Temporarily disable OS sandboxing; default to full-access

.github/workflows/benchmark-cli.yml

@@ -0,0 +1,40 @@
+name: Benchmark CLI build
+
+on:
+  pull_request:
+    paths:
+      - crates/cli/**
+      - crates/sandbox/**
+      - .github/workflows/benchmark-cli.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux-cli:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-musl
+      - uses: mlugg/setup-zig@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-zigbuild@0.23.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: benchmark-linux-cli
+      - name: Verify detached Linux kernel fence
+        run: cargo test -p devo-sandbox --test headless_tty -- --nocapture
+      - name: Build native Linux CLI for container smoke runs
+        run: cargo zigbuild --target x86_64-unknown-linux-musl -p devo-cli
+      - name: Strip debug information from the benchmark artifact
+        run: strip target/x86_64-unknown-linux-musl/debug/devo
+      - uses: actions/upload-artifact@v4
+        with:
+          name: devo-benchmark-linux-${{ github.event.pull_request.head.sha || github.sha }}
+          path: target/x86_64-unknown-linux-musl/debug/devo
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/ci.yml

@@ -5,13 +5,296 @@ on:
     branches: [main, master]
   pull_request:
     branches: [main, master]
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -Dwarnings
 
 jobs:
+  changes:
+    name: Select affected CI components
+    runs-on: ubuntu-latest
+    outputs:
+      rust: ${{ steps.scope.outputs.rust }}
+      desktop: ${{ steps.scope.outputs.desktop }}
+      tui: ${{ steps.scope.outputs.tui }}
+      kernel_python: ${{ steps.scope.outputs.kernel_python }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: python -m unittest discover -s scripts -p test_ci_scope.py -v
+      - id: scope
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            python scripts/ci_scope.py --base "$BASE_SHA" --head "$HEAD_SHA" --output "$GITHUB_OUTPUT"
+          else
+            python scripts/ci_scope.py --all --output "$GITHUB_OUTPUT"
+          fi
+
+  unix-kernel:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    name: Unix kernel (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-musl
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+      - uses: mlugg/setup-zig@v2
+        if: runner.os == 'Linux'
+      - uses: taiki-e/install-action@v2
+        if: runner.os == 'Linux'
+        with:
+          tool: cargo-zigbuild@0.23.0
+      - run: cargo zigbuild --locked -p devo-kernel --lib --target ${{ matrix.target }}
+        if: runner.os == 'Linux'
+      - run: cargo check --locked -p devo-kernel --all-targets --target ${{ matrix.target }}
+        if: runner.os == 'macOS'
+      - run: cargo test --locked -p devo-kernel credential_unix::tests
+        if: runner.os == 'macOS'
+
+  windows-kernel:
+    needs: changes
+    if: needs.changes.outputs.kernel_python == 'true'
+    name: Windows kernel (Python ${{ matrix.python }})
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        python: ["3.11", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install dill==0.4.1
+      - run: python -m unittest discover -s crates/kernel/rlm-runtime/tests -v
+        env:
+          PYTHONPATH: crates/kernel/rlm-runtime/src
+
+  windows-check:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    name: Windows Rust check and Clippy
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo check --workspace --all-targets
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - run: cargo test -p devo-windows-sandbox --bin devo-command-runner
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.0"
+      - run: bun test apps/desktop/scripts/dev-runtime.test.ts
+
+  desktop:
+    needs: changes
+    if: needs.changes.outputs.desktop == 'true'
+    name: Desktop tests and types
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/desktop
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.4.0"
+      - run: bun install --frozen-lockfile
+      - run: bun run test
+      - run: bunx tsc --noEmit
+
+  tui:
+    needs: changes
+    if: needs.changes.outputs.tui == 'true'
+    name: TUI tests (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    defaults:
+      run:
+        working-directory: apps/tui
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: apps/tui/package-lock.json
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+      - run: npm test
+      - run: node --import tsx --test lib/coding-agent/src/modes/interactive/interactive-mode-model-candidates.test.ts lib/coding-agent/src/modes/interactive/interactive-mode-session-ancillary.test.ts
+
+  tmux-secrets:
+    name: Detect live TUI provider secrets
+    runs-on: ubuntu-latest
+    outputs:
+      live: ${{ steps.detect.outputs.live }}
+    steps:
+      # Job-level `if` cannot read the secrets context; fork PRs see empty
+      # secrets, so this doubles as the fork gate for the live job.
+      - id: detect
+        env:
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+        run: |
+          if [ -n "$DEEPSEEK_API_KEY" ]; then
+            echo "live=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "live=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  tmux:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true' || needs.changes.outputs.tui == 'true'
+    name: TUI tmux smoke (mock provider)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: apps/tui/package-lock.json
+      - name: Ensure tmux
+        run: command -v tmux || (sudo apt-get update && sudo apt-get install -y tmux)
+      - name: Install TUI dependencies
+        working-directory: apps/tui
+        run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Build CLI
+        run: cargo build -p devo-cli --bin devo --locked
+      - name: Boot and outcome scenarios (no provider credentials)
+        working-directory: apps/tui
+        run: |
+          for scenario in T1 goal heartbeat; do
+            echo "::group::tmux smoke: $scenario"
+            node scripts/run-tmux-smoke.js "$scenario"
+            echo "::endgroup::"
+          done
+      - name: Completed-turn scenario against the local mock provider
+        working-directory: apps/tui
+        env:
+          DEVO_TUI_TEST_TIMEOUT_MS: "120000"
+        run: |
+          home="$(mktemp -d)"
+          node scripts/smoke-mock-provider.mjs 8801 &
+          mock_pid=$!
+          trap 'kill "$mock_pid" 2>/dev/null || true' EXIT
+          printf '%s\n' \
+            '{"model": "deepseek/deepseek-v4-flash", "provider": {"deepseek": {"credential": "deepseek", "enabled": true, "base_url": "http://127.0.0.1:8801"}}}' \
+            > "$home/providers.json"
+          printf '%s\n' '{"deepseek": {"type": "api_key", "key": "ci-mock-key"}}' > "$home/auth.json"
+          chmod 600 "$home/auth.json"
+          DEVO_HOME="$home" node scripts/run-tmux-smoke.js T2
+
+  tmux-live:
+    needs: [changes, tmux-secrets]
+    if: >-
+      needs.tmux-secrets.outputs.live == 'true' &&
+      (needs.changes.outputs.rust == 'true' || needs.changes.outputs.tui == 'true')
+    name: TUI tmux live LLM (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        # macOS covers the seatbelt fence and python3 fallback paths that
+        # Linux cannot reach with the same code.
+        os: [ubuntu-latest, macos-latest]
+    env:
+      DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: apps/tui/package-lock.json
+      - name: Ensure tmux
+        run: command -v tmux || (if [ "$(uname)" = Darwin ]; then brew install tmux; else sudo apt-get update && sudo apt-get install -y tmux; fi)
+      - name: Install TUI dependencies
+        working-directory: apps/tui
+        run: npm ci --ignore-scripts --no-audit --no-fund
+      - name: Build CLI
+        run: cargo build -p devo-cli --bin devo --locked
+      - name: Seed live Devo homes (one per wire API)
+        run: |
+          # chat-completions: builtin DeepSeek endpoint
+          chat="$(mktemp -d)/home"; mkdir -p "$chat"
+          printf '%s\n' '{"model": "deepseek/deepseek-v4-flash", "provider": {"deepseek": {"credential": "deepseek", "enabled": true, "base_url": "https://api.deepseek.com", "wire_api": "openai_chat_completions"}}}' > "$chat/providers.json"
+          # anthropic-messages: DeepSeek's Anthropic-compatible endpoint, same key
+          anth="$(mktemp -d)/home"; mkdir -p "$anth"
+          printf '%s\n' '{"model": "deepseek/deepseek-v4-flash", "provider": {"deepseek": {"credential": "deepseek", "enabled": true, "base_url": "https://api.deepseek.com/anthropic", "wire_api": "anthropic_messages"}}}' > "$anth/providers.json"
+          # responses: builtin OpenAI (openai_responses wire)
+          resp="$(mktemp -d)/home"; mkdir -p "$resp"
+          printf '%s\n' '{"model": "openai/gpt-5-mini", "provider": {"openai": {"credential": "openai", "enabled": true, "base_url": "https://api.openai.com/v1", "wire_api": "openai_responses"}}}' > "$resp/providers.json"
+          for home in "$chat" "$anth"; do
+            node -e 'const fs = require("fs"); fs.writeFileSync(process.argv[1], JSON.stringify({ deepseek: { type: "api_key", key: process.env.DEEPSEEK_API_KEY } }, null, 2));' "$home/auth.json"
+            chmod 600 "$home/auth.json"
+          done
+          node -e 'const fs = require("fs"); fs.writeFileSync(process.argv[1], JSON.stringify({ openai: { type: "api_key", key: process.env.OPENAI_API_KEY } }, null, 2));' "$resp/auth.json"
+          chmod 600 "$resp/auth.json"
+          echo "DEVO_LIVE_CHAT_HOME=$chat" >> "$GITHUB_ENV"
+          echo "DEVO_LIVE_ANTHROPIC_HOME=$anth" >> "$GITHUB_ENV"
+          echo "DEVO_LIVE_RESPONSES_HOME=$resp" >> "$GITHUB_ENV"
+      - name: Chat Completions wire (real DeepSeek)
+        working-directory: apps/tui
+        env:
+          DEVO_TUI_TEST_TIMEOUT_MS: "180000"
+        run: DEVO_HOME="$DEVO_LIVE_CHAT_HOME" node scripts/run-tmux-smoke.js T2
+      - name: Anthropic Messages wire (real DeepSeek)
+        working-directory: apps/tui
+        env:
+          DEVO_TUI_TEST_TIMEOUT_MS: "180000"
+        run: DEVO_HOME="$DEVO_LIVE_ANTHROPIC_HOME" node scripts/run-tmux-smoke.js T2
+      - name: Responses wire (real OpenAI)
+        # Optional second secret; skipped when absent. The secrets context is
+        # not available in step-level `if`, so read the job env mirror.
+        if: env.OPENAI_API_KEY != ''
+        working-directory: apps/tui
+        env:
+          DEVO_TUI_TEST_TIMEOUT_MS: "180000"
+        run: DEVO_HOME="$DEVO_LIVE_RESPONSES_HOME" node scripts/run-tmux-smoke.js T2
+      - name: Interrupted-turn scenario (real DeepSeek, Chat Completions)
+        working-directory: apps/tui
+        env:
+          DEVO_TUI_TEST_TIMEOUT_MS: "180000"
+        run: DEVO_HOME="$DEVO_LIVE_CHAT_HOME" node scripts/run-tmux-smoke.js T3
+
   check:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     name: Check
     runs-on: ubuntu-latest
     steps:
@@ -21,6 +304,8 @@ jobs:
       - run: cargo check --workspace --all-targets
 
   test:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     name: Test
     runs-on: ubuntu-latest
     steps:
@@ -30,6 +315,8 @@ jobs:
       - run: cargo test --workspace --jobs 1
 
   fmt:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
@@ -39,18 +326,22 @@ jobs:
           components: rustfmt
       - run: cargo fmt --all -- --check
 
-  # clippy:
-  #   name: Clippy
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: dtolnay/rust-toolchain@stable
-  #       with:
-  #         components: clippy
-  #     - uses: Swatinem/rust-cache@v2
-  #     - run: cargo clippy --workspace --all-targets -- -D warnings
+  clippy:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --workspace --all-targets -- -D warnings
 
   doc:
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
     name: Doc
     runs-on: ubuntu-latest
     steps: