chore: sync public mirror from internal

Author: github-actions[bot]

bun.lockb

@@ -110,13 +110,12 @@
 		}
 	},
 	{
-		"name": "extract_document reads a local smoke fixture",
+		"name": "extract_document blocks a local smoke fixture",
 		"kind": "extractDocument",
-		"judgeRubric": "extract_document should preserve the text payload, recognize the text format, and report the downloaded filename.",
+		"judgeRubric": "extract_document should reject private or local document URLs instead of downloading them.",
 		"expected": {
-			"text": "Maestro extract document smoke test",
-			"format": "text",
-			"fileName": "fixture.txt"
+			"blocked": true,
+			"message": "Blocked document URL host: private or local address"
 		}
 	},
 	{

evals/tools/surface-smoke-cases.json

@@ -58,11 +58,12 @@
     "check:workflow-footguns": "node scripts/check-workflow-footguns.mjs",
     "check:test-skip-hygiene": "node scripts/check-test-skip-hygiene.mjs",
     "check:test-timing-wait-hygiene": "node scripts/check-test-timing-wait-hygiene.mjs",
+    "check:atomic-write-hygiene": "node scripts/check-atomic-write-hygiene.mjs",
     "check:codex-parity": "node scripts/check-codex-parity-conformance.mjs",
     "check:codex-operating-layer": "node scripts/check-codex-operating-layer-conformance.mjs",
     "check:platform-runtime-conformance": "node scripts/check-platform-runtime-conformance.mjs",
     "check:release-surface": "node scripts/check-release-surface-conformance.mjs",
-    "lint:evals": "bun run lint:headless-proto && node scripts/ensure-deps.js --no-install --workspace @evalops/contracts && node scripts/verify-evals.js && node scripts/verify-tool-versions.js && node scripts/validate-system-paths.js && node scripts/validate-package-boundaries.js && node scripts/validate-public-package-deps.js && node scripts/check-public-surface-boundary.mjs && npm run check:context-manifest && npm run check:session-wire-contract && npm run check:cli-runtime-conformance && npm run check:rpc-protocol-conformance && npm run check:evidence-integrity && npm run check:maestro-release-gate-events && npm run check:session-replay-fixtures && npm run check:agent-trajectory-fixtures && npm run check:agent-trajectory-replay-fixtures && npm run check:agent-trajectory-score-fixtures && npm run check:agent-trajectory-inspection-fixtures && npm run check:agent-trajectory-scenario-fixtures && npm run check:slack-teammate-runtime-scenarios && npm run check:scripted-scenario-fixtures && node scripts/session-wire-format-codegen.mjs --check && node scripts/headless-protocol-codegen.mjs --check && npm run check:app-server-schema && npm run check:drift-surfaces && npm run check:staged-rollout && npm run check:workflow-footguns && npm run check:test-skip-hygiene && npm run check:test-timing-wait-hygiene && npm run check:codex-parity && npm run check:codex-operating-layer && npm run check:platform-runtime-conformance && npm run check:release-surface && npm run developer-surface:check",
+    "lint:evals": "bun run lint:headless-proto && node scripts/ensure-deps.js --no-install --workspace @evalops/contracts && node scripts/verify-evals.js && node scripts/verify-tool-versions.js && node scripts/validate-system-paths.js && node scripts/validate-package-boundaries.js && node scripts/validate-public-package-deps.js && node scripts/check-public-surface-boundary.mjs && npm run check:context-manifest && npm run check:session-wire-contract && npm run check:cli-runtime-conformance && npm run check:rpc-protocol-conformance && npm run check:evidence-integrity && npm run check:maestro-release-gate-events && npm run check:session-replay-fixtures && npm run check:agent-trajectory-fixtures && npm run check:agent-trajectory-replay-fixtures && npm run check:agent-trajectory-score-fixtures && npm run check:agent-trajectory-inspection-fixtures && npm run check:agent-trajectory-scenario-fixtures && npm run check:slack-teammate-runtime-scenarios && npm run check:scripted-scenario-fixtures && node scripts/session-wire-format-codegen.mjs --check && node scripts/headless-protocol-codegen.mjs --check && npm run check:app-server-schema && npm run check:drift-surfaces && npm run check:staged-rollout && npm run check:workflow-footguns && npm run check:test-skip-hygiene && npm run check:test-timing-wait-hygiene && npm run check:atomic-write-hygiene && npm run check:codex-parity && npm run check:codex-operating-layer && npm run check:platform-runtime-conformance && npm run check:release-surface && npm run developer-surface:check",
     "platform:sdk-smoke": "tsx scripts/check-platform-sdk-contract.ts",
     "platform:agentruntime-e2e": "tsx scripts/smoke-platform-agentruntime-lifecycle.ts",
     "platform:timeline-e2e": "tsx scripts/smoke-platform-timeline-e2e.ts",
@@ -182,6 +183,7 @@
     "@bufbuild/protobuf": "^2.11.0",
     "@crosscopy/clipboard": "^0.2.8",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@napi-rs/keyring": "^1.3.0",
     "@openai/codex": "^0.135.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.76.0",
@@ -221,6 +223,7 @@
     "postgres": "^3.4.8",
     "smol-toml": "^1.6.1",
     "string-width": "^8.2.0",
+    "undici": "^7.25.0",
     "uuid": "^14.0.0",
     "vscode-jsonrpc": "^8.2.1",
     "ws": "^8.20.0",