/native/**'
+      - 'packages/cli/binding.gyp'
+      - '.github/workflows/native-prebuild-win32.yml'
+
+jobs:
+  build-win32-x64:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build native module
+        working-directory: packages/cli
+        run: npx node-gyp rebuild
+
+      - name: Package native artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          cp packages/cli/build/Release/terminai_native.node packages/native-win32-x64/terminai_native.node
+          cd packages/native-win32-x64
+          npm pack
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-win32-x64
+          path: packages/native-win32-x64/*.tgz

.gitignore

@@ -64,6 +64,7 @@ __pycache__/
 *.pyo
 .pytest_cache/
 venv/
+.venv/
 *.egg-info/
 
 # Local scratch files (not committed)
@@ -72,6 +73,8 @@ test_output*.txt
 packages/desktop/src-tauri/bin/
 packages/desktop/src-tauri/resources/
 packages/microvm/resources/vmlinux-x86_64.bin
+packages/microvm/resources/rootfs.ext4
+packages/microvm/resources/firecracker
 
 
 .env
@@ -92,3 +95,7 @@ local/*
 codex-cli/
 opencode/
 opencode-openai-auth/
+
+# Build artifacts
+packages/cli/build/
+packages/sandbox-image/python/build/

.husky/pre-commit

@@ -1,3 +1,4 @@
+#!/bin/sh
 npm run pre-commit || {
   echo ''
   echo '===================================================='

.husky/pre-push

@@ -1,5 +1,4 @@
 #!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
 
 echo "Running full local CI verification before push..."
 ./scripts/verify-ci.sh

.obsidian/workspace.json

@@ -27,12 +27,12 @@
             "state": {
               "type": "markdown",
               "state": {
-                "file": "Untitled.md",
+                "file": "RISK_ASSESSMENT.md",
                 "mode": "source",
                 "source": false
               },
               "icon": "lucide-file",
-              "title": "Untitled"
+              "title": "RISK_ASSESSMENT"
             }
           }
         ],
@@ -93,8 +93,7 @@
       }
     ],
     "direction": "horizontal",
-    "width": 300,
-    "collapsed": true
+    "width": 300
   },
   "right": {
     "id": "a6a4109701045f30",
@@ -201,51 +200,51 @@
   },
   "active": "726b256b2a615ff2",
   "lastOpenFiles": [
-    "local/auth_linux_windows_review_output_antigravity2.md",
-    "local/auth_linux_windows_review_output_antigravity.md",
-    "local/auth_linux_windows_review_output_antigravity 1.md",
-    "windsurf-stable.gpg",
-    "hi",
-    "local/auth_linux_windows_skills.md",
-    "opencode/turbo.json",
-    "opencode/tsconfig.json",
-    "opencode/themes/undertale.json",
-    "opencode/themes/deltarune.json",
-    "opencode/themes",
-    "opencode/sst.config.ts",
-    "opencode/sst-env.d.ts",
-    "opencode/specs/project.md",
-    "opencode/specs/perf-roadmap.md",
-    "opencode/specs/05-modularize-and-dedupe.md",
-    "opencode/specs/04-scroll-spy-optimization.md",
-    "opencode/specs/03-request-throttling.md",
-    "opencode/specs/02-cache-eviction.md",
-    "opencode/specs/01-persist-payload-limits.md",
-    "opencode/specs",
-    "opencode/sdks/vscode/README.md",
-    "opencode/packages/opencode/src/provider/sdk/openai-compatible/src/README.md",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxxhdpi/ic_launcher_round.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxxhdpi/ic_launcher_foreground.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxxhdpi/ic_launcher.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxhdpi/ic_launcher_round.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxhdpi/ic_launcher_foreground.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xxhdpi/ic_launcher.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xhdpi/ic_launcher_round.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xhdpi/ic_launcher_foreground.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-xhdpi/ic_launcher.png",
-    "opencode/packages/desktop/src-tauri/icons/prod/android/mipmap-mdpi/ic_launcher_round.png",
-    "opencode/packages/opencode/test/config/fixtures/no-frontmatter.md",
-    "opencode/packages/opencode/test/config/fixtures/frontmatter.md",
-    "opencode/packages/opencode/test/config/fixtures/empty-frontmatter.md",
-    "opencode/packages/opencode/src/acp/README.md",
-    "opencode/packages/desktop/src-tauri/icons/README.md",
-    "opencode/packages/console/app/README.md",
-    "opencode/packages/web/README.md",
-    "opencode/packages/slack/README.md",
-    "opencode/packages/opencode/README.md",
-    "opencode/packages/opencode/AGENTS.md",
-    "opencode/packages/docs/README.md",
-    "opencode/packages/enterprise/README.md",
-    "opencode/packages/app/README.md"
+    "packages/core/coverage/lcov-report/src/gui/protocol/types.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/protocol/schemas.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/service/index.html",
+    "packages/core/coverage/lcov-report/src/gui/protocol/index.html",
+    "packages/core/coverage/lcov-report/src/gui/service/DesktopAutomationService.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/selectors/resolve.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/selectors/parser.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/selectors/matcher.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/selectors/index.html",
+    "packages/core/coverage/lcov-report/src/gui/selectors/ast.ts.html",
+    "packages/core/coverage/lcov-report/src/gui/drivers/windowsUiaDriver.ts.html",
+    "packages/core/coverage/lcov-report/sort-arrow-sprite.png",
+    "packages/core/coverage/lcov-report/favicon.png",
+    "packages/core/coverage/sort-arrow-sprite.png",
+    "packages/core/coverage/favicon.png",
+    "local/tasks-fix-runtime.md",
+    "packages/vscode-ide-companion/coverage/sort-arrow-sprite.png",
+    "packages/vscode-ide-companion/coverage/favicon.png",
+    "packages/termai/dist/system.md",
+    "packages/cli/dist/src/commands/extensions/examples/context/terminaI.md",
+    "packages/desktop/dist/vite.svg",
+    "packages/desktop/dist/terminai-logo.svg",
+    "packages/desktop/dist/terminai-icon.svg",
+    "packages/desktop/dist/terminai-cursor.svg",
+    "GOVERNANCE.md",
+    "MAINTAINERS.md",
+    "README.md",
+    "RISK_ASSESSMENT.md",
+    "ROADMAP.md",
+    "SECURITY.md",
+    "TECHNICAL_SPEC.md",
+    "docs-terminai/roadmap/roadmap.md",
+    "packages/core/dist/docs/tools/web-search.md",
+    "packages/core/dist/docs/tools/web-fetch.md",
+    "packages/core/dist/docs/tools/todos.md",
+    "packages/core/dist/docs/tools/shell.md",
+    "packages/core/dist/docs/tools/memory.md",
+    "packages/core/dist/docs/tools/mcp-server.md",
+    "packages/core/dist/docs/tools/index.md",
+    "packages/core/dist/docs/tools/file-system.md",
+    "packages/core/dist/docs/ide-integration/index.md",
+    "packages/core/dist/docs/ide-integration/ide-companion-spec.md",
+    "packages/core/dist/docs/hooks/writing-hooks.md",
+    "packages/core/dist/docs/hooks/reference.md",
+    "packages/core/dist/docs/hooks/index.md",
+    "packages/core/dist/docs/hooks/best-practices.md"
   ]
 }

Untitled.md

@@ -0,0 +1,63 @@
+# Walkthrough - Sovereign Runtime Implementation
+
+**Current Status**: Phase 2 Complete (Docker Runtime Operational)
+
+## Phase 0: Restore Power (Completed)
+
+- **Bug Fix**: Addressed shell execution vulnerability/bug in 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+  LocalRuntimeContext.
+- **Verification**: Verified fix with regression tests.
+
+## Phase 1: Host Mode & T-APTS (Completed)
+
+- **Features**: Implemented 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/python.svg)
+  read_file, 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/python.svg)
+  write_file, 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/python.svg)
+  search_files in `terminai_apts.action.files`.
+- **Coverage**: Added unit tests in 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/python.svg)
+  packages/sandbox-image/python/tests/test_files.py.
+- **Integration**: Verified 
+  ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+  LocalRuntimeContext can successfully execute T-APTS.
+
+## Phase 2: Docker Runtime (Completed)
+
+- **Runtime Logic**:
+  - Revived 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    ContainerRuntimeContext.ts with full Docker integration.
+  - Implemented robust 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    initialize (init process, detached), 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    execute (execFile), and 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    spawn.
+  - Prioritized Container Runtime (Tier 1.5) in 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    RuntimeManager.
+- **Sandbox Build System**:
+  - **Fix**: Resolved infinite recursion loop in 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/js.svg)
+    build_sandbox.js by patching 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/node.svg)
+    packages/sandbox-image/package.json (`-s` flag).
+  - **Result**: Successfully built `terminai-sandbox:latest` and passed internal
+    contract tests.
+- **Verification**:
+  - Created and executed 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/ts.svg)
+    packages/cli/src/runtime/verify_container_context.ts.
+  - **Validated**: File write/read inside container and T-APTS 
+    ![](vscode-file://vscode-app/usr/share/antigravity/resources/app/extensions/theme-symbols/src/icons/files/python.svg)
+    read_file execution.
+
+## Next Steps
+
+- **Phase 3**: Micro-VM Integration (Firecracker/Cloud-Hypervisor).
+- **Phase 4**: Windows AppContainer Broker.

docker/Dockerfile.ci

@@ -0,0 +1,16 @@
+FROM node:20-bookworm
+
+# Install build dependencies for native modules
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 \
+    make \
+    g++ \
+    git \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Check node version matches .nvmrc (best effort, warns if mismatch)
+# RUN node -v
+
+CMD ["npm", "run", "preflight"]