feat: ship sandcode cli

.github/workflows/check.yml

@@ -12,7 +12,7 @@ permissions:
 env:
   DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
   DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
-  ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
+  OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 
 jobs:
   Check:
@@ -25,7 +25,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.8
+          bun-version: 1.3.10
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -41,9 +41,10 @@ jobs:
 
       - name: CLI smoke checks
         run: |
-          bun run analyze -- --help
-          bun run start -- --help
-          bun run setup -- --help
+          bun src/sandcode.ts --help
+          bun src/sandcode.ts analyze --help
+          bun src/sandcode.ts start --help
+          bun src/sandcode.ts setup --help
 
   BuildPackage:
     name: Build Package Artifact
@@ -61,7 +62,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.8
+          bun-version: 1.3.10
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -87,6 +88,11 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     needs: BuildPackage
     steps:
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.10
+
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
@@ -105,9 +111,25 @@ jobs:
           npm init -y
           npm install ../artifacts/*.tgz
 
-      - name: Run installed CLI binaries
+      - name: Run installed CLI binary
+        run: |
+          cd e2e-install
+          ./node_modules/.bin/sandcode --help
+          ./node_modules/.bin/sandcode analyze --help
+          ./node_modules/.bin/sandcode start --help
+          ./node_modules/.bin/sandcode setup --help
+
+      - name: Run installed setup smoke
         run: |
           cd e2e-install
-          ./node_modules/.bin/opencode-sandboxed-research-analyze --help
-          ./node_modules/.bin/opencode-sandboxed-research-start --help
-          ./node_modules/.bin/opencode-sandboxed-research-setup --help
+          mkdir -p home-smoke/vaults/test
+          HOME="$PWD/home-smoke" ./node_modules/.bin/sandcode setup --yes \
+            --vault-path ~/vaults/test \
+            --obsidian-integration desktop \
+            --notes-root Research/Sandcode \
+            --catalog-mode repo \
+            --daytona-api-key daytona-test \
+            --opencode-api-key opencode-test
+
+          test -f home-smoke/.config/sandcode/sandcode.toml
+          test -f home-smoke/.config/sandcode/.env

.github/workflows/daytona-e2e.yml

@@ -10,11 +10,11 @@ on:
       model:
         description: "Model to use"
         required: false
-        default: "openai/gpt-5.3-codex"
+        default: "opencode-go/glm-5"
       variant:
         description: "Model variant"
         required: false
-        default: "high"
+        default: ""
       analyze_timeout_sec:
         description: "Analyze timeout seconds"
         required: false
@@ -30,8 +30,7 @@ permissions:
 env:
   DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
   DAYTONA_API_URL: ${{ vars.DAYTONA_API_URL }}
-  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-  ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}
+  OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
 
 jobs:
   E2E:
@@ -45,7 +44,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.8
+          bun-version: 1.3.10
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -56,17 +55,26 @@ jobs:
             echo "DAYTONA_API_KEY is required" >&2
             exit 1
           fi
+          if [ -z "${OPENCODE_API_KEY:-}" ]; then
+            echo "OPENCODE_API_KEY is required for the default opencode-go model flow" >&2
+            exit 1
+          fi
 
       - name: Run analyze e2e
         run: |
           mkdir -p .memory/daytona-e2e
-          bun run analyze -- \
-            --out-dir .memory/daytona-e2e/findings \
-            --model "${{ inputs.model }}" \
-            --variant "${{ inputs.variant }}" \
-            --install-timeout-sec "${{ inputs.install_timeout_sec }}" \
-            --analyze-timeout-sec "${{ inputs.analyze_timeout_sec }}" \
+          args=(
+            analyze
+            --out-dir .memory/daytona-e2e/findings
+            --model "${{ inputs.model }}"
+            --install-timeout-sec "${{ inputs.install_timeout_sec }}"
+            --analyze-timeout-sec "${{ inputs.analyze_timeout_sec }}"
             "${{ inputs.repo_url }}"
+          )
+          if [ -n "${{ inputs.variant }}" ]; then
+            args+=(--variant "${{ inputs.variant }}")
+          fi
+          bun src/sandcode.ts "${args[@]}"
 
       - name: Upload findings artifact
         uses: actions/upload-artifact@v4

.github/workflows/publish-package.yml → .github/workflows/publish.yml

@@ -11,7 +11,7 @@ concurrency:
 permissions:
   contents: write
   pull-requests: write
-  packages: write
+  id-token: write
 
 jobs:
   resolve-merge-context:
@@ -106,7 +106,7 @@ jobs:
 
             const isBumpPr =
               (mergedPr.headRefName ?? "").startsWith("ci/version-bump-") ||
-              /^chore:\s*bump package version to 0\\.0\\.\\d+$/i.test(
+              /^chore:\s*bump package version to 0\.0\.\d+$/i.test(
                 mergedPr.title ?? "",
               );
 
@@ -122,25 +122,29 @@ jobs:
 
   publish-and-manage-bump:
     name: Publish Package + Manage Bump PR
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     needs: resolve-merge-context
     permissions:
       contents: write
       pull-requests: write
-      packages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22.14.0"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Upgrade npm for trusted publishing support
+        run: npm install -g npm@latest
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.8
+          bun-version: 1.3.10
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -211,40 +215,29 @@ jobs:
           fs.writeFileSync("package.json", `${JSON.stringify(pkg, null, 2)}\n`);
           NODE
 
-      - name: Configure npm for GitHub Packages
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          npm config set @shpitdev:registry https://npm.pkg.github.com
-          npm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN"
-
       - name: Publish package
         id: publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PACKAGE_REF="${{ steps.meta.outputs.name }}@${{ steps.meta.outputs.publish_version }}"
 
-          if npm view "$PACKAGE_REF" version --registry https://npm.pkg.github.com >/dev/null 2>&1; then
-            echo "Version $PACKAGE_REF already exists in GitHub Packages; skipping publish."
+          if npm view "$PACKAGE_REF" version >/dev/null 2>&1; then
+            echo "Version $PACKAGE_REF already exists on npm; skipping publish."
             echo "published=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          npm publish --registry https://npm.pkg.github.com --tag "${{ steps.meta.outputs.publish_tag }}"
+          npm publish --tag "${{ steps.meta.outputs.publish_tag }}"
           echo "published=true" >> "$GITHUB_OUTPUT"
 
       - name: Verify published dist-tag
         if: steps.publish.outputs.published == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PACKAGE_NAME="${{ steps.meta.outputs.name }}"
           PUBLISH_TAG="${{ steps.meta.outputs.publish_tag }}"
           EXPECTED_VERSION="${{ steps.meta.outputs.publish_version }}"
 
           for attempt in 1 2 3 4 5 6; do
-            ACTUAL_VERSION="$(npm view "${PACKAGE_NAME}@${PUBLISH_TAG}" version --registry https://npm.pkg.github.com 2>/dev/null || true)"
+            ACTUAL_VERSION="$(npm view "${PACKAGE_NAME}@${PUBLISH_TAG}" version 2>/dev/null || true)"
 
             if [ "$ACTUAL_VERSION" = "$EXPECTED_VERSION" ]; then
               echo "Verified dist-tag ${PUBLISH_TAG}: ${PACKAGE_NAME}@${ACTUAL_VERSION}"
@@ -262,8 +255,6 @@ jobs:
 
       - name: Verify registry install
         if: steps.publish.outputs.published == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PACKAGE_REF="${{ steps.meta.outputs.name }}@${{ steps.meta.outputs.publish_version }}"
 
@@ -284,9 +275,10 @@ jobs:
             sleep 10
           done
 
-          ./node_modules/.bin/opencode-sandboxed-research-analyze --help
-          ./node_modules/.bin/opencode-sandboxed-research-start --help
-          ./node_modules/.bin/opencode-sandboxed-research-setup --help
+          ./node_modules/.bin/sandcode --help
+          ./node_modules/.bin/sandcode analyze --help
+          ./node_modules/.bin/sandcode start --help
+          ./node_modules/.bin/sandcode setup --help
 
       - name: Prepare next patch bump
         if: steps.meta.outputs.create_bump_pr == 'true'

.ignore

@@ -1 +1,2 @@
 !.memory
+!.memory/**

AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS
+
+- Interim work should be done in the `.memory/` folder.