Merge remote-tracking branch 'upstream/main' into chore/sync-upstream-v0.77.0

Author: mabry1985

.beads/issues.jsonl

@@ -41,9 +41,15 @@ tests/
 
 # Docs site — VitePress builds to gh-pages, not into the container
 docs/
+
+# node_modules NEVER enter the build context — the web-builder stage runs a fresh
+# `npm ci` and the python runtime installs via pip, so a host's node_modules would
+# only bloat the context and risk leaking platform-specific binaries.
 node_modules/
-package.json
-package-lock.json
+# NOTE: package.json / package-lock.json are deliberately NOT excluded — the
+# web-builder stage COPYs them to run `npm ci` and build the React console
+# (apps/web/dist). Re-excluding them breaks that stage (the #874 console-never-
+# ships bug). They're harmless in the runtime image (Python ignores them).
 
 # Seccomp profile — Docker reads this on the host at runtime
 # (via docker-compose security_opt), NOT from inside the image

.dockerignore

@@ -0,0 +1,54 @@
+name: Bug report
+description: Something is broken or behaves incorrectly.
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing. The required fields below map 1:1 to the issue gate
+        (`.github/workflows/issue-gate.yml`) — fill them and the gate passes.
+        See #1300 / #1310 for the house style.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / what's wrong
+      description: What's broken, and where? Name the file / subsystem, and link the relevant ADR if any.
+      placeholder: "`server/chat.py` does X every chunk but the contract says Y…"
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce / evidence
+      description: Minimal steps, logs, or a stack trace that demonstrate it.
+    validations:
+      required: true
+  - type: textarea
+    id: expected-actual
+    attributes:
+      label: Expected vs. actual
+      description: What you expected to happen, and what actually happened.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance
+      description: How we'll know it's fixed — verifiable criteria.
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      description: Instance (default/dev), OS, app vs. CLI, version / commit.
+    validations:
+      required: false
+  - type: textarea
+    id: refs
+    attributes:
+      label: Refs
+      description: Related issues / PRs / ADRs (e.g. #1298, ADR 0047).
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,11 @@
+# Keep blank issues enabled: maintainers/agents may file intentional free-form
+# issues (tracking notes, quick split-outs). The gate flags those unless they
+# carry the `gate-exempt` label — see CONTRIBUTING.md.
+blank_issues_enabled: true
+contact_links:
+  - name: Issue standard & contributing
+    url: https://github.com/protoLabsAI/protoAgent/blob/main/CONTRIBUTING.md
+    about: What a good issue needs (the same checks the silent gate runs) and how to clear the needs-info label.
+  - name: Report a security vulnerability
+    url: https://github.com/protoLabsAI/protoAgent/security/advisories/new
+    about: Disclose vulnerabilities privately — do not open a public issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,39 @@
+name: Enhancement / feature
+description: A new capability, or an improvement to an existing one.
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        The required fields below map 1:1 to the issue gate
+        (`.github/workflows/issue-gate.yml`) — fill them and the gate passes.
+        See #1159 for the house style.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What gap or pain motivates this? Who's affected, and where does it live today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed direction
+      description: Sketch the approach. Multiple options are fine — note the trade-offs.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance
+      description: Verifiable criteria for "done".
+    validations:
+      required: true
+  - type: textarea
+    id: refs
+    attributes:
+      label: Refs
+      description: Related issues / PRs / ADRs.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -20,8 +20,8 @@ jobs:
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: "20"
       - name: Verify workspace config (.beads / .automaker / owned runners)
@@ -64,8 +64,8 @@ jobs:
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Ruff check
@@ -89,8 +89,8 @@ jobs:
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
           cache: pip
@@ -107,13 +107,45 @@ jobs:
           . .venv/bin/activate
           python -m pytest tests/ -q
 
+  fleet-integration:
+    name: Fleet integration (multi-instance)
+    runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
+    # These tests boot real `python -m server` hub+member processes (against the
+    # local scripts/fake_openai_server.py) on free loopback ports + tmp roots, so
+    # they're much slower than the unit suite — allow ~10 min. Kept a SEPARATE job
+    # from `tests` so its real-boot slowness never gates the fast unit run.
+    timeout-minutes: 12
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install dependencies
+        # Mirror the `tests` job: full requirements.txt in a venv so
+        # tests/conftest.py's site.getsitepackages() reorder resolves (#175).
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt pytest pytest-asyncio
+      - name: Boot real multi-instance fleet (hub + members) and exercise it
+        # PA_RUN_INTEGRATION=1 flips on the real-subprocess harness the default
+        # `pytest tests/` skips. Covers instance isolation, hub→member proxy
+        # round-trip, cross-instance A2A delegation, and member crash→detect→restart
+        # (POSIX zombie-reap — works on Linux). No network egress beyond loopback:
+        # the fake gateway is local; mDNS advertise binds loopback only.
+        run: |
+          . .venv/bin/activate
+          PA_RUN_INTEGRATION=1 python -m pytest tests/integration -q
+
   live-smoke:
     name: A2A live smoke (lean tier)
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
           cache: pip
@@ -139,8 +171,8 @@ jobs:
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: "20"
           cache: npm
@@ -151,8 +183,37 @@ jobs:
         # the uiStore persist migration). Fast — runs before the heavier
         # Playwright path so a reducer regression fails the job early.
         run: npm run test:unit --workspace @protoagent/web
-      - name: Install Playwright chromium
-        run: npm --workspace @protoagent/web exec -- playwright install --with-deps chromium
+      - name: Resolve Playwright version
+        id: pw
+        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
+      - name: Cache Playwright browsers
+        id: pw-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ steps.pw.outputs.version }}
+      - name: Install Playwright browser + deps
+        # The chromium binary is the slow ~100MB CDN download that intermittently
+        # stalled ~10min until the job-level orphan-kill fired (#1167). Cache it keyed
+        # on the Playwright version (skips the download entirely on a hit — only the
+        # fast apt system-deps run then), and hard-cap each attempt with `timeout` so
+        # a stalled download fails fast and retries instead of hanging the whole job.
+        timeout-minutes: 8
+        run: |
+          if [ "${{ steps.pw-cache.outputs.cache-hit }}" = "true" ]; then
+            cmd="playwright install-deps chromium"   # binary cached → apt deps only
+          else
+            cmd="playwright install --with-deps chromium"
+          fi
+          for attempt in 1 2 3; do
+            if timeout 240 npm --workspace @protoagent/web exec -- $cmd; then
+              exit 0
+            fi
+            echo "::warning::playwright install attempt $attempt stalled/failed; retrying…"
+            sleep 5
+          done
+          echo "::error::playwright install failed after 3 attempts"
+          exit 1
       - name: Run E2E smoke (built SPA vs mock backend)
         # Builds the web app, then drives it with Playwright against the
         # deterministic mock backend (apps/web/e2e/mock-server.mjs) — no Python,

.github/workflows/checks.yml

@@ -82,17 +82,17 @@ jobs:
             target: x86_64-pc-windows-msvc
             bundles: nsis
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ inputs.tag || github.ref }}
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.12'
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '20'
 
@@ -337,7 +337,7 @@ jobs:
 
       - name: Upload dispatch artifact
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: protoAgent-${{ steps.version.outputs.version }}-${{ matrix.target }}
           path: dist-desktop/*
@@ -371,12 +371,12 @@ jobs:
       # in-app updater notes (below). By tag-push time CHANGELOG.md already holds the
       # dated `## [VERSION]` section — the bump PR (prepare-release.yml) merged before
       # the tag. Without this the job has no working tree (it only `gh release`s).
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.ref_name }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '20'
 

.github/workflows/desktop-build.yml

@@ -34,21 +34,21 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate image metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -62,7 +62,7 @@ jobs:
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile

.github/workflows/docker-publish.yml

@@ -26,14 +26,14 @@ jobs:
   build:
     runs-on: ubuntu-latest  # workspace-config: allow-hosted-runner public repo — GH-hosted is free
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 20
           cache: npm
       - run: npm install
       - run: npm run docs:build
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         # Only needed to feed the deploy job — skip on PRs (build-only gate).
         if: github.event_name != 'pull_request'
         with:
@@ -49,4 +49,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5