Beyond VS Code: host API gate, 1.99 floor, the ACP agent and its editors (M60–M63)

.github/workflows/build.yml

@@ -182,6 +182,25 @@ jobs:
           name: muse-spark-code-vsix
           path: '*.vsix'
           if-no-files-found: error
+      # The ACP agent's npm package (M63, PLAN.md D62), from the same
+      # production build `npm run package` just ran.
+      - run: node scripts/package-acp.mjs
+      - name: the agent's package carries its bundles, tables, notices and manifest
+        run: |
+          listing="$(tar -tzf dist/muse-spark-code-acp-*.tgz)"
+          for entry in package/package.json package/dist/acp.js package/dist/searchWorker.js \
+            package/THIRD_PARTY_NOTICES.txt package/LICENSE package/README.md package/l10n/ui.de.json; do
+            if ! grep -qx "$entry" <<< "$listing"; then
+              echo "::error::$entry is missing from the agent's package" >&2
+              exit 1
+            fi
+          done
+          echo "the agent's package holds $(wc -l <<< "$listing") entries, the required ones included"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: muse-spark-code-acp
+          path: dist/muse-spark-code-acp-*.tgz
+          if-no-files-found: error
 
   secrets:
     name: gitleaks

.github/workflows/forks.yml

@@ -0,0 +1,79 @@
+# The VS Code forks that ship Linux builds (PLAN.md M62b): Cursor, Devin
+# Desktop (Windsurf until 2026), Kiro and Positron, each at its latest
+# release from its own update feed (test/hosts/fork-release.mjs). Each job
+# installs the .vsix with the fork's CLI and runs the integration tests in
+# the fork; the job summary names the fork's version and its VS Code base.
+#
+# Apart from hosts.yml because these are the forks' latest builds, not
+# pinned ones, and their feeds can change without notice: every Monday, by
+# hand, and on pull requests that change this check. Every job has a
+# timeout and leaves no token in the git config; none pushes.
+name: Forks
+
+on:
+  pull_request:
+    paths:
+      - 'test/hosts/fork-release.mjs'
+      - 'test/hosts/installed.vscode-test.mjs'
+      - 'test/hosts/run-fork.sh'
+      - '.github/workflows/forks.yml'
+  schedule:
+    - cron: '41 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: forks-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vsix:
+    name: vsix
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run package
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: forks-vsix
+          path: '*.vsix'
+          if-no-files-found: error
+
+  fork:
+    name: ${{ matrix.fork }}
+    needs: vsix
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        fork: [cursor, devin-desktop, kiro, positron]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build:dev
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: forks-vsix
+          path: forks-vsix
+      - name: ${{ matrix.fork }}
+        env:
+          # Positron's latest release is read from the GitHub API.
+          GH_TOKEN: ${{ github.token }}
+        run: xvfb-run -a sh test/hosts/run-fork.sh "${{ matrix.fork }}" forks-vsix/*.vsix "$RUNNER_TEMP/fork"

.github/workflows/hosts.yml

@@ -0,0 +1,267 @@
+# The host checks (PLAN.md M62, M63): the extension in the editors built on
+# VS Code, and the ACP agent in the editors that speak ACP, each driven as
+# docs/certification/m62.md and m63.md recorded it, against the fake Muse
+# Code CLI (no model is called and no real key is used). Each job runs one
+# script of test/hosts, the same script a local run uses.
+#
+# Pull requests and pushes to main that touch the product or these checks,
+# every Monday (the hosts' own new releases), and by hand. Every job has a
+# timeout and leaves no token in the git config; none pushes.
+name: Hosts
+
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'l10n/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'scripts/build.mjs'
+      - 'scripts/package-acp.mjs'
+      - 'test/e2e/**'
+      - 'test/hosts/**'
+      - 'test/integration/**'
+      - '.github/workflows/hosts.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'l10n/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'scripts/build.mjs'
+      - 'scripts/package-acp.mjs'
+      - 'test/e2e/**'
+      - 'test/hosts/**'
+      - 'test/integration/**'
+      - '.github/workflows/hosts.yml'
+  schedule:
+    - cron: '17 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: hosts-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # The .vsix (without the macOS dictation helper, which no check here
+  # needs) and the agent's npm package, from one production build.
+  packages:
+    name: packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run package
+      - run: node scripts/package-acp.mjs
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: hosts-vsix
+          path: '*.vsix'
+          if-no-files-found: error
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: hosts-acp
+          path: dist/muse-spark-code-acp-*.tgz
+          if-no-files-found: error
+
+  # The agent as npm installs it, on each platform: the stdio suite against
+  # the installed package (its own native keyring binding, no repository
+  # modules), then the key's round trip through the platform's credential
+  # store (D61).
+  agent:
+    name: agent package (${{ matrix.os }})
+    needs: packages
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: hosts-acp
+          path: hosts-acp
+      - run: npm install --global ./hosts-acp/muse-spark-code-acp-*.tgz
+      - name: the stdio suite against the installed package
+        run: MUSE_ACP_PACKAGE_DIR="$(npm root --global)/muse-spark-code-acp" npx vitest run test/e2e/acpStdio.e2e.test.ts
+      - name: the key through the Secret Service (linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y -q gnome-keyring
+          dbus-run-session -- sh -c 'printf "ci\n" | gnome-keyring-daemon --unlock --components=secrets > /dev/null && sh test/hosts/keystore.sh muse-spark-code-acp'
+      # A keychain of the job's own, unlocked, as the default: the runner's
+      # login keychain would ask a person to unlock it.
+      - name: the key through the Keychain (macos)
+        if: runner.os == 'macOS'
+        run: |
+          security create-keychain -p ci hosts.keychain
+          security list-keychains -d user -s hosts.keychain login.keychain
+          security default-keychain -d user -s hosts.keychain
+          security unlock-keychain -p ci hosts.keychain
+          security set-keychain-settings hosts.keychain
+          sh test/hosts/keystore.sh muse-spark-code-acp
+      - name: the key through Credential Manager (windows)
+        if: runner.os == 'Windows'
+        run: sh test/hosts/keystore.sh muse-spark-code-acp
+
+  # The integration tests in VSCodium: the floor's release and the latest.
+  vscodium:
+    name: VSCodium ${{ matrix.release }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ['1.99.32846', latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build:dev
+      - run: xvfb-run -a sh test/hosts/run-vscodium.sh "${{ matrix.release }}" "$RUNNER_TEMP/vscodium"
+
+  # The .vsix in code-server, the floor's release (VS Code 1.99.3, Node
+  # 20.18) and the latest, driven in Chrome.
+  code-server:
+    name: code-server ${{ matrix.release }}
+    needs: packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ['4.99.4', latest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: hosts-vsix
+          path: hosts-vsix
+      - name: code-server
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE: ${{ matrix.release }}
+        run: |
+          version="$RELEASE"
+          if [ "$version" = latest ]; then
+            version="$(gh release view --repo coder/code-server --json tagName --jq .tagName | sed 's/^v//')"
+          fi
+          mkdir -p "$RUNNER_TEMP/code-server"
+          curl -fsSL "https://github.com/coder/code-server/releases/download/v$version/code-server-$version-linux-amd64.tar.gz" \
+            | tar -xz -C "$RUNNER_TEMP/code-server" --strip-components=1
+      - run: sh test/hosts/run-code-server.sh "$RUNNER_TEMP/code-server/bin/code-server" hosts-vsix/*.vsix "$RUNNER_TEMP/code-server-check"
+      - if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: code-server-${{ matrix.release }}-evidence
+          path: |
+            ${{ runner.temp }}/code-server-check/shots
+            ${{ runner.temp }}/code-server-check/code-server.log
+            ${{ runner.temp }}/code-server-check/data/logs
+
+  # The .vsix in Eclipse Theia (test/hosts/theia/package.json), built from npm.
+  theia:
+    name: Eclipse Theia
+    needs: packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: hosts-vsix
+          path: hosts-vsix
+      - run: sh test/hosts/run-theia.sh hosts-vsix/*.vsix "$RUNNER_TEMP/theia-check"
+      - if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: theia-evidence
+          path: |
+            ${{ runner.temp }}/theia-check/shots
+            ${{ runner.temp }}/theia-check/theia.log
+
+  # The agent in the ACP clients that install on Linux: JupyterLab (Jupyter
+  # AI), Emacs (acp.el, agent-shell) and Neovim (CodeCompanion).
+  acp-clients:
+    name: ACP client ${{ matrix.client }}
+    needs: packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        client: [jupyter, emacs, neovim]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        if: matrix.client == 'jupyter'
+        with:
+          python-version: '3.12'
+      - run: npm ci
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: hosts-acp
+          path: hosts-acp
+      - run: npm install --global ./hosts-acp/muse-spark-code-acp-*.tgz
+      - if: matrix.client == 'emacs'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -y -q emacs-nox
+      - run: sh "test/hosts/run-${{ matrix.client }}.sh" "$(command -v muse-spark-code-acp)" "$RUNNER_TEMP/${{ matrix.client }}-check"
+      - if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.client }}-evidence
+          path: |
+            ${{ runner.temp }}/${{ matrix.client }}-check/shots
+            ${{ runner.temp }}/${{ matrix.client }}-check/*.log
+          if-no-files-found: ignore