Merge upstream main into fix/nsjail-no-cgroup-clone

.github/scripts/next-release-version.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 <current-vMAJOR.MINOR.PATCH> <git-revision-range>" >&2
+  exit 2
+fi
+
+CURRENT_TAG="$1"
+REVISION_RANGE="$2"
+
+if [[ ! "$CURRENT_TAG" =~ ^v([0-9]+)[.]([0-9]+)[.]([0-9]+)$ ]]; then
+  echo "current release must be a stable vMAJOR.MINOR.PATCH tag (got '$CURRENT_TAG')" >&2
+  exit 2
+fi
+
+# Documentation, workflow, and test-only changes remain auditable in git but do
+# not produce a deployable release. Any unrecognised path is treated as
+# deployable so a newly added runtime component cannot silently miss a release.
+DEPLOYABLE=false
+while IFS= read -r path; do
+  case "$path" in
+    .github/*|docs/*|tests/*|*.md|*/README|*/README.*|*.test.*|*.spec.*)
+      ;;
+    *)
+      DEPLOYABLE=true
+      break
+      ;;
+  esac
+done < <(git diff --name-only "$REVISION_RANGE")
+
+if [ "$DEPLOYABLE" = "false" ]; then
+  exit 0
+fi
+
+COMMIT_MESSAGES="$(git log --format='%s%n%b' "$REVISION_RANGE")"
+BUMP=patch
+
+if grep -Eq '^[[:alnum:]_-]+(\([^)]*\))?!:' <<<"$COMMIT_MESSAGES" \
+   || grep -Eq '^BREAKING([ -])CHANGE:' <<<"$COMMIT_MESSAGES"; then
+  BUMP=major
+elif grep -Eq '^feat(\([^)]*\))?:' <<<"$COMMIT_MESSAGES"; then
+  BUMP=minor
+fi
+
+VERSION="${CURRENT_TAG#v}"
+IFS=. read -r MAJOR MINOR PATCH <<<"$VERSION"
+
+case "$BUMP" in
+  major)
+    MAJOR=$((MAJOR + 1))
+    MINOR=0
+    PATCH=0
+    ;;
+  minor)
+    MINOR=$((MINOR + 1))
+    PATCH=0
+    ;;
+  patch)
+    PATCH=$((PATCH + 1))
+    ;;
+esac
+
+printf 'v%s.%s.%s\n' "$MAJOR" "$MINOR" "$PATCH"

.github/scripts/resolve-release-version.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+
+# Resolves which version a release run publishes, or decides that it publishes
+# nothing, and records the decision in $GITHUB_OUTPUT. Extracted from
+# .github/workflows/release.yml so the four entry paths — an automatic release
+# after CI, a rerun resuming a release whose tag was already cut, a dispatch,
+# and a pushed tag — are covered by tests/release-version-resolution.sh.
+#
+# Inputs arrive as environment variables, mirroring the workflow's env block:
+#
+#   EVENT_NAME     github.event_name
+#   HEAD_SHA       github.event.workflow_run.head_sha
+#   INPUT_VERSION  github.event.inputs.version
+#   INPUT_DRAFT    github.event.inputs.draft
+#   REF_NAME       github.ref_name
+#   REF_TYPE       github.ref_type
+#   GH_TOKEN       a token `gh release view` can read releases with
+#
+# Outputs: skip, and for a real release version, app_version, chart_version,
+# prerelease, latest, draft. Run from the repository root; the chart fields are
+# read from helm/codeapi/Chart.yaml relative to it.
+
+set -euo pipefail
+
+EVENT_NAME="${EVENT_NAME:-}"
+HEAD_SHA="${HEAD_SHA:-}"
+INPUT_VERSION="${INPUT_VERSION:-}"
+INPUT_DRAFT="${INPUT_DRAFT:-}"
+REF_NAME="${REF_NAME:-}"
+REF_TYPE="${REF_TYPE:-}"
+GITHUB_OUTPUT="${GITHUB_OUTPUT:?GITHUB_OUTPUT must name the step output file}"
+
+STABLE_TAG_PATTERN='^v[0-9]+[.][0-9]+[.][0-9]+$'
+
+# `grep` exits 1 when nothing matches, and under `pipefail` that would abort the
+# step. A commit with no stable tag is the ordinary state of `main`, so a
+# no-match reads as an empty answer while a genuine grep failure — exit 2 and
+# above — still fails the release.
+select_stable_tags() {
+  local status=0
+  grep -E "$STABLE_TAG_PATTERN" || status=$?
+  [ "$status" -le 1 ]
+}
+
+# Highest stable tag among those `git tag` selects, empty when there are none.
+newest_stable_tag() {
+  git tag "$@" | select_stable_tags | sort -V | tail -n 1
+}
+
+# The commit a tag resolves to. The caller first verifies that the ref exists,
+# so a failure here means the tag ultimately names a non-commit object.
+tag_commit() {
+  git rev-parse -q --verify "refs/tags/$1^{commit}"
+}
+
+SKIP=false
+VERSION=""
+HEAD_COMMIT=""
+
+if [ "$EVENT_NAME" = "workflow_run" ]; then
+  HEAD_COMMIT="$(git rev-parse HEAD)"
+  if [ "$HEAD_COMMIT" != "$HEAD_SHA" ]; then
+    echo "::error::Checked out SHA does not match the successful CI run"
+    exit 1
+  fi
+
+  REMOTE_MAIN_SHA="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+  if [ -z "$REMOTE_MAIN_SHA" ]; then
+    echo "::error::Could not resolve the current main branch tip"
+    exit 1
+  fi
+  if [ "$REMOTE_MAIN_SHA" != "$HEAD_SHA" ]; then
+    echo "main advanced after this CI run; the newer successful run will release the combined changes"
+    SKIP=true
+  fi
+
+  # A rerun after tag creation but before release publication resumes the
+  # missing release rather than incrementing the version again.
+  EXACT_TAG="$(newest_stable_tag --points-at HEAD)"
+  if [ "$SKIP" = "false" ] && [ -n "$EXACT_TAG" ]; then
+    if gh release view "$EXACT_TAG" >/dev/null 2>&1; then
+      echo "$EXACT_TAG already publishes this commit; nothing to do"
+      SKIP=true
+    else
+      VERSION="$EXACT_TAG"
+    fi
+  elif [ "$SKIP" = "false" ]; then
+    PREVIOUS_TAG="$(newest_stable_tag --merged HEAD)"
+    if [ -z "$PREVIOUS_TAG" ]; then
+      echo "::error::Automatic releases require an existing stable vMAJOR.MINOR.PATCH tag"
+      exit 1
+    fi
+    VERSION="$(.github/scripts/next-release-version.sh "$PREVIOUS_TAG" "$PREVIOUS_TAG..HEAD")"
+    if [ -z "$VERSION" ]; then
+      echo "Only documentation, workflow, or test files changed since $PREVIOUS_TAG; no release needed"
+      SKIP=true
+    fi
+  fi
+elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+  # Releases describe what shipped to main. Dispatching from a topic branch
+  # would tag a commit that is not on the release line.
+  if [ "$REF_TYPE" != "branch" ] || [ "$REF_NAME" != "main" ]; then
+    echo "::error::Releases must be cut from main; this run is on '$REF_NAME'"
+    exit 1
+  fi
+  VERSION="$INPUT_VERSION"
+else
+  VERSION="$REF_NAME"
+fi
+
+if [ "$SKIP" = "true" ]; then
+  echo "skip=true" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+# A bare "2.0.0" typed into the dispatch box is accepted; everything downstream
+# works with the v-prefixed form the tag actually uses.
+case "$VERSION" in
+  v*) ;;
+  *) VERSION="v$VERSION" ;;
+esac
+
+if [[ ! "$VERSION" =~ ^v[0-9]+[.][0-9]+[.][0-9]+(-rc[0-9]+)?$ ]]; then
+  echo "::error::Release tags must be v<major>.<minor>.<patch> or v<major>.<minor>.<patch>-rcN, for example v1.0.0 or v1.1.0-rc1 (got '$VERSION')"
+  exit 1
+fi
+
+if [ "$EVENT_NAME" = "workflow_run" ]; then
+  # A tag already pointing at this commit is the resumed release above, and the
+  # publish steps tolerate it. Only a tag on some other commit is a collision.
+  if git show-ref --verify --quiet "refs/tags/$VERSION"; then
+    if ! EXISTING_TAG_COMMIT="$(tag_commit "$VERSION")"; then
+      echo "::error::Calculated tag $VERSION already exists but does not point to a commit"
+      exit 1
+    fi
+    if [ "$EXISTING_TAG_COMMIT" != "$HEAD_COMMIT" ]; then
+      echo "::error::Calculated tag $VERSION already exists on a different commit"
+      exit 1
+    fi
+  fi
+fi
+
+read_chart_field() {
+  grep -m1 "^$1:" helm/codeapi/Chart.yaml \
+    | sed -E "s/^$1:[[:space:]]*//; s/[[:space:]]*#.*//; s/^[\"']//; s/[\"']\$//"
+}
+APP_VERSION="$(read_chart_field appVersion)"
+CHART_VERSION="$(read_chart_field version)"
+
+if [ "$EVENT_NAME" = "workflow_dispatch" ] \
+   && git rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
+  echo "::error::Tag $VERSION already exists. Pick a new version, or delete the tag if it was cut in error."
+  exit 1
+fi
+
+case "$VERSION" in
+  *-rc*) PRERELEASE=true ;;
+  *) PRERELEASE=false ;;
+esac
+
+# `latest` moves only when this is the highest stable version, so re-cutting an
+# older patch cannot drag it backwards. The tag under dispatch does not exist
+# yet, hence adding it to the comparison.
+LATEST=false
+if [ "$PRERELEASE" = "false" ]; then
+  HIGHEST_STABLE="$(
+    {
+      git tag --list 'v[0-9]*'
+      printf '%s\n' "$VERSION"
+    } \
+      | select_stable_tags \
+      | sort -V \
+      | tail -n 1
+  )"
+  if [ "$HIGHEST_STABLE" = "$VERSION" ]; then
+    LATEST=true
+  fi
+fi
+
+DRAFT=false
+if [ "$INPUT_DRAFT" = "true" ]; then
+  DRAFT=true
+fi
+
+{
+  echo "skip=false"
+  echo "version=$VERSION"
+  echo "app_version=$APP_VERSION"
+  echo "chart_version=$CHART_VERSION"
+  echo "prerelease=$PRERELEASE"
+  echo "latest=$LATEST"
+  echo "draft=$DRAFT"
+} >> "$GITHUB_OUTPUT"
+
+echo "Releasing $VERSION (chart $CHART_VERSION, appVersion $APP_VERSION, prerelease=$PRERELEASE, latest=$LATEST, draft=$DRAFT)"

.github/workflows/ci.yml

@@ -43,6 +43,12 @@ jobs:
       - name: Compose bridge configuration
         run: node tests/compose-bridge-config.cjs
 
+      - name: Release versioning
+        run: tests/release-versioning.sh
+
+      - name: Release version resolution
+        run: tests/release-version-resolution.sh
+
       - name: Validate sandbox Dockerfiles
         run: |
           docker buildx build --check -f api/Dockerfile .
@@ -139,6 +145,16 @@ jobs:
       - name: Install dependencies
         run: bun ci
 
+      - name: Install Redis for ledger integration tests
+        run: sudo apt-get update && sudo apt-get install -y redis-server
+
+      - name: Verify fleet admission with isolated Redis
+        run: |
+          redis_socket="$RUNNER_TEMP/byom-admission.sock"
+          redis-server --port 0 --unixsocket "$redis_socket" --save '' --appendonly no --daemonize yes
+          trap 'redis-cli -s "$redis_socket" shutdown nosave' EXIT
+          BRIDGE_TEST_REDIS_URL="$redis_socket" bun test src/bridge/fleet.test.ts
+
       - name: Build service
         run: bun run build
 
@@ -191,8 +207,19 @@ jobs:
           node-version: 24.16.0
       - run: npm ci
       - run: npm run build
+      - name: Selected project root containment tests
+        run: |
+          command -v rg || brew install ripgrep
+          node --test dist/root-access.test.js
+          node --test --test-name-pattern='selected command|selected replay copy|programmatic probes reject' dist/native-sandbox.test.js
+      - name: Native environment containment tests
+        run: node --test dist/environment.test.js
       - name: Native ACL and credential lifecycle tests
         run: node --test dist/macos-storage.test.js dist/private-storage.test.js dist/storage.test.js dist/github.test.js
+      - name: Native environment setup lifecycle tests
+        env:
+          LIBRECHAT_CODE_LIVE_SRT_TESTS: '1'
+        run: node --test dist/environment-live.test.js
 
   lambda-microvm-provisioning:
     name: Lambda MicroVM Provisioning