Feature/agent sec core/adapt anolisa cli

.github/CODEOWNERS

@@ -19,13 +19,21 @@
 # Component paths
 # ---------------------------------------------------------------------------
 /src/copilot-shell/                     @kongche-jbw @samchu-zsl    # auto-label: component:cosh
-/src/agentsight/                        @chengshuyi                 # auto-label: component:sight
+/src/agentsight/                        @chengshuyi @jfeng18        # auto-label: component:sight
 /src/agent-sec-core/                    @edonyzpc @kid9             # auto-label: component:sec-core
-/src/agent-sec-core/linux-sandbox/      @yanrong-hsr                # auto-label: component:sec-core
+/src/agent-sec-core/agent-sec-cli/      @RemindD @edonyzpc                  # auto-label: component:sec-core
+/src/agent-sec-core/cosh-extension/     @yangdao479                 # auto-label: component:sec-core
+/src/agent-sec-core/linux-sandbox/      @haosanzi                   # auto-label: component:sec-core
+/src/agent-sec-core/openclaw-plugin/    @RemindD                    # auto-label: component:sec-core
+/src/agent-sec-core/skills/             @1570005763                 # auto-label: component:sec-core
+/src/agent-sec-core/Makefile             @yangdao479                 # auto-label: component:sec-core
+/src/agent-sec-core/*.spec.in            @yangdao479                 # auto-label: component:sec-core
 /src/os-skills/                         @Ziqi002                    # auto-label: component:skill
 /src/ws-ckpt/                           @Ziqi002                    # auto-label: component:ckpt
 /src/osbase/                            @casparant                  # auto-label: component:osbase
 /src/tokenless/                         @Forrest-ly @shiloong       # auto-label: component:tokenless
+/src/agent-memory/                      @shiloong                   # auto-label: component:memory
+/src/anolisa/                           @kongche-jbw @ikunkun-sys   # auto-label: component:anolisa
 
 # ---------------------------------------------------------------------------
 # Scope paths
@@ -37,3 +45,7 @@
 /scripts/                               @samchu-zsl                 # auto-label: scope:scripts
 /cliff.toml                             @samchu-zsl                 # auto-label: scope:ci
 /Makefile                               @casparant                  # auto-label: scope:scripts
+
+# SkillFS is listed after generic Markdown scope rules so all files under
+# src/skillfs request the default SkillFS reviewers.
+/src/skillfs/                           @kongche-jbw @yummypeng     # auto-label: component:skillfs

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,69 +6,50 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to fill out this bug report!
-        Select the affected component below — the title will be prefixed automatically.
+        Please prefix the title with `[component]`, e.g. `[cosh] bug: login fails`.
+
+        **Tip:** Run `anolisa bug` to auto-generate diagnostic info, then paste the output into the "Diagnostic Output" field below.
   - type: dropdown
     id: component
     attributes:
       label: Component
       description: Which component is affected?
       options:
+        - anolisa
         - cosh
         - sec-core
         - skill
         - sight
         - tokenless
         - ckpt
+        - memory
+        - skillfs
         - other
     validations:
       required: true
   - type: textarea
     id: description
     attributes:
-      label: Bug Description
-      description: A clear and concise description of what the bug is.
-    validations:
-      required: true
-  - type: textarea
-    id: reproduction
-    attributes:
-      label: Steps to Reproduce
-      description: Steps to reproduce the behavior.
+      label: What happened?
+      description: Describe the bug and how to reproduce it.
       placeholder: |
-        1. Go to '...'
-        2. Run command '...'
-        3. See error '...'
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected Behavior
-      description: What did you expect to happen?
-    validations:
-      required: true
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: |
-        Please provide the following information:
-        - OS: [e.g. Anolis OS 8, Ubuntu 22.04]
-        - Component version: [e.g. cosh v2.1.0]
-        - Node.js version (if applicable): [e.g. 20.11.0]
-        - Python version (if applicable): [e.g. 3.12.3]
-        - Rust version (if applicable): [e.g. 1.80.0]
+        Bug description:
+
+        Steps to reproduce:
+        1. Run `anolisa ...`
+        2. Observe ...
+
+        Expected behavior:
     validations:
       required: true
   - type: textarea
-    id: logs
+    id: diagnostics
     attributes:
-      label: Relevant Log Output
-      description: Please copy and paste any relevant log output.
+      label: Diagnostic Output
+      description: Paste the output of `anolisa bug` (or `anolisa bug --capability <name>`).
       render: shell
   - type: textarea
     id: additional
     attributes:
       label: Additional Context
-      description: Add any other context about the problem here.
+      description: Screenshots, config snippets, or anything else that helps.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -21,6 +21,9 @@ body:
         - sight
         - tokenless
         - ckpt
+        - memory
+        - anolisa
+        - skillfs
         - other
     validations:
       required: true

.github/ISSUE_TEMPLATE/question.yml

@@ -20,6 +20,9 @@ body:
         - sight
         - tokenless
         - ckpt
+        - memory
+        - anolisa
+        - skillfs
         - other
   - type: textarea
     id: question

.github/actions/package-source/action.yaml

@@ -52,6 +52,7 @@ runs:
           tokenless)     SRC_DIR="src/tokenless" ;;
           os-skills)      SRC_DIR="src/os-skills" ;;
           ws-ckpt)        SRC_DIR="src/ws-ckpt" ;;
+          agent-memory)   SRC_DIR="src/agent-memory" ;;
           *)
             echo "ERROR: Unknown component: $COMPONENT"
             exit 1
@@ -100,7 +101,7 @@ runs:
         echo "LICENSE_BUILD_TARGET=${LICENSE_BUILD_TARGET}" >> $GITHUB_ENV
 
     # -----------------------------------------------------------------
-    # Step 3: Create source archive
+    # Step 3.1: Create source archive
     #
     # If Step 2 detected a LICENSE path reference, the resolved real
     # file is copied into the build tree before packaging so the archive
@@ -144,6 +145,49 @@ runs:
           cp -p "${LICENSE_REAL_PATH}" "/tmp/build/${ARCHIVE_NAME}/${LICENSE_BUILD_TARGET}"
         fi
 
+    # -----------------------------------------------------------------
+    # Step 3.2: Install plugin npm dependencies (ws-ckpt only)
+    #
+    # The source archive for ws-ckpt ships pre-installed node_modules
+    # so downstream consumers can use plugins without running npm.
+    # -----------------------------------------------------------------
+    - name: Setup Node.js (ws-ckpt)
+      if: inputs.component == 'ws-ckpt'
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install plugin npm dependencies (ws-ckpt)
+      if: inputs.component == 'ws-ckpt'
+      shell: bash
+      run: |
+        found=0
+        while IFS= read -r pkg; do
+          plugin_dir=$(dirname "$pkg")
+          echo "::group::npm install: ${plugin_dir#/tmp/build/${ARCHIVE_NAME}/}"
+          cd "$plugin_dir"
+          if [ -f package-lock.json ]; then
+            npm ci --ignore-scripts --omit=peer
+          else
+            npm install --ignore-scripts --omit=peer
+          fi
+          echo "::endgroup::"
+          found=$((found + 1))
+          cd /tmp/build/${ARCHIVE_NAME}
+        done < <(find /tmp/build/${ARCHIVE_NAME}/src/plugins -name 'package.json' -not -path '*/node_modules/*' 2>/dev/null)
+
+        if [ "$found" -eq 0 ]; then
+          echo "::warning::No plugin package.json found under src/plugins/"
+        else
+          echo "Installed npm dependencies for $found plugin(s)"
+        fi
+
+    # -----------------------------------------------------------------
+    # Step 3.3: Continue Create source archive
+    # -----------------------------------------------------------------
+    - name: Create source archive (tar)
+      shell: bash
+      run: |
         mkdir -p /tmp/archives
         tar -czf "/tmp/archives/${ARCHIVE_FILE}" \
           -C /tmp/build "${ARCHIVE_NAME}"

.github/commitlint.config.json

@@ -13,6 +13,9 @@
         "sight",
         "tokenless",
         "ckpt",
+        "memory",
+        "anolisa",
+        "skillfs",
         "deps",
         "ci",
         "docs",

.github/dependabot.yml

@@ -85,6 +85,45 @@ updates:
       - "deps"
       - "tokenless"
 
+  # agent-memory (cargo)
+  - package-ecosystem: "cargo"
+    directory: "/src/agent-memory"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+    open-pull-requests-limit: 0   # ← Toggle: 0 = off, 1 = on
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    groups:
+      cargo-minor-patch:
+        applies-to: "version-updates"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "deps"
+      - "agent-memory"
+
+  # SkillFS (cargo)
+  - package-ecosystem: "cargo"
+    directory: "/src/skillfs"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+    open-pull-requests-limit: 0   # ← Toggle: 0 = off, 1 = on
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    groups:
+      cargo-minor-patch:
+        applies-to: "version-updates"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "deps"
+      - "skillfs"
 
   # GitHub Actions
   - package-ecosystem: "github-actions"

.github/maintainers.json

@@ -64,6 +64,9 @@
             "maintainers": [
                 {
                     "github": "chengshuyi"
+                },
+                {
+                    "github": "jfeng18"
                 }
             ]
         },
@@ -74,6 +77,33 @@
                     "github": "Ziqi002"
                 }
             ]
+        },
+        {
+            "label": "component:memory",
+            "maintainers": [
+                {
+                    "github": "shiloong"
+                }
+            ]
+        },
+        {
+            "label": "component:anolisa",
+            "maintainers": [
+                {
+                    "github": "kongche-jbw"
+                },
+                {
+                    "github": "ikunkun-sys"
+                }
+            ]
+        },
+        {
+            "label": "component:skillfs",
+            "maintainers": [
+                {
+                    "github": "kongche-jbw"
+                }
+            ]
         }
     ],
     "default": {

.github/pull_request_template.md

@@ -39,6 +39,10 @@ closes #
 - [ ] `skill` (os-skills)
 - [ ] `sight` (agentsight)
 - [ ] `tokenless` (tokenless)
+- [ ] `ckpt` (ws-ckpt)
+- [ ] `memory` (agent-memory)
+- [ ] `anolisa` (anolisa-cli)
+- [ ] `skillfs` (SkillFS)
 - [ ] Multiple / Project-wide
 
 ## Checklist
@@ -55,6 +59,9 @@ closes #
 - [ ] For `skill`: Skill directory structure is valid and shell scripts pass syntax check
 - [ ] For `sight`: `cargo clippy -- -D warnings` and `cargo fmt --check` pass
 - [ ] For `tokenless`: `cargo clippy -- -D warnings` and `cargo fmt --check` pass
+- [ ] For `memory` (Linux only): `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`, and `cargo test` pass
+- [ ] For `anolisa`: `cargo clippy --all-targets --locked -- -D warnings`, `cargo fmt --all --check`, and `cargo test --locked` pass
+- [ ] For `skillfs`: `cargo fmt --all --check`, `cargo clippy --workspace --all-targets -- -D warnings`, and `cargo test --workspace` pass
 - [ ] Lock files are up to date (`package-lock.json` / `Cargo.lock`)
 
 ## Testing

.github/workflows/_rpm-build.yaml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       component:
-        description: "Component to build (copilot-shell, agent-sec-core, agentsight, os-skills)"
+        description: "Component to build (copilot-shell, agent-sec-core, agentsight, os-skills, tokenless, ws-ckpt, agent-memory)"
         required: true
         type: string
       version:
@@ -33,7 +33,7 @@ on:
 jobs:
   build-rpm:
     name: "Build"
-    runs-on: ${{ inputs.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-22.04' }}
+    runs-on: [self-hosted, Linux, "${{ inputs.arch == 'arm64' && 'ARM64' || 'X64' }}", "${{ inputs.arch == 'arm64' && 'ubuntu-any' || 'ubuntu' }}"]
     container:
       image: alibaba-cloud-linux-4-registry.cn-hangzhou.cr.aliyuncs.com/alinux4/alinux4:latest
     steps:
@@ -62,6 +62,12 @@ jobs:
             ws-ckpt)
               dnf install -y rust cargo btrfs-progs rsync systemd-rpm-macros
               ;;
+            agent-memory)
+              # rusqlite (bundled) + git2 (vendored libgit2) need a C toolchain
+              # and cmake; systemd-devel provides libsystemd headers for the
+              # journald fan-out feature.
+              dnf install -y rust cargo cmake systemd-devel
+              ;;
             os-skills)
               # noarch, no extra build deps
               ;;