fix(cli): stabilize subagents and require release quality checks (v0.15.21)

.github/workflows/cli-quality.yml

@@ -0,0 +1,104 @@
+name: CLI Quality Gate
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+jobs:
+  suite:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version-file: .bun-version
+      - run: bun install --frozen-lockfile
+      - run: bun scripts/check-cli-quality.ts --suite
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: cli-unit-evidence
+          path: .artifacts/test-results
+          if-no-files-found: error
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: tested-npm-package
+          path: |
+            .artifacts/package/*.tgz
+            .artifacts/package/sha256.txt
+            .artifacts/package/package-info.json
+          if-no-files-found: error
+
+  terminal:
+    needs: suite
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, windows-latest]
+        node: [22, 24]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: ${{ matrix.node }}
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version-file: .bun-version
+      - run: bun install --frozen-lockfile
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: tested-npm-package
+          path: .artifacts/package
+      - run: bun scripts/check-cli-quality.ts --terminal
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: always()
+        with:
+          name: cli-terminal-${{ matrix.os }}-node${{ matrix.node }}
+          path: .artifacts/pty
+          if-no-files-found: error
+
+  python:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -r python/requirements.txt
+      - run: python -m pytest -q python/tests
+
+  web:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version-file: .bun-version
+      - run: bun install --cwd web --frozen-lockfile
+      - run: bun run --cwd web typecheck
+      - run: bun run --cwd web build

.github/workflows/pr-checks.yml

@@ -10,12 +10,22 @@ permissions:
   contents: read
 
 jobs:
+  cli-quality:
+    uses: ./.github/workflows/cli-quality.yml
+
   # Keep this check name stable for existing branch-protection rules.
   smoke-and-tests:
     name: smoke-and-tests
+    needs: cli-quality
+    if: ${{ always() }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
+      - name: Require the complete quality gate
+        env:
+          QUALITY_RESULT: ${{ needs.cli-quality.result }}
+        run: test "$QUALITY_RESULT" = success
+
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/release.yml

@@ -73,45 +73,15 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Run release-critical tests
-        run: |
-          bun run desktop:test
-          bun test --max-concurrency=1 \
-            src/Tool.test.ts \
-            src/__tests__/bugfixes-behavioral.test.ts \
-            src/commands/effort/effort.verboo.test.ts \
-            src/commands/logout/logoutState.test.ts \
-            src/components/FreeTokenActivation.test.tsx \
-            src/services/api/boundedResponseBody.test.ts \
-            src/services/api/codexShim.test.ts \
-            src/services/api/openaiProtocolReliability.test.ts \
-            src/services/api/openaiErrorClassification.test.ts \
-            src/services/api/openaiShim.test.ts \
-            src/services/api/verbooCheckout.test.ts \
-            src/services/api/verbooModels.test.ts \
-            src/services/oauth/purchaseFlow.test.ts \
-            src/services/oauth/cliEntitlement.test.ts \
-            src/services/oauth/freeTokenActivation.test.ts \
-            src/services/oauth/pastDueFlow.test.tsx \
-            src/services/oauth/subscriptionAccess.test.ts \
-            src/services/oauth/verbooStartupAuth.test.ts \
-            src/utils/auth.refresh.test.ts \
-            src/utils/messages.toolNameNormalization.test.ts
-
-      - name: Smoke test
-        run: bun run smoke
-
-      - name: Build release artifacts
-        run: bun run build
-
-      - name: Verify npm package contents
-        run: |
-          node dist/cli.mjs --internal-protocol-self-test
-          npm pack --dry-run
+  cli-quality:
+    needs: verify
+    uses: ./.github/workflows/cli-quality.yml
+    with:
+      ref: ${{ needs.verify.outputs.tag }}
 
   publish-npm:
     name: Publish npm package
-    needs: verify
+    needs: [verify, cli-quality]
     if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.desktop_only) }}
     # npm provenance only supports GitHub-hosted runners.
     runs-on: ubuntu-latest
@@ -134,25 +104,23 @@ jobs:
           node-version: 24
           registry-url: https://registry.npmjs.org
 
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Download the tested npm artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          bun-version-file: .bun-version
+          name: tested-npm-package
+          path: .artifacts/package
 
-      - name: Install and build
-        run: |
-          bun install --frozen-lockfile
-          bun run build
-          node dist/cli.mjs --internal-protocol-self-test
-          npm pack --dry-run
+      - name: Verify tested artifact checksum
+        run: node scripts/prepare-cli-package.mjs --verify-only
 
       - name: Clear token auth for trusted publishing
         run: |
           unset NODE_AUTH_TOKEN
           echo "NODE_AUTH_TOKEN=" >> "$GITHUB_ENV"
 
       - name: Publish to npm
-        run: npm publish --access public --provenance
+        working-directory: .artifacts/package
+        run: npm publish ./verboo-code-*.tgz --ignore-scripts --access public --provenance
 
       - name: Release summary
         env:
@@ -167,7 +135,7 @@ jobs:
 
   docker:
     name: Build and push Docker image
-    needs: verify
+    needs: [verify, cli-quality]
     if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.desktop_only) }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
@@ -223,7 +191,7 @@ jobs:
 
   desktop-cli-artifacts:
     name: Build desktop CLI (${{ matrix.target }})
-    needs: verify
+    needs: [verify, cli-quality]
     if: ${{ github.repository == 'verbeux-ai/code' }}
     runs-on: ${{ matrix.runner }}
     strategy:
@@ -281,6 +249,7 @@ jobs:
     name: Sign and publish desktop CLI assets
     needs:
       - verify
+      - cli-quality
       - desktop-cli-artifacts
     if: ${{ github.repository == 'verbeux-ai/code' }}
     runs-on: ubuntu-22.04

.gitignore

@@ -19,3 +19,5 @@ package-lock.json
 coverage/
 agent.log
 plan/
+
+.artifacts/

README.md

@@ -194,9 +194,21 @@ Verboo Code uses Bun's built-in test runner for unit tests.
 Run the full unit suite:
 
 ```bash
-bun test
+bun run test:isolated
 ```
 
+Run the release quality gate with the Bun version pinned in `.bun-version` and
+Node 22 or 24:
+
+```bash
+bun run test:quality
+```
+
+This builds and installs the npm package in an independent consumer directory,
+runs every isolated test file, then exercises the installed CLI in real PTYs
+against a local HTTP/SSE fixture. See [CLI quality checks](docs/cli-quality.md)
+for the test matrix, artifacts and release requirements.
+
 Generate unit test coverage:
 
 ```bash