chore: sync fork to upstream protoAgent v0.81.0 (80 commits)

.dockerignore

@@ -53,7 +53,7 @@ node_modules/
 
 # Seccomp profile — Docker reads this on the host at runtime
 # (via docker-compose security_opt), NOT from inside the image
-seccomp-profile.json
+deploy/seccomp-profile.json
 
 # OS junk
 .DS_Store

.github/ISSUE_TEMPLATE/bug.yml

@@ -24,20 +24,13 @@ body:
       description: Minimal steps, logs, or a stack trace that demonstrate it.
     validations:
       required: true
-  - type: textarea
-    id: expected-actual
-    attributes:
-      label: Expected vs. actual
-      description: What you expected to happen, and what actually happened.
-    validations:
-      required: true
   - type: textarea
     id: acceptance
     attributes:
       label: Acceptance
       description: How we'll know it's fixed — verifiable criteria.
     validations:
-      required: true
+      required: false
   - type: input
     id: env
     attributes:

.github/workflows/checks.yml

@@ -25,6 +25,12 @@ jobs:
         with:
           node-version: "20"
       - name: Verify workspace config (.beads / .automaker / owned runners)
+        # Fork-friendly (#1534): the .beads/.automaker/owned-runner baseline is the
+        # protoLabs *fleet* standard, so it runs across the fleet (protoLabsAI/*) —
+        # keeping gina/protoTrader/roxy conformant — but is skipped on external forks,
+        # which are free to diverge. The job stays green either way (the server.py
+        # guard below still runs everywhere).
+        if: startsWith(github.repository, 'protoLabsAI/')
         # The npm package is still 1.0.0 (predates verify-workspace-config),
         # so run the script directly. It's zero-dependency (node builtins
         # only), so no `npm install` is needed. Switch to

.github/workflows/desktop-build.yml

@@ -19,26 +19,35 @@ name: Desktop Build
 # updater bundles, and the updater-manifest fan-in job composes latest.json
 # (the manifest the in-app updater polls) onto the release — uploaded last.
 #
-# Fires on EVERY semver tag push (patch included) alongside release.yml's Docker build,
-# and on manual dispatch. Patches used to be skipped to save CI minutes, but this repo is
-# public so GitHub-hosted runners (incl. the 10×/2× macOS/Windows legs) are free +
-# unlimited — so every release, patch or minor, ships fresh desktop binaries and an
-# updated latest.json (no more hand-attaching a patch's binaries). macOS builds are signed
-# only when the full Apple secret set is present; Linux/Windows are always unsigned. See
-# ADR 0010 (UI tiers / desktop).
+# Runs on MANUAL DISPATCH ONLY (workflow_dispatch) — deliberately NOT on tag pushes.
+# The macOS (10×) and Windows (2×) legs are this repo's only paid CI, and building the
+# full matrix on EVERY semver tag (dozens/month at current release cadence) was the
+# dominant cost — so desktop drops are now on-demand instead of per-release. Tag pushes
+# still ship the Docker image + a (non-Latest) GitHub Release via release.yml; only the
+# desktop binaries wait for a dispatch.
+#
+# Two dispatch modes, keyed off the `tag` input:
+#   • WITH a `tag` (a vX.Y.Z) → a real desktop RELEASE: binaries attach to that GitHub
+#     Release, the fan-in composes latest.json, and the release is promoted to 'Latest'
+#     (release.yml creates releases --latest=false; the promotion happens here). This is
+#     how a desktop update reaches users' in-app updater.
+#   • WITHOUT a tag (dispatched from a branch) → a TEST build: bundles upload as workflow
+#     artifacts only; no release, no latest.json, no 'Latest' change.
+#
+# macOS builds are signed only when the full Apple secret set is present; Linux/Windows
+# are always unsigned. The repo guard keeps forks from running the matrix. See ADR 0010
+# (UI tiers / desktop) and docs/guides/releasing.md § Desktop.
 
 on:
-  push:
-    tags:
-      - 'v*.*.*'
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Tag/ref to build against (blank = current ref)'
+        description: 'Tag to publish a desktop release for (vX.Y.Z). Blank = test build (artifacts only, no release).'
         required: false
 
 concurrency:
-  group: desktop-build-${{ github.ref }}
+  # Keyed on the dispatched tag (or ref) so two release dispatches don't collide.
+  group: desktop-build-${{ inputs.tag || github.ref }}
   cancel-in-progress: false
 
 permissions:
@@ -47,12 +56,11 @@ permissions:
 jobs:
   build:
     name: ${{ matrix.target }}
-    # Build on every semver tag push (patch included) + any manual dispatch. The old
-    # patch-skip was a CI-cost guard; it's unnecessary on a public repo where GH-hosted
-    # runners are free, and it meant patch desktop fixes never reached users (their
-    # binaries weren't attached and latest.json kept pointing at the last minor). The
-    # repo guard keeps forks from running the matrix.
-    if: github.repository == 'protoLabsAI/protoAgent'
+    # Manual dispatch only (see the `on:` block) — the tag-push trigger was retired
+    # because the macOS/Windows matrix on every release was the repo's dominant CI cost.
+    # Fork-friendly (#1534): a fork can dispatch its own (unsigned) build; the repo
+    # clause keeps forks from auto-building should a tag trigger ever return.
+    if: github.repository == 'protoLabsAI/protoAgent' || github.event_name == 'workflow_dispatch'
     # Per-leg runner, overridable by repo variable so the expensive macOS/Windows
     # legs can move off GitHub-hosted runners (10×/2× billing multipliers) onto
     # Namespace profiles WITHOUT editing this file — the moment the org provisions
@@ -199,8 +207,8 @@ jobs:
           SIGNED="unsigned (dev)"
           if [ "${RUNNER_OS}" = "macOS" ]; then
             # tauri-bundler signs as soon as *any* Apple secret is set, then fails
-            # if the set is incomplete. Require the full set; otherwise unset all so
-            # a dispatch build falls back cleanly to unsigned.
+            # if the set is incomplete. Require the full set for a tagged (publish)
+            # dispatch; a test build (no tag) unsets all and falls back to unsigned.
             if [ -n "${APPLE_CERTIFICATE}" ] && [ -n "${APPLE_CERTIFICATE_PASSWORD}" ] \
                && [ -n "${APPLE_SIGNING_IDENTITY}" ] && [ -n "${APPLE_API_ISSUER}" ] \
                && [ -n "${APPLE_API_KEY}" ] && [ -n "${APPLE_API_KEY_BASE64}" ] \
@@ -210,8 +218,8 @@ jobs:
               python3 -c 'import base64,os,sys; open(sys.argv[1],"wb").write(base64.b64decode(os.environ["APPLE_API_KEY_BASE64"]))' "$KEYFILE"
               export APPLE_API_KEY_PATH="${KEYFILE}"
               SIGNED="Developer ID (signed + notarized)"
-            elif [ "${{ github.event_name }}" = "push" ]; then
-              echo "::error::Semver-tag desktop releases require the full Apple signing secret set."
+            elif [ -n "${{ inputs.tag }}" ]; then
+              echo "::error::A tagged desktop release (tag=${{ inputs.tag }}) requires the full Apple signing secret set."
               exit 2
             else
               unset APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_SIGNING_IDENTITY \
@@ -335,45 +343,45 @@ jobs:
           if [ "${{ steps.build.outputs.signed }}" = "true" ]; then FLAG="--require-signed"; fi
           scripts/verify-macos-desktop.sh $FLAG dist-desktop/*.dmg
 
-      - name: Upload dispatch artifact
-        if: github.event_name == 'workflow_dispatch'
+      - name: Upload test-build artifact
+        # No tag → a test build: bundles are downloadable workflow artifacts only.
+        if: inputs.tag == ''
         uses: actions/upload-artifact@v6
         with:
           name: protoAgent-${{ steps.version.outputs.version }}-${{ matrix.target }}
           path: dist-desktop/*
 
       - name: Attach to release
-        if: github.event_name == 'push'
+        # A tag → publish: attach binaries to that GitHub Release (fan-in adds latest.json).
+        if: inputs.tag != ''
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload "${{ steps.version.outputs.tag }}" dist-desktop/* --clobber
 
   # Fan-in: compose latest.json from every leg's signed updater bundle and
   # upload it LAST, so the manifest never points at assets that don't exist
-  # yet. Runs only on semver tags, and only once ALL legs succeeded (a partial
-  # manifest would skew versions across platforms). If the release carries no
-  # updater bundles (key wasn't present), it skips — in-app updates are simply
-  # disabled for that release.
+  # yet. Runs only for a tagged (publish) dispatch, and only once ALL legs
+  # succeeded (a partial manifest would skew versions across platforms). If the
+  # release carries no updater bundles (key wasn't present), it skips — in-app
+  # updates are simply disabled for that release.
   updater-manifest:
     name: updater manifest (latest.json)
     needs: build
-    # Runs on every tag push (patch included) so the in-app updater's latest.json is
-    # refreshed for every release. Gated to `push` so a manual dispatch (which builds
-    # artifacts, with no release to attach to) doesn't try to compose a manifest;
-    # `needs: build` ties it to a successful matrix.
+    # Only for a publish dispatch (a `tag` was supplied) — a test build (no tag) has no
+    # release to attach a manifest to. `needs: build` ties it to a successful matrix.
     if: >-
-      github.event_name == 'push' && github.repository == 'protoLabsAI/protoAgent'
+      inputs.tag != '' && github.repository == 'protoLabsAI/protoAgent'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 10
     steps:
       # Checkout at the tag so we can read the rolled CHANGELOG.md section for the
-      # in-app updater notes (below). By tag-push time CHANGELOG.md already holds the
+      # in-app updater notes (below). By publish time CHANGELOG.md already holds the
       # dated `## [VERSION]` section — the bump PR (prepare-release.yml) merged before
       # the tag. Without this the job has no working tree (it only `gh release`s).
       - uses: actions/checkout@v5
         with:
-          ref: ${{ github.ref_name }}
+          ref: ${{ inputs.tag }}
 
       - name: Setup Node
         uses: actions/setup-node@v5
@@ -386,7 +394,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          TAG="${{ github.ref_name }}"
+          TAG="${{ inputs.tag }}"
           VERSION="${TAG#v}"
           mkdir -p updater-dist
           gh release download "$TAG" --repo "${{ github.repository }}" --dir updater-dist \
@@ -397,12 +405,19 @@ jobs:
             exit 0
           fi
           # Updater notes, best → worst source:
-          #   1. The curated CHANGELOG.md section for this version (the human-written
-          #      "### Added/Changed/Fixed" markdown) — what the in-app UpdateNotice renders.
-          #   2. The GitHub Release body (auto-generated commit subjects) — used when the
-          #      CHANGELOG section is empty (e.g. a patch with no [Unreleased] bullets).
-          #   3. A generic placeholder, if both are empty.
-          NOTES="$(python3 scripts/changelog.py notes "$VERSION" 2>/dev/null || true)"
+          #   1. The LLM-themed notes posted to Discord — release.yml uploads them as the
+          #      `release-notes.md` asset, so the in-app UpdateNotice renders the SAME text as
+          #      the Discord embed (one changelog, one voice — #1516).
+          #   2. The curated CHANGELOG.md section for this version (the human-written
+          #      "### Added/Changed/Fixed" markdown) — used when the LLM step didn't run
+          #      (e.g. a fork with no gateway key, or the Discord step failed).
+          #   3. The GitHub Release body (auto-generated commit subjects) — if both are empty.
+          #   4. A generic placeholder, if all are empty.
+          NOTES=""
+          if gh release download "$TAG" --repo "${{ github.repository }}" -p release-notes.md -D "$RUNNER_TEMP" --clobber 2>/dev/null; then
+            NOTES="$(cat "$RUNNER_TEMP/release-notes.md" 2>/dev/null || true)"
+          fi
+          [ -z "$NOTES" ] && NOTES="$(python3 scripts/changelog.py notes "$VERSION" 2>/dev/null || true)"
           [ -z "$NOTES" ] && NOTES="$(gh release view "$TAG" --repo "${{ github.repository }}" --json body -q .body 2>/dev/null || true)"
           [ -z "$NOTES" ] && NOTES="protoAgent ${TAG} — see the GitHub Release for details."
           npx --yes -p '@protolabsai/release-tools@latest' build-updater-manifest \

.github/workflows/docker-publish.yml

@@ -24,11 +24,16 @@ permissions:
 env:
   REGISTRY: ghcr.io
   # Normalise the image name — GHCR paths are case-sensitive and Docker refuses
-  # uppercase; github.repository would otherwise yield a mixed-case value.
-  IMAGE_NAME: protolabsai/protoagent
+  # uppercase; github.repository would otherwise yield a mixed-case value. A fork
+  # that opts in (see the job guard) sets its own `IMAGE_NAME` repo variable.
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || 'protolabsai/protoagent' }}
 
 jobs:
   build-and-push:
+    # Fork-friendly (#1534): the hardcoded default pushes to protoLabs' GHCR, which
+    # forks can't write to. Only the canonical repo runs by default; a fork opts in
+    # by setting the `DOCKER_PUBLISH_ENABLED` repo variable (+ its own `IMAGE_NAME`).
+    if: github.repository == 'protoLabsAI/protoAgent' || vars.DOCKER_PUBLISH_ENABLED == 'true'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 30
 

.github/workflows/docs.yml

@@ -7,8 +7,11 @@ on:
   # PR-level gate (#976): vitepress fails the build on parse errors AND dead links,
   # so running docs:build here catches doc breakage at review time instead of letting
   # it merge green and only go red on the main-only deploy. Build-only — no deploy.
+  # Unfiltered on purpose: `build` is a REQUIRED check in the main ruleset, and a
+  # path-filtered required check never reports on non-matching PRs, blocking them
+  # forever. Running everywhere (~30s) is the price of making red docs unmergeable
+  # (a dead link once automerged and froze the Pages deploy on every main push).
   pull_request:
-    paths: ['docs/**', 'package.json', 'package-lock.json', '.github/workflows/docs.yml']
   workflow_dispatch:
 
 permissions:
@@ -41,8 +44,11 @@ jobs:
 
   deploy:
     needs: build
-    # Never deploy from a PR — PRs only validate the build above.
-    if: github.event_name != 'pull_request'
+    # Never deploy from a PR — PRs only validate the build above. Fork-friendly
+    # (#1534): deploys to protoLabs' GitHub Pages, so only the canonical repo runs
+    # it — a fork without Pages configured would otherwise get a deploy error. The
+    # `build` job above is unguarded on purpose: forks want it (catches VitePress breakage).
+    if: github.event_name != 'pull_request' && github.repository == 'protoLabsAI/protoAgent'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     environment:
       name: github-pages

.github/workflows/marketing-deploy.yml

@@ -26,6 +26,9 @@ concurrency:
 jobs:
   deploy:
     name: Build & deploy to Cloudflare Pages
+    # Fork-friendly (#1534): deploys to protoLabs' Cloudflare Pages project and needs
+    # CLOUDFLARE_* secrets no fork has — so only the canonical repo runs it.
+    if: github.repository == 'protoLabsAI/protoAgent'
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     steps:
       - uses: actions/checkout@v5

.github/workflows/release.yml

@@ -18,7 +18,9 @@ on:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: protolabsai/protoagent
+  # Overridable (#1534): a fork that opts into RELEASE_ENABLED sets its own
+  # `IMAGE_NAME` repo variable to push to its GHCR instead of protoLabs'.
+  IMAGE_NAME: ${{ vars.IMAGE_NAME || 'protolabsai/protoagent' }}
 
 jobs:
   release:
@@ -145,13 +147,14 @@ jobs:
           NOTES: ${{ steps.notes.outputs.notes }}
         run: |
           printf '%s' "$NOTES" > "$RUNNER_TEMP/release-notes.md"
-          # --latest=false: do NOT promote to 'Latest' yet. The in-app updater fetches
+          # --latest=false: do NOT promote to 'Latest'. The in-app updater fetches
           # releases/latest/download/latest.json, so a release must not become 'Latest'
-          # until its latest.json exists — otherwise update checks 404 in the window
-          # before the desktop build's fan-in uploads it. The desktop fan-in flips this
-          # release to 'Latest' once latest.json is up (desktop-build.yml). Patch tags
-          # skip the desktop build entirely, so they stay non-Latest and 'Latest'
-          # correctly remains on the last .0 (the one carrying latest.json).
+          # until its latest.json exists — otherwise update checks 404. Desktop builds
+          # are now MANUAL (desktop-build.yml runs on workflow_dispatch, not on tags), so
+          # every tagged release stays non-Latest here; it's promoted to 'Latest' only
+          # when someone dispatches a desktop build for that tag and its fan-in uploads
+          # latest.json. 'Latest' therefore tracks the last DESKTOP release (the one the
+          # updater can actually use), not the newest tag.
           gh release create "${{ steps.version.outputs.tag }}" \
             --title "${{ steps.version.outputs.tag }}" \
             --notes-file "$RUNNER_TEMP/release-notes.md" \
@@ -164,11 +167,28 @@ jobs:
       # scripts/post-release-notes.mjs.
 
       - name: Generate + post release notes
+        id: relnotes
         continue-on-error: true
-        uses: protoLabsAI/release-tools@b7c3531dd67accb57ca09242f47d8c0eb1ace8eb # v1.1.0
+        uses: protoLabsAI/release-tools@d6bfc09ce7d17da3f196f3b54afde5830b8a6398 # v2.4.0 — first version with the out-file input (#1516/#1615)
         with:
           version: ${{ steps.version.outputs.tag }}
           previous-version: ${{ steps.version.outputs.prev_tag }}
+          # Persist the SAME themed notes it posts to Discord (one generation writes the file
+          # AND posts the embed), so the in-app updater can render the identical text — one
+          # changelog, one voice (#1516). Uploaded as a release asset below; the (later,
+          # manual) desktop build prefers it for latest.json.
+          out-file: release-notes.md
         env:
           GATEWAY_API_KEY: ${{ secrets.GATEWAY_API_KEY }}
           DISCORD_RELEASE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_WEBHOOK }}
+
+      # Attach the LLM notes to the release so desktop-build.yml's latest.json fan-in can read
+      # them (it runs on a later manual dispatch, so the asset must live on the release, not a
+      # step output). Best-effort + guarded: a fork with no GATEWAY_API_KEY writes no file, the
+      # upload is skipped, and the updater falls back to the curated CHANGELOG.md section.
+      - name: Persist LLM release notes as an asset
+        if: hashFiles('release-notes.md') != ''
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ steps.version.outputs.tag }}" release-notes.md --clobber